Chapter 7. Preparing to update a cluster with manually maintained credentials

Procedure

1. Obtain the OpenShift Container Platform release image by running the following command:

   $ RELEASE_IMAGE=$(./openshift-install version | awk '/release image/ {print $3}')

2. Obtain the CCO container image from the OpenShift Container Platform release image by running the following command:

   $ CCO_IMAGE=$(oc adm release info --image-for='cloud-credential-operator' $RELEASE_IMAGE -a ~/.pull-secret)

   Note

   Ensure that the architecture of the $RELEASE_IMAGE matches the architecture of the environment in which you will use the ccoctl tool.

3. Extract the ccoctl binary from the CCO container image within the OpenShift Container Platform release image by running the following command:

   $ oc image extract $CCO_IMAGE --file="/usr/bin/ccoctl" -a ~/.pull-secret

4. Change the permissions to make ccoctl executable by running the following command:

   $ chmod 775 ccoctl

Procedure

1. Extract the list of CredentialsRequest custom resources (CRs) from the OpenShift Container Platform release image by running the following command:

   $ oc adm release extract --credentials-requests \
     --cloud=<provider_type> \
     --to=<path_to_directory_with_list_of_credentials_requests>/credrequests \
     quay.io/<path_to>/ocp-release:<version>

   where:

   • <provider_type> is the value for your cloud provider. Valid values are alibabacloud, aws, gcp, ibmcloud, and nutanix.
   • credrequests is the directory where the list of CredentialsRequest objects is stored. This command creates the directory if it does not exist.

2. For each CredentialsRequest CR in the release image, ensure that a namespace that matches the text in the spec.secretRef.namespace field exists in the cluster. This field is where the generated secrets that hold the credentials configuration are stored.

   Sample AWS CredentialsRequest object

   apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: cloud-credential-operator-iam-ro
     namespace: openshift-cloud-credential-operator
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
       kind: AWSProviderSpec
       statementEntries:
       - effect: Allow
         action:
         - iam:GetUser
         - iam:GetUserPolicy
         - iam:ListAccessKeys
         resource: "*"
     secretRef:
       name: cloud-credential-operator-iam-ro-creds
       namespace: openshift-cloud-credential-operator 1

   1

   This field indicates the namespace which needs to exist to hold the generated secret.

   The CredentialsRequest CRs for other platforms have a similar format with different platform-specific values.

3. For any CredentialsRequest CR for which the cluster does not already have a namespace with the name specified in spec.secretRef.namespace, create the namespace by running the following command:

   $ oc create namespace <component_namespace>

4. Use the ccoctl tool to process all CredentialsRequest objects in the credrequests directory by running the command for your cloud provider. The following commands process CredentialsRequest objects:

   • Alibaba Cloud: ccoctl alibabacloud create-ram-users
   • Amazon Web Services (AWS): ccoctl aws create-iam-roles
   • Google Cloud Platform (GCP): ccoctl gcp create-all
   • IBM Cloud: ccoctl ibmcloud create-service-id
   • Nutanix: ccoctl nutanix create-shared-secrets
   Important

   Refer to the ccoctl utility instructions in the installation content for your cloud provider for important platform-specific details about the required arguments and special considerations.

   For each CredentialsRequest object, ccoctl creates the required provider resources and a permissions policy as defined in each CredentialsRequest object from the OpenShift Container Platform release image.

5. Apply the secrets to your cluster by running the following command:

   $ ls <path_to_ccoctl_output_dir>/manifests/*-credentials.yaml | xargs -I{} oc apply -f {}

Procedure

1. Extract and examine the CredentialsRequest custom resource for the new release.

   The "Manually creating IAM" section of the installation content for your cloud provider explains how to obtain and use the credentials required for your cloud.

2. Update the manually maintained credentials on your cluster:

   • Create new secrets for any CredentialsRequest custom resources that are added by the new release image.
   • If the CredentialsRequest custom resources for any existing credentials that are stored in secrets have changed permissions requirements, update the permissions as required.

3. If your cluster uses cluster capabilities to disable one or more optional components, delete the CredentialsRequest custom resources for any disabled components.

   Example credrequests directory contents for OpenShift Container Platform 4.12 on AWS

   0000_30_machine-api-operator_00_credentials-request.yaml 1
   0000_50_cloud-credential-operator_05-iam-ro-credentialsrequest.yaml 2
   0000_50_cluster-image-registry-operator_01-registry-credentials-request.yaml 3
   0000_50_cluster-ingress-operator_00-ingress-credentials-request.yaml 4
   0000_50_cluster-network-operator_02-cncc-credentials.yaml 5
   0000_50_cluster-storage-operator_03_credentials_request_aws.yaml 6

   1

   The Machine API Operator CR is required.

   2

   The Cloud Credential Operator CR is required.

   3

   The Image Registry Operator CR is required.

   4

   The Ingress Operator CR is required.

   5

   The Network Operator CR is required.

   6

   The Storage Operator CR is an optional component and might be disabled in your cluster.

   Example credrequests directory contents for OpenShift Container Platform 4.12 on GCP

   0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml 1
   0000_30_machine-api-operator_00_credentials-request.yaml 2
   0000_50_cloud-credential-operator_05-gcp-ro-credentialsrequest.yaml 3
   0000_50_cluster-image-registry-operator_01-registry-credentials-request-gcs.yaml 4
   0000_50_cluster-ingress-operator_00-ingress-credentials-request.yaml 5
   0000_50_cluster-network-operator_02-cncc-credentials.yaml 6
   0000_50_cluster-storage-operator_03_credentials_request_gcp.yaml 7

   1

   The Cloud Controller Manager Operator CR is required.

   2

   The Machine API Operator CR is required.

   3

   The Cloud Credential Operator CR is required.

   4

   The Image Registry Operator CR is required.

   5

   The Ingress Operator CR is required.

   6

   The Network Operator CR is required.

   7

   The Storage Operator CR is an optional component and might be disabled in your cluster.

Procedure

1. Log in to oc on the cluster as a user with the cluster-admin role.

2. Edit the CloudCredential resource to add an upgradeable-to annotation within the metadata field by running the following command:

   $ oc edit cloudcredential cluster

   Text to add

   ...
     metadata:
       annotations:
         cloudcredential.openshift.io/upgradeable-to: <version_number>
   ...

   Where <version_number> is the version that you are upgrading to, in the format x.y.z. For example, use 4.12.2 for OpenShift Container Platform 4.12.2.

   It may take several minutes after adding the annotation for the upgradeable status to change.

Verification

1. In the Administrator perspective of the web console, navigate to Administration Cluster Settings.

2. To view the CCO status details, click cloud-credential in the Cluster Operators list.

   • If the Upgradeable status in the Conditions section is False, verify that the upgradeable-to annotation is free of typographical errors.
3. When the Upgradeable status in the Conditions section is True, begin the OpenShift Container Platform upgrade.