Logging

Procedure

1. To enable the log forwarder delivery capability, prepare the IAM policy by creating an assume-role-policy.json file. Apply the following IAM policy sample:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::859037107838:role/ROSA-CentralLogDistributionRole-241c1a86"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }

2. To enable the log forwarder distribution capability, create an IAM role that must include the CustomerLogDistribution name by running the following command:

   $ aws iam create-role \
       --role-name CustomerLogDistribution-RH \
       --assume-role-policy-document file://assume-role-policy.json

Procedure

1. Create the CloudWatch log group by running the following command:

   $ aws logs create-log-group –log-group-name <your_log_group_name>

2. In your Red Hat OpenShift Service on AWS cluster, configure the log forwarder to use the CloudWatch log group by applying the following JSON sample:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "CreatePutLogs",
               "Effect": "Allow",
               "Action": [
                   "logs:CreateLogStream",
                   "logs:PutLogEvents"
               ],
               "Resource": "<your_log_group_arn>:*"
           },
           {
               "Sid": "DescribeLogs",
               "Effect": "Allow",
               "Action": [
                   "logs:DescribeLogGroups",
                   "logs:DescribeLogStreams"
               ],
               "Resource": "*"
           }
       ]
   }

3. Attach the policy to the CloudWatch role by running the following command:

   $ aws iam put-role-policy \
       --role-name CustomerLogDistribution-RH \
       --policy-name Allow-CloudWatch-Writes \
       --policy-document file://cloudwatch-policy.json

4. Configure your Red Hat OpenShift Service on AWS cluster to forward logs to the CloudWatch log group by applying the following sample YAML list. Specify an application, or group, or both:

   cloudwatch:
     cloudwatch_log_role_arn: "arn:aws:iam::123456789012:role/RosaCloudWatch"
     cloudwatch_log_group_name: "rosa-logs"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

   where:

   <example_app1>

   Add one or more applications. For a list of applications, see the table in "Determining what log groups to use".

   <example_group1>

   Add one or more of the following groups: api, authentication, controller manager, scheduler.

5. Enable the log forwarder to send logs to your Red Hat OpenShift Service on AWS cluster.

   1. To enable control plane log forwarding on a new cluster, include the log forwarding configuration by running the following command:

      $ rosa create cluster --log-fwd-config="<path_to_file>.yaml"

   2. To enable control plane log forwarding on an existing cluster, include the log forwarding configuration by running the following command:

      $ rosa create log-forwarder -c <cluster> --log-fwd-config="<path_to_file>.yaml" -o yaml

6. Optional: For an example for forwarding logs to the CloudWatch log group, apply the following sample YAML:

   cloudwatch:
     cloudwatch_log_role_arn: "cloudwatch-log-role-arn"
     cloudwatch_log_group_name: "cloudwatch-group-name"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

Procedure

1. Create the S3 bucket by running the following command:

   $ aws s3api create-bucket \
       --bucket <your_s3_bucket_name> \
       --region <your_aws_region> \
       --create-bucket-configuration LocationConstraint=<cluster_aws_region>

2. Configure the policy for the S3 bucket by applying the following S3 bucket policy sample:

    "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowCentralLogDistributionWrite",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::859037107838:role/ROSA-CentralLogDistributionRole-241c1a86"
               },
               "Action": "s3:PutObject",
               "Resource": "arn:aws:s3:::<your_s3_bucket_name>/*",
               "Condition": {
                   "StringEquals": {
                       "s3:x-amz-acl": "bucket-owner-full-control"
                   }
               }
           }
       ]
   }

3. Attach the policy to the S3 role by running the following command:

   $ aws s3api put-bucket-policy \
       --bucket <your_s3_bucket_name> \
       --policy file://s3-bucket-policy.json

4. Configure your Red Hat OpenShift Service on AWS cluster to forward logs to the S3 bucket by applying the following sample YAML list. Specify an application, or group, or both:

   s3:
     s3_config_bucket_name: "my-log-bucket"
     s3_config_bucket_prefix: "my-bucket-prefix"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

   <example_app1>

   Add one or more applications. For a list of applications, see the table in "Determining what log groups to use".

   <example_group1>

   Add one or more of the following groups: api, authentication, controller manager, scheduler.

5. Enable the log forwarder to send logs to your Red Hat OpenShift Service on AWS cluster.

   1. To enable control plane log forwarding on a new cluster, include the log forwarding configuration by running the following command:

      $ rosa create cluster --log-fwd-config="<path_to_file>.yaml"

   2. To enable control plane log forwarding on an existing cluster, include the log forwarding configuration by running the following command:

      $ rosa create log-forwarder -c <cluster> --log-fwd-config="<path_to_file>.yaml" -o yaml

6. Optional: For an example for forwarding logs to the S3 bucket, apply the following sample YAML:

   s3:
     s3_config_bucket_name: "s3-bucket-name"
     s3_config_bucket_prefix: "s3-bucket-prefix"
     groups:
       - "<example_group1>"