1.11.4. マネージドクラスターで AWS 認証情報から IAM ロールに切り替える

oc edit multiclusterengine engine

- configOverrides: {}
  enabled: false
  name: hypershift
- configOverrides: {}
  enabled: false
  name: hypershift-local-hosting
- configOverrides: {}
  enabled: true
  name: cluster-api
- configOverrides: {}
  enabled: true
  name: cluster-api-provider-aws

oc get deploy -n multicluster-engine

NAME                                  READY   UP-TO-DATE   AVAILABLE   AGE
capa-controller-manager               1/1     1            1           12d
capi-controller-manager               1/1     1            1           12d

oc annotate mce multiclusterengine installer.multicluster.openshift.io/pause=true

export OIDC_PROVIDER=$(oc get authentication.config.openshift.io cluster -ojson | jq -r .spec.serviceAccountIssuer | sed 's/https:\/\///')

export AWS_ACCOUNT_ID={YOUR_AWS_ACCOUNT_ID}

cat ./trust.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_PROVIDER}"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "${OIDC_PROVIDER}:sub": "system:serviceaccount:multicluster-engine:capa-controller-manager"
        }
      }
    }
  ]
}

aws iam create-role --role-name "capa-manager-role" --assume-role-policy-document file://trust.json --description "IAM role for CAPA to assume"

aws iam attach-role-policy --role-name capa-manager-role --policy-arn arn:aws:iam::aws:policy/AWSCloudFormationFullAccess

aws iam attach-role-policy --role-name capa-manager-role --policy-arn arn:aws:iam::aws:policy/AmazonVPCFullAccess

export APP_IAM_ROLE_ARN=$(aws iam get-role --role-name=capa-manager-role --query Role.Arn --output text)

export IRSA_ROLE_ARN=eks.amazonaws.com/role-arn=$APP_IAM_ROLE_ARN

oc annotate serviceaccount -n multicluster-engine capa-controller-manager $IRSA_ROLE_ARN

oc rollout restart deployment capa-controller-manager -n multicluster-engine