このコンテンツは選択した言語では利用できません。
Chapter 3. Approved Access
Red Hat Site Reliability Engineering (SRE) typically does not require elevated access to systems as part of normal operations to manage and support Red Hat OpenShift Service on AWS clusters. Elevated access gives SRE the access levels of a cluster-admin role. See cluster roles for more information.
In the unlikely event that SRE needs elevated access to systems, you can use the Approved Access interface to review and approve or deny access to these systems.
Elevated access requests to clusters on Red Hat OpenShift Service on AWS clusters and the corresponding cloud accounts can be created by SRE either in response to a customer-initiated support ticket or in response to alerts received by SRE as part of the standard incident response process.
When Approved Access is enabled and an SRE creates an access request, cluster owners receive an email notification informing them of a new access request. The email notification contains a link allowing the cluster owner to quickly approve or deny the access request. You must respond in a timely manner otherwise there is a risk to your SLA for Red Hat OpenShift Service on AWS.
- If customers require additional users that are not the cluster owner to receive the email, they can add notification cluster contacts.
- Pending access requests are available in the Hybrid Cloud Console on the clusters list or Access Requests tab on the cluster overview for the specific cluster.
Denying an access request requires you to complete the Justification field. In this case, SRE can not directly act on the resources related to the incident. Customers can still use the Customer Support to help investigate and resolve any issues.
3.1. Enabling Approved Access for ROSA clusters by submitting a support case
Red Hat OpenShift Service on AWS Approved Access is not enabled by default. To enable Approved Access for your Red Hat OpenShift Service on AWS clusters, you should create a support ticket.
Procedure
- Log in to the Customer Support page of the Red Hat Customer Portal.
- Click Get support.
On the Cases tab of the Customer support page:
- Optional: Change the pre-filled account and owner details if needed.
- Select the Configuration category and click Continue.
Enter the following information:
- In the Product field, select Red Hat OpenShift Service on AWS or Red Hat OpenShift Service on AWS Hosted control planes.
- In the Problem statement field, enter Enable ROSA Access Protection.
- Click See more options.
- Select OpenShift Cluster ID from the drop-down list.
Fill the remaining mandatory fields in the form:
What are you experiencing? What are you expecting to happen?
- Fill with Approved Access.
Define the value or impact to you or the business.
- Fill with Approved Access.
- Click Continue.
- Select Severity as 4(Low) and click Continue.
- Preview the case details and click Submit.
3.2. Reviewing an access request from an email notification
Cluster owners will receive an email notification when Red Hat Site Reliability Engineering (SRE) request access to their cluster with a link to review the request in the Hybrid Cloud Console.
Procedure
- Click the link within the email to bring you to the Hybrid Cloud Console.
In the Access Request Details dialog, click Approve or Deny under Decision.
NoteDenying an access request requires you to complete the Justification field. In this case, SRE can not directly act on the resources related to the incident. Customers can still use the Customer Support to help investigate and resolve any issues.
- Click Save.
3.3. Reviewing an access request from the Hybrid Cloud Console
Review access requests for your Red Hat OpenShift Service on AWS clusters from the Hybrid Cloud Console.
Procedure
- Navigate to OpenShift Cluster Manager and select Cluster List.
- Click the cluster name to review the Access Request.
- Select the Access Requests tab to list all states.
- Select Open under Actions for the Pending state.
In the Access Request Details dialog, click Approve or Deny under Decision.
NoteDenying an access request requires you to complete the Justification field. In this case, SRE can not directly act on the resources related to the incident. Customers can still use the Customer Support to help investigate and resolve any issues.
- Click Save.
