19장. Integrating RHACS using short-lived tokens

Procedure

1. Run the following command to enable the IAM OpenID Connect (OIDC) provider for your EKS cluster:

   $ eksctl utils associate-iam-oidc-provider --cluster <cluster_name> --approve

2. Create an IAM role for your EKS cluster.

3. Edit the permission policy of the role and grant the permissions required by the integration. For example:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "ecr:BatchCheckLayerAvailability",
                   "ecr:BatchGetImage",
                   "ecr:DescribeImages",
                   "ecr:DescribeRepositories",
                   "ecr:GetAuthorizationToken",
                   "ecr:GetDownloadUrlForLayer",
                   "ecr:ListImages"
               ],
               "Resource": "arn:aws:iam::<ecr_registry>:role/<role_name>"
           }
       ]
   }

4. Update the trust relationship for the role that you want to assume:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": [
             "arn:aws:iam::<ecr-registry>:role/<role_name>"
           ]
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }

   where:

   <ecr-registry>

   Specifies the <role_name>, which should match with the new role that you have created in the earlier steps.

5. Enter the following command to associate the newly created role with a service account:

   $ oc -n stackrox annotate sa central eks.amazonaws.com/role-arn=arn:aws:iam::67890:role/<role_name>

6. Enter the following command to restart the Central pod and apply the changes:

   $ oc -n stackrox delete pod -l "app in (central,sensor)"

Procedure

1. Follow the instructions at Creating OpenID Connect (OIDC) identity providers to create web identity of the OpenShift Container Platform cluster. Use openshift as the value for Audience.
2. Create an IAM role for the web identity of the OpenShift Container Platform cluster.

3. Edit the permission policy of the role and grant the permissions required by the integration. For example:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "ecr:BatchCheckLayerAvailability",
                   "ecr:BatchGetImage",
                   "ecr:DescribeImages",
                   "ecr:DescribeRepositories",
                   "ecr:GetAuthorizationToken",
                   "ecr:GetDownloadUrlForLayer",
                   "ecr:ListImages"
               ],
               "Resource": "arn:aws:iam::<ecr_registry>:role/<role_name>"
           }
       ]
   }

4. Update the trust relationship for the role that you want to assume:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Federated": "<oidc_provider_arn>"
               },
               "Action": "sts:AssumeRoleWithWebIdentity",
               "Condition": {
                   "StringEquals": {
                       "<oidc_provider_name>:aud": "openshift"
                   }
               }
           }
       ]
   }

5. Set the following RHACS environment variables on the Central or Sensor deployment:

   AWS_ROLE_ARN=<role_arn>
   AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/openshift/serviceaccount/token