9.9. 使用 AWS 安全令牌服务为 Red Hat OpenShift 验证 cert-manager Operator

流程

1. 运行以下命令，创建一个目录来存储 CredentialsRequest 资源 YAML 文件：

   $ mkdir credentials-request

2. 通过应用以下 yaml，在 credentials-request 目录下创建一个 CredentialsRequest 资源 YAML 文件，如 sample-credential-request.yaml ：

   apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: cert-manager
     namespace: openshift-cloud-credential-operator
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
       kind: AWSProviderSpec
       statementEntries:
       - action:
         - "route53:GetChange"
         effect: Allow
         resource: "arn:aws:route53:::change/*"
       - action:
         - "route53:ChangeResourceRecordSets"
         - "route53:ListResourceRecordSets"
         effect: Allow
         resource: "arn:aws:route53:::hostedzone/*"
       - action:
         - "route53:ListHostedZonesByName"
         effect: Allow
         resource: "*"
     secretRef:
       name: aws-creds
       namespace: cert-manager
     serviceAccountNames:
     - cert-manager

3. 运行以下命令，使用 ccoctl 工具处理 CredentialsRequest 对象：

   $ ccoctl aws create-iam-roles \
       --name <user_defined_name> --region=<aws_region> \
       --credentials-requests-dir=<path_to_credrequests_dir> \
       --identity-provider-arn <oidc_provider_arn> --output-dir=<path_to_output_dir>

   输出示例

   2023/05/15 18:10:34 Role arn:aws:iam::XXXXXXXXXXXX:role/<user_defined_name>-cert-manager-aws-creds created
   2023/05/15 18:10:34 Saved credentials configuration to: <path_to_output_dir>/manifests/cert-manager-aws-creds-credentials.yaml
   2023/05/15 18:10:35 Updated Role policy for Role <user_defined_name>-cert-manager-aws-creds

   从输出中复制 <aws_role_arn> 以在下一步中使用。例如，"arn:aws:iam::XXXXXXXXXXXX:role/<user_defined_name>-cert-manager-aws-creds"

4. 运行以下命令，将 eks.amazonaws.com/role-arn="<aws_role_arn>" 注解添加到服务帐户：

   $ oc -n cert-manager annotate serviceaccount cert-manager eks.amazonaws.com/role-arn="<aws_role_arn>"

5. 要创建新 pod，请运行以下命令删除现有 cert-manager 控制器 pod：

   $ oc delete pods -l app.kubernetes.io/name=cert-manager -n cert-manager

   AWS 凭证在一分钟内应用到一个新的 cert-manager 控制器 pod。

验证

1. 运行以下命令，获取更新的 cert-manager 控制器 pod 的名称：

   $ oc get pods -l app.kubernetes.io/name=cert-manager -n cert-manager

   输出示例

   NAME                          READY   STATUS    RESTARTS   AGE
   cert-manager-bd7fbb9fc-wvbbt  1/1     Running   0          39s

2. 运行以下命令验证 AWS 凭证是否已更新：

   $ oc set env -n cert-manager po/<cert_manager_controller_pod_name> --list

   输出示例

   # pods/cert-manager-57f9555c54-vbcpg, container cert-manager-controller
   # POD_NAMESPACE from field path metadata.namespace
   AWS_ROLE_ARN=XXXXXXXXXXXX
   AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/eks.amazonaws.com/serviceaccount/token