6.3. Red Hat OpenShift Service on AWS 集群上的额外主体

流程

1. 在 rosa create cluster 命令中添加--additional-allowed-principals 参数，如下所示：

   $ rosa create cluster [...] --additional-allowed-principals <arn_string>

   您可以使用 arn:aws:iam::account_id:role/role_name 批准特定角色。

2. 当集群创建命令运行时，您会收到指定了 --additional-allowed-principals 的集群摘要：

   输出示例

   Name:                       mycluster
   Domain Prefix:              mycluster
   Display Name:               mycluster
   ID:                         <cluster-id>
   External ID:                <cluster-id>
   Control Plane:              ROSA Service Hosted
   OpenShift Version:          4.15.17
   Channel Group:              stable
   DNS:                        Not ready
   AWS Account:                <aws_id>
   AWS Billing Account:        <aws_id>
   API URL:
   Console URL:
   Region:                     us-east-2
   Availability:
    - Control Plane:           MultiAZ
    - Data Plane:              SingleAZ
   
   Nodes:
    - Compute (desired):       2
    - Compute (current):       0
   Network:
    - Type:                    OVNKubernetes
    - Service CIDR:            172.30.0.0/16
    - Machine CIDR:            10.0.0.0/16
    - Pod CIDR:                10.128.0.0/14
    - Host Prefix:             /23
    - Subnets:                 subnet-453e99d40, subnet-666847ce827
   EC2 Metadata Http Tokens:   optional
   Role (STS) ARN:             arn:aws:iam::<aws_id>:role/mycluster-HCP-ROSA-Installer-Role
   Support Role ARN:           arn:aws:iam::<aws_id>:role/mycluster-HCP-ROSA-Support-Role
   Instance IAM Roles:
    - Worker:                  arn:aws:iam::<aws_id>:role/mycluster-HCP-ROSA-Worker-Role
   Operator IAM Roles:
    - arn:aws:iam::<aws_id>:role/mycluster-kube-system-control-plane-operator
    - arn:aws:iam::<aws_id>:role/mycluster-openshift-cloud-network-config-controller-cloud-creden
    - arn:aws:iam::<aws_id>:role/mycluster-openshift-image-registry-installer-cloud-credentials
    - arn:aws:iam::<aws_id>:role/mycluster-openshift-ingress-operator-cloud-credentials
    - arn:aws:iam::<aws_id>:role/mycluster-openshift-cluster-csi-drivers-ebs-cloud-credentials
    - arn:aws:iam::<aws_id>:role/mycluster-kube-system-kms-provider
    - arn:aws:iam::<aws_id>:role/mycluster-kube-system-kube-controller-manager
    - arn:aws:iam::<aws_id>:role/mycluster-kube-system-capa-controller-manager
   Managed Policies:           Yes
   State:                      waiting (Waiting for user action)
   Private:                    No
   Delete Protection:          Disabled
   Created:                    Jun 25 2024 13:36:37 UTC
   User Workload Monitoring:   Enabled
   Details Page:               https://console.redhat.com/openshift/details/s/Bvbok4O79q1Vg8
   OIDC Endpoint URL:          https://oidc.op1.openshiftapps.com/vhufi5lap6vbl3jlq20e (Managed)
   Audit Log Forwarding:       Disabled
   External Authentication:    Disabled
   Additional Principals:      arn:aws:iam::<aws_id>:role/additional-user-role