7.6. 创建 Operator 角色和策略

流程

1. 要创建 Operator 角色，请运行以下命令：

   $ rosa create operator-roles --hosted-cp --prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$OIDC_ID --installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role

   以下分类提供了创建 Operator 角色的选项。

   $ rosa create operator-roles --hosted-cp
   	--prefix=$OPERATOR_ROLES_PREFIX
   	--oidc-config-id=$OIDC_ID
   	--installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/$ACCOUNT_ROLES_PREFIX-HCP-ROSA-Installer-Role

   其中：

   --prefix=

   在创建这些 Operator 角色时，您必须提供一个前缀。如果不这样做，则会产生错误。如需有关 Operator 前缀的信息，请参阅本节的额外资源。

   --oidc-config-id=

   这个值是您为 Red Hat OpenShift Service on AWS 创建的 OIDC 配置 ID。

   --installer-role-arn

   这个值是您在创建 Red Hat OpenShift Service on AWS 帐户角色时创建的安装程序角色 ARN。

   您必须包含 -hosted-cp 参数，以便为 Red Hat OpenShift Service on AWS 集群创建正确的角色。此命令返回以下信息：

   例如：

   ? Role creation mode: auto
   ? Operator roles prefix: <pre-filled_prefix>
   ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4
   ? Create hosted control plane operator roles: Yes
   W: More than one Installer role found
   ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role
   ? Permissions boundary ARN (optional):
   I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles:
   I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>'
   I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials'
   I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti'
   I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager'
   I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager'
   I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator'
   I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider'
   I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials'
   I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials'
   I: To create a cluster with these roles, run the following command:
   	rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp

   其中：

   Operator 角色前缀

   此字段会预先填充您在初始创建命令中设置的前缀。

   OIDC 配置 ID

   此字段要求您选择为 Red Hat OpenShift Service on AWS 集群创建的 OIDC 配置。

   现在，Operator 角色已创建并可用于创建 Red Hat OpenShift Service on AWS 集群。