OSDOCS#7581,7582: Add token auth via CCO for Operator authors (AWS STS) by adellape · Pull Request #64808 · openshift/openshift-docs

adellape · 2023-09-15T21:30:42Z

https://issues.redhat.com/browse/OSDOCS-7581 (Concept)
https://issues.redhat.com/browse/OSDOCS-7582 (Procedure)

4.14 only

Preview:

New assembly: Token authentication for Operators on cloud providers
- Tried to keep the intro matter provider-agnostic, to allow for potential provider additions in the future.
- Start getting specific about AWS + STS with the first subsection (CCO-based workflow for OLM-managed Operators with AWS STS)
Added STS-specific steps in the Operator installation flows:
- Installing from OperatorHub using the web console (steps 5b + 5d)
- Installing from OperatorHub using the CLI (step 5)

TODO:

Sprinkle in some additional xrefs to content from [OSDOCS-6086]: OLM-managed Operators can use AWS STS (CCO docs) #63954 after that is merged (either in this PR or a follow-up).

ocpdocs-previewbot · 2023-09-18T15:42:53Z

🤖 Updated build preview is available at:
https://64808--docspreview.netlify.app

Build log: https://circleci.com/gh/ocpdocs-previewbot/openshift-docs/28138

nalhadef · 2023-09-29T15:15:11Z

Hi! I had a few comments. My biggest difficulty: every time the word "multitenancy" appeared, I read it as "multi-lieutenancy" which confused me as it didn't make sense. :-)

nalhadef · 2023-09-29T15:15:48Z

/remove-label peer-review-in-progress
/label peer-review-done

nalhadef · 2023-09-29T12:21:28Z

 <11> The `resources` parameter defines resource constraints for all the containers in the pod created by OLM.
 <12> The `nodeSelector` parameter defines a `NodeSelector` for the pod created by OLM.

+. If the cluster is in STS mode, include the following fields in the `Subscription` object:


Would it help to spell STS out?

nalhadef · 2023-09-29T12:54:44Z

+* Use the CCO utility (`ccoctl`) to generate the `Secret` YAML object from the `CredentialsRequest` object
+* Apply the `Secret` object to the cluster in the appropriate namespace
+
+The Operator still must be able to consume the resulting secret to communicate with cloud APIs. Because in this case the secret will be created by the user before the Operator is installed, the Operator can do either of the following:


Replace "will be created" with "is created."

From the Red Hat supplemental style guide:

nalhadef · 2023-09-29T13:43:01Z

+webIdentityTokenPath := "/var/run/secrets/openshift/serviceaccount/token"
+----
+
+.. Ensure you have a `CredentialsRequest` object, if one does not already exist, ready to be patched and applied. For example:


Suggestion: Delete "if one does not already exist" and it's accompanying commas. The "ensure" portion of this sentence carries the same meaning, rending these extra words as merely extra words. This deletion also brings the opening and closing phrases together, strengthening the message.

adellape · 2023-10-02T17:32:11Z

@fxierh Applied additional changes per suggestions in a separate commit: 463575d (#64808)

Could you PTAL to verify, as well as see my remaining question in comment reply: #64808 (comment) ?

Thank you!

gallettilance

just realize the credReq used as an example is outdated

gallettilance · 2023-10-06T15:26:40Z

+       ServiceAccountNames: []string{
+           "<service_account_name>",
+       },
+       CloudTokenPath:   "",


this is no longer valid - https://github.com/openshift/cloud-credential-operator/blob/master/pkg/apis/cloudcredential/v1/types_aws.go#L36

Is it the whole var CredentialsRequestTemplate that needs addressing or just the CloudTokenPath line here?

adellape · 2023-10-09T15:57:39Z

@fxierh @gallettilance Thank you for helping get these in shape. I've attempted to interpret/combine your latest comments into some changes but I don't believe I've fully addressed Lance's #64808 (review) about the outdated credReq. I've added a few clarification questions in-line or in replies.

PTAL at the latest changes, which are in an additional separate commit: ~~117ddcd (#64808)~~ (edit: have squashed)

adellape · 2023-10-13T15:29:24Z

Also @fxierh @gallettilance - Release notes for this feature are here: #66133

fxierh · 2023-10-16T04:33:47Z

+     case <-timeout:
+        // timeout is exceeded, return an error
+        return nil, fmt.Errorf("timed out waiting for secret %s in namespace %s", name, namespace)
+// add to this error with a pointer to instructions for following a manual path to a Secret that will work on STS


Is this comment for the line that follows ?

I assumed the line before it; adjusted the indentation for the comment to look more like the others.

fxierh · 2023-10-16T04:35:13Z

+// apply credentialsRequest on install
+   credReq := credreq.CredentialsRequestTemplate


Is there an indentation issue here ?

fxierh · 2023-10-16T04:46:01Z

LGTM for the rest.

adellape · 2023-10-24T16:14:43Z

/cherrypick enterprise-4.14

openshift-cherrypick-robot · 2023-10-24T16:15:30Z

@adellape: new pull request created: #66818

Details

In response to this:

/cherrypick enterprise-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci Bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Sep 15, 2023

adellape force-pushed the sts branch 4 times, most recently from afe878c to 24fc761 Compare September 15, 2023 21:58

adellape changed the title ~~OSDOCS#7582: Add tokenized auth for Operators via CCO~~ [WIP] OSDOCS#7582: Add tokenized auth for Operators via CCO Sep 15, 2023

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 15, 2023

adellape force-pushed the sts branch 5 times, most recently from 7761cf1 to a4279dd Compare September 18, 2023 15:22

adellape force-pushed the sts branch 7 times, most recently from 1df809b to 3187deb Compare September 18, 2023 16:58

openshift-ci Bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Sep 18, 2023

adellape force-pushed the sts branch from 3187deb to 8769fd4 Compare September 18, 2023 17:31

adellape changed the title ~~[WIP] OSDOCS#7582: Add tokenized auth for Operators via CCO~~ OSDOCS#7582: Add tokenized auth for Operators via CCO Sep 18, 2023

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 18, 2023

adellape changed the title ~~OSDOCS#7582: Add tokenized auth for Operators via CCO~~ OSDOCS#7581,7582: Add tokenized auth for Operators via CCO Sep 18, 2023

adellape added the branch/enterprise-4.14 label Sep 18, 2023

adellape added this to the Planned for 4.14 GA milestone Sep 18, 2023

adellape force-pushed the sts branch 2 times, most recently from 3221224 to 86eff83 Compare September 18, 2023 21:02

openshift-ci Bot removed the peer-review-needed Signifies that the peer review team needs to review this PR label Sep 29, 2023

openshift-ci Bot added peer-review-done Signifies that the peer review team has reviewed this PR and removed peer-review-in-progress Signifies that the peer review team is reviewing this PR labels Sep 29, 2023

nalhadef reviewed Sep 29, 2023

View reviewed changes

gallettilance suggested changes Oct 6, 2023

View reviewed changes

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 7, 2023

adellape commented Oct 9, 2023

View reviewed changes

Comment thread modules/osdk-cco-aws-sts-enabling.adoc

adellape commented Oct 9, 2023

View reviewed changes

Comment thread modules/osdk-cco-aws-sts-enabling.adoc Outdated

adellape mentioned this pull request Oct 13, 2023

Add 4.14 relnotes for token auth via CCO / AWS STS #66133

Merged

adellape force-pushed the sts branch from 117ddcd to 0376035 Compare October 13, 2023 15:45

fxierh reviewed Oct 16, 2023

View reviewed changes

adellape force-pushed the sts branch from 8b9dd8e to c8367fa Compare October 16, 2023 19:46

adellape changed the title ~~OSDOCS#7581,7582: Add token auth via CCO for Operator authors~~ OSDOCS#7581,7582: Add token auth via CCO for Operator authors (AWS STS) Oct 16, 2023

Add token auth via CCO for Operator authors (AWS STS)

5a15829

adellape force-pushed the sts branch from c8367fa to 5a15829 Compare October 16, 2023 19:52

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 16, 2023

gallettilance approved these changes Oct 24, 2023

View reviewed changes

adellape merged commit 393a273 into openshift:main Oct 24, 2023

adellape deleted the sts branch October 24, 2023 16:14

openshift-cherrypick-robot mentioned this pull request Oct 24, 2023

[enterprise-4.14] OSDOCS#7581,7582: Add token auth via CCO for Operator authors (AWS STS) #66818

Merged

adellape mentioned this pull request Oct 24, 2023

Add 4.14 RN xrefs for STS/CCO/OLM token auth #66839

Merged

jianping-shu mentioned this pull request Jul 15, 2024

OSDOCS#10947: Support for CCO in HCP #77653

Merged

2 tasks

		// apply credentialsRequest on install
		credReq := credreq.CredentialsRequestTemplate

Conversation

adellape commented Sep 15, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Sep 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nalhadef commented Sep 29, 2023

Uh oh!

nalhadef commented Sep 29, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adellape commented Oct 2, 2023

Uh oh!

gallettilance left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

adellape commented Oct 9, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

adellape commented Oct 13, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fxierh commented Oct 16, 2023

Uh oh!

adellape commented Oct 24, 2023

Uh oh!

openshift-cherrypick-robot commented Oct 24, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

adellape commented Sep 15, 2023 •

edited

Loading

ocpdocs-previewbot commented Sep 18, 2023 •

edited

Loading

adellape commented Oct 9, 2023 •

edited

Loading

adellape commented Oct 13, 2023 •

edited

Loading