OSDOCS#10947: Support for CCO in HCP#77653
Conversation
jeana-redhat
left a comment
There was a problem hiding this comment.
Nice work navigating the STS conditional spaghetti 😅 I've made a few suggestions here to catch a couple loose ends and match the structure of this in the OCP install books (since that's a clear workflow). I'll catch up with you on Slack about placement considerations for this content 🤓
| [role="_additional-resources"] | ||
| .Additional resources | ||
|
|
||
| * To know about the Cloud Credential Operator, see xref:../operators/operator-reference.adoc#cloud-credential-operator_cluster-operators-ref[Cluster Operators reference page for the Cloud Credential Operator]. |
There was a problem hiding this comment.
Add'l resources should just have the link text :)
| * To know about the Cloud Credential Operator, see xref:../operators/operator-reference.adoc#cloud-credential-operator_cluster-operators-ref[Cluster Operators reference page for the Cloud Credential Operator]. | |
| * xref:../operators/operator-reference.adoc#cloud-credential-operator_cluster-operators-ref[Cluster Operators reference page for the Cloud Credential Operator] |
|
|
||
| * To know more about supported identity providers, see xref:../authentication/understanding-identity-provider.adoc#understanding-identity-provider["Understanding identity provider configuration"] in _Authentication and authorization_. | ||
|
|
||
| include::modules/cco-ccoctl-configuring.adoc[leveloffset=+3] |
There was a problem hiding this comment.
Might consider bumping this to a +2? Right now it looks like it's part of "Configuring the OAuth server", but IIUC it's not really part of that
| include::modules/cco-ccoctl-configuring.adoc[leveloffset=+3] | |
| include::modules/cco-ccoctl-configuring.adoc[leveloffset=+2] |
Alternatively, you could make a subheading at the == level to put all the CCO stuff inside to more closely match the structure of these tasks in the install books.
So, something like:
- Configuring the OAuth server for a hosted cluster by using the CLI
- Configuring the OAuth server for a hosted cluster by using the web console
- Configuring an {hcp} cluster to use the AWS Security Token Service
- Configuring the Cloud Credential Operator utility
- Creating AWS resources with the Cloud Credential Operator utility
- Creating AWS resources with a single command
- Creating AWS resources individually
- Incorporating the Cloud Credential Operator utility manifests
This was a bit harder to show with a PR review diff, but I sketched it out in my editor here if you want to see what I'm thinking 🙂
|
|
||
| include::modules/cco-ccoctl-install-creating-manifests.adoc[leveloffset=+3] | ||
|
|
||
| include::modules/cco-mode-sts.adoc[leveloffset=+1] |
There was a problem hiding this comment.
this doesn't seem to exist
There was a problem hiding this comment.
in addition to this one, the module cco-ccoctl-creating-individually.adoc needs to have an hcp-cco condition included anywhere there's aws-sts for it to render right (assuming all STS steps apply to HCP 🙂)
| * You can use the `ccoctl aws create-all` command to create the AWS resources automatically. This is the quickest way to create the resources. See xref:../../../installing/installing_aws/ipi/installing-aws-network-customizations.adoc#cco-ccoctl-creating-at-once_installing-aws-network-customizations[Creating AWS resources with a single command]. | ||
|
|
||
| * If you need to review the JSON files that the `ccoctl` tool creates before modifying AWS resources, or if the process the `ccoctl` tool uses to create AWS resources automatically does not meet the requirements of your organization, you can create the AWS resources individually. See xref:../../../installing/installing_aws/ipi/installing-aws-network-customizations.adoc#cco-ccoctl-creating-individually_installing-aws-network-customizations[Creating AWS resources individually]. |
There was a problem hiding this comment.
For the links in these items, you probably want to point them to the instance of these modules on this page rather than off in IPI install
| * You can use the `ccoctl aws create-all` command to create the AWS resources automatically. This is the quickest way to create the resources. See xref:../../../installing/installing_aws/ipi/installing-aws-network-customizations.adoc#cco-ccoctl-creating-at-once_installing-aws-network-customizations[Creating AWS resources with a single command]. | |
| * If you need to review the JSON files that the `ccoctl` tool creates before modifying AWS resources, or if the process the `ccoctl` tool uses to create AWS resources automatically does not meet the requirements of your organization, you can create the AWS resources individually. See xref:../../../installing/installing_aws/ipi/installing-aws-network-customizations.adoc#cco-ccoctl-creating-individually_installing-aws-network-customizations[Creating AWS resources individually]. | |
| * You can use the `ccoctl aws create-all` command to create the AWS resources automatically. This is the quickest way to create the resources. See xref:../hosted_control_planes/hcp-authentication-authorization.adoc#cco-ccoctl-creating-at-once_hcp-authentication-authorization[Creating AWS resources with a single command]. | |
| * If you need to review the JSON files that the `ccoctl` tool creates before modifying AWS resources, or if the process the `ccoctl` tool uses to create AWS resources automatically does not meet the requirements of your organization, you can create the AWS resources individually. See xref:../hosted_control_planes/hcp-authentication-authorization.adoc#cco-ccoctl-creating-individually_hcp-authentication-authorization[Creating AWS resources individually]. |
| include::modules/cco-ccoctl-configuring.adoc[leveloffset=+3] | ||
|
|
||
| [id="hcp-sts-mode-ccoctl_{context}"] | ||
| == Using Credential Operator utility for {hcp} |
There was a problem hiding this comment.
| == Using Credential Operator utility for {hcp} | |
| == Creating {aws-short} resources with the Cloud Credential Operator utility |
4389f5a to
218c9e9
Compare
|
looks good. Thanks @xenolinux |
|
Hi @xenolinux Please hold off on merging this documentation PR for now. I’ve just reviewed the current doc and noticed that some issues are not clearly explained. I am in the process of reviewing it and will add my comments once I’m finished. |
|
@huangmingxia Sure. Thanks. |
huangmingxia
left a comment
There was a problem hiding this comment.
As @jeana-redhat suggested, the document structure is now very clear.
However, there are differences in how the Cloud Credential Operator works for HyperShift compared to OpenShift:
- For HyperShift on AWS, the CCO only supports Manual mode.
- In OpenShift, when creating a cluster in Manual mode, ccoctl is typically used to generate manifests and OIDC resources. However, this is not the case for HyperShift. HyperShift Hosted Clusters on AWS are always set to Manual mode by default, and there's no need to use ccoctl to generate manifests or OIDC resources.
For HyperShift, since the CCO only supports AWS in Manual mode and doesn’t require ccoctl to create other resources, given these points, there’s no need to include ccoctl usage in the document, we can remove that section from the doc.
Based on above background, we need to update the following content:
- Remove these sections(HyperShift Hosted Clusters on AWS do not use
ccoctl. Ifccoctlis needed in the future, we can add it then.).
- Configuring the Cloud Credential Operator utility
- Creating AWS resources with the Cloud Credential Operator utility
- Incorporating the Cloud Credential Operator utility manifests
-
Clarify the steps for creating a Hosted Cluster in Manual mode:
Follow the same steps as in the hcp-getting-started-aws guide. -
Add below verification steps after installation:
-
Verify Hosted Cluster in Manual Mode, check that the Cloud Credential Operator is set to Manual mode by running:
$oc get cloudcredentials cluster -o=jsonpath={.spec.credentialsMode}
The output should be Manual:
Manual -
Verify Service Account Issuer is not empty, ensure the
serviceAccountIssueris not empty by executing:
$oc get authentication cluster -o jsonpath --template '{.spec.serviceAccountIssuer }'
The output like:
https://aos-hypershift-ci-oidc-26499.s3.us-east-2.amazonaws.com/hypershift-ci-26499
|
|
||
| You can configure the Cloud Credential Operator (CCO) utility (`ccoctl`) on hosted clusters to assign components IAM roles that provide short-term, limited-privilege security credentials. | ||
|
|
||
| To configure the CCO utility for a hosted cluster, your hosted cluster must use the {aws-short} {sts-short}. |
There was a problem hiding this comment.
Please change the sentence to this note:
Note:
The Cloud Credential Operator (CCO) currently supports only Manual mode for Hosted Clusters on AWS. All Hosted Clusters are automatically configured to Manual mode by default, regardless of the management cluster's mode. At present, there is no need to generate additional resources using ccoctl.
In the future, if there are scenarios where ccoctl is added, we can update accordingly.
There was a problem hiding this comment.
For my education: are hosted clusters using AWS STS, or just manual CCO by itself? I ask because I wasn't aware that we could have AWS STS without the ccoctl 🙂
There was a problem hiding this comment.
Let me try to explain in my comment next.
|
@jianping-shu @heliubj18 @YuLi517 Just want you to know this specific change. |
65c6af1 to
3a20f6c
Compare
d417263 to
4cb0476
Compare
|
@huangmingxia I appreciate your review. Thank you!! I updated this PR as per your suggestions. Can you please re-review?
In this command (and the next command)
This link https://aos-hypershift-ci-oidc-26499.s3.us-east-2.amazonaws.com/hypershift-ci-26499 is giving the [1] output. Is it the expected output? If not, can you please help with the expected command output? [1] |
|
Hi @xenolinux Thank you for the update! I am working on some blocker tasks today and expect to have time to review either tomorrow or next Monday. I will address all the issues you mentioned during my review. |
@huangmingxia Sure. No rush. :) Thanks! It takes a couple of mins to get the preview updated again. Here's the updated preview link to the particular sections: |
|
Sorry for late review and feedback! |
3f37009 to
2cc4d84
Compare
|
/label peer-review-needed |
lahinson
left a comment
There was a problem hiding this comment.
Looks great! I had a couple suggestions for your consideration, but overall, LGTM.
| * To know more about supported identity providers, see xref:../authentication/understanding-identity-provider.adoc#understanding-identity-provider["Understanding identity provider configuration"] in _Authentication and authorization_. | ||
|
|
||
| [id="hcp-cco-aws-sts_{context}"] | ||
| == Using the CCO in a hosted cluster on {aws-short} |
There was a problem hiding this comment.
| == Using the CCO in a hosted cluster on {aws-short} | |
| == Assigning components IAM roles by using the CCO in a hosted cluster on {aws-short} |
Just a thought. Is the goal of this task to use the CCO in a hosted cluster, or is it to assign components IAM roles by using the CCO in a hosted cluster?
There was a problem hiding this comment.
As per the text Assigning components IAM... fits better. Addressed the suggestion.
|
|
||
| [NOTE] | ||
| ==== | ||
| The CCO only supports a manual mode for hosted clusters on {aws-short}. By default, hosted clusters are configured in a manual mode. The management cluster might use modes other than manual. |
There was a problem hiding this comment.
| The CCO only supports a manual mode for hosted clusters on {aws-short}. By default, hosted clusters are configured in a manual mode. The management cluster might use modes other than manual. | |
| The CCO supports a manual mode only for hosted clusters on {aws-short}. By default, hosted clusters are configured in a manual mode. The management cluster might use modes other than manual. |
I think "only" is modifying "a manual mode", so I moved "only" closer to that phrase. If "only" is actually modifying "supports", feel free to ignore this suggestion :)
There was a problem hiding this comment.
Ack'ed. Addressed
| [id="hcp-cco-verify-aws-sts_{context}"] | ||
| = Verifying the CCO installation in a hosted cluster on {aws-short} | ||
|
|
||
| You can verify if the Cloud Credential Operator (CCO) is running correctly in your hosted control plane. |
There was a problem hiding this comment.
| You can verify if the Cloud Credential Operator (CCO) is running correctly in your hosted control plane. | |
| You can verify that the Cloud Credential Operator (CCO) is running correctly in your hosted control plane. |
| [role="_additional-resources"] | ||
| .Additional resources | ||
|
|
||
| * xref:../operators/operator-reference.adoc#cloud-credential-operator_cluster-operators-ref[Cluster Operators reference page for the Cloud Credential Operator]. |
There was a problem hiding this comment.
| * xref:../operators/operator-reference.adoc#cloud-credential-operator_cluster-operators-ref[Cluster Operators reference page for the Cloud Credential Operator]. | |
| * xref:../operators/operator-reference.adoc#cloud-credential-operator_cluster-operators-ref[Cluster Operators reference page for the Cloud Credential Operator] |
|
@xenolinux: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/label merge-review-needed |
|
/cherrypick enterprise-4.15 |
|
/cherrypick enterprise-4.16 |
|
/cherrypick enterprise-4.17 |
|
@kcarmichael08: new pull request created: #80906 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@kcarmichael08: new pull request created: #80907 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@kcarmichael08: new pull request created: #80908 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |

Version(s): 4.15+
Issue: https://issues.redhat.com/browse/OSDOCS-10947
Link to docs preview:
Configuring the CCO in a hosted cluster on AWS
Verifying the CCO installation in a hosted cluster on AWS
Enabling Operators to support CCO-based workflows with AWS STS
QE review:
SME review:
Additional information: