Skip to content

[OSDOCS-20477]: CQA: Managing HCP on AWS (2 of 6) #115024

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lahinson wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[OSDOCS-20477]: CQA: Managing HCP on AWS (2 of 6) #115024

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions modules/hcp-managed-aws-iam.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,14 @@
//
// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc

:_mod-docs-content-type: CONCEPT
:_mod-docs-content-type: REFERENCE
[id="hcp-managed-aws-iam_{context}"]
= Identity and Access Management (IAM) permissions
= Identity and Access Management (IAM) permissions for {hcp} on {aws-short}

In the context of {hcp}, the consumer is responsible to create the Amazon Resource Name (ARN) roles. The _consumer_ is an automated process to generate the permissions files. The consumer might be the CLI or {cluster-manager}. {hcp-capital} can enable granularity to honor the principle of least-privilege components, which means that every component uses its own role to operate or create {aws-first} objects, and the roles are limited to what is required for the product to function normally.
[role="_abstract"]
In the context of {hcp}, the consumer is responsible to create the Amazon Resource Name (ARN) roles. The _consumer_ is an automated process to generate the permissions files. It might be the command-line interface (CLI) or {cluster-manager}.

{hcp-capital} can enable granularity to honor the principle of least-privilege components, which means that every component uses its own role to operate or create {aws-first} objects, and the roles are limited to what is required for the product to function normally.

The hosted cluster receives the ARN roles as input and the consumer creates an {aws-short} permission configuration for each component. As a result, the component can authenticate through STS and preconfigured OIDC IDP.

Expand Down
7 changes: 4 additions & 3 deletions modules/hcp-managed-aws-infra-iam-separate.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,9 @@

:_mod-docs-content-type: CONCEPT
[id="hcp-managed-aws-infra-iam-separate_{context}"]
= Creating {aws-short} infrastructure and IAM resources separate
= Separate creation of the hosted cluster and its resources

By default, the `hcp create cluster aws` command creates cloud infrastructure with the hosted cluster and applies it. You can create the cloud infrastructure portion separately so that you can use the `hcp create cluster aws` command only to create the cluster, or render it to modify it before you apply it.
[role="_abstract"]
By default, the `hcp create cluster aws` command creates the cloud infrastructure with the hosted cluster and applies it. However, you can create the cloud infrastructure separately so that you can use the command to create only the cluster, or render it to modify it before you apply it.

To create the cloud infrastructure portion separately, you need to create the {aws-first} infrastructure, create the {aws-short} Identity and Access (IAM) resources, and create the cluster.
The process to create the hosted cluster and its resources separately involves creating the cloud infrastructure, creating the {aws-short} Identity and Access (IAM) resources, and then creating the cluster.
56 changes: 31 additions & 25 deletions modules/hcp-managed-aws-infra-separate.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,21 @@
//
// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc

:_mod-docs-content-type: CONCEPT
:_mod-docs-content-type: PROCEDURE
[id="hcp-managed-aws-infra-separate_{context}"]
= Creating the {aws-short} infrastructure separately

To create the {aws-first} infrastructure, you need to create a Virtual Private Cloud (VPC) and other resources for your cluster. You can use the {aws-short} console or an infrastructure automation and provisioning tool. For instructions to use the {aws-short} console, see link:https://docs.aws.amazon.com/vpc/latest/userguide/create-vpc.html#create-vpc-and-other-resources[Create a VPC plus other VPC resources] in the {aws-short} Documentation.
[role="_abstract"]
To create the {aws-first} infrastructure, you need to create a Virtual Private Cloud (VPC) and other resources for your cluster. You can use the {aws-short} console or an infrastructure automation and provisioning tool.

For instructions to use the {aws-short} console, see link:https://docs.aws.amazon.com/vpc/latest/userguide/create-vpc.html#create-vpc-and-other-resources[Create a VPC plus other VPC resources] in the {aws-short} Documentation.

The VPC must include private and public subnets and resources for external access, such as a network address translation (NAT) gateway and an internet gateway. In addition to the VPC, you need a private hosted zone for the ingress of your cluster. If you are creating clusters that use PrivateLink (`Private` or `PublicAndPrivate` access modes), you need an additional hosted zone for PrivateLink.

Create the {aws-short} infrastructure for your hosted cluster by using the following example configuration:
.Procedure

* Create the {aws-short} infrastructure for your hosted cluster by using the following example configuration:
+
[source,yaml]
[subs="+quotes"]
----
Expand All @@ -32,7 +37,7 @@ metadata:
creationTimestamp: null
labels:
hypershift.openshift.io/safe-to-delete-with-cluster: "true"
name: <pull_secret_name> <1>
name: <pull_secret_name>
namespace: clusters
---
apiVersion: v1
Expand All @@ -43,7 +48,7 @@ metadata:
creationTimestamp: null
labels:
hypershift.openshift.io/safe-to-delete-with-cluster: "true"
name: <etcd_encryption_key_name> <2>
name: <etcd_encryption_key_name>
namespace: clusters
type: Opaque
---
Expand All @@ -56,21 +61,21 @@ metadata:
creationTimestamp: null
labels:
hypershift.openshift.io/safe-to-delete-with-cluster: "true"
name: <ssh-key-name> <3>
name: <ssh_key_name>
namespace: clusters
---
apiVersion: hypershift.openshift.io/v1beta1
kind: HostedCluster
metadata:
creationTimestamp: null
name: <hosted_cluster_name> <4>
name: <hosted_cluster_name>
namespace: clusters
spec:
autoscaling: {}
configuration: {}
controllerAvailabilityPolicy: SingleReplica
dns:
baseDomain: <dns_domain> <5>
baseDomain: <dns_domain>
privateZoneID: xxxxxxxx
publicZoneID: xxxxxxxx
etcd:
Expand All @@ -82,8 +87,8 @@ spec:
type: PersistentVolume
managementType: Managed
fips: false
infraID: <infra_id> <6>
issuerURL: <issuer_url> <7>
infraID: <infra_id>
issuerURL: <issuer_url>
networking:
clusterNetwork:
- cidr: 10.132.0.0/14
Expand All @@ -97,8 +102,8 @@ spec:
aws:
cloudProviderConfig:
subnet:
id: <subnet_xxx> <8>
vpc: <vpc_xxx> <9>
id: <subnet_xxx>
vpc: <vpc_xxx>
zone: us-west-1b
endpointAccess: Public
multiArch: false
Expand Down Expand Up @@ -148,7 +153,7 @@ apiVersion: hypershift.openshift.io/v1beta1
kind: NodePool
metadata:
creationTimestamp: null
name: <node_pool_name> <10>
name: <node_pool_name>
namespace: clusters
spec:
arch: amd64
Expand All @@ -159,7 +164,7 @@ spec:
nodeDrainTimeout: 0s
platform:
aws:
instanceProfile: <instance_profile_name> <11>
instanceProfile: <instance_profile_name>
instanceType: m6i.xlarge
rootVolume:
size: 120
Expand All @@ -173,14 +178,15 @@ spec:
status:
replicas: 0
----
<1> Replace `<pull_secret_name>` with the name of your pull secret.
<2> Replace `<etcd_encryption_key_name>` with the name of your etcd encryption key.
<3> Replace `<ssh_key_name>` with the name of your SSH key.
<4> Replace `<hosted_cluster_name>` with the name of your hosted cluster.
<5> Replace `<dns_domain>` with your base DNS domain, such as `example.com`.
<6> Replace `<infra_id>` with the value that identifies the IAM resources that are associated with the hosted cluster.
<7> Replace `<issuer_url>` with your issuer URL, which ends with your `infra_id` value. For example, `https://example-hosted-us-west-1.s3.us-west-1.amazonaws.com/example-hosted-infra-id`.
<8> Replace `<subnet_xxx>` with your subnet ID. Both private and public subnets need to be tagged. For public subnets, use `kubernetes.io/role/elb=1`. For private subnets, use `kubernetes.io/role/internal-elb=1`.
<9> Replace `<vpc_xxx>` with your VPC ID.
<10> Replace `<node_pool_name>` with the name of your `NodePool` resource.
<11> Replace `<instance_profile_name>` with the name of your {aws-short} instance.
+
** `<pull_secret_name>` specifies the name of your pull secret.
** `<etcd_encryption_key_name>` specifies the name of your etcd encryption key.
** `<ssh_key_name>` specifies the name of your SSH key.
** `<hosted_cluster_name>` specifies the name of your hosted cluster.
** `<dns_domain>` specifies your base DNS domain, such as `example.com`.
** `<infra_id>` specifies the value that identifies the IAM resources that are associated with the hosted cluster.
** `<issuer_url>` specifies your issuer URL, which ends with your `infra_id` value. For example, `https://example-hosted-us-west-1.s3.us-west-1.amazonaws.com/example-hosted-infra-id`.
** `<subnet_xxx>` specifies your subnet ID. Both private and public subnets need to be tagged. For public subnets, use `kubernetes.io/role/elb=1`. For private subnets, use `kubernetes.io/role/internal-elb=1`.
** `<vpc_xxx>` specifies your VPC ID.
** `<node_pool_name>` specifies the name of your `NodePool` resource.
** `<instance_profile_name>` specifies the name of your {aws-short} instance.