Skip to content

Commit 9f5ca00

Browse files
EricPonvelleEricPonvelle
committed
OSDOCS-13051: Porting the ALBO book from OCP to ROSA and ROSA classic
1 parent ad36911 commit 9f5ca00

File tree

5 files changed

+447
-24
lines changed

5 files changed

+447
-24
lines changed

‎cli_reference/index.adoc

+2-3
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,6 @@ using the terminal. Unlike the web console, it allows the user to work directly
6262

6363
* xref:../cli_reference/osdk/cli-osdk-install.adoc#cli-osdk-install[Operator SDK]: The Operator SDK, a component of the Operator Framework, provides a CLI tool that Operator developers can use to build, test, and deploy an Operator from the terminal. It simplifies the process of building Kubernetes-native applications, which can require deep, application-specific operational knowledge.
6464

65-
66-
ifdef::openshift-rosa[]
65+
ifdef::openshift-rosa,openshift-rosa-hcp[]
6766
* xref:../cli_reference/rosa_cli/rosa-get-started-cli.adoc#rosa-get-started-cli[ROSA CLI (`rosa`)]: Use the `rosa` CLI to create, update, manage, and delete ROSA clusters and resources.
68-
endif::openshift-rosa[]
67+
endif::openshift-rosa,openshift-rosa-hcp[]

‎modules/albo-deleting.adoc

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Module included in the following assemblies:
2+
//
3+
:_mod-docs-content-type: PROCEDURE
4+
[id="aws-load-balancer-operator-deleting_{context}"]
5+
= Deleting the example AWS Load Balancer Operator installation
6+
7+
. Delete the hello world application namespace (and all the resources in the namespace):
8+
+
9+
[source,terminal]
10+
----
11+
$ oc delete project hello-world
12+
----
13+
+
14+
. Delete the AWS Load Balancer Operator and the AWS IAM roles:
15+
+
16+
[source,terminal]
17+
----
18+
$ oc delete subscription aws-load-balancer-operator -n aws-load-balancer-operator
19+
$ aws iam detach-role-policy \
20+
--role-name "${ROSA_CLUSTER_NAME}-alb-operator" \
21+
--policy-arn $POLICY_ARN
22+
$ aws iam delete-role \
23+
--role-name "${ROSA_CLUSTER_NAME}-alb-operator"
24+
----
25+
+
26+
. Delete the AWS IAM policy:
27+
+
28+
[source,terminal]
29+
----
30+
$ aws iam delete-policy --policy-arn $POLICY_ARN
31+
----

‎modules/albo-installation.adoc

+288
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,288 @@
1+
// Module included in the following assemblies:
2+
//
3+
:_mod-docs-content-type: PROCEDURE
4+
[id="aws-load-balancer-operator-installation_{context}"]
5+
= Installing the AWS Load Balancer Operator
6+
7+
After setting up your environment with your cluster, you can install the AWS Load Balancer Operator using the CLI.
8+
9+
.Procedure
10+
. Create a new project within your cluster for the AWS Load Balancer Operator:
11+
+
12+
[source,terminal]
13+
----
14+
$ oc new-project aws-load-balancer-operator
15+
----
16+
17+
. Create an AWS IAM policy for the AWS Load Balancer Controller:
18+
+
19+
[NOTE]
20+
====
21+
You can find the AWS IAM policy from link:https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.4.4/docs/install/iam_policy.json[the upstream AWS Load Balancer Controller policy]. This policy includes all of the permissions you needed by the Operator to function.
22+
====
23+
+
24+
[source,terminal]
25+
----
26+
$ POLICY_ARN=$(aws iam list-policies --query \
27+
"Policies[?PolicyName=='aws-load-balancer-operator-policy'].{ARN:Arn}" \
28+
--output text)
29+
$ if [[ -z "${POLICY_ARN}" ]]; then
30+
wget -O "${SCRATCH}/load-balancer-operator-policy.json" \
31+
https://raw.githubusercontent.com/rh-mobb/documentation/main/content/rosa/aws-load-balancer-operator/load-balancer-operator-policy.json
32+
POLICY_ARN=$(aws --region "$REGION" --query Policy.Arn \
33+
--output text iam create-policy \
34+
--policy-name aws-load-balancer-operator-policy \
35+
--policy-document "file://${SCRATCH}/load-balancer-operator-policy.json")
36+
fi
37+
$ echo $POLICY_ARN
38+
----
39+
+
40+
. Create an AWS IAM trust policy for AWS Load Balancer Operator:
41+
+
42+
[source,terminal]
43+
----
44+
$ cat <<EOF > "${SCRATCH}/trust-policy.json"
45+
{
46+
"Version": "2012-10-17",
47+
"Statement": [
48+
{
49+
"Effect": "Allow",
50+
"Condition": {
51+
"StringEquals" : {
52+
"${OIDC_ENDPOINT}:sub": ["system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-operator-controller-manager", "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster"]
53+
}
54+
},
55+
"Principal": {
56+
"Federated": "arn:aws:iam::$AWS_ACCOUNT_ID:oidc-provider/${OIDC_ENDPOINT}"
57+
},
58+
"Action": "sts:AssumeRoleWithWebIdentity"
59+
}
60+
]
61+
}
62+
EOF
63+
----
64+
+
65+
. Create an AWS IAM role for the AWS Load Balancer Operator:
66+
+
67+
[source,terminal]
68+
----
69+
$ ROLE_ARN=$(aws iam create-role --role-name "${ROSA_CLUSTER_NAME}-alb-operator" \
70+
--assume-role-policy-document "file://${SCRATCH}/trust-policy.json" \
71+
--query Role.Arn --output text)
72+
$ echo $ROLE_ARN
73+
74+
$ aws iam attach-role-policy --role-name "${ROSA_CLUSTER_NAME}-alb-operator" \
75+
--policy-arn $POLICY_ARN
76+
----
77+
+
78+
. Create a secret for the AWS Load Balancer Operator to assume our newly created AWS IAM role:
79+
+
80+
[source,terminal]
81+
----
82+
$ cat << EOF | oc apply -f -
83+
apiVersion: v1
84+
kind: Secret
85+
metadata:
86+
name: aws-load-balancer-operator
87+
namespace: aws-load-balancer-operator
88+
stringData:
89+
credentials: |
90+
[default]
91+
role_arn = $ROLE_ARN
92+
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
93+
EOF
94+
----
95+
+
96+
. Install the AWS Load Balancer Operator:
97+
+
98+
[source,terminal]
99+
----
100+
$ cat << EOF | oc apply -f -
101+
apiVersion: operators.coreos.com/v1
102+
kind: OperatorGroup
103+
metadata:
104+
name: aws-load-balancer-operator
105+
namespace: aws-load-balancer-operator
106+
spec:
107+
upgradeStrategy: Default
108+
---
109+
apiVersion: operators.coreos.com/v1alpha1
110+
kind: Subscription
111+
metadata:
112+
name: aws-load-balancer-operator
113+
namespace: aws-load-balancer-operator
114+
spec:
115+
channel: stable-v1.0
116+
installPlanApproval: Automatic
117+
name: aws-load-balancer-operator
118+
source: redhat-operators
119+
sourceNamespace: openshift-marketplace
120+
startingCSV: aws-load-balancer-operator.v1.0.0
121+
EOF
122+
----
123+
+
124+
. Deploy an instance of the AWS Load Balancer Controller using the Operator:
125+
+
126+
[NOTE]
127+
====
128+
If you get an error here wait a minute and try again, it means the Operator has not completed installing yet.
129+
====
130+
+
131+
[source,terminal]
132+
----
133+
$ cat << EOF | oc apply -f -
134+
apiVersion: networking.olm.openshift.io/v1
135+
kind: AWSLoadBalancerController
136+
metadata:
137+
name: cluster
138+
spec:
139+
credentials:
140+
name: aws-load-balancer-operator
141+
EOF
142+
----
143+
+
144+
. Check the that the Operator and controller pods are both running:
145+
+
146+
[source,terminal]
147+
----
148+
$ oc -n aws-load-balancer-operator get pods
149+
----
150+
+
151+
You should see the following, if not wait a moment and retry:
152+
+
153+
[source,terminal]
154+
----
155+
NAME READY STATUS RESTARTS AGE
156+
aws-load-balancer-controller-cluster-6ddf658785-pdp5d 1/1 Running 0 99s
157+
aws-load-balancer-operator-controller-manager-577d9ffcb9-w6zqn 2/2 Running 0 2m4s
158+
----
159+
160+
[id="aws-load-balancer-operator-validating-the-deployment_{context}"]
161+
== Validating the deployment
162+
163+
. Create a new project:
164+
+
165+
[source,terminal]
166+
----
167+
$ oc new-project hello-world
168+
----
169+
+
170+
. Deploy a hello world application:
171+
+
172+
[source,terminal]
173+
----
174+
$ oc new-app -n hello-world --image=docker.io/openshift/hello-openshift
175+
----
176+
+
177+
. Configure a NodePort service for the AWS ALB to connect to:
178+
+
179+
[source,terminal]
180+
----
181+
$ cat << EOF | oc apply -f -
182+
apiVersion: v1
183+
kind: Service
184+
metadata:
185+
name: hello-openshift-nodeport
186+
namespace: hello-world
187+
spec:
188+
ports:
189+
- port: 80
190+
targetPort: 8080
191+
protocol: TCP
192+
type: NodePort
193+
selector:
194+
deployment: hello-openshift
195+
EOF
196+
----
197+
+
198+
. Deploy an AWS ALB using the AWS Load Balancer Operator:
199+
+
200+
[source,terminal]
201+
----
202+
$ cat << EOF | oc apply -f -
203+
apiVersion: networking.k8s.io/v1
204+
kind: Ingress
205+
metadata:
206+
name: hello-openshift-alb
207+
namespace: hello-world
208+
annotations:
209+
alb.ingress.kubernetes.io/scheme: internet-facing
210+
spec:
211+
ingressClassName: alb
212+
rules:
213+
- http:
214+
paths:
215+
- path: /
216+
pathType: Exact
217+
backend:
218+
service:
219+
name: hello-openshift-nodeport
220+
port:
221+
number: 80
222+
EOF
223+
----
224+
+
225+
. Curl the AWS ALB Ingress endpoint to verify the hello world application is accessible:
226+
+
227+
[NOTE]
228+
====
229+
AWS ALB provisioning takes a few minutes. If you receive an error that says `curl: (6) Could not resolve host`, please wait and try again.
230+
====
231+
+
232+
[source,termnial]
233+
----
234+
$ INGRESS=$(oc -n hello-world get ingress hello-openshift-alb \
235+
-o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
236+
$ curl "http://${INGRESS}"
237+
----
238+
+
239+
.Example output
240+
[source,text]
241+
----
242+
Hello OpenShift!
243+
----
244+
245+
. Deploy an AWS NLB for your hello world application:
246+
+
247+
[source,terminal]
248+
----
249+
$ cat << EOF | oc apply -f -
250+
apiVersion: v1
251+
kind: Service
252+
metadata:
253+
name: hello-openshift-nlb
254+
namespace: hello-world
255+
annotations:
256+
service.beta.kubernetes.io/aws-load-balancer-type: external
257+
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: instance
258+
service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
259+
spec:
260+
ports:
261+
- port: 80
262+
targetPort: 8080
263+
protocol: TCP
264+
type: LoadBalancer
265+
selector:
266+
deployment: hello-openshift
267+
EOF
268+
----
269+
+
270+
. Test the AWS NLB endpoint:
271+
+
272+
[NOTE]
273+
====
274+
NLB provisioning takes a few minutes. If you receive an error that says `curl: (6) Could not resolve host`, please wait and try again.
275+
====
276+
+
277+
[source,terminal]
278+
----
279+
$ NLB=$(oc -n hello-world get service hello-openshift-nlb \
280+
-o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
281+
$ curl "http://${NLB}"
282+
----
283+
+
284+
.Example output
285+
[source,text]
286+
----
287+
Hello OpenShift!
288+
----

0 commit comments

Comments
 (0)