Skip to content

Instantly share code, notes, and snippets.

@dudash

dudash/rosa-demo-secure-setup.md

Last active September 8, 2022 00:43
Download ZIP

Revisions

  1. dudash revised this gist Sep 8, 2022. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions rosa-demo-secure-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -116,4 +116,5 @@ EOF
    ```

    `oc apply -f /tmp/new-service-account.json`

    `oc annotate -n default serviceaccount new-s3-service-account eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`
  2. dudash revised this gist Sep 8, 2022. 1 changed file with 18 additions and 14 deletions.
    32 changes: 18 additions & 14 deletions rosa-demo-secure-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -46,26 +46,15 @@ S3_CUSTOM_POLICY_ARN=$(aws iam create-policy --policy-name ROSADemoS3Access \
    (ref: https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html)

    Get your AWS account info:

    ```export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)```

    Get your cluster OIDC info:
    ```
    export OIDC_PROVIDER=$(oc get authentication.config.openshift.io cluster -o json | jq -r .spec.serviceAccountIssuer | sed -e "s/^https:\/\///")
    ```

    Create a new service account that will get this access:
    ```
    cat <<EOF > /tmp/new-service-account.json
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: builder-s3-service-account
    namespace: default
    EOF
    export OIDC_PROVIDER=$(oc get authentication.config.openshift.io cluster -o json | jq -r .spec.serviceAccountIssuer | sed -e "s/^https:\/\///")
    ```

    `oc apply -f /tmp/new-service-account.json`

    The trust policy defines the rules around who can assume this new role:
    ```
    cat <<EOF > /tmp/trustpolicy.json
    @@ -112,4 +101,19 @@ Annotate the local namespace's service account(s) that will run pods needing S3

    `oc annotate serviceaccount builder eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`

    `oc annotate serviceaccount default eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`
    `oc annotate serviceaccount default eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`

    Alternatively, create a new service account, annotate that, and reference it in your deployments:

    ```
    cat <<EOF > /tmp/new-service-account.json
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: new-s3-service-account
    namespace: default
    EOF
    ```

    `oc apply -f /tmp/new-service-account.json`
    `oc annotate -n default serviceaccount new-s3-service-account eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`
  3. dudash revised this gist Sep 8, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion rosa-demo-secure-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,5 @@
    # Secure Demo Setup
    This assumes you have a ROSA cluster and you have added an OIDC provider for the cluster. We will walk through the steps to auth ROSA pods to access specific S3 buckets. Instead of creating and distributing your AWS credentials to the containers or using the Amazon EC2 instance’s role, we will create a role (and associated federated identity) with some of the built-in ROSA service accounts.
    This assumes you have a ROSA cluster and you have added an OIDC provider for the cluster. We will walk through the steps to auth ROSA pods to access specific S3 buckets. Instead of creating and distributing your AWS credentials to the containers or using the Amazon EC2 instance’s role, we will create a IAM Policy and Role (with federated identity) and associate it to some of the built-in ROSA service accounts.

    ## Setup temp AWS creds
    `aws configure --profile rosa-demo`
  4. dudash renamed this gist Sep 8, 2022. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions rosa-demo-setup.md → rosa-demo-secure-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,5 @@
    # Secure Demo Setup
    This assumes you have a ROSA cluster and you have added an OIDC provider for the cluster. We will walk through the steps to auth ROSA pods to access specific S3 buckets. Instead of creating and distributing your AWS credentials to the containers or using the Amazon EC2 instance’s role, we will create a role (and associated federated identity) with some of the built-in ROSA service accounts.

    ## Setup temp AWS creds
    `aws configure --profile rosa-demo`
  5. dudash revised this gist Sep 8, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -107,7 +107,7 @@ aws iam attach-role-policy \
    --policy-arn $S3_CUSTOM_POLICY_ARN
    ```

    Annotate the service account(s) that will run the pods needing S3 access:
    Annotate the local namespace's service account(s) that will run pods needing S3 access:

    `oc annotate serviceaccount builder eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`

  6. dudash revised this gist Sep 8, 2022. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -107,6 +107,8 @@ aws iam attach-role-policy \
    --policy-arn $S3_CUSTOM_POLICY_ARN
    ```

    Annotate your service account:
    Annotate the service account(s) that will run the pods needing S3 access:

    `oc annotate serviceaccount builder eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`

    `oc annotate serviceaccount default eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`
  7. dudash revised this gist Sep 8, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    # Demo Setup
    # Secure Demo Setup

    ## Setup temp AWS creds
    `aws configure --profile rosa-demo`
  8. dudash revised this gist Sep 8, 2022. 1 changed file with 1 addition and 13 deletions.
    14 changes: 1 addition & 13 deletions rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -41,19 +41,7 @@ S3_CUSTOM_POLICY_ARN=$(aws iam create-policy --policy-name ROSADemoS3Access \
    echo $S3_CUSTOM_POLICY_ARN
    ```

    ## Attach a S3 access policy for all workers (option 1)
    Find existing IAM roles for the cluster:
    aws iam list-roles | grep -iE "rosa|ManagedOpenShift"

    ....*find worker role here to use below*....

    ```
    aws iam attach-role-policy \
    --role-name rosa-5cznr-r9gqb-worker-role \
    --policy-arn $S3_CUSTOM_POLICY_ARN
    ```

    ## Create a new role and ROSA service account (option 2)
    ## Create a new role and ROSA service account
    (ref: https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html)

    Get your AWS account info:
  9. dudash revised this gist Sep 7, 2022. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -120,4 +120,5 @@ aws iam attach-role-policy \
    ```

    Annotate your service account:

    `oc annotate serviceaccount builder eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`
  10. dudash revised this gist Sep 7, 2022. 1 changed file with 5 additions and 2 deletions.
    7 changes: 5 additions & 2 deletions rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -112,9 +112,12 @@ S3_ROLE=$(aws iam create-role \

    `echo $S3_ROLE`

    Attach the role
    Attach the role:
    ```
    aws iam attach-role-policy \
    --role-name "ROSADemoS3AccessRole" \
    --policy-arn $S3_CUSTOM_POLICY_ARN
    ```
    ```

    Annotate your service account:
    `oc annotate serviceaccount builder eks.amazonaws.com/role-arn=arn:aws:iam::$AWS_ACCOUNT_ID:role/ROSADemoS3AccessRole`
  11. dudash revised this gist Sep 7, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -92,7 +92,7 @@ cat <<EOF > /tmp/trustpolicy.json
    "Condition": {
    "StringEquals": {
    "${OIDC_PROVIDER}:sub": [
    "system:serviceaccount:default:builder-s3-service-account"
    "system:serviceaccount:*:builder"
    ]
    }
    }
  12. dudash revised this gist Sep 7, 2022. 1 changed file with 1 addition and 3 deletions.
    4 changes: 1 addition & 3 deletions rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -61,19 +61,17 @@ Get your AWS account info:

    Get your cluster OIDC info:
    ```
    export OIDC_PROVIDER=$(oc get authentication.config.openshift.io cluster -o json | jq -r .spec.serviceAccountIssuer| sed -e "s/^https:\/\///")
    export OIDC_PROVIDER=$(oc get authentication.config.openshift.io cluster -o json | jq -r .spec.serviceAccountIssuer | sed -e "s/^https:\/\///")
    ```

    Create a new service account that will get this access:
    ```
    cat <<EOF > /tmp/new-service-account.json
    {
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: builder-s3-service-account
    namespace: default
    }
    EOF
    ```

  13. dudash revised this gist Sep 7, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -57,7 +57,7 @@ aws iam attach-role-policy \
    (ref: https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html)

    Get your AWS account info:
    `export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)`
    ```export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)```

    Get your cluster OIDC info:
    ```
  14. dudash revised this gist Sep 7, 2022. 1 changed file with 116 additions and 1 deletion.
    117 changes: 116 additions & 1 deletion rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,7 +1,122 @@
    # Setup temp AWS creds
    # Demo Setup

    ## Setup temp AWS creds
    `aws configure --profile rosa-demo`

    ....*answer questions*....

    `export AWS_PROFILE=rosa-demo`

    ## Create a custom policy for S3 Access
    `export S3_CUSTOM_BUCKET=sagemaker-us-east-1-546584748567`

    `export S3_FULL_POLICY_ARN=arn:aws:iam::aws:policy/AmazonS3FullAccess`

    ```
    cat <<EOF > /tmp/s3-policy.json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "Statement",
    "Effect": "Allow",
    "Action": [
    "s3:ListBucket",
    "s3:GetObject"
    ],
    "Resource": [
    "arn:aws:s3:::$S3_CUSTOM_BUCKET/*",
    "arn:aws:s3:::$S3_CUSTOM_BUCKET"
    ]
    }
    ]
    }
    EOF
    ```

    ```
    S3_CUSTOM_POLICY_ARN=$(aws iam create-policy --policy-name ROSADemoS3Access \
    --policy-document file:///tmp/s3-policy.json \
    --query 'Policy.Arn' --output text)
    echo $S3_CUSTOM_POLICY_ARN
    ```

    ## Attach a S3 access policy for all workers (option 1)
    Find existing IAM roles for the cluster:
    aws iam list-roles | grep -iE "rosa|ManagedOpenShift"

    ....*find worker role here to use below*....

    ```
    aws iam attach-role-policy \
    --role-name rosa-5cznr-r9gqb-worker-role \
    --policy-arn $S3_CUSTOM_POLICY_ARN
    ```

    ## Create a new role and ROSA service account (option 2)
    (ref: https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html)

    Get your AWS account info:
    `export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)`

    Get your cluster OIDC info:
    ```
    export OIDC_PROVIDER=$(oc get authentication.config.openshift.io cluster -o json | jq -r .spec.serviceAccountIssuer| sed -e "s/^https:\/\///")
    ```

    Create a new service account that will get this access:
    ```
    cat <<EOF > /tmp/new-service-account.json
    {
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: builder-s3-service-account
    namespace: default
    }
    EOF
    ```

    `oc apply -f /tmp/new-service-account.json`

    The trust policy defines the rules around who can assume this new role:
    ```
    cat <<EOF > /tmp/trustpolicy.json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_PROVIDER}"
    },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
    "StringEquals": {
    "${OIDC_PROVIDER}:sub": [
    "system:serviceaccount:default:builder-s3-service-account"
    ]
    }
    }
    }
    ]
    }
    EOF
    ```

    Create the new role:
    ```
    S3_ROLE=$(aws iam create-role \
    --role-name "ROSADemoS3AccessRole" \
    --assume-role-policy-document file:///tmp/trustpolicy.json \
    --query "Role.Arn" --output text)
    ```

    `echo $S3_ROLE`

    Attach the role
    ```
    aws iam attach-role-policy \
    --role-name "ROSADemoS3AccessRole" \
    --policy-arn $S3_CUSTOM_POLICY_ARN
    ```
  15. dudash revised this gist Sep 7, 2022. 2 changed files with 7 additions and 6 deletions.
    6 changes: 0 additions & 6 deletions rosa-demo-setup
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +0,0 @@
    # Setup temp AWS creds
    aws configure --profile rosa-demo

    **answer questions**

    export AWS_PROFILE=rosa-demo
    7 changes: 7 additions & 0 deletions rosa-demo-setup.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,7 @@
    # Setup temp AWS creds
    `aws configure --profile rosa-demo`

    ....*answer questions*....

    `export AWS_PROFILE=rosa-demo`

  16. dudash created this gist Sep 7, 2022.
    6 changes: 6 additions & 0 deletions rosa-demo-setup
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,6 @@
    # Setup temp AWS creds
    aws configure --profile rosa-demo

    **answer questions**

    export AWS_PROFILE=rosa-demo