Installing the AWS Load Balancer Operator on a cluster using the AWS Security Token Service (STS) - AWS Load Balancer Operator | Networking

Creating an IAM role for the AWS Load Balancer Operator
- Creating an AWS IAM role by using the Cloud Credential Operator utility
- Creating an AWS IAM role by using the Cloud Credential Operator utility
Configuring the ARN role for the AWS Load Balancer Operator
Creating an IAM role for the AWS Load Balancer Controller
- Creating an AWS IAM role for the controller by using the Cloud Credential Operator utility
- Creating an AWS IAM role for the controller by using the AWS CLI
Additional resources

You can install the AWS Load Balancer Operator on a cluster that uses STS.

The AWS Load Balancer Operator relies on the CredentialsRequest object to bootstrap the Operator and the AWS Load Balancer Controller. The AWS Load Balancer Operator waits until the required secrets are created and available.

Creating an IAM role for the AWS Load Balancer Operator

An additional AWS Identity and Access Management (IAM) role is required to successfully install the AWS Load Balancer Operator on a cluster that uses STS. The IAM role is required to interact with subnets and Virtual Private Clouds (VPCs). The AWS Load Balancer Operator generates the CredentialsRequest object with the IAM role to bootstrap itself.

You can create the IAM role by using the following options:

Using the Cloud Credential Operator utility (ccoctl) and a predefined CredentialsRequest object.
Using the AWS CLI and predefined AWS manifests.

Use the AWS CLI if your environment does not support the ccoctl command.

Creating an AWS IAM role by using the Cloud Credential Operator utility

You can use the Cloud Credential Operator utility (ccoctl) to create an AWS IAM role for the AWS Load Balancer Operator. An AWS IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).

Prerequisites

You must extract and prepare the ccoctl binary.

Procedure

Download the CredentialsRequest custom resource (CR) and store it in a directory by running the following command:

$ curl --create-dirs -o <credrequests-dir>/operator.yaml https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/operator-credentials-request.yaml

Use the ccoctl utility to create an AWS IAM role by running the following command:

$ ccoctl aws create-iam-roles \
    --name <name> \
    --region=<aws_region> \
    --credentials-requests-dir=<credrequests-dir> \
    --identity-provider-arn <oidc-arn>

Example output

2023/09/12 11:38:57 Role arn:aws:iam::777777777777:role/<name>-aws-load-balancer-operator-aws-load-balancer-operator created (1)
2023/09/12 11:38:57 Saved credentials configuration to: /home/user/<credrequests-dir>/manifests/aws-load-balancer-operator-aws-load-balancer-operator-credentials.yaml
2023/09/12 11:38:58 Updated Role policy for Role <name>-aws-load-balancer-operator-aws-load-balancer-operator created

1	Note the Amazon Resource Name (ARN) of an AWS IAM role.

The length of an AWS IAM role name must be less than or equal to 12 characters.

Creating an AWS IAM role by using the Cloud Credential Operator utility

You can use the AWS Command Line Interface to create an IAM role for the AWS Load Balancer Operator. The IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).

Prerequisites

You must have access to the AWS Command Line Interface (aws).

Procedure

Generate a trust policy file by using your identity provider by running the following command:

$ cat <<EOF > albo-operator-trust-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::777777777777:oidc-provider/<oidc-provider-id>" (1)
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "<oidc-provider-id>:sub": "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-operator-controller-manager" (2)
                }
            }
        }
    ]
}
EOF

1	Specifies the Amazon Resource Name (ARN) of the identity provider.
2	Specifies the service account for the AWS Load Balancer Operator.

Create the IAM role with the generated trust policy by running the following command:

$ aws iam create-role --role-name albo-operator --assume-role-policy-document file://albo-operator-trusted-policy.json

Example output

ROLE	arn:aws:iam::777777777777:role/albo-operator	2023-08-02T12:13:22Z (1)
ASSUMEROLEPOLICYDOCUMENT	2012-10-17
STATEMENT	sts:AssumeRoleWithWebIdentity	Allow
STRINGEQUALS	system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-manager
PRINCIPAL	arn:aws:iam:777777777777:oidc-provider/<oidc-provider-id>

1	Note the ARN of the created IAM role.

Download the permission policy for the AWS Load Balancer Operator by running the following command:

$ curl -o albo-controller-permission-policy.json https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/assets/iam-policy.json

Attach the permission policy for the AWS Load Balancer Controller to the IAM role by running the following command:

$ aws iam put-role-policy --role-name albo-controller --policy-name perms-policy-albo-controller --policy-document file://albo-controller-permission-policy.json

Configuring the ARN role for the AWS Load Balancer Operator

You can configure the Amazon Resource Name (ARN) role for the AWS Load Balancer Operator as an environment variable. You can configure the ARN role by using the CLI.

Prerequisites

You have installed the OpenShift CLI (oc).

Procedure

Create the aws-load-balancer-operator project by running the following command:
```
$ oc new-project aws-load-balancer-operator
```

Create the OperatorGroup object by running the following command:

$ cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: aws-load-balancer-operator
  namespace: aws-load-balancer-operator
spec:
  targetNamespaces: []
EOF

Create the Subscription object by running the following command:

$ cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: aws-load-balancer-operator
  namespace: aws-load-balancer-operator
spec:
  channel: stable-v1
  name: aws-load-balancer-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace
  config:
    env:
    - name: ROLEARN
      value: "<role-arn>" (1)
EOF

1	Specifies the ARN role to be used in the `CredentialsRequest` to provision the AWS credentials for the AWS Load Balancer Operator.

The AWS Load Balancer Operator waits until the secret is created before moving to the Available status.

Creating an IAM role for the AWS Load Balancer Controller

The CredentialsRequest object for the AWS Load Balancer Controller must be set with a manually provisioned IAM role.

You can create the IAM role by using the following options:

Using the Cloud Credential Operator utility (ccoctl) and a predefined CredentialsRequest object.
Using the AWS CLI and predefined AWS manifests.

Use the AWS CLI if your environment does not support the ccoctl command.

Creating an AWS IAM role for the controller by using the Cloud Credential Operator utility

You can use the Cloud Credential Operator utility (ccoctl) to create an AWS IAM role for the AWS Load Balancer Controller. An AWS IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).

Prerequisites

You must extract and prepare the ccoctl binary.

Procedure

Download the CredentialsRequest custom resource (CR) and store it in a directory by running the following command:

$ curl --create-dirs -o <credrequests-dir>/controller.yaml https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/controller/controller-credentials-request.yaml

Use the ccoctl utility to create an AWS IAM role by running the following command:

$ ccoctl aws create-iam-roles \
    --name <name> \
    --region=<aws_region> \
    --credentials-requests-dir=<credrequests-dir> \
    --identity-provider-arn <oidc-arn>

Example output

2023/09/12 11:38:57 Role arn:aws:iam::777777777777:role/<name>-aws-load-balancer-operator-aws-load-balancer-controller created (1)
2023/09/12 11:38:57 Saved credentials configuration to: /home/user/<credrequests-dir>/manifests/aws-load-balancer-operator-aws-load-balancer-controller-credentials.yaml
2023/09/12 11:38:58 Updated Role policy for Role <name>-aws-load-balancer-operator-aws-load-balancer-controller created

1	Note the Amazon Resource Name (ARN) of an AWS IAM role.

The length of an AWS IAM role name must be less than or equal to 12 characters.

Creating an AWS IAM role for the controller by using the AWS CLI

You can use the AWS command line interface to create an AWS IAM role for the AWS Load Balancer Controller. An AWS IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).

Prerequisites

You must have access to the AWS command line interface (aws).

Procedure

Generate a trust policy file using your identity provider by running the following command:

$ cat <<EOF > albo-controller-trust-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::777777777777:oidc-provider/<oidc-provider-id>" (1)
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "<oidc-provider-id>:sub": "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster" (2)
                }
            }
        }
    ]
}
EOF

1	Specifies the Amazon Resource Name (ARN) of the identity provider.
2	Specifies the service account for the AWS Load Balancer Controller.

Create an AWS IAM role with the generated trust policy by running the following command:

$ aws iam create-role --role-name albo-controller --assume-role-policy-document file://albo-controller-trusted-policy.json

Example output

ROLE	arn:aws:iam::777777777777:role/albo-controller	2023-08-02T12:13:22Z (1)
ASSUMEROLEPOLICYDOCUMENT	2012-10-17
STATEMENT	sts:AssumeRoleWithWebIdentity	Allow
STRINGEQUALS	system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster
PRINCIPAL	arn:aws:iam:777777777777:oidc-provider/<oidc-provider-id>

1	Note the ARN of an AWS IAM role.

Download the permission policy for the AWS Load Balancer Controller by running the following command:

$ curl -o albo-controller-permission-policy.json https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/assets/iam-policy.json

Attach the permission policy for the AWS Load Balancer Controller to an AWS IAM role by running the following command:

$ aws iam put-role-policy --role-name albo-controller --policy-name perms-policy-albo-controller --policy-document file://albo-controller-permission-policy.json

Create a YAML file that defines the AWSLoadBalancerController object:

Example sample-aws-lb-manual-creds.yaml file:

apiVersion: networking.olm.openshift.io/v1
kind: AWSLoadBalancerController (1)
metadata:
  name: cluster (2)
spec:
  credentialsRequestConfig:
    stsIAMRoleARN: <role-arn> (3)

1	Defines the `AWSLoadBalancerController` object.
2	Defines the AWS Load Balancer Controller name. All related resources use this instance name as a suffix.
3	Specifies the ARN role. The `CredentialsRequest` object uses this ARN role to provision the AWS credentials.

Additional resources

Configuring the Cloud Credential Operator utility