Skip to content

Commit 99878ec

Browse files
dfitzmaudfitzmau
authored
Merge pull request #102543 from dfitzmau/OSDOCS-17072-batch6
OSDOCS-17072-batch6
2 parents f0be10a + 870dfb7 commit 99878ec

15 files changed

+206
-79
lines changed

‎modules/oadp-using-ca-certificates-with-velero-command.adoc‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,12 @@ $ alias velero='oc -n openshift-adp exec deployment/velero -c velero -it -- ./ve
3131
. Check that the alias is working by running the following command:
3232
+
3333
[source,terminal]
34-
.Example
3534
----
3635
$ velero version
36+
----
37+
+
38+
[source,terminal]
39+
----
3740
Client:
3841
Version: v1.12.1-OADP
3942
Git commit: -

‎modules/op-using-tekton-chains-to-sign-and-verify-image-and-provenance.adoc‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -142,15 +142,18 @@ $ cosign verify-attestation --key cosign.pub $REGISTRY/kaniko-chains
142142
+
143143
[source,terminal]
144144
----
145-
$ rekor-cli search --sha <image_digest> <1>
146-
145+
$ rekor-cli search --sha <image_digest>
146+
----
147+
* `<image_digest>`: Substitute with the `sha256` digest of the image.
148+
+
149+
[source,terminal]
150+
----
147151
<uuid_1> <2>
148152
<uuid_2> <3>
149153
...
150154
----
151-
<1> Substitute with the `sha256` digest of the image.
152-
<2> The first matching universally unique identifier (UUID).
153-
<3> The second matching UUID.
155+
* `<uuid_1>`: The first matching universally unique identifier (UUID).
156+
* `<uuid_2>`: The second matching UUID.
154157
+
155158
The search result displays UUIDs of the matching entries. One of those UUIDs holds the attestation.
156159
+

‎modules/ossm-cert-manage-verify-cert.adoc‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,12 +80,9 @@ $ diff -s /tmp/ca-cert.crt.txt /tmp/pod-cert-chain-ca.crt.txt
8080
You should see the following result:
8181
`Files /tmp/ca-cert.crt.txt and /tmp/pod-cert-chain-ca.crt.txt are identical.`
8282

83-
. Verify the certificate chain from the root certificate to the workload certificate. Replace `<path>` with the path to your certificates.
83+
. Verify the certificate chain from the root certificate to the workload certificate. Replace `<path>` with the path to your certificates. After you run the command, the expected output shows `./proxy-cert-1.pem: OK`.
8484
+
8585
[source,terminal]
8686
----
8787
$ openssl verify -CAfile <(cat <path>/ca-cert.pem <path>/root-cert.pem) ./proxy-cert-1.pem
8888
----
89-
+
90-
You should see the following result:
91-
`./proxy-cert-1.pem: OK`

‎modules/persistent-storage-csi-azure-file-cross-sub-dynamic-provisioning-procedure.adoc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
[id="persistent-storage-csi-azure-file-cross-sub-dynamic-provisioning-procedure_{context}"]
77
= Dynamic provisioning across subscriptions for Azure File
88

9+
To use Azure File dynamic provisioning across subscriptions by completing this procedure.
10+
911
.Prerequisites
1012
* Installed {product-title} cluster on Azure with the service principal or managed identity as an Azure identity in one subscription (call it Subscription A)
1113
@@ -14,7 +16,6 @@
1416
* Logged in to the Azure CLI
1517
1618
.Procedure
17-
To use Azure File dynamic provisioning across subscriptions:
1819

1920
. Record the Azure identity (service principal or managed identity) by running the following applicable commands. The Azure identity is needed in a later step:
2021
+

‎modules/preparing-aws-credentials-for-oadp.adoc‎

Lines changed: 65 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
An {aws-full} account must be prepared and configured to accept an {oadp-first} installation.
1212

1313
.Procedure
14+
1415
. Create the following environment variables by running the following commands:
1516
+
1617
[IMPORTANT]
@@ -20,32 +21,72 @@ Change the cluster name to match your cluster, and ensure you are logged into th
2021
+
2122
[source,terminal]
2223
----
23-
$ export CLUSTER_NAME=my-cluster <1>
24-
export ROSA_CLUSTER_ID=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .id)
25-
export REGION=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .region.id)
26-
export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')
27-
export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
28-
export CLUSTER_VERSION=$(rosa describe cluster -c ${CLUSTER_NAME} -o json | jq -r .version.raw_id | cut -f -2 -d '.')
29-
export ROLE_NAME="${CLUSTER_NAME}-openshift-oadp-aws-cloud-credentials"
30-
export SCRATCH="/tmp/${CLUSTER_NAME}/oadp"
31-
mkdir -p ${SCRATCH}
32-
echo "Cluster ID: ${ROSA_CLUSTER_ID}, Region: ${REGION}, OIDC Endpoint:
33-
${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
24+
$ export CLUSTER_NAME=my-cluster
25+
----
26+
+
27+
--
28+
* `my-cluster`: Replace `my-cluster` with your cluster name.
29+
--
30+
+
31+
[source,terminal]
32+
----
33+
$ export ROSA_CLUSTER_ID=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .id)
34+
----
35+
+
36+
[source,terminal]
37+
----
38+
$ export REGION=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .region.id)
39+
----
40+
+
41+
[source,terminal]
42+
----
43+
$ export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')
44+
----
45+
+
46+
[source,terminal]
47+
----
48+
$ export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
49+
----
50+
+
51+
[source,terminal]
52+
----
53+
$ export CLUSTER_VERSION=$(rosa describe cluster -c ${CLUSTER_NAME} -o json | jq -r .version.raw_id | cut -f -2 -d '.')
54+
----
55+
+
56+
[source,terminal]
57+
----
58+
$ export ROLE_NAME="${CLUSTER_NAME}-openshift-oadp-aws-cloud-credentials"
3459
----
3560
+
36-
<1> Replace `my-cluster` with your cluster name.
61+
[source,terminal]
62+
----
63+
$ export SCRATCH="/tmp/${CLUSTER_NAME}/oadp"
64+
----
65+
+
66+
[source,terminal]
67+
----
68+
$ mkdir -p ${SCRATCH}
69+
----
70+
+
71+
[source,terminal]
72+
----
73+
$ echo "Cluster ID: ${ROSA_CLUSTER_ID}, Region: ${REGION}, OIDC Endpoint:
74+
${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
75+
----
3776

3877
. On the {aws-short} account, create an IAM policy to allow access to {aws-short} S3:
39-
78+
+
4079
.. Check to see if the policy exists by running the following command:
4180
+
4281
[source,terminal]
4382
----
44-
$ POLICY_ARN=$(aws iam list-policies --query "Policies[?PolicyName=='RosaOadpVer1'].{ARN:Arn}" --output text) <1>
83+
$ POLICY_ARN=$(aws iam list-policies --query "Policies[?PolicyName=='RosaOadpVer1'].{ARN:Arn}" --output text)
4584
----
4685
+
47-
<1> Replace `RosaOadp` with your policy name.
48-
86+
--
87+
* `RosaOadp`: Replace `RosaOadp` with your policy name.
88+
--
89+
+
4990
.. Enter the following command to create the policy JSON file and then create the policy:
5091
+
5192
[NOTE]
@@ -56,7 +97,7 @@ If the policy ARN is not found, the command creates the policy. If the policy AR
5697
[source,terminal]
5798
----
5899
$ if [[ -z "${POLICY_ARN}" ]]; then
59-
cat << EOF > ${SCRATCH}/policy.json <1>
100+
cat << EOF > ${SCRATCH}/policy.json
60101
{
61102
"Version": "2012-10-17",
62103
"Statement": [
@@ -101,18 +142,19 @@ EOF
101142
fi
102143
----
103144
+
104-
<1> `SCRATCH` is a name for a temporary directory created for the environment variables.
105-
145+
--
146+
* `SCRATCH`: `SCRATCH` is a name for a temporary directory created for the environment variables.
147+
--
148+
+
106149
.. View the policy ARN by running the following command:
107150
+
108151
[source,terminal]
109152
----
110153
$ echo ${POLICY_ARN}
111154
----
112155

113-
114156
. Create an IAM role trust policy for the cluster:
115-
157+
+
116158
.. Create the trust policy file by running the following command:
117159
+
118160
[source,terminal]
@@ -137,7 +179,7 @@ $ cat <<EOF > ${SCRATCH}/trust-policy.json
137179
}
138180
EOF
139181
----
140-
182+
+
141183
.. Create the role by running the following command:
142184
+
143185
[source,terminal]
@@ -152,7 +194,7 @@ $ ROLE_ARN=$(aws iam create-role --role-name \
152194
Key=operator_name,Value=openshift-oadp \
153195
--query Role.Arn --output text)
154196
----
155-
197+
+
156198
.. View the role ARN by running the following command:
157199
+
158200
[source,terminal]

‎modules/preparing-aws-sts-credentials-for-oadp.adoc‎

Lines changed: 41 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
An {aws-full} account must be prepared and configured to accept an {oadp-first} installation. Prepare the {aws-short} credentials by using the following procedure.
1111

1212
.Procedure
13+
1314
. Define the `cluster_name` environment variable by running the following command:
1415
+
1516
[source,terminal]
@@ -23,45 +24,67 @@ $ export CLUSTER_NAME= <AWS_cluster_name> <1>
2324
[source,terminal]
2425
----
2526
$ export CLUSTER_VERSION=$(oc get clusterversion version -o jsonpath='{.status.desired.version}{"\n"}')
26-
27-
export AWS_CLUSTER_ID=$(oc get clusterversion version -o jsonpath='{.spec.clusterID}{"\n"}')
28-
29-
export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')
30-
31-
export REGION=$(oc get infrastructures cluster -o jsonpath='{.status.platformStatus.aws.region}' --allow-missing-template-keys=false || echo us-east-2)
32-
33-
export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
34-
35-
export ROLE_NAME="${CLUSTER_NAME}-openshift-oadp-aws-cloud-credentials"
3627
----
28+
+
29+
[source,terminal]
30+
----
31+
$ export AWS_CLUSTER_ID=$(oc get clusterversion version -o jsonpath='{.spec.clusterID}{"\n"}')
32+
----
33+
+
34+
[source,terminal]
35+
----
36+
$ export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')
37+
----
38+
+
39+
[source,terminal]
40+
----
41+
$ export REGION=$(oc get infrastructures cluster -o jsonpath='{.status.platformStatus.aws.region}' --allow-missing-template-keys=false || echo us-east-2)
42+
----
43+
+
44+
[source,terminal]
45+
----
46+
$ export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
47+
----
48+
+
49+
[source,terminal]
50+
----
51+
$ export ROLE_NAME="${CLUSTER_NAME}-openshift-oadp-aws-cloud-credentials"
52+
----
53+
3754
. Create a temporary directory to store all of the files by running the following command:
3855
+
3956
[source,terminal]
4057
----
4158
$ export SCRATCH="/tmp/${CLUSTER_NAME}/oadp"
4259
mkdir -p ${SCRATCH}
4360
----
61+
4462
. Display all of the gathered details by running the following command:
4563
+
4664
[source,terminal]
4765
----
4866
$ echo "Cluster ID: ${AWS_CLUSTER_ID}, Region: ${REGION}, OIDC Endpoint:
4967
${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
5068
----
51-
. On the {aws-short} account, create an IAM policy to allow access to {aws-short} S3:
5269

70+
. On the {aws-short} account, create an IAM policy to allow access to {aws-short} S3:
71+
+
5372
.. Check to see if the policy exists by running the following commands:
5473
+
5574
[source,terminal]
5675
----
57-
$ export POLICY_NAME="OadpVer1" <1>
76+
$ export POLICY_NAME="OadpVer1"
5877
----
59-
<1> The variable can be set to any value.
78+
+
79+
--
80+
* `POLICY_NAME`: The variable can be set to any value.
81+
--
6082
+
6183
[source,terminal]
6284
----
6385
$ POLICY_ARN=$(aws iam list-policies --query "Policies[?PolicyName=='$POLICY_NAME'].{ARN:Arn}" --output text)
6486
----
87+
+
6588
.. Enter the following command to create the policy JSON file and then create the policy:
6689
+
6790
[NOTE]
@@ -113,12 +136,11 @@ EOF
113136
POLICY_ARN=$(aws iam create-policy --policy-name $POLICY_NAME \
114137
--policy-document file:///${SCRATCH}/policy.json --query Policy.Arn \
115138
--tags Key=openshift_version,Value=${CLUSTER_VERSION} Key=operator_namespace,Value=openshift-adp Key=operator_name,Value=oadp \
116-
--output text) <1>
139+
--output text)
117140
fi
118141
----
142+
* `SCRATCH`: The name for a temporary directory created for storing the files.
119143
+
120-
<1> `SCRATCH` is a name for a temporary directory created for storing the files.
121-
122144
.. View the policy ARN by running the following command:
123145
+
124146
[source,terminal]
@@ -127,7 +149,7 @@ $ echo ${POLICY_ARN}
127149
----
128150
129151
. Create an IAM role trust policy for the cluster:
130-
152+
+
131153
.. Create the trust policy file by running the following command:
132154
+
133155
[source,terminal]
@@ -152,7 +174,7 @@ $ cat <<EOF > ${SCRATCH}/trust-policy.json
152174
}
153175
EOF
154176
----
155-
177+
+
156178
.. Create an IAM role trust policy for the cluster by running the following command:
157179
+
158180
[source,terminal]
@@ -162,7 +184,7 @@ $ ROLE_ARN=$(aws iam create-role --role-name \
162184
--assume-role-policy-document file://${SCRATCH}/trust-policy.json \
163185
--tags Key=cluster_id,Value=${AWS_CLUSTER_ID} Key=openshift_version,Value=${CLUSTER_VERSION} Key=operator_namespace,Value=openshift-adp Key=operator_name,Value=oadp --query Role.Arn --output text)
164186
----
165-
187+
+
166188
.. View the role ARN by running the following command:
167189
+
168190
[source,terminal]

‎modules/querying-cluster-node-journal-logs.adoc‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,19 +35,23 @@ ifdef::openshift-rosa-hcp[]
3535
* Query `kubelet` `journald` unit logs from {product-title} cluster nodes. The following example queries worker nodes only:
3636
endif::openshift-rosa-hcp[]
3737
+
38+
ifndef::openshift-rosa-hcp[]
3839
[source,terminal]
3940
----
40-
ifndef::openshift-rosa-hcp[]
4141
$ oc adm node-logs --role=master -u kubelet <1>
42+
----
4243
endif::openshift-rosa-hcp[]
4344
ifdef::openshift-rosa-hcp[]
44-
$ oc adm node-logs --role=worker -u kubelet <1>
45-
endif::openshift-rosa-hcp[]
45+
[source,terminal]
46+
----
47+
$ oc adm node-logs --role=worker -u kubelet
4648
----
47-
<1> Replace `kubelet` as appropriate to query other unit logs.
49+
endif::openshift-rosa-hcp[]
50+
* `kubelet`: Replace as appropriate to query other unit logs.
4851

4952
ifndef::openshift-rosa-hcp[]
5053
. Collect logs from specific subdirectories under `/var/log/` on cluster nodes.
54+
+
5155
.. Retrieve a list of logs contained within a `/var/log/` subdirectory. The following example lists files in `/var/log/openshift-apiserver/` on all control plane nodes:
5256
+
5357
[source,terminal]

0 commit comments

Comments
 (0)