Please note that this Terraform provider and its modules are open source and will continue to iterate features, gradually maturing this code. If you encounter any issues, please report them in this repo.
The OCM provider allows Terraform to manage Red Hat OpenShift Service on AWS (ROSA) clusters, machine pools and identity provider.
Red Hat OpenShift Cluster Manager is a managed service where you can install, modify, operate, and upgrade your Red Hat OpenShift clusters. This service allows you to work with all of your organization’s clusters from a single dashboard. More information can be found here.
Red Hat OpenShift Service on AWS (ROSA) is a fully-managed, turnkey application platform that allows you to focus on delivering value to your customers by building and deploying applications. More information can be found here.
A Secure Token Service (STS) is a component that issues, validates, renews, and cancels security tokens for trusted systems, users, and resources requesting access within a federation. AWS provides AWS STS as a web service that enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users or for users you authenticate (federated users).
To deploy a Red Hat OpenShift Service on AWS (ROSA) cluster that uses the AWS Security Token Service (STS), you must create the following AWS Identity Access Management (IAM) resources:
Specific account-wide IAM roles and policies that provide the STS permissions required for ROSA support, installation, control plane, and compute functionality. This includes account-wide Operator policies. Cluster-specific Operator IAM roles that permit the ROSA cluster Operators to carry out core OpenShift functionality. An OpenID Connect (OIDC) provider that the cluster Operators use to authenticate.
Terraform is an infrastructure as a code tool, used primarily by DevOps teams. It lets you define resources in human-readable configuration files that you can version, reuse, and share.
Terraform creates and manages resources through their application programming interfaces (APIs) by using "Providers".
In order to use the provider inside your terraform configuration you need to import it using:
- Offline token (OCM):
Get an offline token from https://console.redhat.com/openshift/token/rosa
Detailed ROSA Account Roles and Policies can be found here
variable ocm_environment {
type = string
default = "production"
}
variable openshift_version {
type = string
default = "4.12"
}
variable account_role_prefix {
type = string
}
variable token {
type = string
}
variable url {
type = string
}
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 4.20.0"
}
ocm = {
version = "0.0.3"
source = "terraform-redhat/ocm"
}
}
}
provider "ocm" {
token = var.token
url = var.url
}
data "ocm_policies" "all_policies"{}
module "create_account_roles"{
source = "terraform-redhat/rosa-sts/aws"
version = "0.0.4"
create_operator_roles = false
create_oidc_provider = false
create_account_roles = true
account_role_prefix = var.account_role_prefix
ocm_environment = var.ocm_environment
rosa_openshift_version= var.openshift_version
account_role_policies=data.ocm_policies.all_policies.account_role_policies
operator_role_policies=data.ocm_policies.all_policies.operator_role_policies
}
- Least AWS Permissions required to run the terraform
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:UpdateOpenIDConnectProviderThumbprint",
"iam:CreateRole",
"iam:DeleteRole",
"iam:UpdateRole",
"iam:DeleteOpenIDConnectProvider",
"iam:GetOpenIDConnectProvider",
"iam:CreateOpenIDConnectProvider",
"iam:TagOpenIDConnectProvider",
"iam:TagRole",
"iam:ListRolePolicies",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole",
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Resource": [
"arn:aws:iam::<ACCOUNT_ID>:oidc-provider/*",
"arn:aws:iam::<ACCOUNT_ID>:role/*"
]
}
]
}
- Choose operator IAM roles prefix name
The operator IAM roles will be created per cluster by module.
variable token {
type = string
}
variable operator_role_prefix {
type = string
}
variable cluster_name {
type = string
}
variable region {
type = string
}
variable zone {
type = string
}
variable account_role_prefix {
type = string
}
provider "ocm" {
token = var.token
}
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 4.20.0"
}
ocm = {
version = "0.0.3"
source = "terraform-redhat/ocm"
}
}
}
locals {
sts_roles = {
role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.account_role_prefix}-Installer-Role",
support_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.account_role_prefix}-Support-Role",
instance_iam_roles = {
master_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.account_role_prefix}-ControlPlane-Role",
worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.account_role_prefix}-Worker-Role"
},
operator_role_prefix = var.operator_role_prefix,
}
}
data "aws_caller_identity" "current" {}
resource "ocm_cluster_rosa_classic" "rosa_sts_cluster" {
name = var.cluster_name
cloud_region = var.region
aws_account_id = data.aws_caller_identity.current.account_id
availability_zones = [var.zone]
properties = {
rosa_creator_arn = data.aws_caller_identity.current.arn
}
sts = local.sts_roles
# disable_waiting_in_destroy = false
# destroy_timeout in minutes
destroy_timeout = 60
}
resource "ocm_cluster_wait" "rosa_cluster" {
cluster = ocm_cluster_rosa_classic.rosa_sts_cluster.id
# timeout in minutes
timeout = 60
}
data "ocm_rosa_operator_roles" "operator_roles" {
operator_role_prefix = var.operator_role_prefix
account_role_prefix = var.account_role_prefix
}
module operator_roles {
source = "terraform-redhat/rosa-sts/aws"
version = "0.0.4"
create_operator_roles = true
create_oidc_provider = true
create_account_roles = false
cluster_id = ocm_cluster_rosa_classic.rosa_sts_cluster.id
rh_oidc_provider_thumbprint = ocm_cluster_rosa_classic.rosa_sts_cluster.sts.thumbprint
rh_oidc_provider_url = ocm_cluster_rosa_classic.rosa_sts_cluster.sts.oidc_endpoint_url
operator_roles_properties = data.ocm_rosa_operator_roles.operator_roles.operator_iam_roles
}
Running terraform plan against a local build of OCM provider can be done by those steps:
- Run
make install. After runningmake installyou will find the ocm provider binary file in the directory:
<HOME>/.terraform.d/plugins/terraform.local/local/ocm/<VERSION>/<TARGET_ARCH>
for example
~/.terraform.d/plugins/terraform.local/local/ocm/0.0.1/linux_amd64
- Point to the local provider by pointing the required_providers ocm to the local terraform directory
terraform {
required_providers {
ocm = {
source = "terraform.local/local/ocm"
version = ">=0.0.1"
}
}
}
provider "ocm" {
token = var.token
url = var.url
}