Skip to content

Commit c1b0c20

Browse files
author
Steven Smith
committed
AWS STS updates
1 parent 4aec994 commit c1b0c20

7 files changed

Lines changed: 186 additions & 6 deletions

‎modules/config-fields-storage-aws.adoc‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,30 @@ DISTRIBUTED_STORAGE_PREFERENCE:
6666
<3> The generated AWS S3 user secret key.
6767
<4> The Amazon Web Services region. Defaults to `us-east-1`.
6868

69+
[id="config-fields-storage-aws-sts-cco"]
70+
== AWS S3 storage with Operator STS and CCO
71+
72+
On STS-enabled AWS clusters, including {product-rosa} and OpenShift Dedicated, the {productname} Operator can provision short-lived credentials through the Cloud Credential Operator when you set the IAM role ARN on the Operator subscription and use unmanaged object storage. Use the `S3Storage` driver without `s3_access_key` or `s3_secret_key` in the config bundle.
73+
74+
.AWS S3 storage with Operator STS example
75+
[source,yaml]
76+
----
77+
# ...
78+
DISTRIBUTED_STORAGE_CONFIG:
79+
default:
80+
- S3Storage
81+
- host: s3.<region>.amazonaws.com
82+
s3_bucket: <s3_bucket_name>
83+
s3_region: <region>
84+
storage_path: /datastorage/registry
85+
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
86+
DISTRIBUTED_STORAGE_PREFERENCE:
87+
- default
88+
# ...
89+
----
90+
91+
For installation and IAM role setup, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator].
92+
6993
[id="aws-cloudfront-storage-example"]
7094
== AWS CloudFront storage
7195

‎modules/configuring-aws-sts-quay.adoc‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@
55
[role="_abstract"]
66
AWS Security Token Service (STS) is a web service for requesting temporary, limited-privilege credentials for AWS IAM users. You can configure AWS STS with {productname} to authenticate with Amazon S3 using temporary credentials.
77

8-
AWS STS enhances security and ensures proper authentication and authorization for object storage access. It is available for standalone {productname} deployments, {productname-ocp}, and {productname} on Red{nbsp}Hat OpenShift Service on AWS (ROSA). AWS STS is useful for clusters using Amazon S3 as an object storage. It allows {productname} to use STS protocols to authenticate with Amazon S3, which can enhance the overall security of the cluster and help to ensure that access to sensitive data is properly authenticated and authorized.
8+
AWS STS enhances security and ensures proper authentication and authorization for object storage access. It is available for standalone {productname} deployments, {productname-ocp}, {product-rosa}, and OpenShift Dedicated.
99

10-
Configuring AWS STS for {ocp} or ROSA requires creating an AWS IAM user, creating an S3 role, and configuring your {productname} `config.yaml` file to include the proper resources.
10+
Use the following approaches depending on your deployment:
11+
12+
* *{ocp}*: Configure `STSS3Storage` with an IAM role ARN and IAM user access keys in `config.yaml`. See link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-ocp-aws-sts[Configuring {productname-ocp} to use AWS STS].
13+
* *{product-rosa} or OpenShift Dedicated with CCO (recommended for {producty})*: Set the IAM role ARN on the Operator subscription and configure `S3Storage` without static keys. See link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator].

‎modules/configuring-quay-rosa-aws-sts.adoc‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,12 @@
33
= Configuring {productname} on {product-rosa} to use AWS STS
44

55
[role="_abstract"]
6-
To configure your {productname} deployment on {product-rosa} to use AWS STS for S3 authentication, you can update the IAM role trust policy to use federated identity, configure the `config.yaml` file, and annotate the service account with the role ARN.
6+
To configure your {productname} deployment on {product-rosa} to use AWS STS for S3 authentication, you can update the IAM role trust policy to use federated identity, configure the `config.yaml` file, and annotate the service account with the role ARN.
7+
8+
[NOTE]
9+
====
10+
For {productname} {producty} on STS-enforced clusters, Red Hat recommends link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator], which uses the Cloud Credential Operator instead of manual service account annotations.
11+
====
712

813
This procedure enables web identity federation for temporary credential authentication.
914

‎modules/configuring-quay-sts-cco-s3-storage.adoc‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
:_mod-docs-content-type: PROCEDURE
2+
[id="configuring-quay-sts-cco-s3-storage"]
3+
= Configuring AWS S3 storage with STS and the Cloud Credential Operator
4+
5+
[role="_abstract"]
6+
On STS-enabled {ocp} clusters on AWS, including {product-rosa} and Red Hat OpenShift Dedicated, you can configure {productname-ocp} to use your own S3 bucket without static AWS access keys. Set the IAM role ARN on the {productname} Operator subscription, set `objectstorage` to `unmanaged`, and configure `S3Storage` in the config bundle without `s3_access_key` or `s3_secret_key`. The Operator creates a Cloud Credential Operator (CCO) `CredentialRequest` and mounts short-lived credentials into the `quay-app` pods.
7+
8+
[NOTE]
9+
====
10+
This procedure requires {ocp} 4.14 or later on AWS with CCO in STS-compatible mode. It applies only when `objectstorage` is `unmanaged`. If `ROLEARN` is not set on the Operator subscription, existing installations are unchanged.
11+
====
12+
13+
.Prerequisites
14+
15+
* An STS-enabled AWS cluster ({product-rosa}, OpenShift Dedicated, or self-managed {ocp} on AWS).
16+
* An IAM role with an OIDC trust policy for the `quay-app` service account and permissions to access your S3 bucket.
17+
* A `QuayRegistry` with `objectstorage` set to `unmanaged`.
18+
* Cluster administrator access to install the Operator and edit the `configBundleSecret`.
19+
20+
.Procedure
21+
22+
. Get the cluster `serviceAccountIssuer` value:
23+
+
24+
[source,terminal]
25+
----
26+
$ oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed -e 's|^https://||'
27+
----
28+
+
29+
.Example output
30+
[source,terminal]
31+
----
32+
oidc.op1.openshiftapps.com/1234567890
33+
----
34+
35+
. Create or update the IAM role trust policy so the `quay-app` service account can assume the role. Replace the account ID, OIDC provider path, namespace, and registry name with your values:
36+
+
37+
[source,json]
38+
----
39+
{
40+
"Version": "2012-10-17",
41+
"Statement": [
42+
{
43+
"Effect": "Allow",
44+
"Principal": {
45+
"Federated": "arn:aws:iam::<aws_account_id>:oidc-provider/<serviceAccountIssuer>"
46+
},
47+
"Action": "sts:AssumeRoleWithWebIdentity",
48+
"Condition": {
49+
"StringEquals": {
50+
"<serviceAccountIssuer>:sub": "system:serviceaccount:<quay_namespace>:<registry_name>-quay-app"
51+
}
52+
}
53+
}
54+
]
55+
}
56+
----
57+
58+
. Attach an IAM policy that grants the S3 permissions required by {productname}, including `s3:GetObject`, `s3:PutObject`, `s3:DeleteObject`, `s3:ListBucket`, `s3:GetBucketLocation`, `s3:ListBucketMultipartUploads`, `s3:AbortMultipartUpload`, and `s3:ListMultipartUploadParts`.
59+
60+
. Install or upgrade the {productname} Operator and set the **Role ARN** field to your IAM role ARN. The Operator exposes this field when AWS token authentication is enabled on the cluster. Alternatively, set the `ROLEARN` environment variable on the Operator subscription.
61+
62+
. Configure your `QuayRegistry` with unmanaged object storage:
63+
+
64+
[source,yaml]
65+
----
66+
apiVersion: quay.redhat.com/v1
67+
kind: QuayRegistry
68+
metadata:
69+
name: <registry_name>
70+
namespace: <quay_namespace>
71+
spec:
72+
components:
73+
- kind: objectstorage
74+
managed: false
75+
configBundleSecret: <config_bundle_secret_name>
76+
----
77+
78+
. Update the `config.yaml` file in your `configBundleSecret` to use `S3Storage` without static credentials:
79+
+
80+
[source,yaml]
81+
----
82+
# ...
83+
DISTRIBUTED_STORAGE_CONFIG:
84+
default:
85+
- S3Storage
86+
- host: s3.<region>.amazonaws.com
87+
s3_bucket: <s3_bucket_name>
88+
s3_region: <region>
89+
storage_path: /datastorage/registry
90+
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
91+
DISTRIBUTED_STORAGE_PREFERENCE:
92+
- default
93+
# ...
94+
----
95+
+
96+
[IMPORTANT]
97+
====
98+
Do not set `s3_access_key` or `s3_secret_key` in the config bundle when using the Operator STS path. If static AWS keys are present while `ROLEARN` is set, the Operator sets `RolloutBlocked` with reason `ConflictingCredentials`.
99+
====
100+
101+
. Wait for the Operator to create and provision the CCO `CredentialRequest`. Verify the request and secret:
102+
+
103+
[source,terminal]
104+
----
105+
$ oc get credentialsrequest -n <quay_namespace>
106+
$ oc get secret <registry_name>-quay-app-aws -n <quay_namespace>
107+
----
108+
109+
. Verify the `QuayRegistry` is available and not blocked:
110+
+
111+
[source,terminal]
112+
----
113+
$ oc get quayregistry <registry_name> -n <quay_namespace> -o jsonpath='{.status.conditions[?(@.type=="Available")].status}{"\n"}'
114+
----
115+
116+
. Push and pull an image to confirm S3 access through STS credentials.
117+
118+
[id="sts-cco-troubleshooting"]
119+
== Troubleshooting
120+
121+
If rollout is blocked, check `QuayRegistry` conditions:
122+
123+
* `CredentialRequestNotProvisioned` — CCO has not yet provisioned credentials, or the IAM role or trust policy is misconfigured. Verify the `CredentialRequest` status and IAM role configuration.
124+
* `ConflictingCredentials` — Remove `s3_access_key` and `s3_secret_key` from `DISTRIBUTED_STORAGE_CONFIG` in the config bundle.
125+
126+
[role="_additional-resources"]
127+
.Additional resources
128+
129+
* link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/configure_red_hat_quay/index#config-fields-storage-aws-sts-cco[AWS S3 storage with Operator STS and CCO]
130+
* link:https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/authentication_and_authorization/assuming-an-aws-iam-role-for-a-service-account[Assuming an AWS IAM role for a service account on {product-rosa}]

‎modules/new-features-and-enhancements-quay-ocp-318.adoc‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,13 @@
44

55
The following updates have been made to {productname-ocp}.
66

7-
[id="example_one"]
8-
== Example one
7+
[id="operator-sts-cco-unmanaged-s3"]
8+
== AWS STS authentication for unmanaged S3 storage on {product-rosa} and OpenShift Dedicated
9+
10+
The {productname} Operator integrates with the {ocp} Cloud Credential Operator (CCO) so that `quay-app` pods can authenticate to AWS S3 without static access keys when `objectstorage` is set to `unmanaged`. This supports STS-enforced clusters, including {product-rosa} and OpenShift Dedicated, where IAM-role-only policies prohibit long-lived credentials.
11+
12+
When you set the IAM role ARN on the Operator subscription (`ROLEARN`), the Operator detects STS-capable AWS clusters, creates a `CredentialRequest`, and mounts CCO-provisioned credentials into `quay-app` pods. Configure `S3Storage` in the config bundle with bucket and region details only — do not include `s3_access_key` or `s3_secret_key`.
13+
14+
If `ROLEARN` is not set, existing installations are unchanged. The Operator blocks rollout with actionable conditions when credentials conflict or CCO provisioning fails.
15+
16+
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator].

‎modules/new-quay-config-fields-318.adoc‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,13 @@
22
[id="new-quay-config-fields-318"]
33
= {productname} configuration fields updates and changes
44

5-
The following configuration fields have been added to {productname} 3.18.
5+
The following configuration fields have been added or changed in {productname} 3.18.
6+
7+
[id="s3storage-sts-cco-no-static-keys"]
8+
== S3Storage configuration without static AWS keys on {productname-ocp}
9+
10+
When you use the Operator STS and CCO integration on STS-enabled AWS clusters, configure `DISTRIBUTED_STORAGE_CONFIG` with the `S3Storage` driver and omit `s3_access_key` and `s3_secret_key`. The Operator supplies credentials through the CCO-provisioned secret mounted at `/var/run/secrets/cloud/credentials`.
11+
12+
This differs from the `STSS3Storage` driver used with static IAM user keys in standalone or generic {ocp} deployments. Do not combine static AWS keys in the config bundle with the Operator `ROLEARN` setting.
13+
14+
For configuration steps, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/configure_red_hat_quay/index#config-fields-storage-aws-sts-cco[AWS S3 storage with Operator STS and CCO] and link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_operator_features/index#configuring-quay-sts-cco-s3-storage[Configuring AWS S3 storage with STS and the Cloud Credential Operator].

‎red_hat_quay_operator_features/master.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ include::modules/configuring-aws-sts-quay.adoc[leveloffset=+1]
100100
include::modules/creating-iam-user-aws-sts-quay.adoc[leveloffset=+2]
101101
include::modules/creating-s3-role-aws-sts.adoc[leveloffset=+2]
102102

103+
include::modules/configuring-quay-sts-cco-s3-storage.adoc[leveloffset=+2]
103104
include::modules/configuring-quay-ocp-aws-sts.adoc[leveloffset=+2]
104105
include::modules/configuring-quay-rosa-aws-sts.adoc[leveloffset=+2]
105106

0 commit comments

Comments
 (0)