@@ -12,7 +12,6 @@ CAPA controller requires service account credentials to be able to provision ROS
12
12
--from-literal=ocmClientSecret=' eyJhbGciOiJIUzI1NiIsI....' \
13
13
--from-literal=ocmApiUrl=' https://api.openshift.com'
14
14
```
15
-
16
15
Note: to consume the secret without the need to reference it from your ` ROSAControlPlane` , name your secret as ` rosa-creds-secret` and create it in the CAPA manager namespace (usually ` capa-system` )
17
16
` ` ` shell
18
17
kubectl -n capa-system create secret generic rosa-creds-secret \
@@ -28,56 +27,54 @@ The SSO offline token is being deprecated and it is recommended to use service a
28
27
1. Visit https://console.redhat.com/openshift/token to retrieve your SSO offline authentication token
29
28
30
29
1. Create a credentials secret within the target namespace with the token to be referenced later by ` ROSAControlePlane`
31
- ` ` ` shell
32
- kubectl create secret generic rosa-creds-secret \
33
- --from-literal=ocmToken=' eyJhbGciOiJIUzI1NiIsI....' \
34
- --from-literal=ocmApiUrl=' https://api.openshift.com'
30
+ ` ` ` shell
31
+ kubectl create secret generic rosa-creds-secret \
32
+ --from-literal=ocmToken=' eyJhbGciOiJIUzI1NiIsI....' \
33
+ --from-literal=ocmApiUrl=' https://api.openshift.com'
34
+ ` ` `
35
+ Alternatively, you can edit the CAPA controller deployment to provide the credentials
36
+ ` ` ` shell
37
+ kubectl edit deployment -n capa-system capa-controller-manager
38
+ ` ` `
39
+ and add the following environment variables to the manager container
40
+ ` ` ` yaml
41
+ env:
42
+ - name: OCM_TOKEN
43
+ value: " <token>"
44
+ - name: OCM_API_URL
45
+ value: " https://api.openshift.com" # or https://api.stage.openshift.com
35
46
` ` `
36
-
37
- Alternatively, you can edit CAPA controller deployment to provide the credentials
38
- ` ` ` shell
39
- kubectl edit deployment -n capa-system capa-controller-manager
40
- ` ` `
41
- and add the following environment variables to the manager container
42
- ` ` ` yaml
43
- env:
44
- - name: OCM_TOKEN
45
- value: " <token>"
46
- - name: OCM_API_URL
47
- value: " https://api.openshift.com" # or https://api.stage.openshift.com
48
- ` ` `
49
47
50
48
# ## Migration from offline token to service account authentication
51
49
52
50
1. Visit [https://console.redhat.com/iam/service-accounts](https://console.redhat.com/iam/service-accounts) and create a new service account.
53
51
54
52
1. If you previously used kubernetes secret to specify the OCM credentials secret, edit the secret:
55
- ` ` ` shell
56
- kubectl edit secret rosa-creds-secret
57
- ` ` `
58
- where you will remove the ` ocmToken` credentials and add base64 encoded ` ocmClientID` and ` ocmClientSecret` credentials like so:
59
- ` ` ` yaml
60
- apiVersion: v1
61
- data:
62
- ocmApiUrl: aHR0cHM6Ly9hcGkub3BlbnNoaWZ0LmNvbQ==
63
- ocmClientID: Y2xpZW50X2lk...
64
- ocmClientSecret: Y2xpZW50X3NlY3JldA==...
65
- kind: Secret
66
- type: Opaque
67
- ` ` `
68
-
69
- 1. If you previously used capa manager deployment to specify the OCM offline token as environment variable, edit the manager deployment:
70
- ` ` ` shell
71
- kubectl -n capa-system edit deployment capa-controller-manager
72
- ` ` `
73
- and remove the ` OCM_TOKEN` and ` OCM_API_URL` variables, followed by ` kubectl -n capa-system rollout restart deploy capa-controller-manager` . Then create the new default
74
- secret in the ` capa-system` namespace with:
75
- ` ` ` shell
76
- kubectl -n capa-system create secret generic rosa-creds-secret \
77
- --from-literal=ocmClientID=' ....' \
78
- --from-literal=ocmClientSecret=' eyJhbGciOiJIUzI1NiIsI....' \
79
- --from-literal=ocmApiUrl=' https://api.openshift.com'
80
- ` ` `
53
+ ` ` ` shell
54
+ kubectl edit secret rosa-creds-secret
55
+ ` ` `
56
+ where you will remove the ` ocmToken` credentials and add base64 encoded ` ocmClientID` and ` ocmClientSecret` credentials like so:
57
+ ` ` ` yaml
58
+ apiVersion: v1
59
+ data:
60
+ ocmApiUrl: aHR0cHM6Ly9hcGkub3BlbnNoaWZ0LmNvbQ==
61
+ ocmClientID: Y2xpZW50X2lk...
62
+ ocmClientSecret: Y2xpZW50X3NlY3JldA==...
63
+ kind: Secret
64
+ type: Opaque
65
+ ` ` `
66
+
67
+ 1. If you previously used capa manager deployment to specify the OCM offline token as environment variable, edit the manager deployment
68
+ ` ` ` shell
69
+ kubectl -n capa-system edit deployment capa-controller-manager
70
+ ` ` `
71
+ and remove the ` OCM_TOKEN` and ` OCM_API_URL` variables, followed by ` kubectl -n capa-system rollout restart deploy capa-controller-manager` . Then create the new default secret in the ` capa-system` namespace with
72
+ ` ` ` shell
73
+ kubectl -n capa-system create secret generic rosa-creds-secret \
74
+ --from-literal=ocmClientID=' ....' \
75
+ --from-literal=ocmClientSecret=' eyJhbGciOiJIUzI1NiIsI....' \
76
+ --from-literal=ocmApiUrl=' https://api.openshift.com'
77
+ ` ` `
81
78
82
79
# # Prerequisites
83
80
@@ -108,7 +105,7 @@ Once Step 3 is done, you will be ready to proceed with creating a ROSA cluster u
108
105
` ` ` shell
109
106
clusterctl generate cluster < cluster-name> --from templates/cluster-template-rosa.yaml > rosa-capi-cluster.yaml
110
107
` ` `
111
- Note: The AWS role name must be no more than 64 characters in length. Otherwise an error will be returned. Truncate values exceeding 64 characters.
108
+ Note: The AWS role name must be no more than 64 characters in length. Otherwise an error will be returned. Truncate values exceeding 64 characters.
112
109
113
110
1. If a credentials secret was created earlier, edit ` ROSAControlPlane` to reference it:
114
111
` ` ` yaml
0 commit comments