diff --git a/hcp/karpenter_iam_role_misconfigured.json b/hcp/karpenter_iam_role_misconfigured.json new file mode 100644 index 0000000..a9656c1 --- /dev/null +++ b/hcp/karpenter_iam_role_misconfigured.json @@ -0,0 +1,11 @@ +{ + "severity": "Critical", + "service_name": "SREManualAction", + "log_type": "cluster-configuration", + "summary": "Action required: Fix Karpenter operator IAM role configuration", + "description": "Your ROSA HCP cluster requires you to take action because the Karpenter operator IAM role is misconfigured in AWS, preventing the Karpenter component from functioning correctly. The Karpenter pod is unable to assume its IAM role via STS AssumeRoleWithWebIdentity, resulting in access denied errors. Please verify the Karpenter operator role's trust policy allows the cluster's OIDC provider to assume the role, and ensure the permissions policy matches the required policy for ROSA HCP operator roles. Review the documentation on configuring operator IAM roles and OIDC trust relationships: https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/install_rosa_with_hcp_clusters/rosa-hcp-sts-creating-a-cluster-quickly#rosa-sts-creating-operator-roles-and-policies_rosa-hcp-sts-creating-a-cluster-quickly.", + "doc_references": [ + "https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/install_rosa_with_hcp_clusters/rosa-hcp-sts-creating-a-cluster-quickly#rosa-sts-creating-operator-roles-and-policies_rosa-hcp-sts-creating-a-cluster-quickly" + ], + "internal_only": false +}