Skip to content

Commit 112ff48

Browse files
xenolinuxxenolinux
authored
Merge pull request #102524 from xenolinux/complete-pr-95504
OSDOCS#14994: Minor SSCSI fixes from Ashwini's PR
2 parents f69f92f + 2502edd commit 112ff48

File tree

5 files changed

+91
-87
lines changed

5 files changed

+91
-87
lines changed

‎modules/secrets-store-aws.adoc‎

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,22 +15,22 @@ endif::[]
1515
[id="secrets-store-aws_{context}"]
1616
= Mounting secrets from {secrets-store-provider}
1717

18-
You can use the {secrets-store-operator} to mount secrets from {secrets-store-provider} to a Container Storage Interface (CSI) volume in {product-title}. To mount secrets from {secrets-store-provider}, your cluster must be installed on AWS and use AWS Security Token Service (STS).
18+
You can use the {secrets-store-operator} to mount secrets from {secrets-store-provider} external secrets store to a Container Storage Interface (CSI) volume in {product-title}.
1919

2020
.Prerequisites
2121

22-
* Your cluster is installed on AWS and uses AWS Security Token Service (STS).
23-
* You installed the {secrets-store-operator}. See _Installing the {secrets-store-driver}_ for instructions.
24-
* You configured {secrets-store-provider} to store the required secrets.
25-
* You extracted and prepared the `ccoctl` binary.
26-
* You installed the `jq` CLI tool.
2722
* You have access to the cluster as a user with the `cluster-admin` role.
23+
* You have installed the `jq` tool.
24+
* You have extracted and prepared the `ccoctl` utility.
25+
* You have installed the cluster on {aws-first} and the cluster uses {aws-short} Security Token Service (STS).
26+
* You have installed the {secrets-store-operator}. For more information, see "Installing the {secrets-store-driver}".
27+
* You have configured {secrets-store-provider} to store the required secrets.
2828
2929
.Procedure
3030

3131
. Install the {secrets-store-provider} provider:
3232

33-
.. Create a YAML file with the following configuration for the provider resources:
33+
.. Create a YAML file by using the following example configuration:
3434
+
3535
[IMPORTANT]
3636
====
@@ -148,24 +148,23 @@ $ oc adm policy add-scc-to-user privileged -z csi-secrets-store-provider-aws -n
148148
$ oc apply -f aws-provider.yaml
149149
----
150150

151-
. Grant permission to allow the service account to read the AWS secret object:
151+
. Grant the read permission to the service account for the AWS secret object:
152152

153153
.. Create a directory to contain the credentials request by running the following command:
154154
+
155155
[source,terminal]
156156
----
157-
$ mkdir credentialsrequest-dir-aws
157+
$ mkdir <aws_creds_directory_name>
158158
----
159159

160-
.. Create a YAML file with the following configuration for the credentials request:
160+
.. Create a YAML file that defines the `CredentialsRequest` resource configuration. See the following example configuration:
161161
+
162-
.Example `credentialsrequest.yaml` file
163162
[source,yaml]
164163
----
165164
apiVersion: cloudcredential.openshift.io/v1
166165
kind: CredentialsRequest
167166
metadata:
168-
name: aws-provider-test
167+
name: aws-creds-request
169168
namespace: openshift-cloud-credential-operator
170169
spec:
171170
providerSpec:
@@ -191,10 +190,10 @@ endif::aws-systems-manager-parameter-store[]
191190
name: aws-creds
192191
namespace: my-namespace
193192
serviceAccountNames:
194-
- aws-provider
193+
- <service_account_name>
195194
----
196195

197-
.. Retrieve the OIDC provider by running the following command:
196+
.. Retrieve the OpenID Connect (OIDC) provider by running the following command:
198197
+
199198
[source,terminal]
200199
----
@@ -214,8 +213,8 @@ Copy the OIDC provider name `<oidc_provider_name>` from the output to use in the
214213
----
215214
$ ccoctl aws create-iam-roles \
216215
--name my-role --region=<aws_region> \
217-
--credentials-requests-dir=credentialsrequest-dir-aws \
218-
--identity-provider-arn arn:aws:iam::<aws_account>:oidc-provider/<oidc_provider_name> --output-dir=credrequests-ccoctl-output
216+
--credentials-requests-dir=<aws_creds_dir_name> \
217+
--identity-provider-arn arn:aws:iam::<aws_account_id>:oidc-provider/<oidc_provider_name> --output-dir=<output_dir_name>
219218
----
220219
+
221220
.Example output

‎modules/secrets-store-azure.adoc‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -4,29 +4,29 @@
44

55
:_mod-docs-content-type: PROCEDURE
66
[id="secrets-store-azure_{context}"]
7-
= Mounting secrets from Azure Key Vault
7+
= Mounting secrets from {azure-short} Key Vault
88

9-
You can use the {secrets-store-operator} to mount secrets from Azure Key Vault to a Container Storage Interface (CSI) volume in {product-title}. To mount secrets from Azure Key Vault, your cluster must be installed on Microsoft Azure.
9+
You can use the {secrets-store-operator} to mount secrets from {azure-first} Key Vault to a Container Storage Interface (CSI) volume in {product-title}. To mount secrets from {azure-short} Key Vault.
1010

1111
.Prerequisites
1212

13-
* Your cluster is installed on Azure.
14-
* You installed the {secrets-store-operator}. See _Installing the {secrets-store-driver}_ for instructions.
15-
* You configured Azure Key Vault to store the required secrets.
16-
* You installed the Azure CLI (`az`).
13+
* Your have installed a cluster on {azure-short}.
1714
* You have access to the cluster as a user with the `cluster-admin` role.
15+
* You have installed the {azure-short} CLI (`az`).
16+
* You have installed the {secrets-store-operator}. See "Installing the {secrets-store-driver}" for instructions.
17+
* You have configured {azure-short} Key Vault to store the required secrets.
1818
1919
.Procedure
2020

21-
. Install the Azure Key Vault provider:
21+
. Install the {azure-short} Key Vault provider:
2222

23-
.. Create a YAML file with the following configuration for the provider resources:
23+
.. Create a YAML file named `azure-provider.yaml` that defines the `ServiceAccount` resource configuration. See the following example configuration:
2424
+
2525
[IMPORTANT]
2626
====
27-
The Azure Key Vault provider for the {secrets-store-driver} is an upstream provider.
27+
The {azure-short} Key Vault provider for the {secrets-store-driver} is an upstream provider.
2828
29-
This configuration is modified from the configuration provided in the upstream link:https://azure.github.io/secrets-store-csi-driver-provider-azure/docs/getting-started/installation/[Azure documentation] so that it works properly with {product-title}. Changes to this configuration might impact functionality.
29+
This configuration is modified from the configuration provided in the upstream link:https://azure.github.io/secrets-store-csi-driver-provider-azure/docs/getting-started/installation/[{azure-short} documentation] so that it works properly with {product-title}. Changes to this configuration might impact functionality.
3030
====
3131
+
3232
.Example `azure-provider.yaml` file
@@ -197,11 +197,11 @@ $ oc -n my-namespace label secret secrets-store-creds secrets-store.csi.k8s.io/u
197197
apiVersion: secrets-store.csi.x-k8s.io/v1
198198
kind: SecretProviderClass
199199
metadata:
200-
name: my-azure-provider <1>
201-
namespace: my-namespace <2>
200+
name: my-azure-provider #<1>
201+
namespace: my-namespace #<2>
202202
spec:
203-
provider: azure <3>
204-
parameters: <4>
203+
provider: azure #<3>
204+
parameters: #<4>
205205
usePodIdentity: "false"
206206
useVMManagedIdentity: "false"
207207
userAssignedIdentityID: ""
@@ -235,8 +235,8 @@ $ oc create -f secret-provider-class-azure.yaml
235235
apiVersion: apps/v1
236236
kind: Deployment
237237
metadata:
238-
name: my-azure-deployment <1>
239-
namespace: my-namespace <2>
238+
name: my-azure-deployment #<1>
239+
namespace: my-namespace #<2>
240240
spec:
241241
replicas: 1
242242
selector:
@@ -263,14 +263,14 @@ spec:
263263
driver: secrets-store.csi.k8s.io
264264
readOnly: true
265265
volumeAttributes:
266-
secretProviderClass: "my-azure-provider" <3>
266+
secretProviderClass: "my-azure-provider" #<3>
267267
nodePublishSecretRef:
268-
name: secrets-store-creds <4>
268+
name: secrets-store-creds #<4>
269269
----
270270
<1> Specify the name for the deployment.
271271
<2> Specify the namespace for the deployment. This must be the same namespace as the secret provider class.
272272
<3> Specify the name of the secret provider class.
273-
<4> Specify the name of the Kubernetes secret that contains the service principal credentials to access Azure Key Vault.
273+
<4> Specify the name of the Kubernetes secret that contains the service principal credentials to access {azure-short} Key Vault.
274274

275275
.. Create the `Deployment` object by running the following command:
276276
+
@@ -281,7 +281,7 @@ $ oc create -f deployment.yaml
281281

282282
.Verification
283283

284-
* Verify that you can access the secrets from Azure Key Vault in the pod volume mount:
284+
* Verify that you can access the secrets from {azure-short} Key Vault in the pod volume mount:
285285
286286
.. List the secrets in the pod mount by running the following command:
287287
+

‎modules/secrets-store-google.adoc‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,16 @@ You can use the {secrets-store-operator} to mount secrets from Google Secret Man
1010

1111
.Prerequisites
1212

13-
* You installed the {secrets-store-operator}. See _Installing the {secrets-store-driver}_ for instructions.
14-
* You configured Google Secret Manager to store the required secrets.
15-
* You created a service account key named `key.json` from your {gcp-full} service account.
1613
* You have access to the cluster as a user with the `cluster-admin` role.
14+
* You have installed the {secrets-store-operator}. See "Installing the {secrets-store-driver}" for instructions.
15+
* You have configured Google Secret Manager to store the required secrets.
16+
* You have created a service account key named `key.json` from your {gcp-full} service account.
1717
1818
.Procedure
1919

2020
. Install the Google Secret Manager provider:
2121

22-
.. Create a YAML file with the following configuration for the provider resources:
22+
.. Create a YAML file Create a YAML file named `gcp-provider.yaml` that defines the `ServiceAccount` resource configuration. See the following example configuration:
2323
+
2424
.Example `gcp-provider.yaml` file
2525
[source,yaml]
@@ -151,7 +151,7 @@ $ oc adm policy add-scc-to-user privileged -z csi-secrets-store-provider-gcp -n
151151
$ oc apply -f gcp-provider.yaml
152152
----
153153

154-
. Grant permission to read the Google Secret Manager secret:
154+
. Grant a read permission to the Google Secret Manager secret:
155155

156156
.. Create a new project by running the following command:
157157
+

‎modules/secrets-store-vault.adoc‎

Lines changed: 46 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ Other cloud providers might work, but have not been tested yet. Additional cloud
2020

2121
.Prerequisites
2222

23-
* You installed the {secrets-store-operator}. See _Installing the {secrets-store-driver}_ for instructions.
24-
* You installed Helm.
2523
* You have access to the cluster as a user with the `cluster-admin` role.
24+
* You have installed the {secrets-store-operator}. See "Installing the {secrets-store-driver}" for instructions.
25+
* You have installed Helm.
2626
2727
.Procedure
2828

@@ -228,42 +228,6 @@ $ oc exec -i vault-0 --namespace=vault -- vault write auth/kubernetes/role/csi \
228228
Success! Data written to: auth/kubernetes/role/csi
229229
----
230230

231-
.. Verify that all of the `vault` pods are running properly by running the following command:
232-
+
233-
[source,terminal]
234-
----
235-
$ oc get pods -n vault
236-
----
237-
+
238-
.Example output
239-
[source,terminal]
240-
----
241-
NAME READY STATUS RESTARTS AGE
242-
vault-0 1/1 Running 0 43m
243-
vault-csi-provider-87rgw 2/2 Running 0 19m
244-
vault-csi-provider-bd6hp 2/2 Running 0 19m
245-
vault-csi-provider-smlv7 2/2 Running 0 19m
246-
----
247-
248-
.. Verify that all of the `secrets-store-csi-driver` pods are running properly by running the following command:
249-
+
250-
[source,terminal]
251-
----
252-
$ oc get pods -n openshift-cluster-csi-drivers | grep -E "secrets"
253-
----
254-
+
255-
.Example output
256-
[source,terminal]
257-
----
258-
secrets-store-csi-driver-node-46d2g 3/3 Running 0 45m
259-
secrets-store-csi-driver-node-d2jjn 3/3 Running 0 45m
260-
secrets-store-csi-driver-node-drmt4 3/3 Running 0 45m
261-
secrets-store-csi-driver-node-j2wlt 3/3 Running 0 45m
262-
secrets-store-csi-driver-node-v9xv4 3/3 Running 0 45m
263-
secrets-store-csi-driver-node-vlz28 3/3 Running 0 45m
264-
secrets-store-csi-driver-operator-84bd699478-fpxrw 1/1 Running 0 47m
265-
----
266-
267231
. Create a secret provider class to define your secrets store provider:
268232

269233
.. Create a YAML file that defines the `SecretProviderClass` object:
@@ -274,11 +238,11 @@ secrets-store-csi-driver-operator-84bd699478-fpxrw 1/1 Running 0
274238
apiVersion: secrets-store.csi.x-k8s.io/v1
275239
kind: SecretProviderClass
276240
metadata:
277-
name: my-vault-provider <1>
278-
namespace: my-namespace <2>
241+
name: my-vault-provider #<1>
242+
namespace: my-namespace #<2>
279243
spec:
280-
provider: vault <3>
281-
parameters: <4>
244+
provider: vault #<3>
245+
parameters: #<4>
282246
roleName: "csi"
283247
vaultAddress: "http://vault.vault:8200"
284248
objects: |
@@ -308,8 +272,8 @@ $ oc create -f secret-provider-class-vault.yaml
308272
apiVersion: apps/v1
309273
kind: Deployment
310274
metadata:
311-
name: busybox-deployment <1>
312-
namespace: my-namespace <2>
275+
name: busybox-deployment #<1>
276+
namespace: my-namespace #<2>
313277
labels:
314278
app: busybox
315279
spec:
@@ -340,7 +304,7 @@ spec:
340304
driver: secrets-store.csi.k8s.io
341305
readOnly: true
342306
volumeAttributes:
343-
secretProviderClass: "my-vault-provider" <3>
307+
secretProviderClass: "my-vault-provider" #<3>
344308
----
345309
<1> Specify the name for the deployment.
346310
<2> Specify the namespace for the deployment. This must be the same namespace as the secret provider class.
@@ -355,7 +319,43 @@ $ oc create -f deployment.yaml
355319

356320
.Verification
357321

358-
* Verify that you can access the secrets from your HashiCorp Vault in the pod volume mount:
322+
.. Verify that all of the `vault` pods are running properly by running the following command:
323+
+
324+
[source,terminal]
325+
----
326+
$ oc get pods -n vault
327+
----
328+
+
329+
.Example output
330+
[source,terminal]
331+
----
332+
NAME READY STATUS RESTARTS AGE
333+
vault-0 1/1 Running 0 43m
334+
vault-csi-provider-87rgw 2/2 Running 0 19m
335+
vault-csi-provider-bd6hp 2/2 Running 0 19m
336+
vault-csi-provider-smlv7 2/2 Running 0 19m
337+
----
338+
339+
.. Verify that all of the `secrets-store-csi-driver` pods are running by running the following command:
340+
+
341+
[source,terminal]
342+
----
343+
$ oc get pods -n openshift-cluster-csi-drivers | grep -E "secrets"
344+
----
345+
+
346+
.Example output
347+
[source,terminal]
348+
----
349+
secrets-store-csi-driver-node-46d2g 3/3 Running 0 45m
350+
secrets-store-csi-driver-node-d2jjn 3/3 Running 0 45m
351+
secrets-store-csi-driver-node-drmt4 3/3 Running 0 45m
352+
secrets-store-csi-driver-node-j2wlt 3/3 Running 0 45m
353+
secrets-store-csi-driver-node-v9xv4 3/3 Running 0 45m
354+
secrets-store-csi-driver-node-vlz28 3/3 Running 0 45m
355+
secrets-store-csi-driver-operator-84bd699478-fpxrw 1/1 Running 0 47m
356+
----
357+
358+
. Verify that you can access the secrets from your HashiCorp Vault in the pod volume mount:
359359

360360
.. List the secrets in the pod mount by running the following command:
361361
+

‎nodes/pods/nodes-pods-secrets-store.adoc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,11 @@ include::modules/secrets-store-google.adoc[leveloffset=+2]
6868
// Mounting secrets from HashiCorp Vault
6969
include::modules/secrets-store-vault.adoc[leveloffset=+2]
7070

71+
[role="_additional-resources"]
72+
.Additional resources
73+
74+
* xref:../../applications/working_with_helm_charts/installing-helm.adoc#installing-helm[Installing Helm]
75+
7176
// Enabling synchronization of mounted content as Kubernetes secrets
7277
include::modules/secrets-store-sync-secrets.adoc[leveloffset=+1]
7378

0 commit comments

Comments
 (0)