Creating the required Alibaba Cloud resources

Before you install OKD, you must use the Alibaba Cloud console to create a Resource Access Management (RAM) user that has sufficient permissions to install OKD into your Alibaba Cloud. This user must also have permissions to create new RAM users. You can also configure and use the ccoctl tool to create new credentials for the OKD components with the permissions that they require.

Alibaba Cloud on OKD is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see https://access.redhat.com/support/offerings/techpreview/.

Creating the required RAM user

You must have a Alibaba Cloud Resource Access Management (RAM) user for the installation that has sufficient privileges. You can use the Alibaba Cloud Resource Access Management console to create a new user or modify an existing user. Later, you create credentials in OKD based on this user’s permissions.

When you configure the RAM user, be sure to consider the following requirements:

  • The user must have an Alibaba Cloud AccessKey ID and AccessKey secret pair.

    • For a new user, you can select Open API Access for the Access Mode when creating the user. This mode generates the required AccessKey pair.

    • For an existing user, you can add an AccessKey pair or you can obtain the AccessKey pair for that user.

      When created, the AccessKey secret is displayed only once. You must immediately save the AccessKey pair because the AccessKey pair is required for API calls.

  • Add the AccessKey ID and secret to the ~/.alibabacloud/credentials file on your local computer. Alibaba Cloud automatically creates this file when you log in to the console. The Cloud Credential Operator (CCO) utility, ccoutil, uses these credentials when processing Credential Request objects.

    For example:

    1. [default]                          # Default client
    2. type = access_key                  # Certification type: access_key
    3. access_key_id = LTAI5t8cefXKmt                # Key (1)
    4. access_key_secret = wYx56mszAN4Uunfh            # Secret
    1Add your AccessKeyID and AccessKeySecret here.

  • The RAM user must have the AdministratorAccess policy to ensure that the account has sufficient permission to create the OKD cluster. This policy grants permissions to manage all Alibaba Cloud resources.

    When you attach the AdministratorAccess policy to a RAM user, you grant that user full access to all Alibaba Cloud services and resources. If you do not want to create a user with full access, create a custom policy with the following actions that you can add to your RAM user for installation. These actions are sufficient to install OKD.

    You can copy and paste the following JSON code into the Alibaba Cloud console to create a custom poicy. For information on creating custom policies, see Create a custom policy in the Alibaba Cloud documentation.

    Example custom policy JSON file

    1. {
    2.   "Version": "1",
    3.   "Statement": [
    4.     {
    5.       "Action": [
    6.         "tag:ListTagResources",
    7.         "tag:UntagResources"
    8.       ],
    9.       "Resource": "*",
    10.       "Effect": "Allow"
    11.     },
    12.     {
    13.       "Action": [
    14.         "vpc:DescribeVpcs",
    15.         "vpc:DeleteVpc",
    16.         "vpc:DescribeVSwitches",
    17.         "vpc:DeleteVSwitch",
    18.         "vpc:DescribeEipAddresses",
    19.         "vpc:DescribeNatGateways",
    20.         "vpc:ReleaseEipAddress",
    21.         "vpc:DeleteNatGateway",
    22.         "vpc:DescribeSnatTableEntries",
    23.         "vpc:CreateSnatEntry",
    24.         "vpc:AssociateEipAddress",
    25.         "vpc:ListTagResources",
    26.         "vpc:TagResources",
    27.         "vpc:DescribeVSwitchAttributes",
    28.         "vpc:CreateVSwitch",
    29.         "vpc:CreateNatGateway",
    30.         "vpc:DescribeRouteTableList",
    31.         "vpc:CreateVpc",
    32.         "vpc:AllocateEipAddress",
    33.         "vpc:ListEnhanhcedNatGatewayAvailableZones"
    34.       ],
    35.       "Resource": "*",
    36.       "Effect": "Allow"
    37.     },
    38.     {
    39.       "Action": [
    40.         "ecs:ModifyInstanceAttribute",
    41.         "ecs:DescribeSecurityGroups",
    42.         "ecs:DeleteSecurityGroup",
    43.         "ecs:DescribeSecurityGroupReferences",
    44.         "ecs:DescribeSecurityGroupAttribute",
    45.         "ecs:RevokeSecurityGroup",
    46.         "ecs:DescribeInstances",
    47.         "ecs:DeleteInstances",
    48.         "ecs:DescribeNetworkInterfaces",
    49.         "ecs:DescribeInstanceRamRole",
    50.         "ecs:DescribeUserData",
    51.         "ecs:DescribeDisks",
    52.         "ecs:ListTagResources",
    53.         "ecs:AuthorizeSecurityGroup",
    54.         "ecs:RunInstances",
    55.         "ecs:TagResources",
    56.         "ecs:ModifySecurityGroupPolicy",
    57.         "ecs:CreateSecurityGroup",
    58.         "ecs:DescribeAvailableResource",
    59.         "ecs:DescribeRegions",
    60.         "ecs:AttachInstanceRamRole"
    61.       ],
    62.       "Resource": "*",
    63.       "Effect": "Allow"
    64.     },
    65.     {
    66.       "Action": [
    67.         "pvtz:DescribeRegions",
    68.         "pvtz:DescribeZones",
    69.         "pvtz:DeleteZone",
    70.         "pvtz:DeleteZoneRecord",
    71.         "pvtz:BindZoneVpc",
    72.         "pvtz:DescribeZoneRecords",
    73.         "pvtz:AddZoneRecord",
    74.         "pvtz:SetZoneRecordStatus",
    75.         "pvtz:DescribeZoneInfo",
    76.         "pvtz:DescribeSyncEcsHostTask",
    77.         "pvtz:AddZone"
    78.       ],
    79.       "Resource": "*",
    80.       "Effect": "Allow"
    81.     },
    82.     {
    83.       "Action": [
    84.         "slb:DescribeLoadBalancers",
    85.         "slb:SetLoadBalancerDeleteProtection",
    86.         "slb:DeleteLoadBalancer",
    87.         "slb:SetLoadBalancerModificationProtection",
    88.         "slb:DescribeLoadBalancerAttribute",
    89.         "slb:AddBackendServers",
    90.         "slb:DescribeLoadBalancerTCPListenerAttribute",
    91.         "slb:SetLoadBalancerTCPListenerAttribute",
    92.         "slb:StartLoadBalancerListener",
    93.         "slb:CreateLoadBalancerTCPListener",
    94.         "slb:ListTagResources",
    95.         "slb:TagResources",
    96.         "slb:CreateLoadBalancer"
    97.       ],
    98.       "Resource": "*",
    99.       "Effect": "Allow"
    100.     },
    101.     {
    102.       "Action": [
    103.         "ram:ListResourceGroups",
    104.         "ram:DeleteResourceGroup",
    105.         "ram:ListPolicyAttachments",
    106.         "ram:DetachPolicy",
    107.         "ram:GetResourceGroup",
    108.         "ram:CreateResourceGroup",
    109.         "ram:DeleteRole",
    110.         "ram:GetPolicy",
    111.         "ram:DeletePolicy",
    112.         "ram:ListPoliciesForRole",
    113.         "ram:CreateRole",
    114.         "ram:AttachPolicyToRole",
    115.         "ram:GetRole",
    116.         "ram:CreatePolicy",
    117.         "ram:CreateUser",
    118.         "ram:DetachPolicyFromRole",
    119.         "ram:CreatePolicyVersion",
    120.         "ram:DetachPolicyFromUser",
    121.         "ram:ListPoliciesForUser",
    122.         "ram:AttachPolicyToUser",
    123.         "ram:CreateUser",
    124.         "ram:GetUser",
    125.         "ram:DeleteUser",
    126.         "ram:CreateAccessKey",
    127.         "ram:ListAccessKeys",
    128.         "ram:DeleteAccessKey",
    129.         "ram:ListUsers",
    130.         "ram:ListPolicyVersions"
    131.       ],
    132.       "Resource": "*",
    133.       "Effect": "Allow"
    134.     },
    135.     {
    136.       "Action": [
    137.         "oss:DeleteBucket",
    138.         "oss:DeleteBucketTagging",
    139.         "oss:GetBucketTagging",
    140.         "oss:GetBucketCors",
    141.         "oss:GetBucketPolicy",
    142.         "oss:GetBucketLifecycle",
    143.         "oss:GetBucketReferer",
    144.         "oss:GetBucketTransferAcceleration",
    145.         "oss:GetBucketLog",
    146.         "oss:GetBucketWebSite",
    147.         "oss:GetBucketInfo",
    148.         "oss:PutBucketTagging",
    149.         "oss:PutBucket",
    150.         "oss:OpenOssService",
    151.         "oss:ListBuckets",
    152.         "oss:GetService",
    153.         "oss:PutBucketACL",
    154.         "oss:GetBucketLogging",
    155.         "oss:ListObjects",
    156.         "oss:GetObject",
    157.         "oss:PutObject",
    158.         "oss:DeleteObject"
    159.       ],
    160.       "Resource": "*",
    161.       "Effect": "Allow"
    162.     },
    163.     {
    164.       "Action": [
    165.         "alidns:DescribeDomainRecords",
    166.         "alidns:DeleteDomainRecord",
    167.         "alidns:DescribeDomains",
    168.         "alidns:DescribeDomainRecordInfo",
    169.         "alidns:AddDomainRecord",
    170.         "alidns:SetDomainRecordStatus"
    171.       ],
    172.       "Resource": "*",
    173.       "Effect": "Allow"
    174.     },
    175.     {
    176.       "Action": "bssapi:CreateInstance",
    177.       "Resource": "*",
    178.       "Effect": "Allow"
    179.     },
    180.     {
    181.       "Action": "ram:PassRole",
    182.       "Resource": "*",
    183.       "Effect": "Allow",
    184.       "Condition": {
    185.         "StringEquals": {
    186.           "acs:Service": "ecs.aliyuncs.com"
    187.         }
    188.       }
    189.     }
    190.   ]
    191. }

For more information about creating a RAM user and granting permissions, see Create a RAM user and Grant permissions to a RAM user in the Alibaba Cloud documentation.

Configuring the Cloud Credential Operator utility

To assign RAM users and policies that provide long-lived RAM AccessKeys (AKs) for each in-cluster component, extract and prepare the OKD Cloud Credential Operator (CCO) utility (ccoctl) binary.

The ccoctl is a Linux binary that must run in a Linux environment.

Procedure

  1. Obtain the OKD release image by running the following command:

    1. $ RELEASE_IMAGE=$(./openshift-install version | awk '/release image/ {print $3}')

  2. Get the CCO container image from the OKD release image by running the following command:

    1. $ CCO_IMAGE=$(oc adm release info --image-for='cloud-credential-operator' $RELEASE_IMAGE)

    Ensure that the architecture of the $RELEASE_IMAGE matches the architecture of the environment in which you will use the ccoctl tool.

  3. Extract the ccoctl binary from the CCO container image within the OKD release image by running the following command:

    1. $ oc image extract $CCO_IMAGE --file="/usr/bin/ccoctl" -a ~/.pull-secret

  4. Change the permissions to make ccoctl executable by running the following command:

    1. $ chmod 775 ccoctl

Verification

  • To verify that ccoctl is ready to use, display the help file by running the following command:

    1. $ ccoctl --help

    Output of ccoctl --help:

    1. OpenShift credentials provisioning tool
    3. Usage:
    4.   ccoctl [command]
    6. Available Commands:
    7.   alibabacloud Manage credentials objects for alibaba cloud
    8.   aws          Manage credentials objects for AWS cloud
    9.   gcp          Manage credentials objects for Google cloud
    10.   help         Help about any command
    11.   ibmcloud     Manage credentials objects for IBM Cloud
    12.   nutanix      Manage credentials objects for Nutanix
    14. Flags:
    15.   -h, --help   help for ccoctl
    17. Use "ccoctl [command] --help" for more information about a command.

Next steps