@@ -12,7 +12,6 @@ CAPA controller requires service account credentials to be able to provision ROS
1212 --from-literal=ocmClientSecret=' eyJhbGciOiJIUzI1NiIsI....' \
1313 --from-literal=ocmApiUrl=' https://api.openshift.com'
1414 ```
15-
1615 Note: to consume the secret without the need to reference it from your ` ROSAControlPlane` , name your secret as ` rosa-creds-secret` and create it in the CAPA manager namespace (usually ` capa-system` )
1716 ` ` ` shell
1817 kubectl -n capa-system create secret generic rosa-creds-secret \
@@ -28,56 +27,56 @@ The SSO offline token is being deprecated and it is recommended to use service a
28271. Visit https://console.redhat.com/openshift/token to retrieve your SSO offline authentication token
2928
30291. Create a credentials secret within the target namespace with the token to be referenced later by ` ROSAControlePlane`
31- ` ` ` shell
32- kubectl create secret generic rosa-creds-secret \
33- --from-literal=ocmToken=' eyJhbGciOiJIUzI1NiIsI....' \
34- --from-literal=ocmApiUrl=' https://api.openshift.com'
30+ ` ` ` shell
31+ kubectl create secret generic rosa-creds-secret \
32+ --from-literal=ocmToken=' eyJhbGciOiJIUzI1NiIsI....' \
33+ --from-literal=ocmApiUrl=' https://api.openshift.com'
3534 ` ` `
3635
3736Alternatively, you can edit CAPA controller deployment to provide the credentials
38- ` ` ` shell
39- kubectl edit deployment -n capa-system capa-controller-manager
40- ` ` `
41- and add the following environment variables to the manager container
42- ` ` ` yaml
43- env:
44- - name: OCM_TOKEN
45- value: " <token>"
46- - name: OCM_API_URL
47- value: " https://api.openshift.com" # or https://api.stage.openshift.com
48- ` ` `
37+ ` ` ` shell
38+ kubectl edit deployment -n capa-system capa-controller-manager
39+ ` ` `
40+ and add the following environment variables to the manager container
41+ ` ` ` yaml
42+ env:
43+ - name: OCM_TOKEN
44+ value: " <token>"
45+ - name: OCM_API_URL
46+ value: " https://api.openshift.com" # or https://api.stage.openshift.com
47+ ` ` `
4948
5049# ## Migration from offline token to service account authentication
5150
52511. Visit [https://console.redhat.com/iam/service-accounts](https://console.redhat.com/iam/service-accounts) and create a new service account.
5352
54531. If you previously used kubernetes secret to specify the OCM credentials secret, edit the secret:
55- ` ` ` shell
56- kubectl edit secret rosa-creds-secret
57- ` ` `
58- where you will remove the ` ocmToken` credentials and add base64 encoded ` ocmClientID` and ` ocmClientSecret` credentials like so:
59- ` ` ` yaml
60- apiVersion: v1
61- data:
62- ocmApiUrl: aHR0cHM6Ly9hcGkub3BlbnNoaWZ0LmNvbQ==
63- ocmClientID: Y2xpZW50X2lk...
64- ocmClientSecret: Y2xpZW50X3NlY3JldA==...
65- kind: Secret
66- type: Opaque
67- ` ` `
54+ ` ` ` shell
55+ kubectl edit secret rosa-creds-secret
56+ ` ` `
57+ where you will remove the ` ocmToken` credentials and add base64 encoded ` ocmClientID` and ` ocmClientSecret` credentials like so:
58+ ` ` ` yaml
59+ apiVersion: v1
60+ data:
61+ ocmApiUrl: aHR0cHM6Ly9hcGkub3BlbnNoaWZ0LmNvbQ==
62+ ocmClientID: Y2xpZW50X2lk...
63+ ocmClientSecret: Y2xpZW50X3NlY3JldA==...
64+ kind: Secret
65+ type: Opaque
66+ ` ` `
6867
69681. If you previously used capa manager deployment to specify the OCM offline token as environment variable, edit the manager deployment:
70- ` ` ` shell
71- kubectl -n capa-system edit deployment capa-controller-manager
72- ` ` `
69+ ` ` ` shell
70+ kubectl -n capa-system edit deployment capa-controller-manager
71+ ` ` `
7372and remove the ` OCM_TOKEN` and ` OCM_API_URL` variables, followed by ` kubectl -n capa-system rollout restart deploy capa-controller-manager` . Then create the new default
7473secret in the ` capa-system` namespace with:
75- ` ` ` shell
76- kubectl -n capa-system create secret generic rosa-creds-secret \
77- --from-literal=ocmClientID=' ....' \
78- --from-literal=ocmClientSecret=' eyJhbGciOiJIUzI1NiIsI....' \
79- --from-literal=ocmApiUrl=' https://api.openshift.com'
80- ` ` `
74+ ` ` ` shell
75+ kubectl -n capa-system create secret generic rosa-creds-secret \
76+ --from-literal=ocmClientID=' ....' \
77+ --from-literal=ocmClientSecret=' eyJhbGciOiJIUzI1NiIsI....' \
78+ --from-literal=ocmApiUrl=' https://api.openshift.com'
79+ ` ` `
8180
8281# # Prerequisites
8382
@@ -108,7 +107,7 @@ Once Step 3 is done, you will be ready to proceed with creating a ROSA cluster u
108107 ` ` ` shell
109108 clusterctl generate cluster < cluster-name> --from templates/cluster-template-rosa.yaml > rosa-capi-cluster.yaml
110109 ` ` `
111- Note: The AWS role name must be no more than 64 characters in length. Otherwise an error will be returned. Truncate values exceeding 64 characters.
110+ Note: The AWS role name must be no more than 64 characters in length. Otherwise an error will be returned. Truncate values exceeding 64 characters.
112111
1131121. If a credentials secret was created earlier, edit ` ROSAControlPlane` to reference it:
114113 ` ` ` yaml
0 commit comments