# Openshift AWS

Create public Route53 zone os.stg.ci.centos.org
Get list of NS records and update DNS CentosProd/filestore/bind/centos.org with all NS records pointing to os.stg.ci

Create inventory/group_vars/openshift-ci-{env}
AWS info needed. Pull secret from console.redhat.com centos-infra account
ssh key pair needs to be created and both keys saved in pkistore/ssh
Pull secret can be obtained from console.redhat.com under the Download section while logged in as the centos-infra user

Run playbooks/adhoc-deploy-ocp-aws.yml

ansible-playbook playbooks/adhoc-deploy-ocp-aws.yml --extra-vars "@inventory/group_vars/openshift-ci-prod"

A build directory will be created in your Home dir under tmp/build
move the build directory to the filestore under aws-ocp/{env} and push to git as its needed to delete the cluster and also contains secrets such as kubeadmin password

Add Route53 zone to acme.sh to create certs (must be done after deploy script)
Deploy fullchain cert and key as secrets then patch config to use them

# Auth

Create a new open id connect provider https://id{.stg}.centos.org/idp/admin/providers/openidc/admin.

For the callback url use https://<cluster_url>/oauth2callback/<idp_name>

Login to the cluster as the kubeadmin. The password can be foud in the build dir in the auth/kubeadmin-password file

export KUBECONFIG=<path>/filestore/aws-ocp/<env>/auth/kubeconfig
oc login -u kubeadmin -p <password>

ansible-playbook playbooks/adhoc-openshift-auth.yml --extra-vars "@inventory/group_vars/openshift-ci-prod"

Record the Client Secret generated use it to create an openshift secret

oc create secret generic <secret_name> --from-literal=clientSecret=<client_secret> -n openshift-config

Create a configuration like so:

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: <idp_name>   # should be the same used in the callback url used when creating oidc provider 
    mappingMethod: claim 
    type: OpenID
    openID:
      clientID: <idp_name>   # should be the name used to create idp provider 
      clientSecret: 
        name: idp-secret  # Name of secret created in previous step
      claims: 
        email:
        - email
        groups:
        - groups
        name:
        - name
        preferredUsername:
        - nickname
      issuer: 'https://id{.stg}.centos.org/idp/openidc'
      

oc apply -f /path/to/config

# Admins

While logged in as the kubeadmin user create a centos-ci-admins group and add your user to it so they will have admin privs on login

# Authoriztion operator

A service account with admin priviliges needs to be created in the centos-ci-admins namespace

oc create sa centos-ci-serviceaccount -n centos-ci-admins

When the service account is created. Add permissions to it:

oc adm policy add-cluster-role-to-user cluster-admin -z centos-ci-serviceaccount -n centos-ci-admins

Get the api token name for the service acocunt by running

oc describe sa centos-ci-serviceaccount -n centos-ci-admins

Then use this name to obtain the secret value

oc describe secret <token_name> -n centos-ci-admins

Using this token we will create a keytab which will be used by the operator to access the accounts system.

nsible-playbook adhoc-create-keytab-secret.yml -e 'centosci_ocp_api_host_stg=api.ocpci.os{.stg}.ci.centos.org' -e 'centosci_ocp_api_token_stg=<token_value>'

# Storage

Create efs filesystem. This can be done manually as there can be up to 120 access points per filesystem so should only need to be done rarely.

- Login to aws console and go to EC2. find a worker node from the cluster and record the VPC id and cidr block and the security group id
- Click into the security group and add a rule to allow nfs from the cidr ip of the VPC
- Go to the VPC console and record the ids of all the private subnets in the VPC
- Navigate to the efs console and Click Create File System.
- Click Customize
- Enter suitable name and leave the default settings. (Life cycle rules could be looked at in future) Click Next
- Select the vpc id recorded earlier
- Ensure all the subnets are the private ones recorded earlier and change the security group to the one for the worker nodes
- Click next twice and the file system will be created.