Bug 1724684
| Summary: | unable to deply cluster on AWS 4.1.x | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Sudarshan Chaudhari <suchaudh> |
| Component: | Documentation | Assignee: | Kathryn Alexander <kalexand> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Johnny Liu <jialiu> |
| Severity: | medium | Docs Contact: | Vikram Goyal <vigoyal> |
| Priority: | high | ||
| Version: | 4.1.z | CC: | adahiya, aos-bugs, erich, gerald.kimmel, jokerman, jrosenta, kalexand, mmccomas, vigoyal |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-12 13:31:55 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Sudarshan Chaudhari
2019-06-27 14:25:52 UTC
Its possible the customer didn't follow: https://docs.openshift.com/container-platform/4.1/installing/installing_aws/installing-aws-account.html Can we confirm that they have followed these docs? Unless we're not using the API properly (for aws): Example https://github.com/aws/aws-sdk-go/issues/1436 Then this is most likely a configuration issue (either on the client side or on the service side (with AWS). can you run ``` aws sts get-caller-identity ``` to provide information of the caller. How are your credentials for AWS setup? the output is
# aws sts get-caller-identity
{
"UserId": "AIDAU7HYQUMBNXXXXXX",
"Account": "341971XXXXXX",
"Arn": "arn:aws:iam::341971XXXXXX:user/A64XXXXXX"
}
and the credentials are set up according to https://aws.amazon.com/de/premiumsupport/knowledge-center/authenticate-mfa-cli/ using ~/.aws/credentials
Since the MFA device can only produce temporary session tokens, and the installer requires credentials from a long lived user (atleast greater than that of the life of the cluster) I think we should make that more clearer in the docs. (In reply to Abhinav Dahiya from comment #10) > Since the MFA device can only produce temporary session tokens, and the > installer requires credentials from a long lived user (atleast greater than > that of the life of the cluster) > > I think we should make that more clearer in the docs. So we fundamentally require that you follow: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html and not AWS supported tools like: https://aws.amazon.com/de/premiumsupport/knowledge-center/authenticate-mfa-cli/ In short, do we simply need to say we don't support using MFA with the CLI as documented by https://aws.amazon.com/de/premiumsupport/knowledge-center/authenticate-mfa-cli/ ? (In reply to Eric Rich from comment #12) > (In reply to Abhinav Dahiya from comment #10) > > Since the MFA device can only produce temporary session tokens, and the > > installer requires credentials from a long lived user (atleast greater than > > that of the life of the cluster) > > > > I think we should make that more clearer in the docs. > > So we fundamentally require that you follow: > https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys. > html and not AWS supported tools like: > https://aws.amazon.com/de/premiumsupport/knowledge-center/authenticate-mfa- > cli/ > > In short, do we simply need to say we don't support using MFA with the CLI > as documented by > https://aws.amazon.com/de/premiumsupport/knowledge-center/authenticate-mfa- > cli/ ? I think that's correct. PR's here: https://github.com/openshift/openshift-docs/pull/16085 Eric, Jianlin, will you PTAL? LGTM. Thank you! I moved the note to earlier in the files based on peer review feedback and merged the change. This change is live on docs.openshift: https://docs.openshift.com/container-platform/4.1/installing/installing_aws/installing-aws-account.html#installation-aws-iam-user_installing-aws-account And on the portal: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.1/html-single/installing/index#installation-aws-iam-user_installing-aws-account |