Bug 1762299

+++ This bug was initially created as a clone of Bug #1760123 +++

Document URL: 

https://docs.openshift.com/container-platform/4.2/storage/persistent-storage/persistent-storage-snapshots.html#aws-authentication


Section Number and Name: 

AWS AUTHENTICATION - snapshot-controller deployment configuration


Describe the issue: 

Refer to BZ for details:  https://bugzilla.redhat.com/show_bug.cgi?id=1718389

The pod spec section in the snapshot-controller deployment configuration should include "hostNetwork: true"


Suggestions for improvement: 

Additional information:

--- Additional comment from Daniel Del Ciancio on 2019-10-10 05:08:17 UTC ---

The following section:

https://docs.openshift.com/container-platform/4.2/storage/persistent-storage/persistent-storage-snapshots.html#snapshots-starting-controller-provisioner_persistent-storage-snapshots


should be modified to include this command after creating the serviceaccount : 

# oc adm policy add-scc-to-user hostnetwork -z snapshot-controller-runner


Since the pod runs using snapshot-controller-runner serviceaccount, it requires the hostnetwork scc assigned it.

--- Additional comment from Daniel Del Ciancio on 2019-10-10 15:12:46 UTC ---

Also, the "AWS authentication" section [https://docs.openshift.com/container-platform/4.2/storage/persistent-storage/persistent-storage-snapshots.html#aws-authentication], it should state something like "when generating the base64 values required for the awskeys secret, make sure to remove any trailing newline character as follows:

echo -n "<aws_access_key_id>" | base64
echo -n "<aws_secret_access_key>" | base64


Can we be sure to have the documentation reflect this as well?


Thanks!

--- Additional comment from Daniel Del Ciancio on 2019-10-15 12:55:40 UTC ---

The restore section in [1] should also reflect the following changes:


# When using AWS EBS storage with gp2 encryption configured, you need to explicitly set the parameters below:

kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: snapshot-promoter
provisioner: volumesnapshot.external-storage.k8s.io/snapshot-promoter
parameters:
  encrypted: "true"
  type: gp2



# The restore snapshot should specify the accessModes and resources attributes:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: snapshot-pv-provisioning-demo
  annotations:
    snapshot.alpha.kubernetes.io/snapshot: snapshot-demo
spec:
  storageClassName: snapshot-promoter
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi



Lastly, the 4.2 doc states that this feature will be deprecated and there is a note also stating that it is tech preview.  Can we clarify what we would expect to replace this? 



-----

[1] https://docs.openshift.com/container-platform/4.2/storage/persistent-storage/persistent-storage-snapshots.html#persistent-storage-snapshots-restore_persistent-storage-snapshots