Currently sts-preflight tool [1] or manual way [2] does not support STS on C2S region [3][4][5] Creating this bug to track this feature to be supported on C2S. [1] https://github.com/openshift/cloud-credential-operator/pull/290 [2] https://issues.redhat.com/browse/CCO-62 [3] https://github.com/openshift/cloud-credential-operator/pull/290#issuecomment-774636639 [4] https://github.com/openshift/cloud-credential-operator/pull/290#issuecomment-775161145 [5] https://github.com/openshift/cloud-credential-operator/pull/290#issuecomment-776051214
this will be resolved by work in 4.8 not a blocker for 4.7
The current design of STS cannot work in C2S. Unfortunately C2S needs to be treated like an entirely new platform for CCO purposes, and we require the usual RFE process for that. Obsoleting.
@yunjiang Customers are going to need to get credentials from the CAP endpoint for all of the operators that need credentials. The customer will be responsible for implementing some means by which the credentials are periodically refreshed. I have put together a reference implementation of a cronjob that refreshes the credentials automatically. See https://github.com/staebler/cap-token-refresh.
Matthew, I've integrated CAP into our CI system, they work fine, checked cap-token-refresh logs and Secret, the credential were refreshed regularly. I also got two questions: 1. The default expiration time of AWS credential created by CAP is one hour, is there a way to change this value? 2. Looks like we can not refresh the AWS credential during the OCP installation process, in most cases, the installation will be finished within 1 hour, but what will happen if it takes more than 1 hour? Even if we could refresh `~/.aws/credentials` during the installation, the installer will not reload the new credential, is it right? Thanks.
(In reply to Yunfei Jiang from comment #5) > Matthew, I've integrated CAP into our CI system, they work fine, checked > cap-token-refresh logs and Secret, the credential were refreshed regularly. > > I also got two questions: > 1. The default expiration time of AWS credential created by CAP is one hour, > is there a way to change this value? I am pretty sure that there is a query parameter that you can add to the CAP URL to request a different lifetime for the credentials. I even have some recollection of seeing it at some point. But recently I have not been able to find any documentation for it. > 2. Looks like we can not refresh the AWS credential during the OCP > installation process, in most cases, the installation will be finished > within 1 hour, but what will happen if it takes more than 1 hour? Even if we > could refresh `~/.aws/credentials` during the installation, the installer > will not reload the new credential, is it right? That is correct. The installer will not reload new credentials. But, the installer credentials are only needed up until the installer finishes the terraform phase. > > Thanks.