From d9aa61d3035bc54fd3149fc8722dbca5aabccb53 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Sep 21 2022 10:54:32 +0000 Subject: [PATCH 1/3] communishift: SOPs for administering the Communishift cluster Signed-off-by: David Kirwan dkirwan@redhat.com Signed-off-by: Lenka Segura lsegura@redhat.com Signed-off-by: Patrik Polakovic ppolakov@redhat.com Signed-off-by: David Kirwan --- diff --git a/modules/ocp4/pages/sop_communishift.adoc b/modules/ocp4/pages/sop_communishift.adoc new file mode 100644 index 0000000..037d279 --- /dev/null +++ b/modules/ocp4/pages/sop_communishift.adoc @@ -0,0 +1,8 @@ += Communishift +The following SOPs are related to the administration of the Communishift Cluster. + +== Resources +- [1] Cluster: https://console-openshift-console.apps.fedora.cj14.p1.openshiftapps.com +- [2] Install the CommunishiftAuthorization operator xref:sop_communishift_authorization_operator.adoc +- [3] Testing the CommunishiftAuthorization operator xref:sop_communishift_authorization_operator_testing.adoc +- [4] Onboarding a Communishift tenant xref:sop_communishift_onboard_tenant.adoc diff --git a/modules/ocp4/pages/sop_communishift_authorization_operator.adoc b/modules/ocp4/pages/sop_communishift_authorization_operator.adoc new file mode 100644 index 0000000..b8ee0ca --- /dev/null +++ b/modules/ocp4/pages/sop_communishift_authorization_operator.adoc @@ -0,0 +1,26 @@ += Configure the CommunishiftAuthorization Operator + +== Resources +- [1] Code: https://pagure.io/cpe/communishift/blob/main/f/CommunishiftAuthorization + +== Installation +There is a Makefile bundled with the code [1] of this operator. + +To install the operator: + +- From a terminal, be logged into the Communishift cluster with cluster-admin privileges. +- Create a project `communishift-authorization-operator` +- Run `make deploy` + +To activate the operator we need to create a `CommunishiftAuthorization` custom resource. An example of one exists in `CommunishiftAuthorization/config/samples/_v1alpha1_communishiftauthorization.yaml` + +Create it with the following: + +---- +oc apply -f CommunishiftAuthorization/config/samples/_v1alpha1_communishiftauthorization.yaml +---- + + +== Configuration + +- No other configuration is required for this operator. diff --git a/modules/ocp4/pages/sop_communishift_authorization_operator_testing.adoc b/modules/ocp4/pages/sop_communishift_authorization_operator_testing.adoc new file mode 100644 index 0000000..de15ef8 --- /dev/null +++ b/modules/ocp4/pages/sop_communishift_authorization_operator_testing.adoc @@ -0,0 +1,14 @@ += Test the CommunishiftAuthorization Operator + +== Resources +- [1] Code: https://pagure.io/cpe/communishift/blob/main/f/CommunishiftAuthorization +- [2] Molecule: https://molecule.readthedocs.io/en/latest/ + +== Installation +There is a molecule directory bundled with the code [1] of this operator. They currently are designed to only run against the Communishift cluster itself, as it needs access to secrets for the keytab to auth against fasjson. + +To run the operator molecule tests: + +- Ensure that the molecule utility is installed `dnf install python3-molecule` +- From a terminal, be logged into the Communishift cluster with cluster-admin privileges. +- Run `molecule test` diff --git a/modules/ocp4/pages/sop_communishift_onboard_tenant.adoc b/modules/ocp4/pages/sop_communishift_onboard_tenant.adoc new file mode 100644 index 0000000..f1cf207 --- /dev/null +++ b/modules/ocp4/pages/sop_communishift_onboard_tenant.adoc @@ -0,0 +1,50 @@ += Onboard a tenant to the Communishift Cluster + +== Resources +- [1] Playbook: https://pagure.io/fedora-infra/ansible/blob/main/f/playbooks/manual/communishift.yml +- [2] Role: https://pagure.io/fedora-infra/ansible/blob/main/f/roles/communishift +- [3] Cluster: https://console-openshift-console.apps.fedora.cj14.p1.openshiftapps.com +- [4] CAO: https://pagure.io/cpe/communishift/blob/main/f/CommunishiftAuthorization + +== Onboarding +To onboard a tenant, perform the following steps: + + +=== Add project name to Playbook +Members of `sysadmin-openshift` can run this playbook at [1]. It contains the list of communishift projects. When onboarding, add the new name of the project to the `communishift_projects` list at the bottom. + +Note: Projects *must* start with `communishift-` eg `communishift-dev-test`. + + +=== Add new project group to IPA +A group must be created in IPA which matches the name of the group added to the playbook in the previous step. Please ensure that the community member requesting access to the cluster is also added to this group in IPA, and made a sponsor. This way they can administer members in their group in a self service fashion later. + + +=== Run the playbook +Run the playbook on the batcave. + +---- +sudo rbac-playbook manual/communishift.yml +---- + +This will create the project, creates the EFS storage in AWS, then creates a Secret in the project which contains the credentials in order to create a `SharedVolume` object. + +eg: + +---- +apiVersion: aws-efs.managed.openshift.io/v1alpha1 +kind: SharedVolume +metadata: + name: communishift-dev-test-sharedvolume + namespace: communishift-dev-test +spec: + accessPointID: fsap-xxxxx + fileSystemID: fs-xxxx +---- + +This also applys a ResourceQuota to the project. This sets an upper limit on the amount of resources that may be consumed within. It is low on purpose, and can be changed later in an indivudal basis based on the tenant needs. + + +=== Authorizing the project members to access the cluster +The CommunishiftAuthorization operator [4] handles dishing out permissions to access the cluster. This is based on the group name being present in IPA. Every 20minutes, the CAO will retrieve a list of groups from IPA via fasjson, which match `communishift-*` pattern, then ensure this group exists in Openshift, and synchronises the users between the IPA group and Openshift. This process is automatic and performed every 20 minutes. + diff --git a/modules/ocp4/pages/sops.adoc b/modules/ocp4/pages/sops.adoc index 5230cd3..96f04d7 100644 --- a/modules/ocp4/pages/sops.adoc +++ b/modules/ocp4/pages/sops.adoc @@ -20,4 +20,4 @@ - xref:sop_add_odf_storage.adoc[SOP Add new capacity to the OCP4 ODF Storage Cluster] - xref:sop_velero.adoc[SOP Velero] - xref:sop_aws_efs_operator.adoc[SOP AWS EFS Operator] - +- xref:sop_communishift.adoc[SOP Communishift Cluster Administration] diff --git a/modules/sysadmin_guide/nav.adoc b/modules/sysadmin_guide/nav.adoc index a72d8e5..83fa465 100644 --- a/modules/sysadmin_guide/nav.adoc +++ b/modules/sysadmin_guide/nav.adoc @@ -85,10 +85,9 @@ ** xref:new-hosts.adoc[DNS Host Addition - SOP] ** xref:nonhumanaccounts.adoc[Non-human Accounts Infrastructure - SOP] ** xref:nuancier.adoc[Nuancier - SOP] -** xref:ocp4:sops.adoc[Openshift 4 SOPs] +** xref:ocp4:sops.adoc[Openshift SOPs] ** xref:odcs.adoc[On Demand Compose Service - SOP] ** xref:openqa.adoc[OpenQA Infrastructure - SOP] -** xref:openshift.adoc[OpenShift - SOP] ** xref:openvpn.adoc[OpenVPN - SOP] ** xref:outage.adoc[Outage Infrastructure - SOP] ** xref:packagereview.adoc[Package Review - SOP] From 41a59464b566591515d4f79f3d5c0cca377c07d2 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Sep 21 2022 11:11:07 +0000 Subject: [PATCH 2/3] Communishift: sop for building/releasing CAO Signed-off-by: David Kirwan --- diff --git a/modules/ocp4/pages/sop_communishift.adoc b/modules/ocp4/pages/sop_communishift.adoc index 037d279..93a0a62 100644 --- a/modules/ocp4/pages/sop_communishift.adoc +++ b/modules/ocp4/pages/sop_communishift.adoc @@ -5,4 +5,5 @@ The following SOPs are related to the administration of the Communishift Cluster - [1] Cluster: https://console-openshift-console.apps.fedora.cj14.p1.openshiftapps.com - [2] Install the CommunishiftAuthorization operator xref:sop_communishift_authorization_operator.adoc - [3] Testing the CommunishiftAuthorization operator xref:sop_communishift_authorization_operator_testing.adoc -- [4] Onboarding a Communishift tenant xref:sop_communishift_onboard_tenant.adoc +- [4] Building/releasing the CommunishiftAuthorization operator xref:sop_communishift_authorization_operator_build.adoc +- [5] Onboarding a Communishift tenant xref:sop_communishift_onboard_tenant.adoc diff --git a/modules/ocp4/pages/sop_communishift_authorization_operator_build.adoc b/modules/ocp4/pages/sop_communishift_authorization_operator_build.adoc new file mode 100644 index 0000000..51e41fb --- /dev/null +++ b/modules/ocp4/pages/sop_communishift_authorization_operator_build.adoc @@ -0,0 +1,23 @@ += Build/release the CommunishiftAuthorization Operator + +== Resources +- [1] Code: https://pagure.io/cpe/communishift/blob/main/f/CommunishiftAuthorization +- [2] Quay: https://quay.io/repository/fedora/communishift-authorization-operator + +== Installation +To build the operator and tag it with version `v0.0.30` as an example: + +- First ensure that you are logged into quay.io and have access to the repository at [2]. +- Check out the code at [1], and change directory into the `CommunishiftAuthorization` directory. +- Update the version mentioned in the Deployment for the operator at `config/manager/manager.yml` + +---- +podman build -t quay.io/fedora/communishift-authorization-operator:v0.0.30 . +---- + +Push the operator to the quay.io catalog then with the following: + +---- +podman push quay.io/fedora/communishift-authorization-operator:v0.0.30 +---- + From 3666299252895bfe8f0c4796d76ddc4a976b9062 Mon Sep 17 00:00:00 2001 From: David Kirwan Date: Sep 22 2022 12:00:43 +0000 Subject: [PATCH 3/3] communishift: SOPs for modifying tenant ResourceQuota communishift: SOPs for creating SharedVolume Signed-off-by: David Kirwan dkirwan@redhat.com Signed-off-by: Lenka Segura lsegura@redhat.com Signed-off-by: Patrik Polakovic ppolakov@redhat.com --- diff --git a/modules/ocp4/pages/sop_communishift.adoc b/modules/ocp4/pages/sop_communishift.adoc index 93a0a62..2b72e6e 100644 --- a/modules/ocp4/pages/sop_communishift.adoc +++ b/modules/ocp4/pages/sop_communishift.adoc @@ -7,3 +7,6 @@ The following SOPs are related to the administration of the Communishift Cluster - [3] Testing the CommunishiftAuthorization operator xref:sop_communishift_authorization_operator_testing.adoc - [4] Building/releasing the CommunishiftAuthorization operator xref:sop_communishift_authorization_operator_build.adoc - [5] Onboarding a Communishift tenant xref:sop_communishift_onboard_tenant.adoc +- [6] Configuring the Resourcequota for a tenant xref:sop_communishift_tenant_quota.adoc +- [7] Create the SharedVolume object which manages tenant storage xref:sop_communishift_create_sharedvolume.adoc + diff --git a/modules/ocp4/pages/sop_communishift_create_sharedvolume.adoc b/modules/ocp4/pages/sop_communishift_create_sharedvolume.adoc new file mode 100644 index 0000000..418452d --- /dev/null +++ b/modules/ocp4/pages/sop_communishift_create_sharedvolume.adoc @@ -0,0 +1,78 @@ += Create SharedVolume + +== Resources +- [1] AWS EFS Operator: https://github.com/openshift/aws-efs-operator +- [2] AWS EFS Operator Installation/Configuration: https://access.redhat.com/articles/5025181 + +=== Creating the SharedVolume +The `communishift` ansible role will create the AWS EFS filesystem and accesspoint, and then creates a Secret called `communishift-project-name-efs-credentials"` in the tenants project. The structure of the secret is as follows: + +---- +data: + efs_filesystem_id: "fsap-xxxxxxxx" + efs_accesspoint_id: "fs-xxxxxxxxxx" +---- + +The values are base64 encoded, to retrieve the values do the following: + +---- +oc get secret communishift-project-name-efs-credentials -o jsonpath="{.data['efs_accesspoint_id']}" | base64 -d +oc get secret communishift-project-name-efs-credentials -o jsonpath="{.data['efs_filesystem_id']}" | base64 -d +---- + +Next create a yaml file and populate the values for the `accessPointID` and the `fileSystemID`. + +---- +apiVersion: aws-efs.managed.openshift.io/v1alpha1 +kind: SharedVolume +metadata: + name: PROJECTNAME-sharedvolume + namespace: PROJECTNAME +spec: + accessPointID: fsap-xxxxx + fileSystemID: fs-xxxxx +---- + +Then create the `SharedVolume` object: + +---- +oc apply -f project-name-sharedvolume.yml +---- + +Once created, the AWS EFS Operator should automatically create a PersistentVolume, then a PersistentVolumeClaim in the project namespace. Tenants can then mount this volume as normal. + +The following Pod defintion maybe used to verify the storage is working correctly. + +---- +apiVersion: v1 +kind: Pod +metadata: + name: volume-test + namespace: communishift-dev-test +spec: + securityContext: + runAsUser: 1001 + runAsGroup: 1001 + fsGroup: 1001 + fsGroupChangePolicy: "OnRootMismatch" + serviceAccount: volume-test + volumes: + - name: test-volume + persistentVolumeClaim: + claimName: pvc-communishift-dev-test-sharedvolume + containers: + - image: quay.io/operator-framework/ansible-operator:v1.23.0 + command: + - /bin/sh + - "-c" + - "sleep 60m" + imagePullPolicy: IfNotPresent + name: alpine + volumeMounts: + - name: test-volume + mountPath: /tmp/volume_test + restartPolicy: Always + resources: + requests: + memory: "2Gi" +---- diff --git a/modules/ocp4/pages/sop_communishift_onboard_tenant.adoc b/modules/ocp4/pages/sop_communishift_onboard_tenant.adoc index f1cf207..6676990 100644 --- a/modules/ocp4/pages/sop_communishift_onboard_tenant.adoc +++ b/modules/ocp4/pages/sop_communishift_onboard_tenant.adoc @@ -11,7 +11,7 @@ To onboard a tenant, perform the following steps: === Add project name to Playbook -Members of `sysadmin-openshift` can run this playbook at [1]. It contains the list of communishift projects. When onboarding, add the new name of the project to the `communishift_projects` list at the bottom. +Members of `sysadmin-openshift` can run this playbook at [1]. It contains the list of communishift projects. When on boarding, add the new name of the project to the `communishift_projects` list at the bottom. Note: Projects *must* start with `communishift-` eg `communishift-dev-test`. @@ -42,7 +42,7 @@ spec: fileSystemID: fs-xxxx ---- -This also applys a ResourceQuota to the project. This sets an upper limit on the amount of resources that may be consumed within. It is low on purpose, and can be changed later in an indivudal basis based on the tenant needs. +This also applies a ResourceQuota to the project. This sets an upper limit on the amount of resources that may be consumed within. It is low on purpose, and can be changed later in an individual basis based on the tenant needs. === Authorizing the project members to access the cluster diff --git a/modules/ocp4/pages/sop_communishift_tenant_quota.adoc b/modules/ocp4/pages/sop_communishift_tenant_quota.adoc new file mode 100644 index 0000000..473ffe8 --- /dev/null +++ b/modules/ocp4/pages/sop_communishift_tenant_quota.adoc @@ -0,0 +1,26 @@ += Configure the tenant ResourceQuota + +== Resources +- [1] ResourceQuota Openshift Docs: https://docs.openshift.com/container-platform/4.11/applications/quotas/quotas-setting-per-project.html + + +=== Config +The ResourceQuota is contained within the tenants namespace and is named like `communishift-project-name-quota`. + +By default the following quota is assigned: + +---- +spec: + hard: + cpu: "1" # requests.cpu + memory: "1Gi" # requests.memory + limits.cpu: "1" + limits.memory: "2Gi" + requests.storage: "5Gi" + persistentvolumeclaims: "1" + pods: "2" + replicationcontrollers: 1 +---- + +This object can be modified in order to increase or restrict resources available to tenants after the fact. Refer to the official docs for instructions [1]. +