operator-roles

operator-roles

Introduction

This Terraform sub-module manages the IAM roles used by operators within the cluster for their necessary actions in the AWS account.

The following permissions are included in this sub-module:

• ROSA Ingress Operator IAM role.
• ROSA back-end storage IAM role.
• ROSA Machine Config Operator role.
• ROSA Cloud Credential Operator role.
• ROSA Image Registry Operator role.

For more information, see the operator-policies sub-module description and About IAM resources for ROSA clusters that use STS in the ROSA documentation.

Example Usage

module "operator_policies" {
  source = "terraform-redhat/rosa-classic/rhcs//modules/operator-policies"

  account_role_prefix  = "my-cluster-account"
  openshift_version    = "4.14.24"
}

module "operator_roles" {
  source = "terraform-redhat/rosa-classic/rhcs//modules/operator-roles"

  operator_role_prefix = "my-cluster-operator"
  account_role_prefix  = "my-cluster-account"
  oidc_endpoint_url    = "my-url"
}

Requirements

Name	Version
terraform	>= 1.0
aws	>= 4.0
rhcs	>= 1.6.2
time	>= 0.9

Providers

Name	Version
aws	>= 4.0
rhcs	>= 1.6.2
time	>= 0.9

Modules

No modules.

Resources

Name	Type
aws_iam_role.operator_role	resource
aws_iam_role_policy_attachment.operator_role_policy_attachment	resource
time_sleep.role_resources_propagation	resource
aws_caller_identity.current	data source
aws_iam_policy_document.custom_trust_policy	data source
aws_partition.current	data source
rhcs_rosa_operator_roles.operator_roles	data source

Inputs

Name	Description	Type	Default	Required
account_role_prefix	User-defined prefix for all generated AWS resources.	string	n/a	yes
oidc_endpoint_url	Registered OIDC configuration issuer URL, added as the trusted relationship to the operator roles.	string	n/a	yes
operator_role_prefix	User-defined prefix for generated AWS operator policies. Use "account-role-prefix" in case no value provided.	string	null	no
path	The ARN path for the account/operator roles as well as their policies. Must use the same path used for "account_iam_roles".	string	"/"	no
permissions_boundary	The ARN of the policy that is used to set the permissions boundary for the IAM roles in STS clusters.	string	""	no
tags	List of AWS resource tags to apply.	map(string)	null	no

Outputs

Name	Description
operator_role_prefix	Prefix used for generated AWS operator policies.
operator_roles_arn	List of Amazon Resource Names (ARNs) for all operator roles created.