diff --git a/_topic_maps/_topic_map_ms.yml b/_topic_maps/_topic_map_ms.yml index 962d8e58560..0d195fdce3a 100644 --- a/_topic_maps/_topic_map_ms.yml +++ b/_topic_maps/_topic_map_ms.yml @@ -235,6 +235,8 @@ Topics: File: microshift-deleting-resource-manifests - Name: Using MicroShift certificate manager File: microshift-cert-manager +- Name: Using the trust-manager operand for MicroShift certificate manager + File: microshift-cert-manager-trust-manager - Name: Configuring Observability File: microshift-observability-service - Name: Embedding applications on RHEL for Edge diff --git a/installing/installing_aws/upi/installing-aws-multiarch-support-upi.adoc b/installing/installing_aws/upi/installing-aws-multiarch-support-upi.adoc index 28fd59f02f3..331dff87c75 100644 --- a/installing/installing_aws/upi/installing-aws-multiarch-support-upi.adoc +++ b/installing/installing_aws/upi/installing-aws-multiarch-support-upi.adoc @@ -6,14 +6,15 @@ include::_attributes/common-attributes.adoc[] toc::[] -An {product-title} cluster with multi-architecture compute machines supports compute machines with different architectures. +[role="_abstract"] +To run workloads across `x86_64` and ARM nodes, you can install an {product-title} cluster on {aws-first} with multi-architecture compute machine support. [NOTE] ==== -When you have nodes with multiple architectures in your cluster, the architecture of your image must be consistent with the architecture of the node. You must ensure that the pod is assigned to the node with the appropriate architecture and that it matches the image architecture. For more information on assigning pods to nodes, see xref:../../../post_installation_configuration/configuring-multi-arch-compute-machines/multi-architecture-compute-managing.adoc#scheduling-workloads-on-clusters-with-multi-architecture-compute-machines[Scheduling workloads on clusters with multi-architecture compute machines]. +When you have nodes with multiple architectures in your cluster, the architecture of your image must be consistent with the architecture of the node. You must ensure that the pod is assigned to the node with the appropriate architecture and that it matches the image architecture. ==== -You can install an AWS cluster with the support for configuring multi-architecture compute machines. After installing the AWS cluster, you can add multi-architecture compute machines to the cluster in the following ways: +You can install an {aws-short} cluster with the support for configuring multi-architecture compute machines. After installing the {aws-short} cluster, you can add multi-architecture compute machines to the cluster in the following ways: * Adding 64-bit x86 compute machines to a cluster that uses 64-bit ARM control plane machines and already includes 64-bit ARM compute machines. In this case, 64-bit x86 is considered the secondary architecture. * Adding 64-bit ARM compute machines to a cluster that uses 64-bit x86 control plane machines and already includes 64-bit x86 compute machines. In this case, 64-bit ARM is considered the secondary architecture. @@ -22,10 +23,9 @@ include::snippets/about-multiarch-tuning-operator.adoc[] include::modules/installing-a-cluster-with-multiarch-support.adoc[leveloffset=+1] -.Next steps -* xref:../../../installing/installing_aws/ipi/installing-aws-localzone.adoc#installation-launching-installer_installing-aws-localzone[Deploying the cluster] - [role="_additional-resources"] .Additional resources +* xref:../../../installing/installing_aws/ipi/installing-aws-localzone.adoc#installation-launching-installer_installing-aws-localzone[Deploying the cluster] +* xref:../../../post_installation_configuration/configuring-multi-arch-compute-machines/multi-architecture-compute-managing.adoc#scheduling-workloads-on-clusters-with-multi-architecture-compute-machines[Scheduling workloads on clusters with multi-architecture compute machines] * xref:../../../post_installation_configuration/configuring-multi-arch-compute-machines/multiarch-tuning-operator.adoc#multiarch-tuning-operator[Managing workloads on multi-architecture clusters by using the Multiarch Tuning Operator] \ No newline at end of file diff --git a/installing/installing_aws/upi/installing-aws-user-infra.adoc b/installing/installing_aws/upi/installing-aws-user-infra.adoc index b22f6ea332a..6ea701d3d55 100644 --- a/installing/installing_aws/upi/installing-aws-user-infra.adoc +++ b/installing/installing_aws/upi/installing-aws-user-infra.adoc @@ -7,34 +7,47 @@ include::_attributes/common-attributes.adoc[] toc::[] -In {product-title} version {product-version}, you can install a cluster on Amazon Web Services (AWS) that uses infrastructure that you provide. +[role="_abstract"] +To deploy {product-title} version {product-version} on Amazon Web Services (AWS) with your own infrastructure, use the `CloudFormation` templates or create resources according to your company's policies. -One way to create this infrastructure is to use the provided CloudFormation templates. You can modify the templates to customize your infrastructure or use the information that they contain to create AWS objects according to your company's policies. +One way to create this infrastructure is to use the `CloudFormation` templates. You can change the templates to customize your infrastructure or use the information that they contain to create AWS objects according to your company's policies. [IMPORTANT] ==== -The steps for performing a user-provisioned infrastructure installation are provided as an example only. Installing a cluster with infrastructure you provide requires knowledge of the cloud provider and the installation process of {product-title}. Several CloudFormation templates are provided to assist in completing these steps or to help model your own. You are also free to create the required resources through other methods; the templates are just an example. +The steps for performing a user-provisioned infrastructure installation are an example only. Installing a cluster with your own infrastructure requires knowledge of the cloud provider and the installation process of {product-title}. Several `CloudFormation` templates are available to assist in completing these steps or to help model your own. You are also free to create the required resources through other methods; the templates are just an example. ==== == Prerequisites -* You reviewed details about the xref:../../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] processes. -* You read the documentation on xref:../../../installing/overview/installing-preparing.adoc#installing-preparing[selecting a cluster installation method and preparing it for users]. -* You xref:../../../installing/installing_aws/installing-aws-account.adoc#installing-aws-account[configured an AWS account] to host the cluster. +* You reviewed details about the {product-title} installation and update processes. +* You read the documentation on selecting a cluster installation method and preparing it for users. +* You configured an AWS account to host the cluster. + [IMPORTANT] ==== -If you have an AWS profile stored on your computer, it must not use a temporary session token that you generated while using a multi-factor authentication device. The cluster continues to use your current AWS credentials to create AWS resources for the entire life of the cluster, so you must use key-based, long-term credentials. To generate appropriate keys, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html[Managing Access Keys for IAM Users] in the AWS documentation. You can supply the keys when you run the installation program. +If you have an AWS profile stored on your computer, it must not use a temporary session token that you generated while using a multifactor authentication device. The cluster continues to use your current AWS credentials to create AWS resources for the entire life of the cluster, so you must use key-based, long-term credentials. To generate appropriate keys, see Managing Access Keys for IAM Users in the AWS documentation. You can supply the keys when you run the installation program. ==== -* You xref:../../../installing/installing_aws/upi/upi-aws-installation-reqs#upi-aws-installation-reqs[prepared the user-provisioned infrastructure.] -* You downloaded the AWS CLI and installed it on your computer. See link:https://docs.aws.amazon.com/cli/latest/userguide/install-bundle.html[Install the AWS CLI Using the Bundled Installer (Linux, macOS, or UNIX)] in the AWS documentation. -* If you use a firewall, you xref:../../../installing/install_config/configuring-firewall.adoc#configuring-firewall-module_configuring-firewall[configured it to allow the sites] that your cluster requires access to. +* You prepared the user-provisioned infrastructure. +* You downloaded the AWS CLI and installed it on your computer. +* If you use a firewall, you configured it to allow the sites that your cluster requires access to. + [NOTE] ==== Be sure to also review this site list if you are configuring a proxy. ==== -* If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, you can xref:../../../installing/installing_aws/ipi/installing-aws-customizations.adoc#manually-create-iam_installing-aws-customizations[manually create and maintain long-term credentials]. +* If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, you can manually create and keep long-term credentials. + +[role="_additional-resources"] +.Additional resources + +* xref:../../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] +* xref:../../../installing/overview/installing-preparing.adoc#installing-preparing[Selecting a cluster installation method and preparing it for users] +* xref:../../../installing/installing_aws/installing-aws-account.adoc#installing-aws-account[Configuring an AWS account] +* xref:../../../installing/installing_aws/upi/upi-aws-installation-reqs.adoc#upi-aws-installation-reqs[Preparing user-provisioned infrastructure] +* xref:../../../installing/install_config/configuring-firewall.adoc#configuring-firewall-module_configuring-firewall[Configuring your firewall] +* xref:../../../installing/installing_aws/ipi/installing-aws-customizations.adoc#manually-create-iam_installing-aws-customizations[Manually creating long-term credentials] +* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html[Managing access keys for IAM Users (AWS documentation)] +* link:https://docs.aws.amazon.com/cli/latest/userguide/install-bundle.html[Install the AWS CLI using the bundled installer (AWS documentation)] include::modules/installation-user-infra-generate.adoc[leveloffset=+1] @@ -45,7 +58,7 @@ include::modules/installation-generate-aws-user-infra-install-config.adoc[levelo [role="_additional-resources"] .Additional resources -* See link:https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html[Configuration and credential file settings] in the AWS documentation for more information about AWS profile and credential configuration. +* link:https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html[Configuration and credential file settings (AWS documentation)] include::modules/installation-configure-proxy.adoc[leveloffset=+2] @@ -62,7 +75,7 @@ include::modules/installation-cloudformation-vpc.adoc[leveloffset=+2] [role="_additional-resources"] .Additional resources -* You can view details about the CloudFormation stacks that you create by navigating to the link:https://console.aws.amazon.com/cloudformation/[AWS CloudFormation console]. +* link:https://console.aws.amazon.com/cloudformation/[AWS `CloudFormation` console] include::modules/installation-creating-aws-dns.adoc[leveloffset=+1] @@ -71,11 +84,11 @@ include::modules/installation-cloudformation-dns.adoc[leveloffset=+2] [role="_additional-resources"] .Additional resources -* You can view details about the CloudFormation stacks that you create by navigating to the link:https://console.aws.amazon.com/cloudformation/[AWS CloudFormation console]. +* link:https://console.aws.amazon.com/cloudformation/[AWS `CloudFormation` console] -* You can view details about your hosted zones by navigating to the link:https://console.aws.amazon.com/route53/[AWS Route 53 console]. +* link:https://console.aws.amazon.com/route53/[AWS Route 53 console] -* link:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ListInfoOnHostedZone.html[Listing public hosted zones({aws-short} documentation)] +* link:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ListInfoOnHostedZone.html[Listing public hosted zones ({aws-short} documentation)] include::modules/installation-creating-aws-security.adoc[leveloffset=+1] @@ -84,7 +97,7 @@ include::modules/installation-cloudformation-security.adoc[leveloffset=+2] [role="_additional-resources"] .Additional resources -* You can view details about the CloudFormation stacks that you create by navigating to the link:https://console.aws.amazon.com/cloudformation/[AWS CloudFormation console]. +* link:https://console.aws.amazon.com/cloudformation/[AWS `CloudFormation` console] include::modules/installation-aws-ami-stream-metadata.adoc[leveloffset=+1] @@ -101,9 +114,9 @@ include::modules/installation-cloudformation-bootstrap.adoc[leveloffset=+2] [role="_additional-resources"] .Additional resources -* You can view details about the CloudFormation stacks that you create by navigating to the link:https://console.aws.amazon.com/cloudformation/[AWS CloudFormation console]. +* link:https://console.aws.amazon.com/cloudformation/[AWS `CloudFormation` console] -* xref:../../../installing/installing_aws/upi/installing-aws-user-infra.adoc#installation-aws-user-infra-rhcos-ami_installing-aws-user-infra[{op-system} AMIs for the AWS infrastructure] +* xref:../../../installing/installing_aws/upi/installing-aws-user-infra.adoc#installation-aws-user-infra-rhcos-ami_installing-aws-user-infra[{op-system} Amazon Machine Images (AMIs) for the AWS infrastructure] include::modules/installation-creating-aws-control-plane.adoc[leveloffset=+1] @@ -112,7 +125,7 @@ include::modules/installation-cloudformation-control-plane.adoc[leveloffset=+2] [role="_additional-resources"] .Additional resources -* You can view details about the CloudFormation stacks that you create by navigating to the link:https://console.aws.amazon.com/cloudformation/[AWS CloudFormation console]. +* link:https://console.aws.amazon.com/cloudformation/[AWS `CloudFormation` console] include::modules/installation-creating-aws-worker.adoc[leveloffset=+1] @@ -131,7 +144,7 @@ include::modules/installation-cloudformation-worker.adoc[leveloffset=+2] [role="_additional-resources"] .Additional resources -* You can view details about the CloudFormation stacks that you create by navigating to the link:https://console.aws.amazon.com/cloudformation/[AWS CloudFormation console]. +* link:https://console.aws.amazon.com/cloudformation/[AWS `CloudFormation` console] include::modules/installation-aws-creating-cloudformation-stack-compute.adoc[leveloffset=+2] @@ -140,11 +153,11 @@ include::modules/installation-aws-user-infra-bootstrap.adoc[leveloffset=+1] [role="_additional-resources"] .Additional resources -* See xref:../../../support/troubleshooting/troubleshooting-installations.adoc#monitoring-installation-progress_troubleshooting-installations[Monitoring installation progress] for details about monitoring the installation, bootstrap, and control plane logs as an {product-title} installation progresses. +* xref:../../../support/troubleshooting/troubleshooting-installations.adoc#monitoring-installation-progress_troubleshooting-installations[Monitoring installation progress] -* See xref:../../../support/troubleshooting/troubleshooting-installations.adoc#gathering-bootstrap-diagnostic-data_troubleshooting-installations[Gathering bootstrap node diagnostic data] for information about troubleshooting issues related to the bootstrap process. +* xref:../../../support/troubleshooting/troubleshooting-installations.adoc#gathering-bootstrap-diagnostic-data_troubleshooting-installations[Gathering bootstrap node diagnostic data] -* You can view details about the running instances that are created by using the link:https://console.aws.amazon.com/ec2[AWS EC2 console]. +* link:https://console.aws.amazon.com/ec2[AWS EC2 console] include::modules/cli-logging-in-kubeadmin.adoc[leveloffset=+1] @@ -154,10 +167,13 @@ include::modules/installation-operators-config.adoc[leveloffset=+1] include::modules/installation-registry-storage-config.adoc[leveloffset=+2] -You can configure registry storage for user-provisioned infrastructure in AWS to deploy {product-title} to hidden regions. See xref:../../../registry/configuring_registry_storage/configuring-registry-storage-aws-user-infrastructure.adoc#configuring-registry-storage-aws-user-infrastructure[Configuring the registry for AWS user-provisioned infrastructure] for more information. - include::modules/registry-configuring-storage-aws-user-infra.adoc[leveloffset=+3] +[role="_additional-resources"] +.Additional resources + +* xref:../../../registry/configuring_registry_storage/configuring-registry-storage-aws-user-infrastructure.adoc#configuring-registry-storage-aws-user-infrastructure[Configuring the registry for AWS user-provisioned infrastructure] + include::modules/installation-registry-storage-non-production.adoc[leveloffset=+3] include::modules/installation-aws-user-infra-delete-bootstrap.adoc[leveloffset=+1] @@ -173,16 +189,14 @@ include::modules/logging-in-by-using-the-web-console.adoc[leveloffset=+1] * xref:../../../web_console/web-console.adoc#web-console[Accessing the web console] -[role="_additional-resources"] [id="installing-aws-user-infra-additional-resources"] +[role="_additional-resources"] == Additional resources -* link:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacks.html[Working with stacks({aws-short} documentation)] - -[id="installing-aws-user-infra-next-steps"] -== Next steps +* link:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacks.html[Working with stacks ({aws-short} documentation)] +* xref:../../../installing/validation_and_troubleshooting/validating-an-installation.adoc#validating-an-installation[Validating an installation] +* xref:../../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customizing your cluster] +* xref:../../../support/remote_health_monitoring/remote-health-reporting.adoc#remote-health-reporting[Remote health reporting] +* xref:../../../post_installation_configuration/changing-cloud-credentials-configuration.adoc#manually-removing-cloud-creds_changing-cloud-credentials-configuration[Removing cloud provider credentials] -* xref:../../../installing/validation_and_troubleshooting/validating-an-installation.adoc#validating-an-installation[Validating an installation]. -* xref:../../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customize your cluster]. -* If necessary, you can xref:../../../support/remote_health_monitoring/remote-health-reporting.adoc#remote-health-reporting[Remote health reporting]. -* If necessary, you can xref:../../../post_installation_configuration/changing-cloud-credentials-configuration.adoc#manually-removing-cloud-creds_changing-cloud-credentials-configuration[remove cloud provider credentials]. +:!platform: \ No newline at end of file diff --git a/installing/installing_aws/upi/upi-aws-installation-reqs.adoc b/installing/installing_aws/upi/upi-aws-installation-reqs.adoc index 5c8d860408a..4e5b3528eb8 100644 --- a/installing/installing_aws/upi/upi-aws-installation-reqs.adoc +++ b/installing/installing_aws/upi/upi-aws-installation-reqs.adoc @@ -6,10 +6,10 @@ include::_attributes/common-attributes.adoc[] toc::[] -Before you begin an installation on infrastructure that you provision, be sure that your AWS environment meets the following installation requirements. +[role="_abstract"] +Before you install {product-title} on infrastructure that you provision, ensure that your {aws-first} environment meets the installation requirements. -For a cluster that contains user-provisioned infrastructure, you must deploy all -of the required machines. +For a cluster that has user-provisioned infrastructure, you must deploy all of the required machines. include::modules/installation-machine-requirements.adoc[leveloffset=+1] diff --git a/microshift_running_apps/microshift-cert-manager-trust-manager.adoc b/microshift_running_apps/microshift-cert-manager-trust-manager.adoc new file mode 100644 index 00000000000..e55f010c763 --- /dev/null +++ b/microshift_running_apps/microshift-cert-manager-trust-manager.adoc @@ -0,0 +1,31 @@ +:_mod-docs-content-type: ASSEMBLY +[id="microshift-cert-manager-trust-manager"] += Distributing certificates by using trust-manager operand +include::_attributes/common-attributes.adoc[] +:context: cert-manager-trust-manager + +[role="_abstract"] +The trust-manager operand simplifies the distribution of certificate authority (CA) certificates across {product-title} clusters. As an administrator, you can configure the operand according to the cluster requirements and manage trust bundles efficiently. + +:FeatureName: Distributing certificates by using trust manager +include::snippets/technology-preview.adoc[leveloffset=+1] + +The trust-manager operand provides the following benefits: + +* Distribution of CA certificates across your cluster as a Day 2 operation. + +* Consolidation of certificates from multiple sources, such as ConfigMaps, Secrets, inline data, and default CAs, into a single trust bundle. + +* Automatic updates to target objects whenever the underlying source certificates change. + +* Creation of trust bundles as secret objects for applications that explicitly require secrets instead of ConfigMap objects. + +* Automatic integration with the default trusted CA bundle of the cluster, requiring no manual configuration. + +include::modules/cert-manager-trust-manager-install.adoc[leveloffset=+1] + +include::modules/cert-manager-configure-trust-bundle.adoc[leveloffset=+1] + +include::modules/cert-manager-trust-manager-uninstall.adoc[leveloffset=+1] + +include::modules/cert-manager-trust-manager-fields.adoc[leveloffset=+1] \ No newline at end of file diff --git a/modules/installation-aws-ami-stream-metadata.adoc b/modules/installation-aws-ami-stream-metadata.adoc index ba299beb24f..242ad871a5a 100644 --- a/modules/installation-aws-ami-stream-metadata.adoc +++ b/modules/installation-aws-ami-stream-metadata.adoc @@ -17,17 +17,15 @@ You can use the `coreos print-stream-json` sub-command of `openshift-install` to For user-provisioned installations, the `openshift-install` binary contains references to the version of {op-system} boot images that are tested for use with {product-title}, such as the {aws-first} AMI. -.Procedure - To parse the stream metadata, use one of the following methods: +.Procedure + * From a Go program, use the official `stream-metadata-go` library at https://github.com/coreos/stream-metadata-go. You can also view example code in the library. * From another programming language, such as Python or Ruby, use the JSON library of your preferred programming language. -* From a command-line utility that handles JSON data, such as `jq`: - -** Print the current `x86_64` +* From a command-line utility that handles JSON data, such as `jq`, print the current `x86_64` ifndef::openshift-origin[] or `aarch64` endif::openshift-origin[]