OSDOCS-1871 Supplying predefined IAM roles to the cluster

[codyhoag]

https://issues.redhat.com/browse/OSDOCS-1871

Previews:

• New install-config fields added
• New section for required AWS IAM role permissions

[netlify]

Deploy preview for osdocs ready!

Built with commit 7b3d618

https://deploy-preview-31702--osdocs.netlify.app

[codyhoag]

@staebler PTAL. Thanks!

[yunjiang29]

I got a question regarding sts:AssumeRole, the sts:AssumeRole is the default permission when creating a role via web console (without any attached policy):

aws iam get-role --role-name yunjiang-test2
{
    "Role": {
        "Path": "/",
        "RoleName": "yunjiang-test2",
        "RoleId": "AROAUMQAHCJOPRPODCRBR",
        "Arn": "arn:aws:iam::301721915996:role/yunjiang-test2",
        "CreateDate": "2021-04-21T06:59:17+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "ec2.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "Description": "Allows EC2 instances to call AWS services on your behalf.",
        "MaxSessionDuration": 3600,
        "RoleLastUsed": {}
    }
}

In the previous IPI way, installer will also create a similar role as above, and attach an external policy which does not contain sts:AssumeRole permission.

My question is, do we need to add sts:AssumeRole permission in the document explicitly?

[codyhoag]

I'll defer to @staebler. Any thoughts on the previous comment, and any feedback on the PR in general? Thanks!

[staebler]

My question is, do we need to add sts:AssumeRole permission in the document explicitly?

If the permission is required, then we should document it explicitly, even if it is the default. Unless you cannot have an IAM role that does not have the sts:AssumeRole permission.

[codyhoag]

@yunjiang29 Do you have any further comments on this PR? Thanks!

[yunjiang29]

My question is, do we need to add sts:AssumeRole permission in the document explicitly?

If the permission is required, then we should document it explicitly, even if it is the default. Unless you cannot have an IAM role that does not have the sts:AssumeRole permission.

Get it, thanks @staebler

[yunjiang29]

@codyhoag LGTM

[codyhoag]

/cherrypick enterprise-4.8

[openshift-cherrypick-robot]

@codyhoag: new pull request created: #32093

Details

In response to this:

/cherrypick enterprise-4.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.