[doc] 3.3.2 Deploying the Infrastructure

[zoopster]

In this section if you leave the iam_profile_master and iam_profile_worker empty, TF does not create the proper IAM Profile even with explicit IAM_Passthru rights or the use of root credentials.
The deployment will fail with a "cannot attach profile" error.
If you add/uncomment these lines, the deployment will finish however the skuba node bootstrap will fail with a error listing instances error.

3.3.2 Deploying the Infrastructure

https://documentation.suse.com/suse-caasp/4.1/single-html/caasp-deployment/#_deploying_the_infrastructure

[r0ckarong]

@flavio @ereslibre What is going wrong here? What is the correct procedure to do this?

[innobead]

cc @cclhsu @maximenoel8

[cclhsu]

fix issue for aws iam profile [bsc#1169506] (1517) #1058 shoudl fixes this issue.

[r0ckarong]

@cclhsu Does this need any additional docs updates?

[cclhsu]

@r0ckarong No document update required, we only need to update terraform file to properly create iam and instance profile.

[r0ckarong]

@jordimassaguerpla We should add this to the known issues until it's merged.

[jordimassaguerpla]

@r0ckarong Does it need to have some content or just the bug mentioned?

[r0ckarong]

@jordimassaguerpla To do it right, we would have to explain the entire workaround with doing the steps terraform is missing by hand but I'm not sure if you can salvage an already failed deployment that way.
If we just mention the issue then AWS is basically non functional until we ship the patch.

Not sure what to do with the right amount of effort.

@kkaempf What do you think?

[kkaempf]

That's one of the problems with "tech previews". :-/

If we just mention the issue then AWS is basically non functional until we ship the patch.

Well, if it's really non functional, that's embarrassing 🤦

Workaround for now:

• document it in the release notes
• make a fixed package available internally (+ announce it on caasp-internal)
• wait for bug reports

Not perfect, but (imho) a minimal effort approach.

[zoopster]

If you simply document the workaround (setup the instance profile prior) then the fix to the tf files can come later and it's functional until then.

[r0ckarong]

@cclhsu Could you provide the steps required to set up the IAM profile to work around this? I think linking to this specification (https://github.com/kubernetes/cloud-provider-aws#readme) and some steps on how to achieve this on AWS would suffice? Can any user just use the profile examples from the bugzilla thread?

[zoopster]

Through the aws console...it's just a matter of creating a role with the documented policy (in iam_policies.tf) and the instance profile will be created automatically with the same name of the role. That role/instance profile name needs to be added to the terraform.tfvars (where the commented caasp-k8s-master-vm-profile is noted). If you need specific docs...happy to create them...