Skip to content

Commit

Permalink
Merge branch 'master' into workspace-refactor
Browse files Browse the repository at this point in the history
  • Loading branch information
lennessyy authored Dec 20, 2024
2 parents dc8b2fe + 3ddd13a commit e5951b1
Showing 8 changed files with 641 additions and 456 deletions.
96 changes: 96 additions & 0 deletions _partials/self-hosted/_aws-sts-config.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,96 @@
---
partial_category: self-hosted
partial_name: sts-config
---

{props.edition} allows tenants to use AWS Secret Token Service (STS) to add AWS cloud accounts to their {props.edition} environment.
In order to do this, {props.edition} relies on another AWS cloud account that is configured on the {props.edition} instance
to assume a custom role created on the tenant's AWS account.

This custom role establishes a trust relationship between the tenant's AWS account and the AWS account bound to the {props.edition} instance.
It allows the {props.edition}-bound AWS account to receive temporary credentials from the tenant's AWS account to deploy infrastructure in AWS using STS. For more information on how to add an AWS cloud account to a tenant using STS, refer to the <VersionedLink text="Add an AWS Account to Palette" url="/clusters/public-cloud/aws/add-aws-accounts/" /> guide.

You must configure your {props.edition} instance with an STS AWS account before your tenants can add AWS cloud accounts
to deploy clusters in AWS using STS. Without this configuration, the STS option will be greyed out when your tenants try to add an AWS account.

## Prerequisites

- Access to the {props.edition} system console.

- The role of Root Administrator or Account Administrator.

- An AWS IAM user that is allowed to assume cross-account IAM roles.

## Enable Adding AWS Accounts Using STS

1. Open a terminal session.

2. Log in to the {props.edition} System API by using the `/v1/auth/syslogin` endpoint.
Use the curl command below and replace the `example.com` placeholder URL with the URL of your {props.edition} instance.
Ensure you replace the credentials below with your system console credentials.

```shell
TOKEN=$(curl --insecure --location 'https://example.com/v1/auth/syslogin' \
--header 'Content-Type: application/json' \
--data '{
"password": "**********",
"username": "**********"
}')
```

3. Next, prepare a payload for the AWS account you want to configure.
Use the following JSON payload as a template and replace the `accessKey`, `secretKey`, and `accountId` fields with the AWS access key, secret key, and account ID of your AWS account.

```json
CONFIG_JSON=$(cat <<EOF
{
"accessKey": "**********",
"secretKey": "**********",
"accountId": "123456789"
}
EOF
)
```

This avoids exposing sensitive information in the command line.

2. Issue the following command to invoke the {props.edition} API to configure the AWS account to your instance.

<Tabs>

<TabItem value="AWS">

```bash
curl --request POST \
--url https://<palette-api-url>/v1/system/config/aws/account \
--header 'Authorization: $TOKEN' \
--data '$CONFIG_JSON'
```

</TabItem>

<TabItem value="AWS GOV">

```bash
curl --request POST \
--url https://<palette-api-url>/v1/system/config/awsgov/sts/account \
--header 'Authorization: $TOKEN' \
--data '$CONFIG_JSON'
```

</TabItem>

</Tabs>


## Validate

Issue the following command to make an API call that confirms that the credentials were configured successfully.

```bash
curl --request POST \
--url https://<palette-api-url>/v1/system/config/aws/account \
--header 'Authorization: $TOKEN'
```

If you receive a response that contains the payload you configured, the configuration was successful.
Original file line number Diff line number Diff line change
@@ -20,8 +20,6 @@ To support dynamic credentials with AWS, Palette uses the AWS Security Token Ser
can use AWS STS when adding an S3 bucket as the backup location. The following sections outline the prerequisites and
provide detailed steps to add an S3 bucket as the backup location using the STS authentication method.

<br />

:::warning

Palette supports AWS STS only when your Palette’s hosting environment and the backup location service provider are the
@@ -46,6 +44,11 @@ cloud account.

### Prerequisites

- If you are using a self-hosted Palette or Vertex instance, you must configure an AWS account at the instance-level to
allow tenants to add AWS accounts using STS. For more information, refer to
[Enable Adding AWS Accounts Using STS - Palette](../../../enterprise-version/system-management/configure-aws-sts-account.md)
or [Enable Adding AWS Accounts Using STS - VerteX](../../../vertex/system-management/configure-aws-sts-account.md)

- Both your Palette environment instance and the S3 bucket are hosted on AWS. This prerequisite is more applicable to
self-hosted Palette and Palette VerteX customers. Palette SaaS in hosted in an AWS environment.

@@ -114,8 +117,6 @@ cloud account.

:::

<br />

### Instructions

1. Log in to [Palette](https://console.spectrocloud.com/).
@@ -194,8 +195,6 @@ AWS STS to authenticate Palette with the S3 bucket in the same AWS account you d
4. Search for the newly added backup location in the list. The presence of the backup location validates that you
successfully added a new backup location.

<br />

## Multiple Cloud Accounts with AWS STS

Suppose your Kubernetes cluster is deployed in _AWS Account A_, and you want to create the backup in _AWS Account B_,
@@ -220,10 +219,13 @@ A multi-cloud account scenario requires you to perform the following authenticat
Use the following steps to add an S3 bucket as the backup location using the STS authentication method when you have
multiple cloud accounts.

<br />

### Prerequisites

- If you are using a self-hosted Palette or Vertex instance, you must configure an AWS account at the instance-level to
allow tenants to add AWS accounts using STS. For more information, refer to
[Enable Adding AWS Accounts Using STS - Palette](../../../enterprise-version/system-management/configure-aws-sts-account.md)
or [Enable Adding AWS Accounts Using STS - VerteX](../../../vertex/system-management/configure-aws-sts-account.md)

- Both your Palette environment instance and the S3 bucket are hosted on AWS. This prerequisite is more applicable to
self-hosted Palette and Palette VerteX customers. Palette SaaS is hosted in an AWS environment.

40 changes: 24 additions & 16 deletions docs/docs-content/clusters/public-cloud/aws/add-aws-accounts.md
Original file line number Diff line number Diff line change
@@ -49,6 +49,10 @@ Use the steps below to add an AWS cloud account using Security Token Service (ST

#### Prerequisites

- If you are using a self-hosted instance of Palette or VerteX, you must configure an AWS account at the instance-level
to allow tenants to add AWS accounts using STS. For more information, refer to
[Enable Adding AWS Accounts Using STS - Palette](../../../enterprise-version/system-management/configure-aws-sts-account.md)
or [Enable Adding AWS Accounts Using STS - VerteX](../../../vertex/system-management/configure-aws-sts-account.md)
- An AWS account.
- Sufficient access to create an IAM role or IAM user.
- Palette IAM policies. Review the [Required IAM Policies](required-iam-policies.md) section for guidance.
@@ -70,14 +74,14 @@ Use the steps below to add an AWS cloud account using Security Token Service (ST
5. You will be provided with information on the right side of the wizard. You will need this information to create an
IAM Role for Palette. The following table lists the information provided by the wizard after you select **STS**.

| **Parameter** | **Description** |
| ----------------------- | ------------------------------------------------ |
| **Trusted Entity Type** | Another AWS account |
| **Account ID** | Copy the Account ID displayed on the UI |
| **Require External ID** | Enable |
| **External ID** | Copy the External ID displayed on the UI |
| **Permissions Policy** | Search and select the 4 policies added in step 2 |
| **Role Name** | SpectroCloudRole |
| **Parameter** | **Description** |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Trusted Entity Type** | Another AWS account. |
| **Account ID** | Copy the Account ID displayed on the UI. If using a self-hosted instance, this is the same AWS account that you configured for your Palette or VerteX instance to enable STS. |
| **Require External ID** | Enable. |
| **External ID** | Copy the External ID displayed on the UI. This ID is generated by Palette or VerteX and is different per tenant. |
| **Permissions Policy** | Search and select the 4 policies added in step 2. |
| **Role Name** | SpectroCloudRole. |

6. In the AWS console, create a new IAM role for Palette. Use the following resources if you need additional help.

@@ -161,6 +165,10 @@ Use the steps below to add an AWS cloud account using STS credentials.

#### Prerequisites

- If you are using a self-hosted instance of Palette or VerteX, you must configure an AWS account at the instance-level
to allow tenants to add AWS accounts using STS. For more information, refer to
[Enable Adding AWS Accounts Using STS - Palette](../../../enterprise-version/system-management/configure-aws-sts-account.md)
or [Enable Adding AWS Accounts Using STS - VerteX](../../../vertex/system-management/configure-aws-sts-account.md)
- An AWS account
- Sufficient access to create an IAM role or IAM user.
- Palette IAM policies. Please review the [Required IAM Policies](required-iam-policies.md) section for guidance.
@@ -182,14 +190,14 @@ Use the steps below to add an AWS cloud account using STS credentials.
5. You will be provided with information on the right side of the wizard. You will need this information to create an
IAM Role for Palette. The following table lists the information provided by the wizard after you select **STS**.

| **Parameter** | **Description** |
| ----------------------- | ------------------------------------------------- |
| **Trusted Entity Type** | Another AWS account |
| **Account ID** | Copy the Account ID displayed on the UI |
| **Require External ID** | Enable |
| **External ID** | Copy the External ID displayed on the UI |
| **Permissions Policy** | Search and select the 4 policies added in step #2 |
| **Role Name** | SpectroCloudRole |
| **Parameter** | **Description** |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Trusted Entity Type** | Another AWS account. |
| **Account ID** | Copy the Account ID displayed on the UI. If using a self-hosted instance, this is the same AWS account that you configured for your Palette or VerteX instance to enable STS. |
| **Require External ID** | Enable. |
| **External ID** | Copy the External ID displayed on the UI. This ID is generated by Palette or VerteX and is different per tenant. |
| **Permissions Policy** | Search and select the 4 policies added in step #2. |
| **Role Name** | SpectroCloudRole. |

6. In the AWS console, create a new IAM role for Palette. Use the following resources if you need additional help.

Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
---
sidebar_label: "Enable Adding AWS Accounts Using STS "
title: "Enable Adding AWS Accounts Using STS "
description: "This page teaches you how to allow tenants to add AWS accounts using STS."
icon: ""
hide_table_of_contents: false
sidebar_position: 20
tags: ["palette", "management", "account", "credentials"]
keywords: ["self-hosted", "palette"]
---

<PartialsComponent category="self-hosted" name="sts-config" edition="Palette" />
4 changes: 4 additions & 0 deletions docs/docs-content/release-notes/release-notes.md
Original file line number Diff line number Diff line change
@@ -394,6 +394,10 @@ guide to learn how to create a Cluster Group.
| ---------------------- | ----------- |
| vSphere No-Provisioner | 1.0.0 |

### Bug Fixes

- Fixed an issue where cluster tags were not propagated to AWS volumes when creating new AWS IaaS clusters.

## October 26, 2024 - Release 4.5.5

### Breaking Changes
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
---
sidebar_label: "Enable Adding AWS Accounts Using STS"
title: "Enable Adding AWS Accounts Using STS "
description: "This page teaches you how to allow tenants to add AWS accounts using STS."
icon: ""
hide_table_of_contents: false
sidebar_position: 20
tags: ["palette", "management", "account", "credentials"]
keywords: ["self-hosted", "vertex"]
---

<PartialsComponent category="self-hosted" name="sts-config" edition="VerteX" />
Loading

0 comments on commit e5951b1

Please sign in to comment.