diff --git a/docs/user/README.md b/docs/user/README.md index e6fc4c1e9..0d0e9ecb6 100644 --- a/docs/user/README.md +++ b/docs/user/README.md @@ -67,6 +67,11 @@ The `gcpvpcpeering.cloud-resources.kyma-project.io` CRD describes the VPC Peerin that you can use to peer the Kyma cluster with your Google Cloud project VPC. To learn more, read the [GcpVpcPeering Custom Resource](./resources/04-50-gcp-vpc-peering.md) documentation. +### AwsVpcPeering CR + +The `awsvpcpeering.cloud-resources.kyma-project.io` CRD describes the AWS peering connection +between Kyma and the remote AWS Virtual Network. To learn more, read the [AwsVpcPeering Custom Resource](./resources/04-70-10-aws-vpc-peering.md) documentation. + ### GcpRedisInstance CR The `gcpredisinstance.cloud-resources.kyma-project.io` CRD describes the Redis instance provisioned inside Google Memorystore. To learn more, read the [GcpRedisInstance Custom Resource](./resources/04-60-gcp-redis-instance.md) documentation. diff --git a/docs/user/_sidebar.md b/docs/user/_sidebar.md index c300ed4d9..64ed002cd 100644 --- a/docs/user/_sidebar.md +++ b/docs/user/_sidebar.md @@ -9,15 +9,18 @@ * [GcpNfsBackupSchedule](/cloud-manager/user/resources/04-30-30-gcp-nfs-backup-schedule.md) * [GcpNfsVolumeRestore](/cloud-manager/user/resources/04-90-10-gcp-nfs-volume-restore.md) * [AzureVpcPeering](/cloud-manager/user/resources/04-40-10-azure-vpc-peering.md) + * [AwsVpcPeering](/cloud-manager/user/resources/04-70-10-aws-vpc-peering.md) * [GcpVpcPeering](/cloud-manager/user/resources/04-50-gcp-vpc-peering.md) * [GcpRedisInstance](/cloud-manager/user/resources/04-60-gcp-redis-instance.md) * [Tutorials](/cloud-manager/user/tutorials/README.md) * [Use RWX Volumes in AWS](/cloud-manager/user/tutorials/01-10-aws-nfs-volume.md) * [Use RWX Volumes in GCP](/cloud-manager/user/tutorials/01-20-gcp-nfs-volume.md) + * [Create VPC Peering in Azure](/cloud-manager/user/tutorials/01-30-azure-vpc-peering.md) * [Backup RWX Volumes in GCP](/cloud-manager/user/tutorials/01-70-gcp-nfs-volume-backup.md) * [Create Scheduled Automatic RWX Volume Backups in Google Cloud](/cloud-manager/user/tutorials/01-80-gcp-scheduled-nfs-backup.md) * [Restore RWX Volume Backups in GCP](/cloud-manager/user/tutorials/01-90-gcp-nfs-volume-restore.md) * [Use VPC Peering in Azure](/cloud-manager/user/tutorials/01-30-azure-vpc-peering.md) * [Create VPC Peering in GCP](/cloud-manager/user/tutorials/01-30-gcp-vpc-peering.md) + * [Create VPC Peering in AWS](/cloud-manager/user/tutorials/01-40-aws-vpc-peering.md) * [Glossary](/cloud-manager/user/00-10-glossary.md) diff --git a/docs/user/resources/04-40-10-azure-vpc-peering.md b/docs/user/resources/04-40-10-azure-vpc-peering.md index e26c89b18..91de44a10 100644 --- a/docs/user/resources/04-40-10-azure-vpc-peering.md +++ b/docs/user/resources/04-40-10-azure-vpc-peering.md @@ -1,4 +1,4 @@ -## Azure Vpc Peering +# AzureVpcPeering Custom Resource The `azurevpcpeering.cloud-resources.kyma-project.io` custom resource (CR) specifies the virtual network peering between @@ -34,6 +34,7 @@ This table lists the parameters of the given resource together with their descri | Parameter | Type | Description | |-----------------------------------|------------|---------------------------------------------------------------------------------------------| | **id** | string | Represents the VPC peering name on the Kyma cluster underlying cloud provider subscription. | +| **state** | string | Signifies the current state of CustomObject. | | **conditions** | \[\]object | Represents the current state of the CR's conditions. | | **conditions.lastTransitionTime** | string | Defines the date of the last condition status change. | | **conditions.message** | string | Provides more details about the condition status change. | diff --git a/docs/user/resources/04-70-10-aws-vpc-peering.md b/docs/user/resources/04-70-10-aws-vpc-peering.md new file mode 100644 index 000000000..ff1a29dd8 --- /dev/null +++ b/docs/user/resources/04-70-10-aws-vpc-peering.md @@ -0,0 +1,103 @@ +# AwsVpcPeering Custom Resource + + +The `awsvpcpeering.cloud-resources.kyma-project.io` custom resource (CR) specifies the virtual network peering between +Kyma and the remote AWS Virtual Private Cloud (VPC) network. Virtual network peering is only possible within the networks +of the same cloud provider. + +Once an `AwsVpcPeering` CR is created and reconciled, the Cloud Manager controller creates a VPC peering connection in +the Kyma cluster underlying cloud provider account and accepts VPC peering connection in the remote cloud provider account. + +### Authorization + +Cloud Manager must be authorized in the remote cloud provider account to accept VPC peering connection. For cross-account access, +Cloud Manager uses [`AssumeRole`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/assume-role.html). + +1. Create a new role named **CloudManagerPeeringRole** with a trust policy that allows Cloud Manager principal `arn:aws:iam::{194230256199}:user/cloud-manager-peering-ENV` to assume the role. + + **ENV** corresponds to **dev**, **stage**, or **prod**. + + ```json + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::194230256199:user/cloud-manager-peering-ENV" + }, + "Action": "sts:AssumeRole" + } + ] + } + + ``` + +2. Create a new managed policy **CloudManagerPeeringAccess** with the following permissions: + ```json + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "Statement1", + "Effect": "Allow", + "Action": [ + "ec2:AcceptVpcPeeringConnection", + "ec2:DescribeVpcs", + "ec2:DescribeVpcPeeringConnections", + "ec2:DescribeRouteTables", + "ec2:CreateRoute", + "ec2:CreateTags" + ], + "Resource": "*" + } + ] + } + ``` + +3. Attach the **CloudManagerPeeringAccess** policy to the **CloudManagerPeeringRole**. + +### Deleting `AwsVpcPeering` + +Kyma's underlying cloud provider VPC peering connection is deleted as a part of AwsVpcPeering deletion. The remote VPC +peering connection is left hanging, and must be deleted manually. + +## Specification + +This table lists the parameters of the given resource together with their descriptions: + +**Spec:** + +| Parameter | Type | Description | +|---------------------|--------|----------------------------------------------------------------------------------------------| +| **remoteAccountId** | string | Required. Specifies the the Amazon Web Services account ID of the owner of the accepter VPC. | +| **remoteRegion** | string | Required. Specifies the Region code for the accepter VPC. | +| **remoteVpcId** | string | Required. Specifies the ID of the VPC with which you are creating the VPC peering connection | + +**Status:** + +| Parameter | Type | Description | +|-----------------------------------|------------|---------------------------------------------------------------------------------------------| +| **id** | string | Represents the VPC peering name on the Kyma cluster underlying cloud provider subscription. | +| **state** | string | Signifies the current state of CustomObject. | +| **conditions** | \[\]object | Represents the current state of the CR's conditions. | +| **conditions.lastTransitionTime** | string | Defines the date of the last condition status change. | +| **conditions.message** | string | Provides more details about the condition status change. | +| **conditions.reason** | string | Defines the reason for the condition status change. | +| **conditions.status** (required) | string | Represents the status of the condition. The value is either `True`, `False`, or `Unknown`. | +| **conditions.type** | string | Provides a short description of the condition. | + +## Sample Custom Resource + +See an exemplary `AwsVpcPeering` custom resource: + +```yaml +apiVersion: cloud-resources.kyma-project.io/v1beta1 +kind: AwsVpcPeering +metadata: + name: peering-to-vpc-11122233 +spec: + remoteVpcId: vpc-11122233 + remoteRegion: us-west-2 + remoteAccountId: 123456789012 +``` diff --git a/docs/user/resources/README.md b/docs/user/resources/README.md index 579c2ebe5..d1faaff59 100644 --- a/docs/user/resources/README.md +++ b/docs/user/resources/README.md @@ -8,6 +8,7 @@ Cloud Manager custom resources: * [GcpNfsBackupSchedule Custom Resource](./04-30-30-gcp-nfs-backup-schedule.md) * [GcpNfsVolumeRestore Custom Resource](./04-90-10-gcp-nfs-volume-restore.md) * [AzureVpcPeering Custom Resource](./04-40-10-azure-vpc-peering.md) +* [AwsVpcPeering Custom Resource](./04-70-10-aws-vpc-peering.md) * [GcpVpcPeering Custom Resource](./04-50-gcp-vpc-peering.md) * [GcpRedisInstance Custom Resource](./04-60-gcp-redis-instance.md) * [AwsRedisInstance Custom Resource](./04-70-aws-redis-instance.md) diff --git a/docs/user/tutorials/01-40-aws-vpc-peering.md b/docs/user/tutorials/01-40-aws-vpc-peering.md new file mode 100644 index 000000000..6676a4c79 --- /dev/null +++ b/docs/user/tutorials/01-40-aws-vpc-peering.md @@ -0,0 +1,231 @@ +# Create VPC Peering in AWS + +This tutorial explains how to create a VPC peering connection between a remote VPC network and Kyma in AWS. Follow the +steps from this tutorial to create a new VPC network, and VM, and assign required permissions to the provided Kyma account and role in your AWS account. If you want to +use the existing resources instead of creating new ones, adjust variable names accordingly and skip the steps that +create those resources. + +## Prerequisites + +* The Cloud Manager module enabled in your Kyma cluster +* The AWS CLI configured. For instructions, see the [AWS documentation](https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-configure.html). + +## Steps + +1. Set the default AWS CLI profile. + ```shell + export AWS_PROFILE={PROFILE_NAME} + export AWS_DEFAULT_REGION={REGION} + ``` + +2. Create a trust policy document. + ```shell + export PRINCIPAL_PROFILE_AWS_ACCOUNT_ID=194230256199 + export USER_NAME=cloud-manager-peering-dev + cat > trust_policy.json <<- EOF + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::$PRINCIPAL_PROFILE_AWS_ACCOUNT_ID:user/$USER_NAME" + }, + "Action": "sts:AssumeRole" + } + ] + } + EOF + ``` +3. Create **CloudManagerPeeringRole** and attach a trust policy document. + ```shell + export AWS_ROLE_NAME=CloudManagerPeeringRole + aws iam create-role --role-name $AWS_ROLE_NAME --assume-role-policy-document file://./trust_policy.json + ``` +4. Create a policy document that is used to create the policy. + ```shell + cat > accept_policy.json <<- EOF + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ec2:AcceptVpcPeeringConnection", + "ec2:DescribeVpcs", + "ec2:DescribeVpcPeeringConnections", + "ec2:DescribeRouteTables", + "ec2:CreateRoute", + "ec2:CreateTags" + ], + "Resource": "*" + } + ] + } + EOF + ``` + +5. Create a new managed policy for your Amazon Web Services account. + ```shell + aws iam create-policy --policy-name CloudManagerPeeringAccess --policy-document file://./accept_policy.json + ``` +6. Attach the specified managed policy to the specified IAM role. + ```shell + aws iam attach-role-policy --role-name $AWS_ROLE_NAME --policy-arn arn:aws:iam::$REMOTE_ACCOUNT_ID:policy/CloudManagerPeeringAccess + ``` +7. Create a VPC and tag it with a Kyma shoot name. + ```shell + export CIDR_BLOCK=10.3.0.0/16 + export SHOOT_NAME=$(kubectl get cm -n kube-system shoot-info -o jsonpath='{.data.shootName}') + export NODE_NETWORK=$(kubectl get cm -n kube-system shoot-info -o jsonpath='{.data.nodeNetwork}') + export VPC_NAME=my-vpc + export VPC_ID=$(aws ec2 create-vpc --cidr-block $CIDR_BLOCK --tag-specifications ResourceType=vpc,Tags=[{Key=$SHOOT_NAME,Value=""},{Key=Name,Value=$VPC_NAME}] --query Vpc.VpcId --output text) + ``` +8. Create a subnet. + ```shell + export SUBNET_ID=$(aws ec2 create-subnet --vpc-id $VPC_ID --cidr-block $CIDR_BLOCK --query Subnet.SubnetId --output text) + ``` + +9. Run an instance. + ```shell + export INSTANCE_ID=$(aws ec2 run-instances --image-id ami-0c38b837cd80f13bb --instance-type t2.micro --subnet-id $SUBNET_ID --query "Instances[0].InstanceId" --output text) + export IP_ADDRESS=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID --query "Reservations[0].Instances[0].PrivateIpAddress" --output text) + ``` +10. Allow ICMP traffic from Kyma Pods. + ```shell + export SG_ID=$(aws ec2 describe-security-groups --filters Name=vpc-id,Values=$VPC_ID --query "SecurityGroups[0].GroupId" --output text) + aws ec2 authorize-security-group-ingress --group-id $SG_ID --ip-permissions IpProtocol=icmp,FromPort=-1,ToPort=-1,IpRanges="[{CidrIp=$NODE_NETWORK}]" + ``` + +11. Create an AwsVpcPeering resource. + ```shell + export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) + kubectl apply -f - <