Introduction to Red Hat OpenShift Service on AWS (ROSA)

The Cloud Credential Operator simplifies the configuration of credentials in the cloud provider infrastructure. The project develops the ccoctl command that you download from the Red Hat Hybrid Cloud Console at https://console.redhat.com/openshift/downloads.

You can then use the ccoctl command to create the IAM resources that Vector requires to access the CloudWatch API.

Use the ccoctl command as follows:

Instead of using the ccoctl command, you can create the IAM resources by using aws commands. Because the ccoctl command is available only for Linux, using the AWS CLI is the only available method for other operating systems.

The following steps describe the process of creating the required AWS resources:

The ROSA creation process creates the openshift-logging namespace and the operator group. To deploy Red Hat OpenShift Logging from the command line, you need to create only the Subscription resource for the operator.

The following logging-operator.yaml file declares the Subscription resource:

---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: cluster-logging
  namespace: openshift-logging
spec:
  channel: "stable"
  installPlanApproval: Automatic
  name: cluster-logging
  source: redhat-operators
  sourceNamespace: openshift-marketplace

Use the oc apply command to deploy the operator.

$ oc apply -f logging-operator.yaml

Monitor the installation process by inspecting the related ClusterServiceVersion object. The installation completes when the PHASE column displays the Succeeded status.

$ oc get csv -n openshift-logging
NAME                      DISPLAY                      VERSION  ...   PHASE
cluster-logging.v5.6.5    Red Hat OpenShift Logging    5.6.5    ...   Succeeded
...output omitted...

You configure Vector by creating a ClusterLogForwarder resource. The following vector-conf.yaml file declares the instance object:

apiVersion: "logging.openshift.io/v1"
kind: ClusterLogForwarder
metadata:
  name: instance 
  namespace: openshift-logging
spec:
  outputs:
    - name: cw 
      type: cloudwatch
      cloudwatch: 
        groupBy: namespaceName 
        groupPrefix: rosa-mycluster 
        region: us-east-1 
      secret:
        name: cloudwatch-credentials 
  pipelines:
    - name: to-cloudwatch
      inputRefs: 
        - infrastructure
        - audit
        - application
      outputRefs:
        - cw 

Use the oc apply command to create the resource:

$ oc apply -f vector-conf.yaml

Configure the logging subsystem by creating a ClusterLogging CR. The name of the resource must be instance. The following logging-conf.yaml file declares this resource:

apiVersion: logging.openshift.io/v1
kind: ClusterLogging
metadata:
  name: instance
  namespace: openshift-logging
spec:
  collection:
    logs:
      type: vector
  managementState: Managed

Use the oc apply command to create the resource:

$ oc apply -f logging-conf.yaml

From the command line, use the aws logs command.

CloudWatch organizes the logs into groups:

$ aws logs describe-log-groups
{
    "logGroups": [
        {
            "logGroupName": "rosa-mycluster.audit",
            "creationTime": 1682067556160,
            "metricFilterCount": 0,
            "arn": "arn:aws:logs:...:log-group:rosa-mycluster.audit:*",
            "storedBytes": 0
        },
        {
            "logGroupName": "rosa-mycluster.application",
            "creationTime": 1682067555259,
            "metricFilterCount": 0,
            "arn": "arn:aws:logs:...:log-group:rosa-mycluster.application:*",
            "storedBytes": 0
        },
        {
            "logGroupName": "rosa-mycluster.infrastructure",
            "creationTime": 1682067555259,
            "metricFilterCount": 0,
            "arn": "arn:aws:logs:...:log-group:rosa-mycluster.infrastructure:*",
            "storedBytes": 0
        }
    ]
}

In each group, CloudWatch organizes the logs into streams. A stream groups the messages for a pod or for a node, for example.

The following command lists the streams in the rosa-mycluster.infrastructure group. The logStreamName attribute includes the name of the pods and their namespace, or the name of a node and the log type.

$ aws logs describe-log-streams --log-group-name rosa-mycluster.infrastructure
{
    "logStreams": [
        {
            "logStreamName": "ip-10-0-148-7.ec2.internal.kubernetes.var.log.pods.openshift-apiserver_apiserver-785568cf5-lsbzj_b90...1ded.openshift-apiserver.0.log",
            "creationTime": 1682351719884,
            "firstEventTimestamp": 1682351859573,
            "lastEventTimestamp": 1682407432799,
...output omitted...
        },
...output omitted...
        {
            "logStreamName": "ip-10-0-237-202.journal.system",
            "creationTime": 1682351707381,
            "firstEventTimestamp": 1682351706888,
            "lastEventTimestamp": 1682410840958,
...output omitted...
        },
...output omitted...

To retrieve all the messages in a stream, use the aws logs get-log-events command:

$ aws logs get-log-events --log-group-name rosa-mycluster.infrastructure
  --log-stream-name ip-10-0-237-202.journal.system
{
    "events": [
        {
            "timestamp": 1682410810457,
            "message": "{...}",
            "ingestionTime": 1682410811460
        },
        {
            "timestamp": 1682410810957,
            "message": "{...}",
            "ingestionTime": 1682410811460
        },
...output omitted...

To review the logs of your ROSA cluster, use the AWS Management Console at https://console.aws.amazon.com/.

Important

When you use the AWS Management Console, be sure to select the correct region for your ROSA cluster. Otherwise, you might not find the AWS resources that you are looking for.

Figure 2.22: Select the AWS Region

You access the log messages for your ROSA cluster as follows: