Add servicelog template for Karpenter IAM role misconfiguration#406
Add servicelog template for Karpenter IAM role misconfiguration#406clcollins wants to merge 2 commits intoopenshift:masterfrom
Conversation
Add a new servicelog template to notify customers when the Karpenter operator IAM role is misconfigured in AWS. This error prevents the Karpenter pod from assuming its IAM role via STS AssumeRoleWithWebIdentity, resulting in access denied errors. The template includes: - Critical severity notification - Clear description of the issue and required customer action - Link to documentation on configuring operator IAM roles and OIDC trust Related: openshift/ops-sop#3916 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: clcollins The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
The validation script requires the description field to end with a period. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
@clcollins: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| "service_name": "SREManualAction", | ||
| "log_type": "cluster-configuration", | ||
| "summary": "Action required: Fix Karpenter operator IAM role configuration", | ||
| "description": "Your ROSA HCP cluster requires you to take action because the Karpenter operator IAM role is misconfigured in AWS, preventing the Karpenter component from functioning correctly. The Karpenter pod is unable to assume its IAM role via STS AssumeRoleWithWebIdentity, resulting in access denied errors. Please verify the Karpenter operator role's trust policy allows the cluster's OIDC provider to assume the role, and ensure the permissions policy matches the required policy for ROSA HCP operator roles. Review the documentation on configuring operator IAM roles and OIDC trust relationships: https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/install_rosa_with_hcp_clusters/rosa-hcp-sts-creating-a-cluster-quickly#rosa-sts-creating-operator-roles-and-policies_rosa-hcp-sts-creating-a-cluster-quickly.", |
There was a problem hiding this comment.
Seems there is no such quick link rosa-sts-creating-operator-roles-and-policies_rosa-hcp-sts-creating-a-cluster-quickly in page https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/install_rosa_with_hcp_clusters/rosa-hcp-sts-creating-a-cluster-quickly
2 participants
Summary
Add a new servicelog template to notify customers when the Karpenter operator IAM role is misconfigured in AWS, preventing the Karpenter component from functioning correctly.
Changes
hcp/karpenter_iam_role_misconfigured.jsonTemplate Details
Severity: Critical
Service: SREManualAction
Log Type: cluster-configuration
The template is triggered when the Karpenter pod cannot assume its IAM role via STS AssumeRoleWithWebIdentity, resulting in 403 AccessDenied errors.
Related PRs
Test plan
🤖 Generated with Claude Code