CORS-4468: aws: automate cluster provisioning with short-term credentials via AWS STS

data/data/install.openshift.io_installconfigs.yaml

@@ -5462,6 +5462,33 @@ spec:
                       - url
                       type: object
                     type: array
+                  sts:
+                    description: |-
+                      STS configures the use of AWS Security Token Service for
+                      short-term credential provisioning. When set, the cluster
+                      components use IAM roles with OIDC-based web identity tokens
+                      instead of long-lived credentials.
+                    properties:
+                      mode:
+                        description: |-
+                          Mode determines how STS resources are provisioned.
+
+                          Following are the accepted values:
+
+                          * "Managed": The installer creates the OIDC provider, IAM roles,
+                          and credential secrets automatically.
+
+                          * "Manual": The user pre-creates all STS resources (e.g. via ccoctl)
+                          and places the manifests in the install directory.
+
+                          If this field is not set explicitly, the default value is "Manual".
+                          This default is subject to change over time.
+                        enum:
+                        - ""
+                        - Managed
+                        - Manual
+                        type: string
+                    type: object
                   subnets:
                     description: |-
                       Subnets specifies existing subnets (by ID) where cluster

go.mod

@@ -154,7 +154,10 @@ require (
 
 require github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute v1.0.0
 
-require github.com/k-orc/openstack-resource-controller/v2 v2.3.0
+require (
+	github.com/go-jose/go-jose/v4 v4.1.4
+	github.com/k-orc/openstack-resource-controller/v2 v2.3.0
+)
 
 require (
 	cel.dev/expr v0.25.1 // indirect
@@ -168,7 +171,6 @@ require (
 	github.com/djherbis/times v1.6.0 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/golangci/plugin-module-register v0.1.2 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect

pkg/asset/cluster/cluster.go

@@ -15,6 +15,7 @@ import (
 	"github.com/openshift/installer/pkg/asset/cluster/azure"
 	"github.com/openshift/installer/pkg/asset/cluster/openstack"
 	"github.com/openshift/installer/pkg/asset/cluster/tfvars"
+	"github.com/openshift/installer/pkg/asset/credentialsrequest"
 	"github.com/openshift/installer/pkg/asset/ignition/bootstrap"
 	"github.com/openshift/installer/pkg/asset/ignition/machine"
 	"github.com/openshift/installer/pkg/asset/installconfig"
@@ -80,6 +81,8 @@ func (c *Cluster) Dependencies() []asset.Asset {
 		new(rhcos.Image),
 		&manifests.Manifests{},
 		&tls.RootCA{},
+		&tls.BoundSASigningKey{},
+		&credentialsrequest.CredentialsRequests{},
 	}
 }
 

pkg/asset/credentialsrequest/aws.go

@@ -0,0 +1,28 @@
+package credentialsrequest
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+
+	ccov1 "github.com/openshift/cloud-credential-operator/pkg/apis/cloudcredential/v1"
+	awstypes "github.com/openshift/installer/pkg/types/aws"
+)
+
+// AWSProviderSpec holds the decoded AWS-specific provider spec
+// from a CredentialsRequest.
+type AWSProviderSpec struct {
+	StatementEntries []ccov1.StatementEntry
+}
+
+func init() {
+	registerProviderSpecDecoder(awstypes.Name, decodeAWSProviderSpec)
+}
+
+func decodeAWSProviderSpec(raw *runtime.RawExtension) (interface{}, error) {
+	awsSpec := &ccov1.AWSProviderSpec{}
+	if err := ccov1.Codec.DecodeProviderSpec(raw, awsSpec); err != nil {
+		return nil, err
+	}
+	return &AWSProviderSpec{
+		StatementEntries: awsSpec.StatementEntries,
+	}, nil
+}