Skip to content

Commit

Permalink
Auth and logging docs nits (#1931)
Browse files Browse the repository at this point in the history
(cherry picked from commit 0f1b6b1)
  • Loading branch information
vishalbollu committed Mar 2, 2021
1 parent 54039fd commit e184ca6
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 12 deletions.
4 changes: 2 additions & 2 deletions docs/clusters/aws/auth.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Cortex client uses the default credential provider chain to get credentials. Cre

### API Management

Cortex client relies an AWS IAM to authenticate requests (e.g. `cortex deploy`, `cortex get`) to a cluster on AWS. The client will include a get-caller-identity request that has been signed with the credentials from the default credential provider chain along with original request. The operator executes the presigned request to verify that credentials are valid and belong to the same account as the IAM entity of the cluster.
Cortex client relies on AWS IAM to authenticate requests (e.g. `cortex deploy`, `cortex get`) to a cluster on AWS. The client will include a get-caller-identity request that has been signed with the credentials from the default credential provider chain along with original request. The operator executes the presigned request to verify that credentials are valid and belong to the same account as the IAM entity of the cluster.

AWS credentials required to authenticate cortex client requests to the operator don't require any permissions. However, managing the cluster using `cortex cluster *` commands do require permissions.

Expand Down Expand Up @@ -56,7 +56,7 @@ When spinning up a cortex cluster, you can provide additional policies to author

If you already have a cluster running and would like to add additional permissions, you can update the policy that is created automatically during `cortex cluster up`. In [IAM console](https://console.aws.amazon.com/iam/home?policies#/policies) search for `cortex-<cluster_name>-<region>` to find the policy that has been attached to your cluster. Adding more permissions to this policy will automatically give more access to all of your Cortex APIs.

*** NOTE: The policy created during `cortex cluster up` will automatically be deleted during `cortex cluster down`. It is recommended to create your own policies that can be specified in `iam_policy_arns` field in cluster configuration. The precreated policy should only be updated for development and testing purposes. ***
_NOTE: The policy created during `cortex cluster up` will automatically be deleted during `cortex cluster down`. It is recommended to create your own policies that can be specified in `iam_policy_arns` field in cluster configuration. The precreated policy should only be updated for development and testing purposes._

`cortex cluster up` will create a default policy which is the minimum set of IAM permissions to run your APIs and various processes on the cluster such as the operator and fluent-bit. Fields from your AWS account and cluster configuration will be used to populate the policy below.

Expand Down
10 changes: 0 additions & 10 deletions docs/workloads/observability/logging.md
Original file line number Diff line number Diff line change
Expand Up @@ -77,16 +77,6 @@ labels.apiKind="RealtimeAPI"
labels.apiName="<INSERT API NAME>"
```

**BatchAPI:**

```text
resource.type="k8s_container"
resource.labels.cluster_name="<INSERT CLUSTER NAME>"
labels.apiKind="BatchAPI"
labels.apiName="<INSERT API NAME>"
labels.jobID="<INSERT JOB ID>"
```

**TaskAPI:**

```text
Expand Down

0 comments on commit e184ca6

Please sign in to comment.