Deploying applications with Amazon Controller for Kubernetes (ACK)

AWS Controllers for Kubernetes (ACK) let you define and use AWS service resources directly from Red Hat OpenShift Service on AWS. With ACK, you can take advantage of AWS-managed services for your applications without needing to define resources outside of the cluster or run services that provide supporting capabilities such as databases or message queues within the cluster.

You can install various ACK Operators directly from the software catalog. This makes it easy to get started and use the Operators with your applications.

In this tutorial, let’s deploy the ACK S3 Operator.

Prerequisites:

• A successfully deployed application on a ROSA cluster

In this learning path, you will:

• Understand ACK architecture and benefits.
• Install and configure ACK Operators from the OpenShift software catalog.
• Create identity access management (IAM) trust policies and roles for ACK service account integration.
• Deploy AWS resources (S3 buckets) directly from Kubernetes manifests using AC.
• Verify AWS resource creation through ACK Operators.
• Implement GitOps patterns for AWS infrastructure provisioning.

Set up environment variables

Configure the following environment variables, changing the cluster name to suit your cluster: 

export CLUSTER_NAME=$(oc get infrastructure cluster -o=jsonpath="{.status.apiServerURL}" | awk -F '.' '{print $2}')
export REGION=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .region.id)
export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o json | jq -r .spec.serviceAccountIssuer | sed  's|^https://||')
export AWS_ACCOUNT_ID=`aws sts get-caller-identity --query Account --output text`
export ACK_SERVICE=s3
export ACK_SERVICE_ACCOUNT=ack-${ACK_SERVICE}-controller
export POLICY_ARN=arn:aws:iam::aws:policy/AmazonS3FullAccess
export AWS_PAGER=""
export SCRATCH="/tmp/${CLUSTER_NAME}/ack"
mkdir -p ${SCRATCH}

Ensure all fields output correctly before moving to the next section.

echo "Cluster: ${CLUSTER_NAME}, Region: ${REGION}, OIDC Endpoint: ${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"

Prepare AWS account

Create an AWS IAM trust policy for the ACK Operator:

cat <<EOF > "${SCRATCH}/trust-policy.json"
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Condition": {
   "StringEquals" : {
     "${OIDC_ENDPOINT}:sub": "system:serviceaccount:ack-system:${ACK_SERVICE_ACCOUNT}"
   }
 },
 "Principal": {
   "Federated": "arn:aws:iam::$AWS_ACCOUNT_ID:oidc-provider/${OIDC_ENDPOINT}"
 },
 "Action": "sts:AssumeRoleWithWebIdentity"
 }
 ]
}
EOF

Create an AWS IAM role for the ACK Operator to assume with the AmazonS3FullAccess policy attached.

ROLE_ARN=$(aws iam create-role --role-name "ack-${ACK_SERVICE}-controller" \
   --assume-role-policy-document "file://${SCRATCH}/trust-policy.json" \
   --query Role.Arn --output text)
echo $ROLE_ARN

aws iam attach-role-policy --role-name "ack-${ACK_SERVICE}-controller" \
     --policy-arn ${POLICY_ARN}

Install the ACK S3 Controller

Create a project to install the ACK S3 Operator into.

oc new-project ack-system

Create a file with the ACK S3 Operator configuration

cat << EOF > "${SCRATCH}/config.txt"
ACK_ENABLE_DEVELOPMENT_LOGGING=true
ACK_LOG_LEVEL=debug
ACK_WATCH_NAMESPACE=
AWS_REGION=${REGION}
AWS_ENDPOINT_URL=
ACK_RESOURCE_TAGS=
ENABLE_LEADER_ELECTION=true
LEADER_ELECTION_NAMESPACE=
RECONCILE_DEFAULT_MAX_CONCURRENT_SYNCS=1
FEATURE_FLAGS=
FEATURE_GATES=
ENABLE_CARM=false
EOF

Use the file from the previous step to create a ConfigMap.

oc -n ack-system create configmap \
  --from-env-file=${SCRATCH}/config.txt ack-${ACK_SERVICE}-user-config

Install the ACK S3 Operator from the software catalog:

cat << EOF | oc apply -f -
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: ack-${ACK_SERVICE}-controller
  namespace: ack-system
spec:
  upgradeStrategy: Default
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: ack-${ACK_SERVICE}-controller
  namespace: ack-system
spec:
  channel: alpha
  installPlanApproval: Automatic
  name: ack-${ACK_SERVICE}-controller
  source: community-operators
  sourceNamespace: openshift-marketplace
EOF

Verify that the ACK S3 Operator is running.

oc -n ack-system get pods

Sample output:

NAME                                 READY   STATUS    RESTARTS   AGE
ack-s3-controller-585f6775db-s4lfz   1/1     Running   0          51s

Validate the deployment

Deploy an S3 bucket resource

cat << EOF | oc apply -f -
apiVersion: s3.services.k8s.aws/v1alpha1
kind: Bucket
metadata:
   name: ${CLUSTER_NAME}-bucket
   namespace: ack-system
spec:
   name: ${CLUSTER_NAME}-bucket
EOF

Verify the S3 bucket was created in AWS

aws s3 ls | grep ${CLUSTER_NAME}-bucket

Sample output:

2025-10-04 14:51:45 mrmc-test-maz-bucket

Get more support

• Red Hat OpenShift Service on AWS frequently asked questions
• Troubleshoot with Red Hat support
• Troubleshoot with AWS support

More OpenShift resources

• Build, run, and scale container-based applications
• 4 reasons to run applications on ROSA
• OpenShift interactive learning paths
• Explore more OpenShift on AWS learning materials
• ROSA Lightboard videos​​​​​​​