Skip to content

Commit 161d0f0

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #83582 from mletalie/OSDOCS-9401
[OSDOCS-9401]:Document support for Private Service Connect on OSD-GCP
2 parents 053f737 + 7aa8735 commit 161d0f0

File tree

6 files changed

+105
-0
lines changed

6 files changed

+105
-0
lines changed

‎_topic_maps/_topic_map_osd.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,8 @@ Distros: openshift-dedicated
121121
Topics:
122122
- Name: Creating a cluster on AWS
123123
File: creating-an-aws-cluster
124+
- Name: Creating a GCP Private Service Connect enabled private cluster
125+
File: creating-a-gcp-psc-enabled-private-cluster
124126
- Name: Creating a cluster on GCP
125127
File: creating-a-gcp-cluster
126128
- Name: Configuring your identity providers

‎images/psc-arch-overview.png

240 KB
Loading

‎modules/private-service-connect-create.adoc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * osd_install_access_delete_cluster/creating-a-gcp-psc-enabled-private-cluster.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="private-service-connect-create"]
7+
= Creating a private cluster with Private Service Connect
8+
9+
Private Service Connect is supported with the Customer Cloud Subscription (CCS) infrastructure type only. To create an {product-title} on {GCP} using PSC, see
10+
xref:../osd_install_access_delete_cluster/creating-a-gcp-cluster.adoc#osd-create-cluster-gcp-account_osd-creating-a-cluster-on-gcp[Creating a cluster on GCP with Google Cloud Marketplace].

‎modules/private-service-connect-overview.adoc

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * osd_install_access_delete_cluster/creating-a-gcp-psc-enabled-private-cluster.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="private-service-connect-overview"]
7+
= Private Service Connect overview
8+
Private Service Connect (PSC), a capability of Google Cloud networking, enables private communication between services across different projects or organizations within GCP. Users that implement PSC as part of their network connectivity can deploy {product-title} clusters in a private and secured environment within {GCP} without any public facing cloud resources.
9+
For more information on PSC, see link:https://cloud.google.com/vpc/docs/private-service-connect[Private Service Connect].
10+
11+
[IMPORTANT]
12+
====
13+
Private Service Connect is supported by the Customer Cloud Subscription (CCS) infrastructure type only.
14+
====
15+
16+
[id="psc-architecture_{context}"]
17+
== Private Service Connect architecture
18+
19+
The PSC architecture includes producer services and consumer services. Using PSC, the consumers can access producer services privately from inside their VPC network. Similarly, it allows producers to host services in their own separate VPC networks and offer a private connect to their consumers.
20+
21+
The following image depicts how Red HAT SREs and other internal resources access and support clusters created using PSC.
22+
23+
* A unique PSC Service Attachment is created for each OSD cluster in the customer GCP project. The PSC Service Attachment points to the cluster API server load balancer created in the customer GCP project.
24+
25+
* Similar to Service Attachments, a unique PSC Service Endpoint is created in the Red Hat Management GCP project for each OSD cluster.
26+
27+
* A dedicated subnet for GCP Private Service Connect is created in the cluster’s network within the customer GCP project. This is a special subnet type where the producer services are published via PSC Service Attachments. This subnet is used to Source NAT (SNAT) incoming requests to the cluster API server. Additionally, the PSC subnet must be within the Machine CIDR range and cannot be used in more than one Service Attachment.
28+
29+
* Red Hat internal resources and SREs access private OSD clusters using the connectivity between a PSC Endpoint and Service Attachment. Even though the traffic transits multiple VPC networks, it remains entirely within Google Cloud.
30+
31+
* Access to PSC Service Attachments is possible only via the Red Hat Management project.
32+
33+
.PSC architecture overview
34+
image::psc-arch-overview.png[PSC architecture overview]

‎modules/private-service-connect-prereqs.adoc

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * osd_install_access_delete_cluster/creating-a-gcp-psc-enabled-private-cluster.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="private-service-connect-prereqs"]
7+
= Prerequisites
8+
9+
In addition to the prerequisites that you need to complete before deploying any {product-title} on {GCP} cluster, you must also complete the following prerequisites to deploy a private cluster using Private Service Connect (PSC):
10+
11+
* A pre-created Virtual Private Cloud (VPC) with the following subnets in the same {GCP} region where your cluster will be deployed:
12+
13+
** A control plane subnet
14+
** A worker subnet
15+
** A subnet used for the PSC service attachment with the purpose set to Private Service Connect.
16+
+
17+
[IMPORTANT]
18+
====
19+
The subnet mask for the PSC service attachment must be /29 or larger and must be dedicated to an individual {product-title} cluster. Additionally, the subnet must be contained within the Machine CIDR range used while provisioning the {product-title} cluster.
20+
====
21+
+
22+
For information on how to create a VPC on {GCP}, see link:https://cloud.google.com/vpc/docs/create-modify-vpc-networks[Create and manage VPC networks] in the Google Cloud documentation.
23+
24+
* Provide a path from the OpenShift Dedicated cluster to the internet for the domains and ports listed in the _GCP firewall prerequisites_ in the _Additional resources_ section.
25+
26+
* Enabled link:https://console.cloud.google.com/marketplace/product/google/iap.googleapis.com?q=search&referrer=search&hl=en&project=openshift-gce-devel[Cloud Identity-Aware Proxy API] at the {GCP} project level.
27+
28+
In addition to the requirements listed above, clusters configured with the **Service Account authentication type** must grant the `IAP-Secured Tunnel User` role to `osd-ccs-admin` service account.
29+
30+
For more information on the prerequisites that must be completed before deploying an {product-title} on {GCP}, see _Additional resources_.
31+
32+
// [id="prereqs-wif-authentication_{context}"]
33+
// == Requirements when using Workload Identity Federation authentication type
34+
35+
// [id="prereqs-sa-authentication_{context}"]
36+
// == Requirements when using Service Account as the authentication type
37+

‎osd_install_access_delete_cluster/creating-a-gcp-psc-enabled-private-cluster.adoc

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="osd-creating-a-gcp-psc"]
3+
= Creating a GCP Private Service Connect enabled private cluster
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: osd-creating-a-gcp-psc-enabled-private-cluster
6+
7+
toc::[]
8+
You can create a private {product-title} cluster on {GCP} using Google Cloud's security-enhanced networking feature Private Service Connect (PSC).
9+
10+
include::modules/private-service-connect-overview.adoc[leveloffset=+1]
11+
12+
include::modules/private-service-connect-prereqs.adoc[leveloffset=+1]
13+
14+
include::modules/private-service-connect-create.adoc[leveloffset=+1]
15+
16+
17+
[id="additional-resources_{context}"]
18+
== Additional resources
19+
For information on {product-title} on {GCP} cluster prerequisites, see xref:../osd_planning/gcp-ccs.adoc#ccs-gcp-customer-requirements_gcp-ccs[Customer Requirements].
20+
21+
For information about configuring your firewalls , see xref:../osd_planning/gcp-ccs.adoc#osd-gcp-psc-firewall-prerequisites_gcp-ccs[GCP firewall prerequisites].
22+
//Once https://issues.redhat.com/browse/OSDOCS-7329 goes live, put link directly to this topic.

0 commit comments

Comments
 (0)