Skip to content

Commit 2840367

Browse files
committed
OCPBUGS-54302: Add Key Rings list permission for gcp
** After adding https://issues.redhat.com/browse/OCPBUGS-52203, the permission `cloudkms.keyRings.list` is required when a user provides at least one kms key in the installconfig under compute, control plane, or default machine. The permission is required because the key rings must be searched and returned then compared to the key ring that the user provides for validation.
1 parent 7e9ef0e commit 2840367

File tree

2 files changed

+12
-0
lines changed

2 files changed

+12
-0
lines changed

modules/minimum-required-permissions-ipi-gcp.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,12 @@ If your organization’s security policies require a more restrictive set of per
194194
* `iam.serviceAccounts.signBlob`
195195
====
196196
197+
.Required permissions when providing Key Management Service (KMS) key rings
198+
[%collapsible]
199+
====
200+
* `cloudkms.keyRings.list`
201+
====
202+
197203
.Optional Images permissions for installation
198204
[%collapsible]
199205
====

modules/minimum-required-permissions-upi-gcp.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,12 @@ If your organization’s security policies require a more restrictive set of per
193193
* `iam.serviceAccounts.signBlob`
194194
====
195195

196+
.Required permissions when providing Key Management Service (KMS) key rings
197+
[%collapsible]
198+
====
199+
* `cloudkms.keyRings.list`
200+
====
201+
196202
.Required Images permissions for installation
197203
[%collapsible]
198204
====

0 commit comments

Comments
 (0)