Skip to content

Commit 2e06326

Browse files
barbacbdopenshift-cherrypick-robot
authored andcommitted
OCPBUGS-38723: Add section for new roles for short lived credentials
** GCP Short lived credentials does not fill out certain fields in the GCP structure. This causes failures when creating resources such as signed urls. In order to create these resources the user should add the role Service Account User which has the permission "iam.serviceAccounts.signBlob".
1 parent 0048a63 commit 2e06326

File tree

3 files changed

+12
-2
lines changed

3 files changed

+12
-2
lines changed

modules/installation-gcp-service-account.adoc

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,6 @@ While making the service account an owner of the project is the easiest way to g
3333
. You can create the service account key in JSON format, or attach the service account to a GCP virtual machine.
3434
See link:https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys[Creating service account keys] and link:https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances[Creating and enabling service accounts for instances] in the GCP documentation.
3535
+
36-
You must have a service account key or a virtual machine with an attached service account to create the cluster.
37-
+
3836
[NOTE]
3937
====
4038
If you use a virtual machine with an attached service account to create your cluster, you must set `credentialsMode: Manual` in the `install-config.yaml` file before installation.

modules/minimum-required-permissions-ipi-gcp.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,12 @@ If your organization’s security policies require a more restrictive set of per
186186
* `iam.roles.get`
187187
====
188188
189+
.Required permissions when authenticating without a service account key
190+
[%collapsible]
191+
====
192+
* `iam.serviceAccounts.signBlob`
193+
====
194+
189195
.Optional Images permissions for installation
190196
[%collapsible]
191197
====

modules/minimum-required-permissions-upi-gcp.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,12 @@ If your organization’s security policies require a more restrictive set of per
187187
* `iam.roles.get`
188188
====
189189

190+
.Required permissions when authenticating without a service account key
191+
[%collapsible]
192+
====
193+
* `iam.serviceAccounts.signBlob`
194+
====
195+
190196
.Required Images permissions for installation
191197
[%collapsible]
192198
====

0 commit comments

Comments
 (0)