You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/ccs-gcp-customer-requirements.adoc
+14-14Lines changed: 14 additions & 14 deletions
Original file line number
Diff line number
Diff line change
@@ -11,34 +11,34 @@
11
11
[id="ccs-gcp-requirements-account_{context}"]
12
12
== Account
13
13
14
-
* The customer ensures that link:https://cloud.google.com/storage/quotas[Google Cloud limits] are sufficient to support {product-title} provisioned within the customer-provided GCP account.
14
+
* The customer ensures that link:https://cloud.google.com/storage/quotas[Google Cloud limits] and link:https://cloud.google.com/compute/resource-usage[allocation quotas that apply to Compute Engine] are sufficient to support {product-title} provisioned within the customer-provided GCP account.
15
15
16
16
* The customer-provided GCP account should be in the customer's Google Cloud Organization.
17
17
18
-
* The customer-provided GCP account must not be transferable to RedHat.
18
+
* The customer-provided GCP account must not be transferable to Red{nbsp}Hat.
19
19
20
-
* The customer may not impose GCP usage restrictions on RedHat activities. Imposing restrictions severely hinders RedHat's ability to respond to incidents.
20
+
* The customer may not impose GCP usage restrictions on Red{nbsp}Hat activities. Imposing restrictions severely hinders Red{nbsp}Hat's ability to respond to incidents.
21
21
22
-
* RedHat deploys monitoring into GCP to alert RedHat when a highly privileged account, such as a root account, logs into the customer-provided GCP account.
22
+
* Red{nbsp}Hat deploys monitoring into GCP to alert Red{nbsp}Hat when a highly privileged account, such as a root account, logs into the customer-provided GCP account.
23
23
24
24
* The customer can deploy native GCP services within the same customer-provided GCP account.
25
25
+
26
26
[NOTE]
27
27
====
28
-
Customers are encouraged, but not mandated, to deploy resources in a Virtual Private Cloud (VPC) separate from the VPC hosting {product-title} and other RedHat supported services.
28
+
Customers are encouraged, but not mandated, to deploy resources in a Virtual Private Cloud (VPC) separate from the VPC hosting {product-title} and other Red{nbsp}Hat supported services.
29
29
====
30
30
31
31
[id="ccs-gcp-requirements-access_{context}"]
32
32
== Access requirements
33
33
34
-
* To appropriately manage the {product-title} service, RedHat must have the `AdministratorAccess` policy applied to the administrator role at all times.
34
+
* To appropriately manage the {product-title} service, Red{nbsp}Hat must have the `AdministratorAccess` policy applied to the administrator role at all times.
35
35
+
36
36
[NOTE]
37
37
====
38
-
This policy only provides RedHat with permissions and capabilities to change resources in the customer-provided GCP account.
38
+
This policy only provides Red{nbsp}Hat with permissions and capabilities to change resources in the customer-provided GCP account.
39
39
====
40
40
41
-
* RedHat must have GCP console access to the customer-provided GCP account. This access is protected and managed by RedHat.
41
+
* Red{nbsp}Hat must have GCP console access to the customer-provided GCP account. This access is protected and managed by Red{nbsp}Hat.
42
42
43
43
* The customer must not utilize the GCP account to elevate their permissions within the {product-title} cluster.
44
44
@@ -47,13 +47,13 @@ This policy only provides Red Hat with permissions and capabilities to change re
47
47
[id="ccs-gcp-requirements-support_{context}"]
48
48
== Support requirements
49
49
50
-
* RedHat recommends that the customer have at least link:https://cloud.google.com/support[Enhanced Support] from GCP.
50
+
* Red{nbsp}Hat recommends that the customer have at least link:https://cloud.google.com/support[Enhanced Support] from GCP.
51
51
52
-
* RedHat has authority from the customer to request GCP support on their behalf.
52
+
* Red{nbsp}Hat has authority from the customer to request GCP support on their behalf.
53
53
54
-
* RedHat has authority from the customer to request GCP resource limit increases on the customer-provided account.
54
+
* Red{nbsp}Hat has authority from the customer to request GCP resource limit increases on the customer-provided account.
55
55
56
-
* RedHat manages the restrictions, limitations, expectations, and defaults for all {product-title} clusters in the same manner, unless otherwise specified in this requirements section.
56
+
* Red{nbsp}Hat manages the restrictions, limitations, expectations, and defaults for all {product-title} clusters in the same manner, unless otherwise specified in this requirements section.
57
57
58
58
[id="ccs-gcp-requirements-security_{context}"]
59
59
== Security requirements
@@ -62,11 +62,11 @@ This policy only provides Red Hat with permissions and capabilities to change re
62
62
63
63
* Volume snapshots will remain within the customer-provided GCP account and customer-specified region.
64
64
65
-
* To manage, monitor, and troubleshoot {product-title} clusters, RedHat must have direct access to the cluster's API server. You must not restrict or otherwise prevent RedHat's access to the {product-title} cluster's API server.
65
+
* To manage, monitor, and troubleshoot {product-title} clusters, Red{nbsp}Hat must have direct access to the cluster's API server. You must not restrict or otherwise prevent Red{nbsp}Hat's access to the {product-title} cluster's API server.
66
66
+
67
67
[NOTE]
68
68
====
69
-
SRE uses various methods to access clusters, depending on network configuration. Access to private clusters is restricted to RedHat trusted IP addresses only. These access restrictions are managed automatically by RedHat.
69
+
SRE uses various methods to access clusters, depending on network configuration. Access to private clusters is restricted to Red{nbsp}Hat trusted IP addresses only. These access restrictions are managed automatically by Red{nbsp}Hat.
70
70
====
71
71
+
72
72
* {product-title} requires egress access to certain endpoints over the internet. Only clusters deployed with Private Service Connect can use a firewall to control egress traffic. For additional information, see the _GCP firewall prerequisites_ section.
Copy file name to clipboardExpand all lines: modules/ccs-gcp-understand.adoc
+5-3Lines changed: 5 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -7,8 +7,10 @@
7
7
= Understanding Customer Cloud Subscriptions on GCP
8
8
9
9
10
-
RedHat {product-title} provides a Customer Cloud Subscription (CCS) model that allows RedHat to deploy and manage {product-title} into a customer's existing {GCP} account. RedHat requires several prerequisites be met in order to provide this service.
10
+
Red{nbsp}Hat {product-title} provides a Customer Cloud Subscription (CCS) model that allows Red{nbsp}Hat to deploy and manage {product-title} into a customer's existing {GCP} account. Red{nbsp}Hat requires several prerequisites be met in order to provide this service.
11
11
12
-
RedHat recommends the usage of GCP project, managed by the customer, to organize all of your GCP resources. A project consists of a set of users and APIs, as well as billing, authentication, and monitoring settings for those APIs.
12
+
Red{nbsp}Hat recommends the usage of a GCP project, managed by the customer, to organize all of your GCP resources. A project consists of a set of users and APIs, as well as billing, authentication, and monitoring settings for those APIs.
13
13
14
-
It is recommended for the {product-title} cluster using a CCS model to be hosted in a GCP project within a GCP organization. The Organization resource is the root node of the GCP resource hierarchy and all resources that belong to an organization are grouped under the organization node. Customers have the choice of using service account keys or Workload Identity Federation when creating the roles and credentials necessary to access Google Cloud resources within a GCP project.
14
+
It is recommended for the {product-title} cluster using a CCS model to be hosted in a GCP project within a GCP organization. The organization resource is the root node of the GCP resource hierarchy and all resources that belong to an organization are grouped under the organization node. Customers have the choice of using service account keys or Workload Identity Federation when creating the roles and credentials necessary to access Google Cloud resources within a GCP project.
15
+
16
+
For more information about creating and managing organization resources within GCP, see link:https://cloud.google.com/resource-manager/docs/creating-managing-organization[Creating and managing organization resources].
0 commit comments