Skip to content

Commit d911ba6

Browse files
mletaliemletalie
committed
wif overview
1 parent 161d0f0 commit d911ba6

15 files changed

+667
-60
lines changed

‎_topic_maps/_topic_map_osd.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,8 @@ Topics:
123123
File: creating-an-aws-cluster
124124
- Name: Creating a GCP Private Service Connect enabled private cluster
125125
File: creating-a-gcp-psc-enabled-private-cluster
126+
- Name: Creating a cluster on GCP with Workload Identity Federation
127+
File: creating-a-gcp-cluster-with-workload-identity-federation
126128
- Name: Creating a cluster on GCP
127129
File: creating-a-gcp-cluster
128130
- Name: Configuring your identity providers

‎modules/ccs-gcp-customer-procedure-serviceaccount.adoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * osd_planning/gcp-ccs.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="ccs-gcp-customer-procedure-sa_{context}"]
6+
7+
= Service account authentication type procedure
8+
// TODO: Same as other module - Better procedure heading that tells you what this is doing
9+
10+
Besides the required customer procedures listed in _Required customer procedure_, there are other specific actions that you must take when creating an {product-title} cluster on {GCP} using a service account as the authentication type.
11+
12+
.Procedure
13+
14+
. To ensure that Red Hat can perform necessary actions, you must create an `osd-ccs-admin` IAM link:https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating_a_service_account[service account] user within the GCP project.
15+
16+
+
17+
18+
The following roles must be link:https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource[granted to the service account]:
19+
+
20+
.Required roles
21+
[cols="2a,3a",options="header"]
22+
23+
|===
24+
25+
|Role|Console role name
26+
27+
|Compute Admin
28+
|`roles/compute.admin`
29+
30+
|DNS Administrator
31+
|`roles/dns.admin`
32+
33+
|Organization Policy Viewer
34+
|`roles/orgpolicy.policyViewer`
35+
36+
|Service Management Administrator
37+
|`roles/servicemanagement.admin`
38+
39+
|Service Usage Admin
40+
|`roles/serviceusage.serviceUsageAdmin`
41+
42+
|Storage Admin
43+
|`roles/storage.admin`
44+
45+
|Compute Load Balancer Admin
46+
|`roles/compute.loadBalancerAdmin`
47+
48+
|Role Viewer
49+
|`roles/viewer`
50+
51+
|Role Administrator
52+
|`roles/iam.roleAdmin`
53+
54+
|Security Admin
55+
|`roles/iam.securityAdmin`
56+
57+
|Service Account Key Admin
58+
|`roles/iam.serviceAccountKeyAdmin`
59+
60+
|Service Account Admin
61+
|`roles/iam.serviceAccountAdmin`
62+
63+
|Service Account User
64+
|`roles/iam.serviceAccountUser`
65+
66+
|===
67+
68+
+
69+
70+
. link:https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys[Create the service account key] for the `osd-ccs-admin` IAM service account. Export the key to a file named `osServiceAccount.json`; this JSON file will be uploaded in {cluster-manager-first} when you create your cluster.
71+

‎modules/ccs-gcp-customer-procedure-wif.adoc

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * osd_planning/gcp-ccs.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="ccs-gcp-customer-procedure-wif_{context}"]
6+
7+
= Workload Identity Federation authentication type procedure
8+
// TODO: Same as other module - Better procedure heading that tells you what this is doing
9+
Besides the required customer procedures listed in _Required customer procedure_, there are other specific actions that you must take when creating an {product-title} cluster on {GCP} using Workload Identity Federation as the authentication type.
10+
11+
.Procedure
12+
13+
. Assign the following roles to the link:https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource[service account] of the user implementing the Workload Identity Federation authentication type:
14+
+
15+
.Required roles
16+
[cols="2a,3a,3a",options="header"]
17+
18+
|===
19+
20+
|Role|Console role name|Role purpose
21+
22+
|Role Administrator
23+
|`roles/iam.roleAdmin`
24+
|Required by the GCP client in the OCM CLI for creating custom roles.
25+
26+
|Service Account Admin
27+
|`roles/iam.serviceAccountAdmin`
28+
|Required to pre-create the services account required by the OSD deployer, support and operators.
29+
30+
|Workload Identity Pool Admin
31+
|`roles/iam.workloadIdentityPoolAdmin`
32+
|Required to create and configure the workload identity pool.
33+
34+
|Project IAM Admin
35+
|`roles/resourcemanager.projectIamAdmin`
36+
|Required for assigning roles to the service account and giving permissions to those roles that are necessary to perform operations on cloud resources.
37+
38+
|===
39+
40+
. Install the link:https://console.redhat.com/openshift/downloads[OpenShift Cluster Manager API command-line interface (`ocm`)].
41+
+
42+
To use the OCM CLI, you must authenticate against your Red Hat {cluster-manager} account. This is accomplished with the {cluster-manager} API token.
43+
+
44+
You can obtain your token link:https://console.redhat.com/openshift/token/show[here].
45+
46+
. To authenticate against your Red Hat {cluster-manager} account, run the following command:
47+
+
48+
[source,terminal]
49+
----
50+
$ ocm login --token <token> <1>
51+
----
52+
<1> Replace `<token>` with your {cluster-manager} API token.
53+
+
54+
[IMPORTANT]
55+
====
56+
[subs="attributes+"]
57+
OpenShift Cluster Manager API command-line interface (`ocm`) is a Technology Preview feature only.
58+
For more information about the support scope of Red Hat Technology Preview features, see link:https://access.redhat.com/support/offerings/techpreview/[Technology Preview Features Support Scope].
59+
====
60+
61+
. Install the link:https://cloud.google.com/sdk/docs/install[gcloud CLI].
62+
+
63+
. Authenticate the gcloud CLI with the link:https://cloud.google.com/docs/authentication/provide-credentials-adc[Application Default Credentials (ADC)].

‎modules/ccs-gcp-customer-procedure.adoc

Lines changed: 6 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@
99

1010

1111
The Customer Cloud Subscription (CCS) model allows Red Hat to deploy and manage {product-title} into a customer's Google Cloud Platform (GCP) project. Red Hat requires several prerequisites to provide these services.
12+
[NOTE]
13+
====
14+
The following requirements in this topic apply to {product-title} on {GCP} clusters created using both the service account and Workload Identity Federation authentication type. For additional requirements that apply to the service account authentication type only, see _Service account authentication type procedure_. For additional requirements that apply to the Workload Identity Federation authentication type only, see _Workload Identity Federation authentication type procedure_.
15+
====
1216

1317
[WARNING]
1418
====
@@ -28,14 +32,14 @@ To use {product-title} in your GCP project, the following GCP organizational pol
2832
+
2933
.Required API services
3034
[cols="2a,3a",options="header"]
35+
3136
|===
32-
|API service |Console service name
3337

38+
|API service |Console service name
3439

3540
|link:https://console.cloud.google.com/apis/library/deploymentmanager.googleapis.com?pli=1&project=openshift-gce-devel&folder=&organizationId=[Cloud Deployment Manager V2 API]
3641
|`deploymentmanager.googleapis.com`
3742

38-
3943
|link:https://console.cloud.google.com/apis/library/compute.googleapis.com?project=openshift-gce-devel&folder=&organizationId=[Compute Engine API]
4044
|`compute.googleapis.com`
4145

@@ -73,57 +77,3 @@ To use {product-title} in your GCP project, the following GCP organizational pol
7377
|`orgpolicy.googleapis.com`
7478

7579
|===
76-
77-
. To ensure that Red Hat can perform necessary actions, you must create an `osd-ccs-admin` IAM link:https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating_a_service_account[service account] user within the GCP project.
78-
+
79-
The following roles must be link:https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource[granted to the service account]:
80-
+
81-
.Required roles
82-
[cols="2a,3a",options="header"]
83-
84-
|===
85-
86-
|Role|Console role name
87-
88-
|Compute Admin
89-
|`roles/compute.admin`
90-
91-
|DNS Administrator
92-
|`roles/dns.admin`
93-
94-
|Organization Policy Viewer
95-
|`roles/orgpolicy.policyViewer`
96-
97-
|Service Management Administrator
98-
|`roles/servicemanagement.admin`
99-
100-
|Service Usage Admin
101-
|`roles/serviceusage.serviceUsageAdmin`
102-
103-
|Storage Admin
104-
|`roles/storage.admin`
105-
106-
|Compute Load Balancer Admin
107-
|`roles/compute.loadBalancerAdmin`
108-
109-
|Role Viewer
110-
|`roles/viewer`
111-
112-
|Role Administrator
113-
|`roles/iam.roleAdmin`
114-
115-
|Security Admin
116-
|`roles/iam.securityAdmin`
117-
118-
|Service Account Key Admin
119-
|`roles/iam.serviceAccountKeyAdmin`
120-
121-
|Service Account Admin
122-
|`roles/iam.serviceAccountAdmin`
123-
124-
|Service Account User
125-
|`roles/iam.serviceAccountUser`
126-
127-
|===
128-
129-
. link:https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys[Create the service account key] for the `osd-ccs-admin` IAM service account. Export the key to a file named `osServiceAccount.json`; this JSON file will be uploaded in {cluster-manager-first} when you create your cluster.

‎modules/ccs-gcp-customer-requirements.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
* The customer ensures that link:https://cloud.google.com/storage/quotas[Google Cloud limits] are sufficient to support {product-title} provisioned within the customer-provided GCP account.
1515

16-
* The customer-provided GCP account should be in the customer's Google Cloud Organization with the applicable Service Account applied.
16+
* The customer-provided GCP account should be in the customer's Google Cloud Organization.
1717

1818
* The customer-provided GCP account must not be transferable to Red Hat.
1919

‎modules/ccs-gcp-iam.adoc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88

99
Red Hat is responsible for creating and managing the following IAM Google Cloud Platform (GCP) resources.
1010

11+
[IMPORTANT]
12+
=====
13+
The _IAM service account and roles_ and _IAM group and roles_ topics are only applicable to clusters created using the service account authentication type.
14+
=====
15+
1116
[id="ccs-gcp-iam-service-account-roles_{context}"]
1217
== IAM service account and roles
1318

@@ -63,6 +68,11 @@ When applied to an individual *bucket*, control applies only to the specified bu
6368

6469
The `sd-sre-platform-gcp-access` Google group is granted access to the GCP project to allow Red Hat Site Reliability Engineering (SRE) access to the console for emergency troubleshooting purposes.
6570

71+
[NOTE]
72+
====
73+
* For information regarding the roles within the `sd-sre-platform-gcp-access` group that are specific to clusters created when using the Workload Identity Federation (WIF) authentication type, see link:https://github.com/openshift/managed-cluster-config/blob/master/resources/wif/4.17/vanilla.yaml[managed-cluster-config].
74+
* For information about creating a cluster using the Workload Identity Federation authentication type, see _Additional resources_.
75+
====
6676
The following roles are attached to the group:
6777

6878
.IAM roles for sd-sre-platform-gcp-access

‎modules/ccs-gcp-understand.adoc

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,10 @@ Red Hat {product-title} provides a Customer Cloud Subscription (CCS) model that
1111

1212
Red Hat recommends the usage of GCP project, managed by the customer, to organize all of your GCP resources. A project consists of a set of users and APIs, as well as billing, authentication, and monitoring settings for those APIs.
1313

14-
It is recommended for the {product-title} cluster using a CCS model to be hosted in a GCP project within a GCP organization. The Organization resource is the root node of the GCP resource hierarchy and all resources that belong to an organization are grouped under the organization node. An IAM service account with certain roles granted is created and applied to the GCP project. When you make calls to the API, you typically provide service account keys for authentication. Each service account is owned by a specific project, but service accounts can be provided roles to access resources for other projects.
14+
It is recommended for the {product-title} cluster using a CCS model to be hosted in a GCP project within a GCP organization. The Organization resource is the root node of the GCP resource hierarchy and all resources that belong to an organization are grouped under the organization node. Customers have the choice of using service account keys or Workload Identity Federation when creating the roles and credentials necessary to access Google Cloud resources within a GCP project.
15+
// When you make calls to the API, you typically provide service account keys for authentication. Each service account is owned by a specific project, but service accounts can be provided roles to access resources for other projects.
16+
17+
[IMPORTANT]
18+
====
19+
Unless specified, the information provided in this topic is applicable to {product-title} on {GCP} clusters that use service account keys or Workload Identity Federation (WIF) to grant the required necessary credentials.
20+
====

0 commit comments

Comments
 (0)