apiVersion: v1
kind: Secret
metadata:
namespace: <target_namespace> (1)
name: <target_secret_name> (2)
data:
service_account.json: <service_account> (3)
Manual mode with GCP Workload Identity is supported for Google Cloud Platform (GCP).
This credentials strategy is supported for only new OpenShift Container Platform clusters and must be configured during installation. You cannot reconfigure an existing cluster that uses a different credentials strategy to use this feature. |
In manual mode with GCP Workload Identity, the individual OpenShift Container Platform cluster components can impersonate IAM service accounts using short-term, limited-privilege credentials.
Requests for new and refreshed credentials are automated by using an appropriately configured OpenID Connect (OIDC) identity provider, combined with IAM service accounts. OpenShift Container Platform signs service account tokens that are trusted by GCP, and can be projected into a pod and used for authentication. Tokens are refreshed after one hour by default.
Using manual mode with GCP Workload Identity changes the content of the GCP credentials that are provided to individual OpenShift Container Platform components.
apiVersion: v1
kind: Secret
metadata:
namespace: <target_namespace> (1)
name: <target_secret_name> (2)
data:
service_account.json: <service_account> (3)
1 | The namespace for the component. |
2 | The name of the component secret. |
3 | The Base64 encoded service account. |
service_account.json
file using long-lived credentials{
"type": "service_account", (1)
"project_id": "<project_id>",
"private_key_id": "<private_key_id>",
"private_key": "<private_key>", (2)
"client_email": "<client_email_address>",
"client_id": "<client_id>",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/<client_email_address>"
}
1 | The credential type is service_account . |
2 | The private RSA key that is used to authenticate to GCP. This key must be kept secure and is not rotated. |
service_account.json
file using GCP Workload Identity{
"type": "external_account", (1)
"audience": "//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/test-pool/providers/test-provider", (2)
"subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
"token_url": "https://sts.googleapis.com/v1/token",
"service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/<client_email_address>:generateAccessToken", (3)
"credential_source": {
"file": "<path_to_token>", (4)
"format": {
"type": "text"
}
}
}
1 | The credential type is external_account . |
2 | The target audience is the GCP Workload Identity provider. |
3 | The resource URL of the service account that can be impersonated with these credentials. |
4 | The path to the service account token inside the pod. By convention, this is /var/run/secrets/openshift/serviceaccount/token for OpenShift Container Platform components. |
To install a cluster that is configured to use the Cloud Credential Operator (CCO) in manual mode with GCP Workload Identity:
To create and manage cloud credentials from outside of the cluster when the Cloud Credential Operator (CCO) is operating in
manual mode with GCP Workload Identity,
extract and prepare the CCO utility (ccoctl
) binary.
The |
Obtain the OpenShift Container Platform release image by running the following command:
$ RELEASE_IMAGE=$(./openshift-install version | awk '/release image/ {print $3}')
Obtain the CCO container image from the OpenShift Container Platform release image by running the following command:
$ CCO_IMAGE=$(oc adm release info --image-for='cloud-credential-operator' $RELEASE_IMAGE -a ~/.pull-secret)
Ensure that the architecture of the |
Extract the ccoctl
binary from the CCO container image within the OpenShift Container Platform release image by running the following command:
$ oc image extract $CCO_IMAGE --file="/usr/bin/ccoctl" -a ~/.pull-secret
Change the permissions to make ccoctl
executable by running the following command:
$ chmod 775 ccoctl
To verify that ccoctl
is ready to use, display the help file by running the following command:
$ ccoctl --help
ccoctl --help
:OpenShift credentials provisioning tool
Usage:
ccoctl [command]
Available Commands:
alibabacloud Manage credentials objects for alibaba cloud
aws Manage credentials objects for AWS cloud
gcp Manage credentials objects for Google cloud
help Help about any command
ibmcloud Manage credentials objects for IBM Cloud
nutanix Manage credentials objects for Nutanix
Flags:
-h, --help help for ccoctl
Use "ccoctl [command] --help" for more information about a command.
You can use the ccoctl gcp create-all
command to automate the creation of GCP resources.
By default, |
You must have:
Extracted and prepared the ccoctl
binary.
Extract the list of CredentialsRequest
objects from the OpenShift Container Platform release image:
$ oc adm release extract \
--credentials-requests \
--cloud=gcp \
--to=<path_to_directory_with_list_of_credentials_requests>/credrequests \ (1)
quay.io/<path_to>/ocp-release:<version>
1 | credrequests is the directory where the list of CredentialsRequest objects is stored. This command creates the directory if it does not exist. |
This command can take a few moments to run. |
Use the ccoctl
tool to process all CredentialsRequest
objects in the credrequests
directory:
$ ccoctl gcp create-all \
--name=<name> \
--region=<gcp_region> \
--project=<gcp_project_id> \
--credentials-requests-dir=<path_to_directory_with_list_of_credentials_requests>/credrequests
where:
<name>
is the user-defined name for all created GCP resources used for tracking.
<gcp_region>
is the GCP region in which cloud resources will be created.
<gcp_project_id>
is the GCP project ID in which cloud resources will be created.
<path_to_directory_with_list_of_credentials_requests>/credrequests
is the directory containing the files of CredentialsRequest
manifests to create GCP service accounts.
If your cluster uses Technology Preview features that are enabled by the |
To verify that the OpenShift Container Platform secrets are created, list the files in the <path_to_ccoctl_output_dir>/manifests
directory:
$ ls <path_to_ccoctl_output_dir>/manifests
You can verify that the IAM service accounts are created by querying GCP. For more information, refer to GCP documentation on listing IAM service accounts.
Configure an account with the cloud platform that hosts your cluster.
Obtain the OpenShift Container Platform release image.
Change to the directory that contains the installation program and create the install-config.yaml
file:
$ openshift-install create install-config --dir <installation_directory>
where <installation_directory>
is the directory in which the installation program creates files.
Edit the install-config.yaml
configuration file so that it contains the credentialsMode
parameter set to Manual
.
install-config.yaml
configuration fileapiVersion: v1
baseDomain: cluster1.example.com
credentialsMode: Manual (1)
compute:
- architecture: amd64
hyperthreading: Enabled
1 | This line is added to set the credentialsMode parameter to Manual . |
Create the required OpenShift Container Platform installation manifests:
$ openshift-install create manifests
Copy the manifests that ccoctl
generated to the manifests directory that the installation program created:
$ cp /<path_to_ccoctl_output_dir>/manifests/* ./manifests/
Copy the private key that the ccoctl
generated in the tls
directory to the installation directory:
$ cp -a /<path_to_ccoctl_output_dir>/tls .
Run the OpenShift Container Platform installer:
$ ./openshift-install create cluster