Chapter 4. Authenticate with workload identity federation

Prerequisites

• Your cluster was installed with workload identity federation enabled. Workload identity federation is available on clusters installed with the Cloud Credential Operator in manual mode with short-lived credentials, such as AWS STS, Azure Workload Identity, or GCP Workload Identity Federation. It is not available on clusters that use standard long-lived cloud credentials or on on-site installations.
• You have administrator permissions.

Procedure

• Use one of the following options to enable authentication:

  • If you used the OpenShift Container Platform web console to install the Loki Operator, the system automatically detects clusters that use short-lived tokens. You are prompted to create roles and supply the data required for the Loki Operator to create a CredentialsRequest object, which populates a secret.

  • If you used the OpenShift CLI (oc) to install the Loki Operator, you must manually create a Subscription object. Use the appropriate template for your storage provider, as shown in the following samples. This authentication strategy supports only the storage providers indicated within the samples.

    Microsoft Azure sample subscription

    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: loki-operator
      namespace: openshift-operators-redhat
    spec:
      channel: "stable-6.3"
      installPlanApproval: Manual
      name: loki-operator
      source: redhat-operators
      sourceNamespace: openshift-marketplace
      config:
        env:
          - name: CLIENTID
            value: <your_client_id>
          - name: TENANTID
            value: <your_tenant_id>
          - name: SUBSCRIPTIONID
            value: <your_subscription_id>
          - name: REGION
            value: <your_region>

    Amazon Web Services (AWS) sample subscription

    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: loki-operator
      namespace: openshift-operators-redhat
    spec:
      channel: "stable-6.3"
      installPlanApproval: Manual
      name: loki-operator
      source: redhat-operators
      sourceNamespace: openshift-marketplace
      config:
        env:
        - name: ROLEARN
          value: <role_ARN>

    Google Cloud (GCP) sample subscription

    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: loki-operator
      namespace: openshift-operators-redhat
    spec:
      channel: "stable-6.3"
      installPlanApproval: Manual
      name: loki-operator
      source:  redhat-operators
      sourceNamespace: openshift-marketplace
      config:
        env:
        - name: PROJECT_NUMBER
          value: <your_project_number>
        - name: POOL_ID
          value: <your_pool_id>
        - name: PROVIDER_ID
          value: <your_provider_id>
        - name: SERVICE_ACCOUNT_EMAIL
          value: example@mydomain.iam.gserviceaccount.com