-
Story
-
Resolution: Done
-
Blocker
-
None
-
Strategic Product Work
-
False
-
None
-
False
-
OCPSTRAT-506 - ARO Managed Identity
Implement ccoctl command to create the infrastructure necessary for Azure workload identity:
- Create key pair
- Azure blob storage container OIDC Issuer
- OIDC discovery document
- jkws document
- User assigned managed identities
- Federated identity credentials for user assigned managed identities
From the enhancement proposal,
The Cloud Credential Operator's command-line utility (ccoctl) will be extended with subcommands for Azure which provide methods for,
- Generating a key pair to be used for ServiceAccount token signing for a fresh OpenShift cluster.
- Creating an Azure blob storage container to serve as the OIDC Issuer in which to publish OIDC discovery and JWKS documents needed to establish trust at a publicly available address. This sub-command will output a modified cluster Authentication CR, containing a serviceAccountIssuer pointing to the Azure blob storage container's URL to be provided as a manifest for installation.
- Creating Managed Identity infrastructure with federated credentials for OpenShift operator ServiceAccounts (identified by namespace & name) and to output secrets containing the clientID of the Managed Identity to be provided as manifests for the installer. This command will process CredentialsRequest custom resources to identify service accounts that will be associated with Managed Identities in Azure as federated credentials. For self-managed installation, CredentialsRequests will be extracted from the release image.
➜ ccoctl azure -h Creating/updating/deleting cloud credentials objects for Azure Usage: ccoctl azure [command] Available Commands: create-all Create OIDC issuer and managed identities create-key-pair Create a key pair create-managed-identities Create Azure Managed Identities create-oidc-issuer Create OIDC Issuer delete Delete OIDC issuer and managed identities Flags: -h, --help help for azure Use "ccoctl azure [command] --help" for more information about a command.
Azure workload identity documentation: https://azure.github.io/azure-workload-identity/docs/introduction.html
Pull request: https://github.com/openshift/cloud-credential-operator/pull/523
- blocks
-
CCO-233 Document Azure workload identity usage within CCO repo documentation
-
- Closed
-
-
CCO-234 Azure workload identity e2e testing
-
- Closed
-
-
NE-1244 Update Azure Credentials Request manifest of the Cluster Ingress Operator to use new API field for requesting permissions
-
- Closed
-
-
OCPBUGS-8665 cert-manager does not work with "Managed Identity Using AAD Pod Identities"
-
- Closed
-
- is depended on by
-
CCO-187 Azure Managed Identity (Workload Identity) Support
-
- Closed
-
- is related to
-
OCPBUGS-15907 ccoctl azure delete leaks role assignments
-
- Closed
-
- relates to
-
OCPBUGS-16228 ccoctl azure --dry-run does not output either bash script or template for the resources to be created
-
- New
-
- links to