-
Epic
-
Resolution: Done
-
Major
-
None
-
None
-
None
-
Support for pre-creation of Service Accounts used in GCP deployments
-
Product / Portfolio Work
-
-
0% To Do, 0% In Progress, 100% Done
-
False
-
-
False
-
Not Selected
-
None
-
None
-
None
As an Openshift cluster deployer, I would like to pre-create the service accounts used by the installer in order to minimize the permissions of the service account that the installer will use.
The creation of an Openshift Dedicated cluster on GCP today results in what Google's Security Health Analytics service considers to be "common security vulnerabilities". Successful cluster provisioning requires an IAM service account with a broad set of administrative permissions. Included in this set of permissions are the roles "Service Account Admin" and "Service Account User", setting off the security health detectors SERVICE_ACCOUNT_ROLE_SEPARATION and OVER_PRIVILEGED_SERVICE_ACCOUNT_USER.
Based on the findings of the spikes completed by the CORS and OCM teams, enhancing the installer to support the pre-creation of service accounts used by the installation will remove the need for the installation service account from having the "Service Account Admin" and "Service Account Key Admin" roles.
- duplicates
-
CORS-3568 CAPG - allow pre-created ServiceAccounts to be used
-
- Closed
-
- incorporates
-
-
- Closed
-
- is cloned by
-
OCPSTRAT-1294 Pre-creation Service Accounts used in GCP deployments
-
- Closed
-
- relates to
-
-
- Closed
-
-
CORS-3567 Determine if GCP nodes require ServiceAccounts
-
- Closed
-
- links to
