Uploaded image for project: 'OpenShift Cloud'
  1. OpenShift Cloud
  2. OCPCLOUD-1718

Update GCP Credentials Request manifests of the OpenShift components to use new API field for requesting permissions

XMLWordPrintable

    • CCO Role Granularity
    • BU Product Work
    • False
    • None
    • False
    • OCPSTRAT-243 - Custom roles for GCP Workload Identity
    • OCPSTRAT-243Custom roles for GCP Workload Identity
    • 0% To Do, 0% In Progress, 100% Done

      Evaluate if any of the GCP predefined roles in the credentials request manifests of OpenShift cluster operators give elevated permissions. Remove any such predefined role from spec.predefinedRoles field and replace it with required permissions in the new spec.permissions field.

      The new GCP provider spec for credentials request CR is as follows:

      type GCPProviderSpec struct {
   metav1.TypeMeta `json:",inline"`
   // PredefinedRoles is the list of GCP pre-defined roles
   // that the CredentialsRequest requires.
   PredefinedRoles []string `json:"predefinedRoles"`
   // Permissions is the list of GCP permissions required to
   // create a more fine-grained custom role to satisfy the
   // CredentialsRequest.
   // When both Permissions and PredefinedRoles are specified
   // service account will have union of permissions from
   // both the fields
   Permissions []string `json:"permissions"`
   // SkipServiceCheck can be set to true to skip the check whether the requested roles or permissions
   // have the necessary services enabled
   // +optional
   SkipServiceCheck bool `json:"skipServiceCheck,omitempty"`
}

      we can use the following command to check permissions associated with a GCP predefined role

      gcloud iam roles describe <role_name>

       

      The sample output for role roleViewer is as follows. The  permission are listed in "includedPermissions" field.

      [akhilrane@localhost cloud-credential-operator]$ gcloud iam roles describe roles/iam.roleViewer
description: Read access to all custom roles in the project.
etag: AA==
includedPermissions:
- iam.roles.get
- iam.roles.list
- resourcemanager.projects.get
- resourcemanager.projects.getIamPolicy
name: roles/iam.roleViewer
stage: GA
title: Role Viewer

       

          1.
          		 Update GCP Credentials Request manifest of the Cloud Credentials Operator to use new API field for requesting permissions Sub-task Closed Undefined Andrew Butcher
          2.
          		 Update GCP Credentials Request manifest of the Cluster Image Registry Operator to use new API field for requesting permissions Sub-task Closed Undefined Oleg Bulatov (Inactive)
          3.
          		 Update GCP Credentials Request manifest of the Cluster Ingress Operator to use new API field for requesting permissions Sub-task Closed Undefined Miciah Masters
          4.
          		 Update GCP Credentials Request manifest of the Cluster Network Operator to use new API field for requesting permissions Sub-task Closed Undefined Aniket Bhat
          5.
          		 Update GCP Credentials Request manifest of the Cluster Storage Operator to use new API field for requesting permissions Sub-task Closed Undefined Hemant Kumar
          6.
          		 Docs Tracker Sub-task Closed Undefined Unassigned
          7.
          		 QE Tracker Sub-task Closed Undefined Unassigned

              joelspeed Joel Speed
              akhilrane Akhil Rane (Inactive)
              Milind Yadav Milind Yadav
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: