Uploaded image for project: 'OpenShift Container Platform (OCP) Strategy'
  1. OpenShift Container Platform (OCP) Strategy
  2. OCPSTRAT-1294

Pre-creation Service Accounts used in GCP deployments

XMLWordPrintable

    • 0
    • Enablement for this should be provided to ensure support is ready to help with service account creation.

      As an Openshift cluster deployer, I would like to pre-create the service accounts used by the installer in order to minimize the permissions of the service account that the installer will use.

      The creation of an Openshift Dedicated cluster on GCP today results in what Google's Security Health Analytics service considers to be "common security vulnerabilities". Successful cluster provisioning requires an IAM service account with a broad set of administrative permissions. Included in this set of permissions are the roles "Service Account Admin" and "Service Account User", setting off the security health detectors SERVICE_ACCOUNT_ROLE_SEPARATION and OVER_PRIVILEGED_SERVICE_ACCOUNT_USER.

      Based on the findings of the spikes completed by the CORS and OCM teams, enhancing the installer to support the pre-creation of service accounts used by the installation will remove the need for the installation service account from having the "Service Account Admin" and "Service Account Key Admin" roles.

       

      Considerations

      There will be no backport provided.

       

              mak.redhat.com Marcos Entenza Garcia
              rcampos2020 Renan Campos
              Beth White, Renan Campos, Shreyans Mulkutkar
              Patrick Dillon Patrick Dillon
              Jianli Wei Jianli Wei
              Stephanie Stout Stephanie Stout
              Patrick Dillon Patrick Dillon
              Marcos Entenza Garcia Marcos Entenza Garcia
              Eric Rich Eric Rich
              Votes:
              0 Vote for this issue
              Watchers:
              12 Start watching this issue

                Created:
                Updated:
                Resolved: