Uploaded image for project: 'OpenShift Container Platform (OCP) Strategy'
  1. OpenShift Container Platform (OCP) Strategy
  2. OCPSTRAT-1294

Pre-creation Service Accounts used in GCP deployments

XMLWordPrintable

    • 0
    • Enablement for this should be provided to ensure support is ready to help with service account creation.

      As an Openshift cluster deployer, I would like to pre-create the service accounts used by the installer in order to minimize the permissions of the service account that the installer will use.

      The creation of an Openshift Dedicated cluster on GCP today results in what Google's Security Health Analytics service considers to be "common security vulnerabilities". Successful cluster provisioning requires an IAM service account with a broad set of administrative permissions. Included in this set of permissions are the roles "Service Account Admin" and "Service Account User", setting off the security health detectors SERVICE_ACCOUNT_ROLE_SEPARATION and OVER_PRIVILEGED_SERVICE_ACCOUNT_USER.

      Based on the findings of the spikes completed by the CORS and OCM teams, enhancing the installer to support the pre-creation of service accounts used by the installation will remove the need for the installation service account from having the "Service Account Admin" and "Service Account Key Admin" roles.

       

      Considerations

      There will be no backport provided.

       

            mak.redhat.com Marcos Entenza Garcia
            rcampos2020 Renan Campos
            Beth White, Renan Campos, Shreyans Mulkutkar
            Patrick Dillon Patrick Dillon
            Jianli Wei Jianli Wei
            Stephanie Stout Stephanie Stout
            Patrick Dillon Patrick Dillon
            Marcos Entenza Garcia Marcos Entenza Garcia
            Eric Rich Eric Rich
            Votes:
            0 Vote for this issue
            Watchers:
            12 Start watching this issue

              Created:
              Updated:
              Resolved: