Skip to content

[enterprise-4.20] OSDOCS-16429 Reducing GCP permissions #100761

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 17, 2025
Merged

[enterprise-4.20] OSDOCS-16429 Reducing GCP permissions #100761

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion modules/minimum-required-permissions-ipi-gcp-xpn.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ Ensure that the host project applies one of the following configurations to the
* `roles/compute.networkUser`
====

If you do not supply a service account for control plane nodes in the `install-config.yaml` file, please grant the below permissions to the service account in the host project. If you do not supply a service account for compute nodes in the `install-config.yaml` file, please grant the below permissions to the service account in the host project for cluster destruction.
If you do not supply a service account for control plane nodes in the `install-config.yaml` file, please grant the following permissions to the service account in the host project. If you do not supply a service account for compute nodes in the `install-config.yaml` file, please grant the following permissions to the service account in the host project for cluster destruction. If you do supply service accounts for control plane and compute nodes, you do not need to grant the following permissions.

[%collapsible]
====
Expand Down
5 changes: 3 additions & 2 deletions modules/minimum-required-permissions-ipi-gcp.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@

When you attach the `Owner` role to the service account that you create, you grant that service account all permissions, including those that are required to install {product-title}.

If your organization’s security policies require a more restrictive set of permissions, you can create link:https://cloud.google.com/iam/docs/creating-custom-roles[custom roles] with the necessary permissions. The following permissions are required for the installer-provisioned infrastructure for creating and deleting the {product-title} cluster.
If your organization's security policies require a more restrictive set of permissions, you can create link:https://cloud.google.com/iam/docs/creating-custom-roles[custom roles] with the necessary permissions. The following permissions are required for the installer-provisioned infrastructure for creating and deleting the {product-title} cluster.

.Required permissions for creating network resources
[%collapsible]
Expand Down Expand Up @@ -96,13 +96,15 @@ If your organization’s security policies require a more restrictive set of per
* `iam.serviceAccountKeys.get`
* `iam.serviceAccountKeys.list`
* `iam.serviceAccounts.actAs`
** This permission can be limited to act as the control plane and compute service accounts. Alternatively, you may grant the service account that the installation program uses the `iam.serviceAccountUser` role on the control plane and compute service accounts.
* `iam.serviceAccounts.create`
* `iam.serviceAccounts.delete`
* `iam.serviceAccounts.get`
* `iam.serviceAccounts.list`
* `resourcemanager.projects.get`
* `resourcemanager.projects.getIamPolicy`
* `resourcemanager.projects.setIamPolicy`
** This permission is not required if you use `credentialsMode: Manual` and supply your own service accounts for compute and control plane nodes.
====

.Required permissions for creating compute resources
Expand Down Expand Up @@ -268,7 +270,6 @@ If your organization’s security policies require a more restrictive set of per
* `iam.serviceAccounts.get`
* `iam.serviceAccounts.list`
* `resourcemanager.projects.getIamPolicy`
* `resourcemanager.projects.setIamPolicy`
====

.Required permissions for deleting compute resources
Expand Down