Skip to content

BZ-1961399: Adding clarification around required GCP permissions #44356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

BZ-1961399: Adding clarification around required GCP permissions #44356

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion modules/installation-gcp-permissions.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ the following role:
* Service Account Key Admin

The roles are applied to the service accounts that the control plane and compute
machines use:
machines use. The roles are required for configuring a GCP project to host the {product-title}.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The initial ask was to clarify "if the entries in the table is for Installer or after-install operations or both". I don't think the above statement answers the question, could you please clarify? Thanks!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jianli-wei Do you have any suggestions for the text? My understanding is that these roles are required to configure a GCP project which is done prior to installing OCP.

Copy link

@jianli-wei jianli-wei Apr 12, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sagidlow Sorry, it's not for configuring a GCP project, because the GCP projects (one as service project and another as host project) should have been created before OCP installation. As for the initial ask, i.e. "if the entries in the table is for Installer or after-install operations or both", sorry that I cannot answer for sure even after discussing with other QEs. We guess, the Day-1 and Day-2 operations may require the same set of roles, in terms of the control plane and compute machines. @patrickdillon Would you please advise? Thanks!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Personally, I don't think the bug is valid. It says "As it is written now, it is not clear if the entries in the table is for Installer or after-install operations or both." The doc clearly states: " To deploy an {product-title} cluster, the service
account requires the following permissions."

So yes, it is a requirement for deployment. We have separate sections which also talk about permissions required to operate the cluster. I think https://bugzilla.redhat.com/show_bug.cgi?id=1961399 is NOTABUG

Asa a side note, when reviewing this, I noticed "The roles are applied to the service accounts that the control plane and compute machines use." This is not accurate. It could simply be removed.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jianli-wei, are you ok with us closing this issue as NOTABUG?


.GCP service account permissions
[cols="2a,2a",options="header"]
Expand Down