Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OSDOCS-4341 GCP: Authenticate using Service Account on a GCP VM #52170

Merged
merged 1 commit into from
Nov 28, 2022
Merged

OSDOCS-4341 GCP: Authenticate using Service Account on a GCP VM #52170

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 5 additions & 0 deletions installing/installing_gcp/installing-gcp-account.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,11 @@ include::modules/installation-gcp-limits.adoc[leveloffset=+1]

include::modules/installation-gcp-service-account.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources

* See xref:../../installing/installing_gcp/manually-creating-iam-gcp.adoc#manually-create-iam_manually-creating-iam-gcp[Manually creating IAM] for more details about using manual credentials mode.

include::modules/installation-gcp-permissions.adoc[leveloffset=+2]

include::modules/installation-gcp-regions.adoc[leveloffset=+1]
Expand Down
4 changes: 2 additions & 2 deletions modules/installation-gcp-limits.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ the bootstrap process and are removed after the cluster deploys.
|Resources removed after bootstrap

ifeval::["{context}" == "installing-gcp-account"]
|Service account |IAM |Global |5 |0
|Service account |IAM |Global |6 |1
|Firewall rules |Compute |Global |11 |1
|Forwarding rules |Compute |Global |2 |0
|In-use global IP addresses |Compute |Global |4 |1
Expand All @@ -54,7 +54,7 @@ ifeval::["{context}" == "installing-gcp-account"]
endif::[]

ifdef::template[]
|Service account |IAM |Global |5 |0
|Service account |IAM |Global |6 |1
|Firewall rules |Networking |Global |11 |1
|Forwarding rules |Compute |Global |2 |0
// |In-use IP addresses global |Networking |Global |4 |1
Expand Down
12 changes: 8 additions & 4 deletions modules/installation-gcp-service-account.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,12 @@ See link:https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#gr
While making the service account an owner of the project is the easiest way to gain the required permissions, it means that service account has complete control over the project. You must determine if the risk that comes from offering that power is acceptable.
====

. Create the service account key in JSON format.
See link:https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys[Creating service account keys]
in the GCP documentation.
. You can create the service account key in JSON format, or attach the service account to a GCP virtual machine.
See link:https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys[Creating service account keys] and link:https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances[Creating and enabling service accounts for instances] in the GCP documentation.
+
You must have a service account key or a virtual machine with an attached service account to create the cluster.
+
The service account key is required to create a cluster.
[NOTE]
====
If you use a virtual machine with an attached service account to create your cluster, you must set `credentialsMode: Manual` in the `install-config.yaml` file before installation.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Better to tell what's needed when using credentialsMode: Manual, e.g. https://docs.openshift.com/container-platform/4.11/installing/installing_gcp/manually-creating-iam-gcp.html. Thanks!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @jianli-wei , I have added a reference to the "Manually create IAM" page immediately after this note. I would prefer not to detail the steps of manual IAM when we have an entire page dedicated to that. Does this look good to you?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

====
2 changes: 1 addition & 1 deletion modules/installation-launching-installer.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,7 +348,7 @@ endif::azure,ash[]
ifdef::gcp[]
.. Select *gcp* as the platform to target.
.. If you have not configured the service account key for your GCP account on
your computer, you must obtain it from GCP and paste the contents of the file
your host, you must obtain it from GCP and paste the contents of the file
or enter the absolute path to the file.
.. Select the project ID to provision the cluster in. The default value is
specified by the service account that you configured.
Expand Down
2 changes: 1 addition & 1 deletion modules/installation-obtaining-installer.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ the mirror host.
endif::restricted[]
ifndef::restricted[]
ifdef::ibm-z,ibm-z-kvm[ your provisioning machine.]
ifndef::ibm-z,ibm-z-kvm,private[ a local computer.]
ifndef::ibm-z,ibm-z-kvm,private[ the host you are using for installation.]
ifdef::private[]
a bastion host on your cloud network or a machine that has access to the to the network through a VPN.

Expand Down
15 changes: 0 additions & 15 deletions modules/ssh-agent-using.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,21 +229,6 @@ $ ssh-add <path>/<file_name> <1>
Identity added: /home/<you>/<path>/<file_name> (<computer_name>)
----

ifdef::gcp[]
. Set the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to the full path to your service account private key file.
+
[source,terminal]
----
$ export GOOGLE_APPLICATION_CREDENTIALS="<your_service_account_file>"
----
. Verify that the credentials were applied.
+
[source,terminal]
----
$ gcloud auth list
----
endif::gcp[]

.Next steps

* When you install {product-title}, provide the SSH public key to the installation program.
Expand Down