Skip to content

Commit a5cd6b1

Browse files
xenolinuxxenolinux
committed
OSDOCS#6057: Authenticating cert-manager Operator on GCP (without workload identity)
1 parent 5599ff6 commit a5cd6b1

File tree

3 files changed

+120
-0
lines changed

3 files changed

+120
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,8 @@ Topics:
10121012
File: cert-manager-authenticate-gcp
10131013
- Name: Authenticating the cert-manager Operator for Red Hat OpenShift on AWS
10141014
File: cert-manager-authentication-non-sts
1015+
- Name: Authenticating the cert-manager Operator for Red Hat OpenShift on GCP
1016+
File: cert-manager-authenticate-non-sts-gcp
10151017
- Name: Uninstalling the cert-manager Operator for Red Hat OpenShift
10161018
File: cert-manager-operator-uninstall
10171019
- Name: Viewing audit logs

‎modules/cert-manager-configure-cloud-credentials-gcp-non-sts.adoc

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-authenticate-non-sts-gcp.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="cert-manager-configure-cloud-credentials-gcp-non-sts_{context}"]
7+
= Configuring cloud credentials for the {cert-manager-operator} on GCP
8+
9+
To configure the cloud credentials for the {cert-manager-operator} on a GCP cluster you must create a `CredentialsRequest` object, and allow the Cloud Credential Operator to generate the cloud credentials secret.
10+
11+
.Prerequisites
12+
13+
* You have installed the {cert-manager-operator} 1.11.1 or later.
14+
* You have configured the Cloud Credential Operator to operate in _mint_ or _passthrough_ mode.
15+
16+
.Procedure
17+
18+
. Create a `CredentialsRequest` resource YAML file, such as, `sample-credential-request.yaml` by applying the following yaml:
19+
+
20+
[source,yaml]
21+
----
22+
apiVersion: cloudcredential.openshift.io/v1
23+
kind: CredentialsRequest
24+
metadata:
25+
name: cert-manager
26+
namespace: openshift-cloud-credential-operator
27+
spec:
28+
providerSpec:
29+
apiVersion: cloudcredential.openshift.io/v1
30+
kind: GCPProviderSpec
31+
predefinedRoles:
32+
- roles/dns.admin
33+
secretRef:
34+
name: gcp-credentials
35+
namespace: cert-manager
36+
serviceAccountNames:
37+
- cert-manager
38+
----
39+
+
40+
[NOTE]
41+
====
42+
The `dns.admin` role provides admin privileges to the service account for managing Google Cloud DNS resources. To ensure that the cert-manager runs with the service account that has the least privilege, you can create a custom role with the following permissions:
43+
44+
* `dns.resourceRecordSets.*`
45+
* `dns.changes.*`
46+
* `dns.managedZones.list`
47+
====
48+
49+
. Create a `CredentialsRequest` resource by running the following command:
50+
+
51+
[source,terminal]
52+
----
53+
$ oc create -f sample-credential-request.yaml
54+
----
55+
56+
. Update the subscription object for {cert-manager-operator} by running the following command:
57+
+
58+
[source,terminal]
59+
----
60+
$ oc -n cert-manager-operator patch subscription openshift-cert-manager-operator --type=merge -p '{"spec":{"config":{"env":[{"name":"CLOUD_CREDENTIALS_SECRET_NAME","value":"gcp-credentials"}]}}}'
61+
----
62+
63+
.Verification
64+
65+
. Get the name of the redeployed cert-manager controller pod by running the following command:
66+
+
67+
[source,terminal]
68+
----
69+
$ oc get pods -l app.kubernetes.io/name=cert-manager -n cert-manager
70+
----
71+
+
72+
.Example output
73+
[source,terminal]
74+
----
75+
NAME READY STATUS RESTARTS AGE
76+
cert-manager-bd7fbb9fc-wvbbt 1/1 Running 0 15m39s
77+
----
78+
79+
. Verify that the cert-manager controller pod is updated with GCP credential volumes that are mounted under the path specified in `mountPath` by running the following command:
80+
+
81+
[source,terminal]
82+
----
83+
$ oc get -n cert-manager pod/<cert-manager_controller_pod_name> -o yaml
84+
----
85+
+
86+
.Example output
87+
[source,terminal]
88+
----
89+
spec:
90+
containers:
91+
- args:
92+
...
93+
volumeMounts:
94+
...
95+
- mountPath: /.config/gcloud
96+
name: cloud-credentials
97+
....
98+
volumes:
99+
...
100+
- name: cloud-credentials
101+
secret:
102+
...
103+
items:
104+
- key: service_account.json
105+
path: application_default_credentials.json
106+
secretName: gcp-credentials
107+
----

‎security/cert_manager_operator/cert-manager-authenticate-non-sts-gcp.adoc

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
:_content-type: ASSEMBLY
2+
[id="cert-manager-authenticate-non-sts-gcp"]
3+
= Authenticating the {cert-manager-operator} on GCP
4+
include::_attributes/common-attributes.adoc[]
5+
:context: cert-manager-authenticate-non-sts-gcp
6+
7+
toc::[]
8+
9+
You can configure cloud credentials for the {cert-manager-operator} on a GCP cluster. The cloud credentials are generated by the Cloud Credential Operator.
10+
11+
include::modules/cert-manager-configure-cloud-credentials-gcp-non-sts.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)