Skip to content

Commit a6cc723

Browse files
xenolinuxxenolinux
committed
OSDOCS#6055: Authenticating cert-manager Operator with GCP workload identity
1 parent e09121d commit a6cc723

File tree

3 files changed

+166
-0
lines changed

3 files changed

+166
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1008,6 +1008,8 @@ Topics:
10081008
File: cert-manager-authenticate-aws
10091009
- Name: Configuring log levels for cert-manager and the cert-manager Operator for Red Hat OpenShift
10101010
File: cert-manager-log-levels
1011+
- Name: Authenticating the cert-manager Operator for Red Hat OpenShift with GCP Workload Identity
1012+
File: cert-manager-authenticate-gcp
10111013
- Name: Uninstalling the cert-manager Operator for Red Hat OpenShift
10121014
File: cert-manager-operator-uninstall
10131015
- Name: Viewing audit logs

‎modules/cert-manager-configure-cloud-credentials-gcp-sts.adoc

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-authenticate-gcp.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="cert-manager-configure-cloud-credentials-gcp-sts_{context}"]
7+
= Configuring cloud credentials for the {cert-manager-operator} with GCP Workload Identity
8+
9+
Generate the cloud credentials for the {cert-manager-operator} by using the `ccoctl` binary. Then, apply them to the GCP Workload Identity cluster.
10+
11+
.Prerequisites
12+
13+
* You extracted and prepared the `ccoctl` binary.
14+
* The {cert-manager-operator} 1.11.1 or later is installed.
15+
* You have configured an {product-title} cluster with GCP Workload Identity by using the Cloud Credential Operator in a manual mode.
16+
17+
.Procedure
18+
19+
. Create a directory to store a `CredentialsRequest` resource YAML file by running the following command:
20+
+
21+
[source,terminal]
22+
----
23+
$ mkdir credentials-request
24+
----
25+
26+
. In the `credentials-request` directory, create a YAML file that contains the following `CredentialsRequest` manifest:
27+
+
28+
[source,yaml]
29+
----
30+
apiVersion: cloudcredential.openshift.io/v1
31+
kind: CredentialsRequest
32+
metadata:
33+
name: cert-manager
34+
namespace: openshift-cloud-credential-operator
35+
spec:
36+
providerSpec:
37+
apiVersion: cloudcredential.openshift.io/v1
38+
kind: GCPProviderSpec
39+
predefinedRoles:
40+
- roles/dns.admin
41+
secretRef:
42+
name: gcp-credentials
43+
namespace: cert-manager
44+
serviceAccountNames:
45+
- cert-manager
46+
----
47+
+
48+
[NOTE]
49+
====
50+
The `dns.admin` role provides admin privileges to the service account for managing Google Cloud DNS resources. To ensure that the cert-manager runs with the service account that has the least privilege, you can create a custom role with the following permissions:
51+
52+
* `dns.resourceRecordSets.*`
53+
* `dns.changes.*`
54+
* `dns.managedZones.list`
55+
====
56+
57+
. Use the `ccoctl` tool to process `CredentialsRequest` objects by running the following command:
58+
+
59+
[source,terminal]
60+
----
61+
$ ccoctl gcp create-service-accounts \
62+
--name <user_defined_name> --output-dir=<path_to_output_dir> \
63+
--credentials-requests-dir=<path_to_credrequests_dir> \
64+
--workload-identity-pool <workload_identity_pool> \
65+
--workload-identity-provider <workload_identity_provider> \
66+
--project <gcp_project_id>
67+
----
68+
+
69+
.Example command
70+
[source,terminal]
71+
----
72+
$ ccoctl gcp create-service-accounts \
73+
--name abcde-20230525-4bac2781 --output-dir=/home/outputdir \
74+
--credentials-requests-dir=/home/credentials-requests \
75+
--workload-identity-pool abcde-20230525-4bac2781 \
76+
--workload-identity-provider abcde-20230525-4bac2781 \
77+
--project openshift-gcp-devel
78+
----
79+
80+
. Apply the secrets generated in the manifests directory of your cluster by running the following command:
81+
+
82+
[source,terminal]
83+
----
84+
$ ls <path_to_output_dir>/manifests/*-credentials.yaml | xargs -I{} oc apply -f {}
85+
----
86+
87+
. Update the subscription object for {cert-manager-operator} by running the following command:
88+
+
89+
[source,terminal]
90+
----
91+
$ oc -n cert-manager-operator patch subscription openshift-cert-manager-operator --type=merge -p '{"spec":{"config":{"env":[{"name":"CLOUD_CREDENTIALS_SECRET_NAME","value":"gcp-credentials"}]}}}'
92+
----
93+
94+
.Verification
95+
96+
. Get the name of the redeployed cert-manager controller pod by running the following command:
97+
+
98+
[source,terminal]
99+
----
100+
$ oc get pods -l app.kubernetes.io/name=cert-manager -n cert-manager
101+
----
102+
+
103+
.Example output
104+
[source,terminal]
105+
----
106+
NAME READY STATUS RESTARTS AGE
107+
cert-manager-bd7fbb9fc-wvbbt 1/1 Running 0 15m39s
108+
----
109+
110+
. Verify that the cert-manager controller pod is updated with GCP workload identity credential volumes that are mounted under the path specified in `mountPath` by running the following command:
111+
+
112+
[source,terminal]
113+
----
114+
$ oc get -n cert-manager pod/<cert-manager_controller_pod_name> -o yaml
115+
----
116+
+
117+
.Example output
118+
[source,terminal]
119+
----
120+
spec:
121+
containers:
122+
- args:
123+
...
124+
volumeMounts:
125+
- mountPath: /var/run/secrets/openshift/serviceaccount
126+
name: bound-sa-token
127+
...
128+
- mountPath: /.config/gcloud
129+
name: cloud-credentials
130+
...
131+
volumes:
132+
- name: bound-sa-token
133+
projected:
134+
...
135+
sources:
136+
- serviceAccountToken:
137+
audience: openshift
138+
...
139+
path: token
140+
- name: cloud-credentials
141+
secret:
142+
...
143+
items:
144+
- key: service_account.json
145+
path: application_default_credentials.json
146+
secretName: gcp-credentials
147+
----

‎security/cert_manager_operator/cert-manager-authenticate-gcp.adoc

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
:_content-type: ASSEMBLY
2+
[id="cert-manager-authenticate-gcp"]
3+
= Authenticating the {cert-manager-operator} with GCP Workload Identity
4+
include::_attributes/common-attributes.adoc[]
5+
:context: cert-manager-authenticate-gcp
6+
7+
toc::[]
8+
9+
You can authenticate the {cert-manager-operator} on the GCP Workload Identity cluster by using the cloud credentials. You can configure the cloud credentials by using the `ccoctl` binary.
10+
11+
include::modules/cert-manager-configure-cloud-credentials-gcp-sts.adoc[leveloffset=+1]
12+
13+
[role="_additional-resources"]
14+
[id="additional-resources_cert-manager-authenticate-gcp-workload-identity"]
15+
== Additional resources
16+
* xref:../../authentication/managing_cloud_provider_credentials/cco-mode-sts.adoc#cco-ccoctl-configuring_cco-mode-sts[Configuring the Cloud Credential Operator utility]
17+
* xref:../../authentication/managing_cloud_provider_credentials/cco-mode-gcp-workload-identity.adoc#gcp-workload-identity-mode-installing[Configuring an {product-title} cluster by using the manual mode with GCP Workload Identity]

0 commit comments

Comments
 (0)