Skip to content

Commit b768569

Browse files
lpettyjolpettyjo
authored
Merge pull request #87736 from lpettyjo/OSDOCS-12321
OSDOCS-12321# GCP Filestore WIF support
2 parents aae2aef + 1f3d623 commit b768569

File tree

3 files changed

+164
-14
lines changed

3 files changed

+164
-14
lines changed

‎modules/persistent-storage-csi-gcp-file-install.adoc

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,17 @@
44

55
:_mod-docs-content-type: PROCEDURE
66
[id="persistent-storage-csi-olm-operator-install_{context}"]
7-
= Installing the GCP Filestore CSI Driver Operator
7+
= Installing the {gcp-short} Filestore CSI Driver Operator
88

9-
The Google Compute Platform (GCP) Filestore Container Storage Interface (CSI) Driver Operator is not installed in {product-title} by default.
10-
Use the following procedure to install the GCP Filestore CSI Driver Operator in your cluster.
9+
The Google Compute Platform ({gcp-short}) Filestore Container Storage Interface (CSI) Driver Operator is not installed in {product-title} by default.
10+
Use the following procedure to install the {gcp-short} Filestore CSI Driver Operator in your cluster.
1111

1212
.Prerequisites
1313
* Access to the {product-title} web console.
14+
* If using {gcp-wid-short}, certain {gcp-wid-short} parameters are needed. See the preceding Section _Preparing to install the {gcp-short} Filestore CSI Driver Operator with Workload Identity_.
1415
1516
.Procedure
16-
To install the GCP Filestore CSI Driver Operator from the web console:
17+
To install the {gcp-short} Filestore CSI Driver Operator from the web console:
1718

1819
ifdef::openshift-dedicated[]
1920

@@ -40,26 +41,33 @@ $ gcloud services enable file.googleapis.com --project <my_gce_project> <1>
4041
+
4142
You can also do this using Google Cloud web console.
4243

43-
. Install the GCP Filestore CSI Operator:
44+
. Install the {gcp-short} Filestore CSI Operator:
4445

4546
.. Click *Operators* -> *OperatorHub*.
4647

47-
.. Locate the GCP Filestore CSI Operator by typing *GCP Filestore* in the filter box.
48+
.. Locate the {gcp-short} Filestore CSI Operator by typing *{gcp-short} Filestore* in the filter box.
4849

49-
.. Click the *GCP Filestore CSI Driver Operator* button.
50+
.. Click the *{gcp-short} Filestore CSI Driver Operator* button.
5051

51-
.. On the *GCP Filestore CSI Driver Operator* page, click *Install*.
52+
.. On the *{gcp-short} Filestore CSI Driver Operator* page, click *Install*.
5253

5354
.. On the *Install Operator* page, ensure that:
5455
+
5556
* *All namespaces on the cluster (default)* is selected.
5657
* *Installed Namespace* is set to *openshift-cluster-csi-drivers*.
58+
+
59+
If using {gcp-wid-short}, enter values for the following fields obtained from the procedure in Section _Preparing to install the {gcp-short} Filestore CSI Driver Operator with Workload Identity_:
60+
+
61+
* *{gcp-short} Project Number*
62+
* *{gcp-short} Pool ID*
63+
* *{gcp-short} Provider ID*
64+
* *{gcp-short} Service Account Email*
5765
5866
.. Click *Install*.
5967
+
60-
After the installation finishes, the GCP Filestore CSI Operator is listed in the *Installed Operators* section of the web console.
68+
After the installation finishes, the {gcp-short} Filestore CSI Operator is listed in the *Installed Operators* section of the web console.
6169

62-
. Install the GCP Filestore CSI Driver:
70+
. Install the {gcp-short} Filestore CSI Driver:
6371

6472
.. Click *administration* → *CustomResourceDefinitions* → *ClusterCSIDriver*.
6573

‎modules/persistent-storage-csi-gcp-filestore-wif.adoc

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/container_storage_csi-google_cloud_file.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="persistent-storage-csi-gcp-filestore-wif_{context}"]
7+
= Preparing to install the {gcp-short} Filestore CSI Driver Operator with Workload Identity
8+
9+
If you are planning to use {gcp-wid-short} with Google Compute Platform Filestore, you must obtain certain parameters that you will use during the installation of the {gcp-short} Filestore Container Storage Interface (CSI) Driver Operator.
10+
11+
.Prerequisites
12+
* Access to the cluster as a user with the cluster-admin role.
13+
14+
// Put note in install area of docs to remind users to take note of the identity pool ID and the provider ID
15+
16+
.Procedure
17+
18+
To prepare to install the {gcp-short} Filestore CSI Driver Operator with Workload Identity:
19+
20+
. Obtain the project number:
21+
22+
.. Obtain the project ID by running the following command:
23+
+
24+
[source, terminal]
25+
----
26+
$ export PROJECT_ID=$(oc get infrastructure/cluster -o jsonpath='{.status.platformStatus.gcp.projectID}')
27+
----
28+
29+
.. Obtain the project number, using the project ID, by running the following command:
30+
+
31+
[source, terminal]
32+
----
33+
$ gcloud projects describe $PROJECT_ID --format="value(projectNumber)"
34+
----
35+
36+
. Find the identity pool ID and the provider ID:
37+
+
38+
During cluster installation, the names of these resources are provided to the Cloud Credential Operator utility (`ccoctl`) with the `--name parameter`. See "Creating {gcp-short} resources with the Cloud Credential Operator utility".
39+
40+
. Create Workload Identity resources for the {gcp-short} Filestore Operator:
41+
42+
.. Create a `CredentialsRequest` file using the following example file:
43+
+
44+
.Example Credentials Request YAML file
45+
[source, YAML]
46+
----
47+
apiVersion: cloudcredential.openshift.io/v1
48+
kind: CredentialsRequest
49+
metadata:
50+
name: openshift-gcp-filestore-csi-driver-operator
51+
namespace: openshift-cloud-credential-operator
52+
annotations:
53+
include.release.openshift.io/self-managed-high-availability: "true"
54+
include.release.openshift.io/single-node-developer: "true"
55+
spec:
56+
serviceAccountNames:
57+
- gcp-filestore-csi-driver-operator
58+
- gcp-filestore-csi-driver-controller-sa
59+
secretRef:
60+
name: gcp-filestore-cloud-credentials
61+
namespace: openshift-cluster-csi-drivers
62+
providerSpec:
63+
apiVersion: cloudcredential.openshift.io/v1
64+
kind: GCPProviderSpec
65+
predefinedRoles:
66+
- roles/file.editor
67+
- roles/resourcemanager.tagUser
68+
skipServiceCheck: true
69+
----
70+
71+
.. Use the `CredentialsRequest` file to create a {gcp-short} service account by running the following command:
72+
+
73+
[source, terminal]
74+
----
75+
$ ./ccoctl gcp create-service-accounts --name=<filestore-service-account> \// <1>
76+
--workload-identity-pool=<workload-identity-pool> \// <2>
77+
--workload-identity-provider=<workload-identity-provider> \// <3>
78+
--project=<project-id> \// <4>
79+
--credentials-requests-dir=/tmp/credreq <5>
80+
----
81+
<1> <filestore-service-account> is a user-chosen name.
82+
<2> <workload-identity-pool> comes from Step 2 above.
83+
<3> <workload-identity-provider> comes from Step 2 above.
84+
<4> <project-id> comes from Step 1.a above.
85+
<5> The name of directory where the `CredentialsRequest` file resides.
86+
+
87+
.Example output
88+
[source, terminal]
89+
----
90+
2025/02/10 17:47:39 Credentials loaded from gcloud CLI defaults
91+
2025/02/10 17:47:42 IAM service account filestore-service-account-openshift-gcp-filestore-csi-driver-operator created
92+
2025/02/10 17:47:44 Unable to add predefined roles to IAM service account, retrying...
93+
2025/02/10 17:47:59 Updated policy bindings for IAM service account filestore-service-account-openshift-gcp-filestore-csi-driver-operator
94+
2025/02/10 17:47:59 Saved credentials configuration to: /tmp/install-dir/ <1>
95+
openshift-cluster-csi-drivers-gcp-filestore-cloud-credentials-credentials.yaml
96+
----
97+
<1> The current directory.
98+
99+
.. Find the service account email of the newly created service account by running the following command:
100+
+
101+
[source, terminal]
102+
----
103+
$ cat /tmp/install-dir/manifests/openshift-cluster-csi-drivers-gcp-filestore-cloud-credentials-credentials.yaml | yq '.data["service_account.json"]' | base64 -d | jq '.service_account_impersonation_url'
104+
----
105+
+
106+
.Example output
107+
[source, terminal]
108+
----
109+
https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/filestore-se-openshift-g-ch8cm@openshift-gce-devel.iam.gserviceaccount.com:generateAccessToken
110+
----
111+
+
112+
In this example output, the service account email is `filestore-se-openshift-g-ch8cm@openshift-gce-devel.iam.gserviceaccount.com`.
113+
114+
.Results
115+
116+
You now have the following parameters that you need to install the {gcp-short} Filestore CSI Driver Operator:
117+
118+
* Project number - from Step 1.b
119+
120+
* Pool ID - from Step 2
121+
122+
* Provider ID - from Step 2
123+
124+
* Service account email - from Step 3.c
125+
126+

‎storage/container_storage_interface/persistent-storage-csi-google-cloud-file.adoc

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,27 @@ toc::[]
1414

1515
Familiarity with xref:../../storage/understanding-persistent-storage.adoc#understanding-persistent-storage[persistent storage] and xref:../../storage/container_storage_interface/persistent-storage-csi.adoc#persistent-storage-csi[configuring CSI volumes] is recommended when working with a CSI Operator and driver.
1616

17-
To create CSI-provisioned PVs that mount to GCP Filestore Storage assets, you install the GCP Filestore CSI Driver Operator and the GCP Filestore CSI driver in the `openshift-cluster-csi-drivers` namespace.
17+
To create CSI-provisioned PVs that mount to {gcp-short} Filestore Storage assets, you install the {gcp-short} Filestore CSI Driver Operator and the {gcp-short} Filestore CSI driver in the `openshift-cluster-csi-drivers` namespace.
1818

19-
* The _GCP Filestore CSI Driver Operator_ does not provide a storage class by default, but xref:../../storage/container_storage_interface/persistent-storage-csi-google-cloud-file.adoc#persistent-storage-csi-google-cloud-file-create-sc_persistent-storage-csi-google-cloud-file[you can create one if needed]. The GCP Filestore CSI Driver Operator supports dynamic volume provisioning by allowing storage volumes to be created on demand, eliminating the need for cluster administrators to pre-provision storage.
19+
* The _{gcp-short} Filestore CSI Driver Operator_ does not provide a storage class by default, but xref:../../storage/container_storage_interface/persistent-storage-csi-google-cloud-file.adoc#persistent-storage-csi-google-cloud-file-create-sc_persistent-storage-csi-google-cloud-file[you can create one if needed]. The {gcp-short} Filestore CSI Driver Operator supports dynamic volume provisioning by allowing storage volumes to be created on demand, eliminating the need for cluster administrators to pre-provision storage.
2020

21-
* The _GCP Filestore CSI driver_ enables you to create and mount GCP Filestore PVs.
21+
* The _{gcp-short} Filestore CSI driver_ enables you to create and mount {gcp-short} Filestore PVs.
22+
23+
{product-title} {gcp-short} Filestore supports Workload Identity. This allows users to access Google Cloud resources using federated identities instead of a service account key. {gcp-wid-short} must be enabled globally during installation, and then configured for the {gcp-short} Filestore CSI Driver Operator. For more information, see xref:../../storage/container_storage_interface/persistent-storage-csi-google-cloud-file.adoc#installing-the-gcp-filestore-csi-driver-operator[Installing the {gcp-short} Filestore CSI Driver Operator].
2224

2325
include::modules/persistent-storage-csi-about.adoc[leveloffset=+1]
2426

25-
include::modules/persistent-storage-csi-gcp-file-install.adoc[leveloffset=+1]
27+
== Installing the {gcp-short} Filestore CSI Driver Operator
28+
29+
include::modules/persistent-storage-csi-gcp-filestore-wif.adoc[leveloffset=+2]
30+
31+
ifndef::openshift-dedicated[]
32+
[role="_additional-resources"]
33+
.Additional resources
34+
* xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#cco-ccoctl-creating-at-once_installing-gcp-customizations[Creating {gcp-short} resources with the Cloud Credential Operator utility]
35+
endif::[]
36+
37+
include::modules/persistent-storage-csi-gcp-file-install.adoc[leveloffset=+2]
2638

2739
[role="_additional-resources"]
2840
.Additional resources
@@ -36,3 +48,7 @@ include::modules/persistent-storage-csi-google-cloud-file-delete-instances.adoc[
3648
[role="_additional-resources"]
3749
== Additional resources
3850
* xref:../../storage/container_storage_interface/persistent-storage-csi.adoc#persistent-storage-csi[Configuring CSI volumes]
51+
ifndef::openshift-dedicated[]
52+
[id="osdk-cco-gpc_{context}"]
53+
* xref:../../operators/operator_sdk/token_auth/osdk-cco-gcp.adoc[CCO-based workflow for OLM-managed Operators with {gcp-short} Workload Identity].
54+
endif::openshift-dedicated[]

0 commit comments

Comments
 (0)