Skip to content

Commit da01de9

Browse files
kcarmichael08kcarmichael08
authored
Merge pull request #66071 from CarmiWisemon/OADP1309GCPWIF
2 parents fad0c18 + 380ae40 commit da01de9

File tree

3 files changed

+109
-11
lines changed

3 files changed

+109
-11
lines changed

‎backup_and_restore/application_backup_and_restore/installing/installing-oadp-gcp.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ You can configure the Data Protection Application by setting Velero resource all
3131
include::modules/oadp-setting-resource-limits-and-requests.adoc[leveloffset=+2]
3232
include::modules/oadp-self-signed-certificate.adoc[leveloffset=+2]
3333

34+
include::modules/oadp-gcp-wif-cloud-authentication.adoc[leveloffset=+1]
35+
3436
include::modules/oadp-installing-dpa.adoc[leveloffset=+1]
3537
include::modules/oadp-enabling-csi-dpa.adoc[leveloffset=+2]
3638

‎modules/oadp-gcp-wif-cloud-authentication.adoc

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-gcp.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="oadp-gcp-wif-cloud-authentication_{context}"]
7+
= Google workload identity federation cloud authentication
8+
9+
Applications running outside Google Cloud use service account keys, such as usernames and passwords, to gain access to Google Cloud resources. These service account keys might become a security risk if they are not properly managed.
10+
11+
With Google's workload identity federation you can use Identity and Access Management (IAM) to offer external identities IAM roles, including the ability to impersonate service accounts. This eliminates the maintenance and security risks associated with service account keys.
12+
13+
Workload identity federation handles encrypting and decrypting certificates, extracting user attributes, and validation. Identity federation externalizes authentication, passing it over to Security Token Services (STS), and reduces the demands on individual developers. Authorization and controlling access to resources remain the responsibility of the application.
14+
15+
[NOTE]
16+
====
17+
Google workload identity federation is available for OADP 1.3.x and later.
18+
====
19+
20+
If you do not use Google workload identity federation cloud authentication, continue to _Installing the Data Protection Application_.
21+
22+
.Prerequisites
23+
24+
* You have installed a cluster in manual mode with link:https://docs.openshift.com/container-platform/4.14/installing/installing_gcp/installing-gcp-customizations.html#installing-gcp-with-short-term-creds_installing-gcp-customizations[GCP Workload Identity configured].
25+
* You have access to the Cloud Credential Operator utility (`ccoctl`) and to the associated workload identity pool.
26+
27+
.Procedure
28+
29+
. Create an `oadp-credrequest` directory by running the following command:
30+
+
31+
[source,terminal]
32+
----
33+
$ mkdir -p oadp-credrequest
34+
----
35+
. Create a `CredentialsRequest.yaml` file as following:
36+
+
37+
[source,yaml]
38+
----
39+
echo 'apiVersion: cloudcredential.openshift.io/v1
40+
kind: CredentialsRequest
41+
metadata:
42+
name: oadp-operator-credentials
43+
namespace: openshift-cloud-credential-operator
44+
spec:
45+
providerSpec:
46+
apiVersion: cloudcredential.openshift.io/v1
47+
kind: GCPProviderSpec
48+
permissions:
49+
- compute.disks.get
50+
- compute.disks.create
51+
- compute.disks.createSnapshot
52+
- compute.snapshots.get
53+
- compute.snapshots.create
54+
- compute.snapshots.useReadOnly
55+
- compute.snapshots.delete
56+
- compute.zones.get
57+
- storage.objects.create
58+
- storage.objects.delete
59+
- storage.objects.get
60+
- storage.objects.list
61+
- iam.serviceAccounts.signBlob
62+
skipServiceCheck: true
63+
secretRef:
64+
name: cloud-credentials-gcp
65+
namespace: <OPERATOR_INSTALL_NS>
66+
serviceAccountNames:
67+
- velero
68+
' > oadp-credrequest/credrequest.yaml
69+
----
70+
. Use the `ccoctl` utility to process the `CredentialsRequest` objects in the `oadp-credrequest` directory by running the following command:
71+
+
72+
[source,terminal]
73+
----
74+
$ ccoctl gcp create-service-accounts \
75+
--name=<name> \
76+
--project=<gcp_project_id> \
77+
--credentials-requests-dir=oadp-credrequest \
78+
--workload-identity-pool=<pool_id> \
79+
--workload-identity-provider=<provider_id>
80+
----
81+
The `manifests/openshift-adp-cloud-credentials-gcp-credentials.yaml` file is now available to use in the following steps.
82+
. Create a namespace by running the following command:
83+
+
84+
[source,terminal]
85+
----
86+
$ oc create namespace <OPERATOR_INSTALL_NS>
87+
----
88+
. Apply the credentials to the namespace by running the following command:
89+
+
90+
[source,terminal]
91+
----
92+
$ oc apply -f manifests/openshift-adp-cloud-credentials-gcp-credentials.yaml
93+
----
94+
95+

‎modules/oadp-installing-dpa.adoc

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -181,28 +181,29 @@ spec:
181181
provider: {provider}
182182
default: true
183183
credential:
184-
key: cloud
185-
name: {credentials} <5>
184+
key: cloud <5>
185+
name: {credentials} <6>
186186
objectStorage:
187-
bucket: <bucket_name> <6>
188-
prefix: <prefix> <7>
189-
snapshotLocations: <8>
187+
bucket: <bucket_name> <7>
188+
prefix: <prefix> <8>
189+
snapshotLocations: <9>
190190
- velero:
191191
provider: {provider}
192192
default: true
193193
config:
194194
project: <project>
195-
snapshotLocation: us-west1 <9>
195+
snapshotLocation: us-west1 <10>
196196
----
197197
<1> The `openshift` plugin is mandatory.
198198
<2> Specify how many minutes to wait for several Velero resources before timeout occurs, such as Velero CRD availability, volumeSnapshot deletion, and backup repository availability. The default is 10m.
199199
<3> Set this value to `false` if you want to disable the Restic installation. Restic deploys a daemon set, which means that Restic pods run on each working node. In OADP version 1.2 and later, you can configure Restic for backups by adding `spec.defaultVolumesToFsBackup: true` to the `Backup` CR. In OADP version 1.1, add `spec.defaultVolumesToRestic: true` to the `Backup` CR.
200200
<4> Specify on which nodes Restic is available. By default, Restic runs on all nodes.
201-
<5> If you do not specify this value, the default name, `{credentials}`, is used. If you specify a custom name, the custom name is used for the backup location.
202-
<6> Specify a bucket as the backup storage location. If the bucket is not a dedicated bucket for Velero backups, you must specify a prefix.
203-
<7> Specify a prefix for Velero backups, for example, `velero`, if the bucket is used for multiple purposes.
204-
<8> Specify a snapshot location, unless you use CSI snapshots or Restic to back up PVs.
205-
<9> The snapshot location must be in the same region as the PVs.
201+
<5> Secret key that contain credentials. For Google workload identity federation cloud authentication use `service_account.json`.
202+
<6> Secret name that contains credentials. If you do not specify this value, the default name, `{credentials}`, is used.
203+
<7> Specify a bucket as the backup storage location. If the bucket is not a dedicated bucket for Velero backups, you must specify a prefix.
204+
<8> Specify a prefix for Velero backups, for example, `velero`, if the bucket is used for multiple purposes.
205+
<9> Specify a snapshot location, unless you use CSI snapshots or Restic to back up PVs.
206+
<10> The snapshot location must be in the same region as the PVs.
206207
endif::[]
207208
ifdef::installing-oadp-mcg[]
208209
+

0 commit comments

Comments
 (0)