You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Cloud Credential Operator (CCO) manages cloud provider credentials as Kubernetes custom resource definitions (CRDs). To install a cluster on {ibm-power-server-name}, you must set the CCO to `manual` mode as part of the installation process.
139
147
endif::ibm-power-vs[]
140
148
141
-
//Alibaba Cloud uses ccoctl, but creates different kinds of resources than other clouds, so this applies to everyone else. The upgrade procs also have a different intro, so they are excluded here.
142
-
ifndef::alibabacloud,update[]
149
+
//Alibaba Cloud uses ccoctl, but creates different kinds of resources than other clouds, so this applies to everyone else. The upgrade and postinstall procs also have a different intro, so they are excluded here.
150
+
ifndef::alibabacloud,update,postinstall[]
143
151
To create and manage cloud credentials from outside of the cluster when the Cloud Credential Operator (CCO) is operating in manual mode, extract and prepare the CCO utility (`ccoctl`) binary.
144
-
endif::alibabacloud,update[]
152
+
endif::alibabacloud,update,postinstall[]
153
+
154
+
//Intro for the postinstall procs.
155
+
ifdef::postinstall[]
156
+
To configure an existing cluster to create and manage cloud credentials from outside of the cluster, extract and prepare the Cloud Credential Operator utility (`ccoctl`) binary.
= Clusters that use short-term credentials: Verifying the credentials configuration
8
+
= Verifying that a cluster uses short-term credentials
8
9
9
-
You can verify that your cluster is using short-term security credentials for individual components.
10
+
You can verify that a cluster uses short-term security credentials for individual components by checking the Cloud Credential Operator (CCO) configuration and other values in the cluster.
10
11
11
12
.Prerequisites
12
13
13
14
* You deployed an {product-title} cluster using the Cloud Credential Operator utility (`ccoctl`) to implement short-term credentials.
14
15
15
16
* You installed the {oc-first}.
16
17
18
+
* You are logged in as a user with `cluster-admin` privileges.
17
19
18
20
.Procedure
19
21
20
-
. Log in as a user with `cluster-admin` privileges.
22
+
* Verify that the CCO is configured to operate in manual mode by running the following command:
23
+
+
24
+
[source,terminal]
25
+
----
26
+
$ oc get cloudcredentials cluster \
27
+
-o=jsonpath={.spec.credentialsMode}
28
+
----
29
+
+
30
+
The following output confirms that the CCO is operating in manual mode:
31
+
+
32
+
.Example output
33
+
[source,text]
34
+
----
35
+
Manual
36
+
----
21
37
22
-
. Verify that the cluster does not have `root` credentials by running the following command:
38
+
* Verify that the cluster does not have `root` credentials by running the following command:
23
39
+
24
40
[source,terminal]
25
41
----
26
-
$ oc get secrets -n kube-system <secret_name>
42
+
$ oc get secrets \
43
+
-n kube-system <secret_name>
27
44
----
28
45
+
29
46
where `<secret_name>` is the name of the root secret for your cloud provider.
@@ -33,26 +50,26 @@ where `<secret_name>` is the name of the root secret for your cloud provider.
33
50
|Platform
34
51
|Secret name
35
52
36
-
|AWS
53
+
|{aws-first}
37
54
|`aws-creds`
38
55
39
-
|Azure
56
+
|{azure-first}
40
57
|`azure-credentials`
41
58
42
-
|GCP
59
+
|{gcp-first}
43
60
|`gcp-credentials`
44
61
45
62
|===
46
63
+
47
-
An error confirms that the root secret is not present on the cluster. The following example shows the expected output from an AWS cluster:
64
+
An error confirms that the root secret is not present on the cluster.
48
65
+
49
-
.Example output
66
+
.Example output for an {aws-short} cluster
50
67
[source,text]
51
68
----
52
69
Error from server (NotFound): secrets "aws-creds" not found
53
70
----
54
71
55
-
. Verify that the components are using short-term security credentials for individual components by running the following command:
72
+
* Verify that the components are using short-term security credentials for individual components by running the following command:
56
73
+
57
74
[source,terminal]
58
75
----
@@ -61,4 +78,32 @@ $ oc get authentication cluster \
61
78
--template='{ .spec.serviceAccountIssuer }'
62
79
----
63
80
+
64
-
This command displays the value of the `.spec.serviceAccountIssuer` parameter in the cluster `Authentication` object. An output of a URL that is associated with your cloud provider indicates that the cluster is using manual mode with short-term credentials that are created and managed from outside of the cluster.
81
+
This command displays the value of the `.spec.serviceAccountIssuer` parameter in the cluster `Authentication` object.
82
+
An output of a URL that is associated with your cloud provider indicates that the cluster is using manual mode with short-term credentials that are created and managed from outside of the cluster.
83
+
84
+
* {azure-short} clusters: Verify that the components are assuming the {azure-short} client ID that is specified in the secret manifests by running the following command:
An output that contains the `azure_client_id` and `azure_federated_token_file` felids confirms that the components are assuming the {azure-short} client ID.
94
+
95
+
* {azure-short} clusters: Verify that the pod identity webhook is running by running the following command:
0 commit comments