Skip to content

Commit f04e4e1

Browse files
jeana-redhatjeana-redhat
authored
Merge pull request #64058 from jeana-redhat/OSDOCS-5129-azure-component-permissions
[OSDOCS-5129]: Azure (and AWS) role granularity
2 parents 10f4755 + 95d9e07 commit f04e4e1

8 files changed

+496
-11
lines changed

‎authentication/managing_cloud_provider_credentials/cco-short-term-creds.adoc

Lines changed: 48 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,14 @@ During installation, you can configure the Cloud Credential Operator (CCO) to op
1010

1111
[NOTE]
1212
====
13-
This credentials strategy is supported for Amazon Web Services (AWS) and Google Cloud Platform (GCP) only. The strategy must be configured during installation of a new {product-title} cluster. You cannot configure an existing cluster that uses a different credentials strategy to use this feature.
13+
This credentials strategy is supported for Amazon Web Services (AWS), Google Cloud Platform (GCP), and global Microsoft Azure only. The strategy must be configured during installation of a new {product-title} cluster. You cannot configure an existing cluster that uses a different credentials strategy to use this feature.
1414
====
1515

1616
//todo: Should provide some more info about the benefits of this here as well. Note: Azure is not yet limited-priv, but still gets the benefit of not storing root creds on the cluster and some sort of time-based rotation
1717

1818
Cloud providers use different terms for their implementation of this authentication method.
1919

2020
.Short-term credentials provider terminology
21-
//[cols="<.^,^.^"]
2221
|====
2322
|Cloud provider |Provider nomenclature
2423

@@ -28,26 +27,64 @@ Cloud providers use different terms for their implementation of this authenticat
2827
|Google Cloud Platform (GCP)
2928
|GCP Workload Identity
3029

31-
//|global Microsoft Azure
32-
//|Azure AD Workload Identity
33-
//
30+
|Global Microsoft Azure
31+
|Azure AD Workload Identity
32+
3433
|====
3534

36-
//Provider authentication processes
37-
include::modules/cco-short-term-creds-auth-flows.adoc[leveloffset=+1]
35+
[id="cco-short-term-creds-aws_{context}"]
36+
== AWS Security Token Service
37+
38+
In manual mode with STS, the individual {product-title} cluster components use the AWS Security Token Service (STS) to assign components IAM roles that provide short-term, limited-privilege security credentials. These credentials are associated with IAM roles that are specific to each component that makes AWS API calls.
39+
40+
[role="_additional-resources"]
41+
.Additional resources
42+
* xref:../../installing/installing_aws/installing-aws-customizations.adoc#installing-aws-with-short-term-creds_installing-aws-customizations[Configuring an AWS cluster to use short-term credentials]
3843

39-
[id="cco-short-term-creds-formats_{context}"]
40-
== Component secret formats
41-
The content of the component `Secret` object for a cluster that uses short-term credentials managed outside the cluster differs from the secret format used for long-term credentials.
44+
//AWS Security Token Service authentication process
45+
include::modules/cco-short-term-creds-auth-flow-aws.adoc[leveloffset=+2]
4246

4347
//AWS component secret formats
4448
include::modules/cco-short-term-creds-format-aws.adoc[leveloffset=+2]
4549

50+
//AWS component secret permissions requirements
51+
include::modules/cco-short-term-creds-component-permissions-aws.adoc[leveloffset=+2]
52+
53+
[id="cco-short-term-creds-gcp_{context}"]
54+
== GCP Workload Identity
55+
56+
In manual mode with GCP Workload Identity, the individual {product-title} cluster components use the GCP workload identity provider to allow components to impersonate GCP service accounts using short-term, limited-privilege credentials.
57+
58+
[role="_additional-resources"]
59+
.Additional resources
60+
* xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#installing-gcp-with-short-term-creds_installing-gcp-customizations[Configuring a GCP cluster to use short-term credentials]
61+
62+
//GCP Workload Identity authentication process
63+
include::modules/cco-short-term-creds-auth-flow-gcp.adoc[leveloffset=+2]
64+
4665
//GCP component secret formats
4766
include::modules/cco-short-term-creds-format-gcp.adoc[leveloffset=+2]
4867

68+
//GCP component secret permissions requirements (placeholder)
69+
//include::modules/cco-short-term-creds-component-permissions-gcp.adoc[leveloffset=+2]
70+
71+
[id="cco-short-term-creds-azure_{context}"]
72+
== Azure AD Workload Identity
73+
74+
In manual mode with Azure AD Workload Identity, the individual {product-title} cluster components use the Azure AD workload identity provider to assign components short-term security credentials.
75+
76+
[role="_additional-resources"]
77+
.Additional resources
78+
//* xr\ef:../../installing/installing_azure/installing-azure-customizations.adoc#installing-azure-with-short-term-creds_installing-azure-customizations[Configuring a global Microsoft Azure cluster to use short-term credentials]
79+
80+
//Azure AD Workload Identity authentication process (placeholder)
81+
//include::modules/cco-short-term-creds-auth-flow-azure.adoc[leveloffset=+2]
82+
4983
//Azure component secret formats
50-
//inc\lude::modules/cco-short-term-creds-format-azure.adoc[leveloffset=+2]
84+
include::modules/cco-short-term-creds-format-azure.adoc[leveloffset=+2]
85+
86+
//Azure component secret permissions requirements
87+
include::modules/cco-short-term-creds-component-permissions-azure.adoc[leveloffset=+2]
5188

5289
[role="_additional-resources"]
5390
[id="additional-resources_{context}"]

‎modules/cco-short-term-creds-auth-flow-aws.adoc

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/managing_cloud_provider_credentials/cco-short-term-creds.adoc
4+
5+
:_content-type: REFERENCE
6+
[id="cco-short-term-creds-auth-flow-aws_{context}"]
7+
= AWS Security Token Service authentication process
8+
9+
The following diagram details the authentication flow between AWS and the {product-title} cluster when using AWS STS.
10+
11+
.AWS Security Token Service authentication flow
12+
image::347_OpenShift_credentials_with_STS_updates_0623_AWS.png[Detailed authentication flow between AWS and the cluster when using AWS STS]

‎modules/cco-short-term-creds-auth-flow-azure.adoc

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/managing_cloud_provider_credentials/cco-short-term-creds.adoc
4+
5+
:_content-type: REFERENCE
6+
[id="cco-short-term-creds-auth-flow-azure_{context}"]
7+
= Azure AD Workload Identity authentication process
8+
9+
The following diagram details the authentication flow between Azure and the {product-title} cluster when using Azure AD Workload Identity.
10+
11+
//todo: work with dev and diagrams team to get a diagram for Azure
12+
.Azure AD Workload Identity authentication flow
13+
//image::azure_ad_workload_identity_flow.png[Detailed authentication flow between Azure and the cluster when using Azure AD Workload Identity]

‎modules/cco-short-term-creds-auth-flow-gcp.adoc

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/managing_cloud_provider_credentials/cco-short-term-creds.adoc
4+
5+
:_content-type: REFERENCE
6+
[id="cco-short-term-creds-auth-flow-gcp_{context}"]
7+
= GCP Workload Identity authentication process
8+
9+
The following diagram details the authentication flow between GCP and the {product-title} cluster when using GCP Workload Identity.
10+
11+
.GCP Workload Identity authentication flow
12+
image::347_OpenShift_credentials_with_STS_updates_0623_GCP.png[Detailed authentication flow between GCP and the cluster when using GCP Workload Identity]

‎modules/cco-short-term-creds-component-permissions-aws.adoc

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/managing_cloud_provider_credentials/cco-short-term-creds.adoc
4+
5+
:_content-type: REFERENCE
6+
[id="cco-short-term-creds-component-permissions-aws_{context}"]
7+
= AWS component secret permissions requirements
8+
9+
{product-title} components require the following permissions. These values are in the `CredentialsRequest` custom resource (CR) for each component.
10+
11+
[NOTE]
12+
====
13+
These permissions apply to all resources. Unless specified, there are no request conditions on these permissions.
14+
====
15+
16+
[cols="a,a,a"]
17+
|====
18+
|Component |Custom resource |Required permissions for services
19+
20+
|Cluster CAPI Operator
21+
|`openshift-cluster-api-aws`
22+
|**EC2**
23+
24+
* `ec2:CreateTags`
25+
* `ec2:DescribeAvailabilityZones`
26+
* `ec2:DescribeDhcpOptions`
27+
* `ec2:DescribeImages`
28+
* `ec2:DescribeInstances`
29+
* `ec2:DescribeInternetGateways`
30+
* `ec2:DescribeSecurityGroups`
31+
* `ec2:DescribeSubnets`
32+
* `ec2:DescribeVpcs`
33+
* `ec2:DescribeNetworkInterfaces`
34+
* `ec2:DescribeNetworkInterfaceAttribute`
35+
* `ec2:ModifyNetworkInterfaceAttribute`
36+
* `ec2:RunInstances`
37+
* `ec2:TerminateInstances`
38+
39+
**Elastic load balancing**
40+
41+
* `elasticloadbalancing:DescribeLoadBalancers`
42+
* `elasticloadbalancing:DescribeTargetGroups`
43+
* `elasticloadbalancing:DescribeTargetHealth`
44+
* `elasticloadbalancing:RegisterInstancesWithLoadBalancer`
45+
* `elasticloadbalancing:RegisterTargets`
46+
* `elasticloadbalancing:DeregisterTargets`
47+
48+
**Identity and Access Management (IAM)**
49+
50+
* `iam:PassRole`
51+
* `iam:CreateServiceLinkedRole`
52+
53+
**Key Management Service (KMS)**
54+
55+
* `kms:Decrypt`
56+
* `kms:Encrypt`
57+
* `kms:GenerateDataKey`
58+
* `kms:GenerateDataKeyWithoutPlainText`
59+
* `kms:DescribeKey`
60+
* `kms:RevokeGrant`^[1]^
61+
* `kms:CreateGrant` ^[1]^
62+
* `kms:ListGrants` ^[1]^
63+
64+
|Machine API Operator
65+
|`openshift-machine-api-aws`
66+
|**EC2**
67+
68+
* `ec2:CreateTags`
69+
* `ec2:DescribeAvailabilityZones`
70+
* `ec2:DescribeDhcpOptions`
71+
* `ec2:DescribeImages`
72+
* `ec2:DescribeInstances`
73+
* `ec2:DescribeInstanceTypes`
74+
* `ec2:DescribeInternetGateways`
75+
* `ec2:DescribeSecurityGroups`
76+
* `ec2:DescribeRegions`
77+
* `ec2:DescribeSubnets`
78+
* `ec2:DescribeVpcs`
79+
* `ec2:RunInstances`
80+
* `ec2:TerminateInstances`
81+
82+
**Elastic load balancing**
83+
84+
* `elasticloadbalancing:DescribeLoadBalancers`
85+
* `elasticloadbalancing:DescribeTargetGroups`
86+
* `elasticloadbalancing:DescribeTargetHealth`
87+
* `elasticloadbalancing:RegisterInstancesWithLoadBalancer`
88+
* `elasticloadbalancing:RegisterTargets`
89+
* `elasticloadbalancing:DeregisterTargets`
90+
91+
**Identity and Access Management (IAM)**
92+
93+
* `iam:PassRole`
94+
* `iam:CreateServiceLinkedRole`
95+
96+
**Key Management Service (KMS)**
97+
98+
* `kms:Decrypt`
99+
* `kms:Encrypt`
100+
* `kms:GenerateDataKey`
101+
* `kms:GenerateDataKeyWithoutPlainText`
102+
* `kms:DescribeKey`
103+
* `kms:RevokeGrant`^[1]^
104+
* `kms:CreateGrant` ^[1]^
105+
* `kms:ListGrants` ^[1]^
106+
107+
|Cloud Credential Operator
108+
|`cloud-credential-operator-iam-ro`
109+
|**Identity and Access Management (IAM)**
110+
111+
* `iam:GetUser`
112+
* `iam:GetUserPolicy`
113+
* `iam:ListAccessKeys`
114+
115+
|Cluster Image Registry Operator
116+
|`openshift-image-registry`
117+
|**S3**
118+
119+
* `s3:CreateBucket`
120+
* `s3:DeleteBucket`
121+
* `s3:PutBucketTagging`
122+
* `s3:GetBucketTagging`
123+
* `s3:PutBucketPublicAccessBlock`
124+
* `s3:GetBucketPublicAccessBlock`
125+
* `s3:PutEncryptionConfiguration`
126+
* `s3:GetEncryptionConfiguration`
127+
* `s3:PutLifecycleConfiguration`
128+
* `s3:GetLifecycleConfiguration`
129+
* `s3:GetBucketLocation`
130+
* `s3:ListBucket`
131+
* `s3:GetObject`
132+
* `s3:PutObject`
133+
* `s3:DeleteObject`
134+
* `s3:ListBucketMultipartUploads`
135+
* `s3:AbortMultipartUpload`
136+
* `s3:ListMultipartUploadParts`
137+
138+
|Ingress Operator
139+
|`openshift-ingress`
140+
|**Elastic load balancing**
141+
142+
* `elasticloadbalancing:DescribeLoadBalancers`
143+
144+
**Route 53**
145+
146+
* `route53:ListHostedZones`
147+
* `route53:ListTagsForResources`
148+
* `route53:ChangeResourceRecordSets`
149+
150+
**Tag**
151+
152+
* `tag:GetResources`
153+
154+
**Security Token Service (STS)**
155+
156+
* `sts:AssumeRole`
157+
158+
|Cluster Network Operator
159+
|`openshift-cloud-network-config-controller-aws`
160+
|**EC2**
161+
162+
* `ec2:DescribeInstances`
163+
* `ec2:DescribeInstanceStatus`
164+
* `ec2:DescribeInstanceTypes`
165+
* `ec2:UnassignPrivateIpAddresses`
166+
* `ec2:AssignPrivateIpAddresses`
167+
* `ec2:UnassignIpv6Addresses`
168+
* `ec2:AssignIpv6Addresses`
169+
* `ec2:DescribeSubnets`
170+
* `ec2:DescribeNetworkInterfaces`
171+
172+
|AWS Elastic Block Store CSI Driver Operator
173+
|`aws-ebs-csi-driver-operator`
174+
|**EC2**
175+
176+
* `ec2:AttachVolume`
177+
* `ec2:CreateSnapshot`
178+
* `ec2:CreateTags`
179+
* `ec2:CreateVolume`
180+
* `ec2:DeleteSnapshot`
181+
* `ec2:DeleteTags`
182+
* `ec2:DeleteVolume`
183+
* `ec2:DescribeInstances`
184+
* `ec2:DescribeSnapshots`
185+
* `ec2:DescribeTags`
186+
* `ec2:DescribeVolumes`
187+
* `ec2:DescribeVolumesModifications`
188+
* `ec2:DetachVolume`
189+
* `ec2:ModifyVolume`
190+
* `ec2:DescribeAvailabilityZones`
191+
* `ec2:EnableFastSnapshotRestores`
192+
193+
**Key Management Service (KMS)**
194+
195+
* `kms:ReEncrypt*`
196+
* `kms:Decrypt`
197+
* `kms:Encrypt`
198+
* `kms:GenerateDataKey`
199+
* `kms:GenerateDataKeyWithoutPlainText`
200+
* `kms:DescribeKey`
201+
* `kms:RevokeGrant`^[1]^
202+
* `kms:CreateGrant` ^[1]^
203+
* `kms:ListGrants` ^[1]^
204+
205+
|====
206+
[.small]
207+
--
208+
1. Request condition: `kms:GrantIsForAWSResource: true`
209+
--

0 commit comments

Comments
 (0)