Skip to content

Commit 58e9e07

Browse files
kalexand-rhkalexand-rh
authored
Merge pull request #16820 from openshift-cherrypick-robot/cherry-pick-16232-to-enterprise-4.2
[enterprise-4.2] osdocs-635 draft of GCP account config
2 parents 18ebe2b + 9390429 commit 58e9e07

8 files changed

+265
-10
lines changed

‎_topic_map.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,8 +107,8 @@ Topics:
107107
- Name: Installing on GCP
108108
Dir: installing_gcp
109109
Topics:
110-
# - Name: Configuring an GCP account
111-
# File: installing-gcp-account
110+
- Name: Configuring an GCP account
111+
File: installing-gcp-account
112112
- Name: Installing a cluster quickly on GCP
113113
File: installing-gcp-default
114114
- Name: Installing a cluster on GCP with customizations

‎installing/installing_gcp/installing-gcp-account.adoc‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,29 @@
11
[id="installing-gcp-account"]
2-
= Configuring a GCP account
2+
= Configuring a GCP project
33
include::modules/common-attributes.adoc[]
44
:context: installing-gcp-account
55

66
toc::[]
77

8-
Before you can install {product-title}, you must configure an
9-
Google Cloud Platform (GCP) account.
8+
Before you can install {product-title}, you must configure a
9+
Google Cloud Platform (GCP) project to host it.
1010

11-
//include::modules/installation-aws-route53.adoc[leveloffset=+1]
11+
include::modules/installation-gcp-dns.adoc[leveloffset=+1]
1212

13-
//include::modules/installation-aws-limits.adoc[leveloffset=+1]
13+
include::modules/installation-gcp-limits.adoc[leveloffset=+1]
1414

15-
//include::modules/installation-aws-permissions.adoc[leveloffset=+1]
15+
include::modules/installation-gcp-service-account.adoc[leveloffset=+1]
16+
include::modules/installation-gcp-permissions.adoc[leveloffset=+2]
1617

17-
//include::modules/installation-aws-iam-user.adoc[leveloffset=+1]
18+
include::modules/installation-gcp-enabling-api-services.adoc[leveloffset=+1]
1819

19-
//include::modules/installation-aws-regions.adoc[leveloffset=+1]
20+
include::modules/installation-gcp-regions.adoc[leveloffset=+1]
2021

22+
////
2123
.Next steps
2224
2325
* Install an {product-title} cluster. You can
2426
xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#installing-gcp-customizations[install a customized cluster]
2527
or xref:../../installing/installing_gcp/installing-gcp-default.adoc#installing-gcp-default[quickly install a cluster]
2628
with default options.
29+
////

‎modules/installation-gcp-dns.adoc‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_gcp/installing-gcp-account.adoc
4+
5+
[id="installation-gcp-dns_{context}"]
6+
= Configuring DNS for GCP
7+
8+
To install {product-title}, the Google Cloud Platform (GCP) account you use must
9+
have a dedicated public hosted zone in the same project that you host the
10+
{product-title} cluster. This zone must be authoritative for the domain. The
11+
DNS service provides cluster DNS resolution and name lookup for external
12+
connections to the cluster.
13+
14+
.Procedure
15+
16+
. Create a project to host your {product-title} cluster. See
17+
link:https://cloud.google.com/resource-manager/docs/creating-managing-projects[Creating and Managing Projects]
18+
in the GCP documentation.
19+
20+
. Identify your domain, or subdomain, and registrar. You can transfer an existing domain and
21+
registrar or obtain a new one through GCP or another source.
22+
+
23+
[NOTE]
24+
====
25+
If you purchase a new domain, it can take time for the relevant DNS
26+
changes to propagate. For more information about purchasing domains
27+
through Google, see link:https://domains.google/[Google Domains].
28+
====
29+
30+
. Create a public hosted zone for your domain or subdomain. See
31+
link:https://cloud.google.com/dns/zones/#creating_public_zones[Creating public zones]
32+
in the GCP documentation.
33+
+
34+
Use an appropriate root domain, such as `openshiftcorp.com`, or subdomain,
35+
such as `clusters.openshiftcorp.com`.
36+
37+
. Extract the new authoritative name servers from the hosted zone records. See
38+
link:https://cloud.google.com/dns/docs/update-name-servers#look_up_your_name_servers[Look up your Cloud DNS name servers]
39+
in the GCP documentation.
40+
+
41+
You typically have four name servers.
42+
43+
. Update the registrar records for the name servers that your domain
44+
uses. For example, if you registered your domain to Google Domains, see the
45+
following topic in the Google Domains Help:
46+
link:https://support.google.com/domains/answer/3290309?hl=en[How to switch to custom name servers].
47+
48+
. If you use a subdomain, follow your company's procedures to add its delegation
49+
records to the parent domain.

‎modules/installation-gcp-enabling-api-services.adoc‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_gcp/installing-gcp-account.adoc
4+
5+
[id="installation-gcp-enabling-api-services_{context}"]
6+
= Enabling API services in GCP
7+
8+
Your Google Cloud Platform (GCP) project requires access to several API services
9+
to complete {product-title} installation.
10+
11+
.Prerequisites
12+
13+
* You created a project to host your cluster.
14+
15+
.Procedure
16+
17+
* Enable the following required API services in the project that hosts your
18+
cluster. See
19+
link:https://cloud.google.com/service-usage/docs/enable-disable#enabling[Enabling services]
20+
in the GCP documentation.
21+
+
22+
.Required API services
23+
[cols="2a,3a",options="header"]
24+
|===
25+
|API service |Console service name
26+
|Compute Engine API
27+
|`compute.googleapis.com`
28+
29+
|Google Cloud APIs
30+
|`cloudapis.googleapis.com`
31+
32+
|Cloud Resource Manager API
33+
|`cloudresourcemanager.googleapis.com`
34+
35+
|Google DNS API
36+
|`dns.googleapis.com`
37+
38+
|IAM Service Account Credentials API
39+
|`iamcredentials.googleapis.com`
40+
41+
|Identity and Access Management (IAM API)
42+
|`iam.googleapis.com`
43+
44+
|Service Management API
45+
|`servicemanagement.googleapis.com`
46+
47+
|Service Usage API
48+
|`serviceusage.googleapis.com`
49+
50+
|Google Cloud Storage JSON API
51+
|`storage-api.googleapis.com`
52+
53+
|Cloud Storage
54+
|`storage-component.googleapis.com`
55+
|===

‎modules/installation-gcp-limits.adoc‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_gcp/installing-gcp-account.adoc
4+
5+
[id="installation-gcp-limits_{context}"]
6+
= GCP account limits
7+
8+
The {product-title} cluster uses a number of Google Cloud Platform (GCP)
9+
components, but the default
10+
link:https://cloud.google.com/docs/quota[Quotas]
11+
do not affect your ability to install a default {product-title} cluster.
12+
13+
A default cluster, which contains three compute and three control plane machines,
14+
uses the following resources. Note that some resources are required only during
15+
the bootstrap process and are removed after the cluster deploys.
16+
17+
.GCP resources used in a default cluster
18+
19+
[cols="2a,2a,2a,2a,2a",options="header"]
20+
|===
21+
|Service
22+
|Component
23+
|Location
24+
|Total resources required
25+
|Resources removed after bootstrap
26+
27+
|Service account |IAM |Global |5 |0
28+
|Firewall Rules |Compute |Global |35 |1
29+
|Forwarding Rules |Compute |Global |3 |0
30+
|In-use IP addresses global |Compute |Global |4 |1
31+
|Health checks |Compute |Global |3 |0
32+
|Images |Compute |Global |1 |0
33+
|Networks |Compute |Global |1 |0
34+
|Static IP addresses |Compute |Region |4 |1
35+
|Routers |Compute |Global |1 |0
36+
|Routes |Compute |Global |3 |0
37+
|Subnetworks |Compute |Global |2 |0
38+
|Target Pools |Compute |Global |3 |0
39+
|CPUs |Compute |Region |28 |4
40+
|Persistent Disk SSD (GB) |Compute |Region |896 |128
41+
42+
|===

‎modules/installation-gcp-permissions.adoc‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_gcp/installing-gcp-account.adoc
4+
5+
[id="installation-gcp-permissions_{context}"]
6+
= Required GCP permissions
7+
8+
When you attach the `Owner` role to the service account that you create, you
9+
grant that service account all permissions, including those that are required to
10+
install {product-title}. To deploy an {product-title} cluster, the service
11+
account requires the following permissions:
12+
13+
.Required roles for the installer
14+
* Compute Admin
15+
* DNS Administrator
16+
* Security Admin
17+
* Service Account Admin
18+
* Service Account User
19+
* Storage Admin
20+
21+
.Optional roles
22+
For the cluster to create new limited credentials for its Operators, add
23+
the following role:
24+
25+
* Service Account Key Admin
26+
27+
The roles are applied to the service accounts that the control plane and compute
28+
machines use:
29+
30+
.GCP service account permissions
31+
[cols="2a,2a",options="header"]
32+
|===
33+
34+
|Account
35+
|Roles
36+
37+
.5+|Control Plane
38+
|`roles/compute.instanceAdmin`
39+
|`roles/network.admin`
40+
|`roles/compute.securityAdmin`
41+
|`roles/storage.admin`
42+
|`roles/iam.serviceAccountUser`
43+
44+
.2+|Compute
45+
|`roles/compute.viewer`
46+
|`roles/storage.admin`
47+
|===

‎modules/installation-gcp-regions.adoc‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_gcp/installing-gcp-account.adoc
4+
5+
[id="installation-gcp-regions_{context}"]
6+
= Supported GCP regions
7+
8+
You can deploy an {product-title} cluster to the following Google Cloud Platform (GCP)
9+
regions:
10+
11+
* asia-east1 (Changhua County, Taiwan)
12+
* asia-east2 (Hong Kong)
13+
* asia-northeast1 (Tokyo, Japan)
14+
* asia-northeast2 (Osaka, Japan)
15+
* asia-south1 (Mumbai, India)
16+
* asia-southeast1 (Jurong West, Singapore)
17+
* australia-southeast1 (Sydney, Australia)
18+
* europe-north1 (Hamina, Finland)
19+
* europe-west1 (St. Ghislain, Belgium)
20+
* europe-west2 (London, England, UK)
21+
* europe-west3 (Frankfurt, Germany)
22+
* europe-west4 (Eemshaven, Netherlands)
23+
* europe-west6 (Zürich, Switzerland)
24+
* northamerica-northeast1 (Montréal, Québec, Canada)
25+
* southamerica-east1 (São Paulo, Brazil)
26+
* us-central1 (Council Bluffs, Iowa, USA)
27+
* us-east1 (Moncks Corner, South Carolina, USA)
28+
* us-east4 (Ashburn, Northern Virginia, USA)
29+
* us-west1 (The Dalles, Oregon, USA)
30+
* us-west2 (Los Angeles, California, USA)

‎modules/installation-gcp-service-account.adoc‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_gcp/installing-gcp-account.adoc
4+
5+
[id="installation-gcp-service-account_{context}"]
6+
= Creating a service account in GCP
7+
8+
{product-title} requires a Google Cloud Platform (GCP) service account.
9+
10+
.Prerequisites
11+
12+
* You created a project to host your cluster.
13+
14+
.Procedure
15+
16+
. Create a new service account in the project that you use to host your
17+
{product-title} cluster. See
18+
link:https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating_a_service_account[Creating a service account]
19+
in the GCP documentation.
20+
21+
. Grant the service account the appropriate permissions. You can either
22+
grant the individual permissions that follow or assign the `Owner` role to it.
23+
See link:https://cloud.google.com/iam/docs/granting-roles-to-service-accounts#granting_access_to_a_service_account_for_a_resource[Granting roles to a service account for specific resources]
24+
25+
. Create the service account key.
26+
See link:https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys[Creating service account keys]
27+
in the GCP documentation.
28+
+
29+
The service account key is required to create a cluster.

0 commit comments

Comments
 (0)