You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -27,140 +27,6 @@ Before creating the cluster, you must first create a WIF configuration.
27
27
Migrating an existing non-WIF cluster to a WIF configuration is not supported. This feature can only be enabled during new cluster creation.
28
28
====
29
29
30
-
[id="create-wif-configuration_{context}"]
31
-
== Creating a WIF configuration
32
-
33
-
.Procedure
34
-
You can create a WIF configuration using the `auto` mode or the `manual` mode.
35
-
36
-
The `auto` mode enables you to automatically create the service accounts for {product-title} components as well as other IAM resources.
37
-
38
-
Alternatively, you can use the `manual` mode. In `manual` mode, you are provided with commands within a `script.sh` file which you use to manually create the service accounts for {product-title} components as well as other IAM resources.
39
-
40
-
* Based on your mode preference, run one of the following commands to create a WIF configuration:
41
-
42
-
** Create a WIF configuration in auto mode by running the following command:
<1> Replace `<wif_name>` with the name of your WIF configuration.
52
-
<2> Replace `<gcp_project_id>` with the ID of the {GCP} project where the WIF configuration will be implemented.
53
-
<3> Optional: Replace `<osd_version>` with the desired {product-title} version the wif-config will need to support. If you do not specify a version, the wif-config will support the latest {product-title} y-stream version as well as the last three supported {product-title} y-stream versions (beginning with version 4.17).
54
-
<4> Optional: Replace `<gcp_project_id>` with the ID of the dedicated project where the workload identity pools and providers will be created and managed. If the `--federated-project` flag is not specified, the workload identity pools and providers will be created and managed in the project specified by the `--project` flag.
55
-
56
-
+
57
-
58
-
[NOTE]
59
-
=====
60
-
Using a dedicated project to create and manage workload identity pools and providers is recommended by {GCP}.
61
-
Using a dedicated project helps you to establish centralized governance over the configuration of workload identity pools and providers, enforce uniform attribute mappings and conditions throughout all projects and applications, and ensure that only authorized identity providers can authenticate with WIF.
62
-
63
-
For more information, see link:https://cloud.google.com/iam/docs/best-practices-for-using-workload-identity-federation#dedicated-project[Use a dedicated project to manage workload identity pools and providers].
64
-
=====
65
-
+
66
-
[IMPORTANT]
67
-
====
68
-
Creating and managing workload identity pools and providers in a dedicated project is only allowed during initial WIF configuration creation. The `--federated-project` flag cannot be applied to existing `wif-configs`.
For the complete list of WIF configuration roles and their assigned permissions, see link:https://github.com/openshift/managed-cluster-config/blob/master/resources/wif/4.19/vanilla.yaml[managed-cluster-config].
160
-
161
-
[id="create-wif-cluster_{context}"]
162
-
== Creating a WIF cluster
163
-
164
30
.Procedure
165
31
You can create a WIF cluster using the `interactive` mode or the `non-interactive` mode.
166
32
@@ -227,176 +93,4 @@ If an {product-title} version is specified, the version must also be supported b
227
93
====
228
94
If your cluster deployment fails during installation, certain resources created during the installation process are not automatically removed from your {GCP} account. To remove these resources from your {gcp-short} account, you must delete the failed cluster.
229
95
====
230
-
231
-
[id="ocm-cli-list-wif-commands_{context}"]
232
-
== Listing WIF clusters
233
-
234
-
To list all of your {product-title} clusters that have been deployed using the WIF authentication type, run the following command:
235
-
236
-
[source,terminal]
237
-
----
238
-
$ ocm list clusters --parameter search="gcp.authentication.wif_config_id != ''"
239
-
----
240
-
To list all of your {product-title} clusters that have been deployed using a specific wif-config, run the following command:
241
-
[source,terminal]
242
-
----
243
-
$ ocm list clusters --parameter search="gcp.authentication.wif_config_id = '<wif_config_id>'" <1>
244
-
----
245
-
<1> Replace `<wif_config_id>` with the ID of the WIF configuration.
246
-
247
-
[id="wif-configuration-update_{context}"]
248
-
== Updating a WIF configuration
249
-
250
-
[NOTE]
251
-
====
252
-
Updating a WIF configuration is only applicable for y-stream updates. For an overview of the update process, including details regarding version semantics, see link:https://www.redhat.com/en/blog/the-ultimate-guide-to-openshift-release-and-upgrade-process-for-cluster-administrators#:~:text=Ongoing%20security%20patches%20and%20bug,is%20the%20dark%20green%20bar.[The Ultimate Guide to OpenShift Release and Upgrade Process for Cluster Administrators].
253
-
====
254
-
Before upgrading a WIF-enabled {product-title} cluster to a newer version, you must update the wif-config to that version as well. If you do not update the wif-config version before attempting to upgrade the cluster version, the cluster version upgrade will fail.
255
-
256
-
As part of Red{nbsp}Hat's ongoing commitment to the principle of least privilege, certain permissions previously assigned to the `osd-deployer` service account in WIF configurations have been removed. These changes help enhance the security of your clusters by ensuring that service accounts have only the permissions they need to perform their functions.
257
-
258
-
For the complete list of WIF configuration roles and their assigned permissions, see link:https://github.com/openshift/managed-cluster-config/blob/master/resources/wif/4.19/vanilla.yaml[managed-cluster-config].
259
-
260
-
To align your existing WIF configurations with these updated permissions, you can run the `ocm gcp update wif-config` command. This command updates the WIF configuration to include the latest permissions and roles required for optimal operation.
261
-
262
-
When you update a wif-config or create a new one, ensure your {cluster-manager} CLI (`ocm`) is up to date. Not updating to the latest version of the `ocm` can result in error messages and service disruptions.
263
-
264
-
.Example output
265
-
[source,text]
266
-
----
267
-
Error: failed to create wif-config: failed to create wif-config: status is 400, identifier is '400', code is 'CLUSTERS-MGMT-400', at '2025-10-06T15:18:37Z' and operation identifier is 'f9551d63-a58a-4e3c-b847-5f99ba1b0b74': Client version is out of date for WIF operations. Please update from vOCM-CLI/1.0.7 to v1.0.8 and try again.
268
-
----
269
-
270
-
.Procedure
271
-
. To check the version of your `ocm`, run the following command:
272
-
+
273
-
[source,terminal]
274
-
----
275
-
$ ocm version
276
-
----
277
-
+
278
-
. Optional: If your `ocm` version is not the latest available, download and install the latest version from the link:https://console.redhat.com/openshift/downloads[Downloads] page on {cluster-manager}.
279
-
+
280
-
. Update a wif-config to a specific {product-title} version by running the following command:
281
-
+
282
-
[source,terminal]
283
-
----
284
-
ocm gcp update wif-config <wif_name> \ <1>
285
-
--version <version> <2>
286
-
----
287
-
<1> Replace `<wif_name>` with the name of the WIF configuration you want to update.
288
-
<2> Optional: Replace `<version>` with the {product-title} y-stream version you plan to update the cluster to. If you do not specify a version, the wif-config will be updated to support the latest {product-title} y-stream version as well as the last three {product-title} supported y-stream versions (beginning with version 4.17).
289
-
290
-
[id="wif-removing-stale-permissions_{context}"]
291
-
== Removing stale permissions from service accounts managed by a WIF configuration
292
-
293
-
The stale set of permissions previously assigned to the `osd-deployer` service account will remain on the account after updating the wif-config. You need to manually access the roles and remove these stale permissions from them.
=== Removing stale deployer permissions from service accounts managed by a WIF configuration
297
-
298
-
To remove the stale deployer permissions, run the following commands on a terminal with access to the {gcp-full} project hosting the service accounts.
299
-
300
-
.Procedure
301
-
302
-
. Retrieve the existing role definition, ensuring the `PROJECT_ID` environment variable points to your {gcp-full} project:
303
-
+
304
-
[source,terminal]
305
-
----
306
-
$ gcloud iam roles describe \
307
-
osd_deployer_v4.18 \
308
-
--project $PROJECT_ID \
309
-
--format=yaml > /tmp/role.yaml
310
-
----
311
-
+
312
-
. Remove the unwanted permissions. You can do this by filtering out the unwanted permissions from the role definition file and saving the updated definition to a new file:
. Review the changes in the output between the original and updated role definitions to ensure only the unwanted permissions have been removed:
323
-
+
324
-
[source,terminal]
325
-
----
326
-
$ diff /tmp/role.yaml /tmp/updated_role.yaml
327
-
----
328
-
+
329
-
. Update the role in {gcp-full} with the updated role definition file, ensuring the `PROJECT_ID` environment variable points to your {gcp-full} project:
. Remove the unwanted permissions. You can do this by filtering out the unwanted permissions from the role definition file and saving the updated definition to a new file:
. Review the changes in the output between the original and updated role definitions to ensure only the unwanted permissions have been removed:
361
-
+
362
-
[source,terminal]
363
-
----
364
-
$ diff /tmp/role.yaml /tmp/updated_role.yaml
365
-
----
366
-
+
367
-
. Update the role in {gcp-full} with the updated role definition file, ensuring the `PROJECT_ID` environment variable points to your {gcp-full} project:
368
-
+
369
-
[source,terminal]
370
-
----
371
-
$ gcloud iam roles update sre_managed_support --project $PROJECT_ID --file=/tmp/updated_role.yaml
372
-
----
373
-
374
-
[id="ocm-cli-verify-wif-commands_{context}"]
375
-
== Verifying a WIF configuration
376
-
You can verify that the configuration of resources associated with a WIF configuration are correct by running the `ocm gcp verify wif-config` command. If a misconfiguration is found, the output provides details about the misconfiguration and recommends that you update the WIF configuration.
377
-
378
-
You need the name and ID of the WIF configuration you want to verify before verification.
379
-
To obtain the name and ID of your active WIF configurations, run the following command:
380
-
381
-
[source,terminal]
382
-
----
383
-
$ ocm gcp list wif-configs
384
-
----
385
-
386
-
To determine if the WIF configuration you want to verify is configured correctly, run the following command:
= Creating a Workload Identity Federation cluster using {cluster-manager}
9
9
10
+
[role="_abstract"]
11
+
Follow the steps in this procedure to create an {product-title} cluster on {gcp-full} using Workload Identity Federation (WIF) for authentication through the {cluster-manager} web console
12
+
10
13
.Procedure
11
14
12
15
. Log in to {cluster-manager-url} and click *Create cluster* on the {product-title} card.
0 commit comments