×
Manual mode with short-term credentials for components
During installation, you can configure the Cloud Credential Operator (CCO) to operate in manual mode and use the CCO utility (ccoctl) to implement short-term security credentials for individual components that are created and managed outside the OKD cluster.
|
This credentials strategy is supported for Amazon Web Services (AWS), Google Cloud Platform (GCP), and global Microsoft Azure only. The strategy must be configured during installation of a new OKD cluster. You cannot configure an existing cluster that uses a different credentials strategy to use this feature. |
Cloud providers use different terms for their implementation of this authentication method.
| Cloud provider | Provider nomenclature |
|---|---|
Amazon Web Services (AWS) |
AWS Security Token Service (STS) |
Google Cloud Platform (GCP) |
GCP Workload Identity |
Global Microsoft Azure |
Azure AD Workload Identity |
AWS Security Token Service
In manual mode with STS, the individual OKD cluster components use the AWS Security Token Service (STS) to assign components IAM roles that provide short-term, limited-privilege security credentials. These credentials are associated with IAM roles that are specific to each component that makes AWS API calls.
Additional resources
AWS Security Token Service authentication process
The following diagram details the authentication flow between AWS and the OKD cluster when using AWS STS.
Figure 1. AWS Security Token Service authentication flow
AWS component secret formats
Using manual mode with the AWS Security Token Service (STS) changes the content of the AWS credentials that are provided to individual OKD components. Compare the following secret formats:
AWS secret format using long-term credentials
apiVersion: v1
kind: Secret
metadata:
namespace: <target_namespace> (1)
name: <target_secret_name> (2)
data:
aws_access_key_id: <base64_encoded_access_key_id>
aws_secret_access_key: <base64_encoded_secret_access_key>| 1 | The namespace for the component. |
| 2 | The name of the component secret. |
AWS secret format using AWS STS
apiVersion: v1
kind: Secret
metadata:
namespace: <target_namespace> (1)
name: <target_secret_name> (2)
stringData:
credentials: |-
[default]
sts_regional_endpoints = regional
role_name: <operator_role_name> (3)
web_identity_token_file: <path_to_token> (4)| 1 | The namespace for the component. |
| 2 | The name of the component secret. |
| 3 | The IAM role for the component. |
| 4 | The path to the service account token inside the pod. By convention, this is /var/run/secrets/openshift/serviceaccount/token for OKD components. |
AWS component secret permissions requirements
OKD components require the following permissions. These values are in the CredentialsRequest custom resource (CR) for each component.
|
These permissions apply to all resources. Unless specified, there are no request conditions on these permissions. |
| Component | Custom resource | Required permissions for services |
|---|---|---|
Cluster CAPI Operator |
|
EC2
Elastic load balancing
Identity and Access Management (IAM)
Key Management Service (KMS)
|
Machine API Operator |
|
EC2
Elastic load balancing
Identity and Access Management (IAM)
Key Management Service (KMS)
|
Cloud Credential Operator |
|
Identity and Access Management (IAM)
|
Cluster Image Registry Operator |
|
S3
|
Ingress Operator |
|
Elastic load balancing
Route 53
Tag
Security Token Service (STS)
|
Cluster Network Operator |
|
EC2
|
AWS Elastic Block Store CSI Driver Operator |
|
EC2
Key Management Service (KMS)
|
-
Request condition:
kms:GrantIsForAWSResource: true
GCP Workload Identity
In manual mode with GCP Workload Identity, the individual OKD cluster components use the GCP workload identity provider to allow components to impersonate GCP service accounts using short-term, limited-privilege credentials.
Additional resources
GCP Workload Identity authentication process
The following diagram details the authentication flow between GCP and the OKD cluster when using GCP Workload Identity.
Figure 2. GCP Workload Identity authentication flow
GCP component secret formats
Using manual mode with GCP Workload Identity changes the content of the GCP credentials that are provided to individual OKD components. Compare the following secret content:
GCP secret format
apiVersion: v1
kind: Secret
metadata:
namespace: <target_namespace> (1)
name: <target_secret_name> (2)
data:
service_account.json: <service_account> (3)| 1 | The namespace for the component. |
| 2 | The name of the component secret. |
| 3 | The Base64 encoded service account. |
Content of the Base64 encoded
service_account.json file using long-term credentials{
"type": "service_account", (1)
"project_id": "<project_id>",
"private_key_id": "<private_key_id>",
"private_key": "<private_key>", (2)
"client_email": "<client_email_address>",
"client_id": "<client_id>",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/<client_email_address>"
}| 1 | The credential type is service_account. |
| 2 | The private RSA key that is used to authenticate to GCP. This key must be kept secure and is not rotated. |
Content of the Base64 encoded
service_account.json file using GCP Workload Identity{
"type": "external_account", (1)
"audience": "//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/test-pool/providers/test-provider", (2)
"subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
"token_url": "https://sts.googleapis.com/v1/token",
"service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/<client_email_address>:generateAccessToken", (3)
"credential_source": {
"file": "<path_to_token>", (4)
"format": {
"type": "text"
}
}
}| 1 | The credential type is external_account. |
| 2 | The target audience is the GCP Workload Identity provider. |
| 3 | The resource URL of the service account that can be impersonated with these credentials. |
| 4 | The path to the service account token inside the pod. By convention, this is /var/run/secrets/openshift/serviceaccount/token for OKD components. |
Azure AD Workload Identity
In manual mode with Azure AD Workload Identity, the individual OKD cluster components use the Azure AD workload identity provider to assign components short-term security credentials.
Azure component secret formats
Additional resources
Using manual mode with AD Workload Identity changes the content of the Azure credentials that are provided to individual OKD components. Compare the following secret formats:
Azure secret format using long-term credentials
apiVersion: v1
kind: Secret
metadata:
namespace: <target_namespace> (1)
name: <target_secret_name> (2)
data:
azure_client_id: <client_id> (3)
azure_client_secret: <client_secret> (4)
azure_region: <region>
azure_resource_prefix: <resource_group_prefix> (5)
azure_resourcegroup: <resource_group_prefix>-rg (6)
azure_subscription_id: <subscription_id>
azure_tenant_id: <tenant_id>
type: Opaque| 1 | The namespace for the component. |
| 2 | The name of the component secret. |
| 3 | The client ID of the Azure AD identity that the component uses to authenticate. |
| 4 | The component secret that is used to authenticate with Azure AD for the <client_id> identity. |
| 5 | The resource group prefix. |
| 6 | The resource group. This value is formed by the <resource_group_prefix> and the suffix -rg. |
Azure secret format using AD Workload Identity
apiVersion: v1
kind: Secret
metadata:
namespace: <target_namespace> (1)
name: <target_secret_name> (2)
data:
azure_client_id: <client_id> (3)
azure_federated_token_file: <path_to_token_file> (4)
azure_region: <region>
azure_subscription_id: <subscription_id>
azure_tenant_id: <tenant_id>
type: Opaque| 1 | The namespace for the component. |
| 2 | The name of the component secret. |
| 3 | The client ID of the user-assigned managed identity that the component uses to authenticate. |
| 4 | The path to the mounted service account token file. |
Azure component secret permissions requirements
OKD components require the following permissions. These values are in the CredentialsRequest custom resource (CR) for each component.
| Component | Custom resource | Required permissions for services |
|---|---|---|
Cloud Controller Manager Operator |
|
|
Cluster CAPI Operator |
|
role: |
Machine API Operator |
|
|
Cluster Image Registry Operator |
|
Data permissions
General permissions
|
Ingress Operator |
|
|
Cluster Network Operator |
|
|
Azure File CSI Driver Operator |
|
|
Azure Disk CSI Driver Operator |
|
|
-
This component requires a role rather than a set of permissions.