You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/ccs-gcp-customer-procedure-wif.adoc
+72-59Lines changed: 72 additions & 59 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,6 +6,8 @@
6
6
7
7
= Workload Identity Federation authentication type procedure
8
8
// TODO: Same as other module - Better procedure heading that tells you what this is doing
9
+
10
+
[role="_abstract"]
9
11
Besides the required customer procedures listed in _Required customer procedure_, there are other specific actions that you must take when creating an {product-title} cluster on {GCP} using Workload Identity Federation (WIF) as the authentication type.
10
12
11
13
.Procedure
@@ -28,80 +30,91 @@ The following roles are only required when creating, updating, or deleting WIF c
28
30
Required by the {gcp-short} client in the OCM CLI for creating custom role.
29
31
30
32
|`roles/iam.roleAdmin`
31
-
|* iam.roles.create
32
-
* iam.roles.delete
33
-
* iam.roles.get
34
-
* iam.roles.list
35
-
* iam.roles.undelete
36
-
* iam.roles.update
37
-
* resourcemanager.projects.get
38
-
* resourcemanager.projects.getIamPolicy
33
+
34
+
|iam.roles.create
35
+
36
+
iam.roles.delete
37
+
38
+
iam.roles.get
39
+
40
+
iam.roles.list
41
+
42
+
iam.roles.undelete
43
+
44
+
iam.roles.update
45
+
46
+
resourcemanager.projects.get
47
+
resourcemanager.projects.getIamPolicy
39
48
40
49
|Service Account Admin
41
50
42
51
Required for the pre-creation of the service accounts used by the deployer, support, and Operators.
43
52
|`roles/iam.serviceAccountAdmin`
44
-
|* iam.serviceAccountApiKeyBindings.create
45
-
* iam.serviceAccountApiKeyBindings.delete
46
-
* iam.serviceAccountApiKeyBindings.undelete
47
-
* iam.serviceAccounts.create
48
-
* iam.serviceAccounts.createTagBinding
49
-
* iam.serviceAccounts.delete
50
-
* iam.serviceAccounts.deleteTagBinding
51
-
* iam.serviceAccounts.disable
52
-
* iam.serviceAccounts.enable
53
-
* iam.serviceAccounts.get
54
-
* iam.serviceAccounts.getIamPolicy
55
-
* iam.serviceAccounts.list
56
-
* iam.serviceAccounts.listEffectiveTags
57
-
* iam.serviceAccounts.listTagBindings
58
-
* iam.serviceAccounts.setIamPolicy
59
-
* iam.serviceAccounts.undelete
60
-
* iam.serviceAccounts.update
61
-
* resourcemanager.projects.get
62
-
* resourcemanager.projects.list
53
+
54
+
a| iam.serviceAccountApiKeyBindings.create
55
+
iam.serviceAccountApiKeyBindings.delete
56
+
iam.serviceAccountApiKeyBindings.undelete
57
+
iam.serviceAccounts.create
58
+
iam.serviceAccounts.create
59
+
iam.serviceAccounts.create
60
+
iam.serviceAccounts.createTagBinding
61
+
iam.serviceAccounts.delete
62
+
iam.serviceAccounts.deleteTagBinding
63
+
iam.serviceAccounts.disable
64
+
iam.serviceAccounts.enable
65
+
iam.serviceAccounts.get
66
+
iam.serviceAccounts.getIamPolicy
67
+
iam.serviceAccounts.list
68
+
iam.serviceAccounts.listEffectiveTags
69
+
iam.serviceAccounts.listTagBindings
70
+
iam.serviceAccounts.setIamPolicy
71
+
iam.serviceAccounts.undelete
72
+
iam.serviceAccounts.update
73
+
resourcemanager.projects.get
74
+
resourcemanager.projects.list
63
75
64
76
|Workload Identity Pool Admin
65
77
66
78
Required to create and configure the workload identity pool.
Copy file name to clipboardExpand all lines: modules/ccs-gcp-customer-procedure.adoc
+7Lines changed: 7 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,6 +6,7 @@
6
6
7
7
= Required customer procedure
8
8
9
+
[role="_abstract"]
9
10
The Customer Cloud Subscription (CCS) model allows Red{nbsp}Hat to deploy and manage {product-title} into a customer's {gcp-first} project. Red{nbsp}Hat requires several prerequisites to be completed before providing these services.
10
11
[NOTE]
11
12
====
@@ -108,6 +109,12 @@ For more information about configuring {gcp-short} organization policy constrain
108
109
|`orgpolicy.googleapis.com`
109
110
|Used to identify governance rules applied to customer’s {gcp-full} that might impact cluster creation or management.
|Enables users to procure products from the {gcp-short} Marketplace. Specifically, this permission is required to validate through this API that customers have accepted the Marketplace terms and conditions for {product-title}.
115
+
116
+
This API is required when transacting through the {gcp-short} Marketplace.
To deploy an {product-title} cluster using {GCP} Marketplace-based billing, your {GCP} account must first be prepared. This involves accepting the {GCP} Marketplace terms and agreements for the OpenShift Dedicated product listing. Contact your {GCP} administrator who has the `Consumer Procurement Entitlement Manager` role to enable {product-title} cluster deployments in your {GCP} project.
11
+
12
+
To automate the checking and acceptance of these terms and agreements during OpenShift Dedicated cluster creation, you must grant the `Consumer Procurement Entitlement Viewer` role to the {GCP} identity (user or service account) that is creating the cluster. The `Consumer Procurement Entitlement Viewer` role includes the necessary permissions to check for existing consent to the {GCP} terms and agreements and grants consent if that has not yet been given.
13
+
14
+
The following table lists the permissions that are included in the `Consumer Procurement Entitlement Viewer` role.
15
+
16
+
.Required permissions in the Consumer Procurement Entitlement Viewer role
17
+
[cols="2a,3a,3a",options="header"]
18
+
|===
19
+
20
+
|Role and description|Console role name|Permissions
Allows for the inspecting of entitlements and service states for a consumer project.
25
+
|`consumerprocurement.entitlementViewer`
26
+
|commerceoffercatalog.offers.get
27
+
consumerprocurement.consents.check
28
+
consumerprocurement.consents.list
29
+
consumerprocurement.entitlements.get
30
+
consumerprocurement.entitlements.list
31
+
consumerprocurement.freeTrials.get
32
+
consumerprocurement.freeTrials.list
33
+
orgpolicy.policy.get
34
+
resourcemanager.projects.get
35
+
resourcemanager.projects.list
36
+
serviceusage.consumerpolicy.analyze
37
+
serviceusage.consumerpolicy.get
38
+
serviceusage.effectivepolicy.get
39
+
serviceusage.groups.list
40
+
serviceusage.groups.listExpandedMembers
41
+
serviceusage.groups.listMembers
42
+
serviceusage.services.get
43
+
serviceusage.services.list
44
+
serviceusage.values.test
45
+
46
+
|===
47
+
48
+
For more information about {GCP} Marketplace roles and permissions, see link:https://docs.cloud.google.com/marketplace/docs/access-control[Access control with IAM] in the {GCP} documentation.
0 commit comments