8.7. kube-system 프로젝트에 관리자 수준 시크릿을 저장하는 대안

프로세스

1. 설치 프로그램이 사용하는 GCP 계정에 다음 세분화된 권한을 추가합니다.

   예 8.1. 필요한 GCP 권한

   • compute.machineTypes.list
   • compute.regions.list
   • compute.zones.list
   • dns.changes.create

2. apiVersion: v1
   baseDomain: example.com
   credentialsMode: Manual
   # ...

3. $ openshift-install create manifests --dir <installation_directory>

4. $ RELEASE_IMAGE=$(./openshift-install version | awk '/release image/ {print $3}')

5. $ oc adm release extract \
     --from=$RELEASE_IMAGE \
     --credentials-requests \
     --included \1
     --install-config=<path_to_directory_with_installation_configuration>/install-config.yaml \2
     --to=<path_to_directory_for_credentials_requests> 3

   1

   2

   3

   apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: <component_credentials_request>
     namespace: openshift-cloud-credential-operator
     ...
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
       kind: GCPProviderSpec
       predefinedRoles:
       - roles/storage.admin
       - roles/iam.serviceAccountUser
       skipServiceCheck: true
     ...

6. apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: <component_credentials_request>
     namespace: openshift-cloud-credential-operator
     ...
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
         ...
     secretRef:
       name: <component_secret>
       namespace: <component_namespace>
     ...

   apiVersion: v1
   kind: Secret
   metadata:
     name: <component_secret>
     namespace: <component_namespace>
   data:
     service_account.json: <base64_encoded_gcp_service_account_file>