Chapter 6. Google workload identity federation cloud authentication

Procedure

1. Create an oadp-credrequest directory by running the following command:

   $ mkdir -p oadp-credrequest

   Copy to Clipboard Toggle word wrap

2. Create a CredentialsRequest.yaml file as following:

   echo 'apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: oadp-operator-credentials
     namespace: openshift-cloud-credential-operator
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
       kind: GCPProviderSpec
       permissions:
       - compute.disks.get
       - compute.disks.create
       - compute.disks.createSnapshot
       - compute.snapshots.get
       - compute.snapshots.create
       - compute.snapshots.useReadOnly
       - compute.snapshots.delete
       - compute.zones.get
       - storage.objects.create
       - storage.objects.delete
       - storage.objects.get
       - storage.objects.list
       - iam.serviceAccounts.signBlob
       skipServiceCheck: true
     secretRef:
       name: cloud-credentials-gcp
       namespace: <OPERATOR_INSTALL_NS>
     serviceAccountNames:
     - velero
   ' > oadp-credrequest/credrequest.yaml

   Copy to Clipboard Toggle word wrap

3. Use the ccoctl utility to process the CredentialsRequest objects in the oadp-credrequest directory by running the following command:

   $ ccoctl gcp create-service-accounts \
       --name=<name> \
       --project=<gcp_project_id> \
       --credentials-requests-dir=oadp-credrequest \
       --workload-identity-pool=<pool_id> \
       --workload-identity-provider=<provider_id>

   Copy to Clipboard Toggle word wrap

   The manifests/openshift-adp-cloud-credentials-gcp-credentials.yaml file is now available to use in the following steps.

4. Create a namespace by running the following command:

   $ oc create namespace <OPERATOR_INSTALL_NS>

   Copy to Clipboard Toggle word wrap

5. Apply the credentials to the namespace by running the following command:

   $ oc apply -f manifests/openshift-adp-cloud-credentials-gcp-credentials.yaml

   Copy to Clipboard Toggle word wrap