Determining the Cloud Credential Operator mode

For platforms that support using the CCO in multiple modes, you can determine what mode the CCO is configured to use by using the web console or the CLI.

Decision tree showing how to determine the configured CCO credentials mode for your cluster.
Figure 9. Determining the CCO configuration
Determining the Cloud Credential Operator mode by using the web console

You can determine what mode the Cloud Credential Operator (CCO) is configured to use by using the web console.

Before you perform upgrades or troubleshoot, ensure you understand your cluster’s credential management configuration.

Note

Only Amazon Web Services (AWS), global Microsoft Azure, and Google Cloud clusters support multiple CCO modes.
Prerequisites

  • You have access to an Red Hat OpenShift Container Platform account with cluster administrator permissions.

Procedure

  1. Log in to the Red Hat OpenShift Container Platform web console as a user with the cluster-admin role.

  2. Navigate to Administration → Cluster Settings.

  3. On the Cluster Settings page, select the Configuration tab.

  4. Under Configuration resource, select CloudCredential.

  5. On the CloudCredential details page, select the YAML tab.

  6. In the YAML block, check the value of spec.credentialsMode. The following values are possible, though not all are supported on all platforms:

    • '': The CCO is operating in the default mode. In this configuration, the CCO operates in mint or passthrough mode, depending on the credentials provided during installation.

    • Mint: The CCO is operating in mint mode.

    • Passthrough: The CCO is operating in passthrough mode.

    • Manual: The CCO is operating in manual mode.

    Important

    To determine the specific configuration of an AWS, Google Cloud, or global Microsoft Azure cluster that has a spec.credentialsMode of '', Mint, or Manual, you must investigate further.

    AWS and Google Cloud clusters support using mint mode with the root secret deleted.

    An AWS, Google Cloud, or global Microsoft Azure cluster that uses manual mode might be configured to create and manage cloud credentials from outside of the cluster with AWS STS, Google Cloud Workload Identity, or Microsoft Entra Workload ID. You can determine whether your cluster uses this strategy by examining the cluster Authentication object.

  7. AWS or Google Cloud clusters that use the default ('') only: To determine whether the cluster is operating in mint or passthrough mode, inspect the annotations on the cluster root secret:

    1. Navigate to Workloads → Secrets and look for the root secret for your cloud provider.

      Note

      Ensure that the Project dropdown is set to All Projects.
      Platform Secret name

      AWS

      aws-creds

      Google Cloud

      gcp-credentials

    2. To view the CCO mode that the cluster is using, click 1 annotation under Annotations, and check the value field. The following values are possible:

      • Mint: The CCO is operating in mint mode.

      • Passthrough: The CCO is operating in passthrough mode.

      If your cluster uses mint mode, you can also determine whether the cluster is operating without the root secret.

  8. AWS or Google Cloud clusters that use mint mode only: To determine whether the cluster is operating without the root secret, navigate to Workloads → Secrets and look for the root secret for your cloud provider.

    Note

    Ensure that the Project dropdown is set to All Projects.
    Platform Secret name

    AWS

    aws-creds

    Google Cloud

    gcp-credentials

    • If you see one of these values, your cluster is using mint or passthrough mode with the root secret present.

    • If you do not see these values, your cluster is using the CCO in mint mode with the root secret removed.

  9. AWS, Google Cloud, or global Microsoft Azure clusters that use manual mode only: To determine whether the cluster is configured to create and manage cloud credentials from outside of the cluster, you must check the cluster Authentication object YAML values.

    1. Navigate to Administration → Cluster Settings.

    2. On the Cluster Settings page, select the Configuration tab.

    3. Under Configuration resource, select Authentication.

    4. On the Authentication details page, select the YAML tab.

    5. In the YAML block, check the value of the .spec.serviceAccountIssuer parameter.

      • A value that contains a URL that is associated with your cloud provider indicates that the CCO is using manual mode with short-term credentials for components. These clusters are configured using the ccoctl utility to create and manage cloud credentials from outside of the cluster.

      • An empty value ('') indicates that the cluster is using the CCO in manual mode but was not configured using the ccoctl utility.

Determining the Cloud Credential Operator mode by using the CLI

You can determine what mode the Cloud Credential Operator (CCO) is configured to use by using the CLI.

Before you perform upgrades or troubleshoot, ensure you understand your cluster’s credential management configuration.

Note

Only Amazon Web Services (AWS), global Microsoft Azure, and Google Cloud clusters support multiple CCO modes.
Prerequisites

  • You have access to an Red Hat OpenShift Container Platform account with cluster administrator permissions.

  • You have installed the OpenShift CLI (oc).

Procedure

  1. Log in to oc on the cluster as a user with the cluster-admin role.

  2. To determine the mode that the CCO is configured to use, enter the following command:

    $ oc get cloudcredentials cluster \
  -o=jsonpath={.spec.credentialsMode}

    The following output values are possible, though not all are supported on all platforms:

    • '': The CCO is operating in the default mode. In this configuration, the CCO operates in mint or passthrough mode, depending on the credentials provided during installation.

    • Mint: The CCO is operating in mint mode.

    • Passthrough: The CCO is operating in passthrough mode.

    • Manual: The CCO is operating in manual mode.

    Important

    To determine the specific configuration of an AWS, Google Cloud, or global Microsoft Azure cluster that has a spec.credentialsMode of '', Mint, or Manual, you must investigate further.

    AWS and Google Cloud clusters support using mint mode with the root secret deleted.

    An AWS, Google Cloud, or global Microsoft Azure cluster that uses manual mode might be configured to create and manage cloud credentials from outside of the cluster with AWS STS, Google Cloud Workload Identity, or Microsoft Entra Workload ID. You can determine whether your cluster uses this strategy by examining the cluster Authentication object.

  3. AWS or Google Cloud clusters that use the default ('') only: To determine whether the cluster is operating in mint or passthrough mode, run the following command:

    $ oc get secret <secret_name> \
  -n kube-system \
  -o jsonpath \
  --template '{ .metadata.annotations }'

    where <secret_name> is aws-creds for AWS or gcp-credentials for Google Cloud.

    This command displays the value of the .metadata.annotations parameter in the cluster root secret object. The following output values are possible:

    • Mint: The CCO is operating in mint mode.

    • Passthrough: The CCO is operating in passthrough mode.

    If your cluster uses mint mode, you can also determine whether the cluster is operating without the root secret.

  4. AWS or Google Cloud clusters that use mint mode only: To determine whether the cluster is operating without the root secret, run the following command:

    $ oc get secret <secret_name> \
  -n=kube-system

    where <secret_name> is aws-creds for AWS or gcp-credentials for Google Cloud.

    If the root secret is present, the output of this command returns information about the secret. An error indicates that the root secret is not present on the cluster.

  5. AWS, Google Cloud, or global Microsoft Azure clusters that use manual mode only: To determine whether the cluster is configured to create and manage cloud credentials from outside of the cluster, run the following command:

    $ oc get authentication cluster \
  -o jsonpath \
  --template='{ .spec.serviceAccountIssuer }'

    This command displays the value of the .spec.serviceAccountIssuer parameter in the cluster Authentication object.

    • An output of a URL that is associated with your cloud provider indicates that the CCO is using manual mode with short-term credentials for components. These clusters are configured using the ccoctl utility to create and manage cloud credentials from outside of the cluster.

    • An empty output indicates that the cluster is using the CCO in manual mode but was not configured using the ccoctl utility.

← Previous: About Cloud Credential Operator modes | ↑ Up: Manage cloud provider credentials | ⌂ Home: Red Hat OpenShift Container Platform | Next: About the Cloud Credential Operator default behavior →