Red Hat OpenShift Container Platform

About Cloud Credential Operator modes

You can configure the Cloud Credential Operator (CCO) to operate in several different modes. These options provide transparency and flexibility in how the CCO uses cloud credentials to process CredentialsRequest CRs in the cluster to suit the security requirements of your organization.

By setting different values for the credentialsMode parameter in the install-config.yaml file, you can configure the CCO to operate in mint, passthrough, or manual mode.

Mint: In mint mode, the CCO uses the provided admin-level cloud credential to create new credentials for components in the cluster with only the specific permissions that are required.
Passthrough: In passthrough mode, the CCO passes the provided cloud credential to the components that request cloud credentials.
Manual mode with long-term credentials for components: In manual mode, you can manage long-term cloud credentials instead of the CCO.
Manual mode with short-term credentials for components: For some providers, you can use the CCO utility (ccoctl) during installation to implement short-term credentials for individual components. These credentials are created and managed outside the Red Hat OpenShift Container Platform cluster.

If no mode is specified, or the credentialsMode parameter is set to an empty string (""), the CCO operates in its default mode.

Not all CCO modes are supported for all cloud providers, as described in the following table:

Table 39. CCO mode support matrix
Cloud provider	Mint	Passthrough	Manual with long-term credentials	Manual with short-term credentials
Amazon Web Services (AWS)	X	X	X	X
Global Microsoft Azure		X	X	X
Microsoft Azure Stack Hub			X
Google Cloud	X	X	X	X
IBM Cloud®			X ^[1]
Nutanix			X ^[1]
Red Hat OpenStack Platform (RHOSP)		X
VMware vSphere		X

This platform uses the ccoctl utility during installation to configure long-term credentials.