Red Hat OpenShift Container Platform

Passthrough mode permissions requirements

When using the CCO in passthrough mode, ensure that the credential you provide meets the requirements of the cloud on which you are running or installing Red Hat OpenShift Container Platform. If the provided credentials the CCO passes to a component that creates a CredentialsRequest CR are not sufficient, that component will report an error when it tries to call an API that it does not have permissions for.

Amazon Web Services (AWS) permissions: The credential you provide for passthrough mode in AWS must have all the requested permissions for all CredentialsRequest CRs that are required by the version of Red Hat OpenShift Container Platform you are running or installing.

To locate the CredentialsRequest CRs that are required, see "Manually creating long-term credentials for AWS.
Microsoft Azure permissions: The credential you provide for passthrough mode in Azure must have all the requested permissions for all CredentialsRequest CRs that are required by the version of Red Hat OpenShift Container Platform you are running or installing.

To locate the CredentialsRequest CRs that are required, see "Manually creating long-term credentials for Azure".
Google Cloud permissions: The credential you provide for passthrough mode in Google Cloud must have all the requested permissions for all CredentialsRequest CRs that are required by the version of Red Hat OpenShift Container Platform you are running or installing.

To locate the CredentialsRequest CRs that are required, see "Manually creating long-term credentials for Google Cloud".
Red Hat OpenStack Platform (RHOSP) permissions: To install an Red Hat OpenShift Container Platform cluster on RHOSP, the CCO requires a credential with the permissions of a member user role.
VMware vSphere permissions: To install an Red Hat OpenShift Container Platform cluster on VMware vSphere, the CCO requires a credential with the following vSphere privileges:

Table 40. Required vSphere privileges
Category	Privileges
Datastore	Allocate space
Folder	Create folder, Delete folder
vSphere Tagging	All privileges
Network	Assign network
Resource	Assign virtual machine to resource pool
Profile-driven storage	All privileges
vApp	All privileges
Virtual machine	All privileges

If CredentialsRequest CRs change over time as the cluster is upgraded, you must manually update the passthrough mode credential to meet the requirements. To avoid credentials issues during an upgrade, check the CredentialsRequest CRs in the release image for the new version of Red Hat OpenShift Container Platform before upgrading.

To locate the CredentialsRequest CRs that are required for AWS, Azure, or Google Cloud, see the Manually creating long-term credentials topic for your platform.

Reducing permissions after installation

When using passthrough mode, after installing you can reduce the installed permissions to only those permissions required to run the cluster.

In passthrough mode, each component has the same permissions used by all other components. If you do not reduce the permissions after installing, all components have the broad permissions that are required to run the installation program.

After installation, reduce the permissions on your credential to only those defined by the CredentialsRequest CRs in the release image for the version of Red Hat OpenShift Container Platform that you are using.

To locate the CredentialsRequest CRs that are required for AWS, Azure, or Google Cloud and learn how to change the permissions the CCO uses, see the Manually creating long-term credentials topic for your platform.