About GCP Workload Identity

To allow components to use the Google Cloud Platform Workload Identity to impersonate Google Cloud service accounts using short-term, limited-privilege credentials, you can configure your cluster to use manual mode with GCP Workload Identity.

Google Cloud Workload Identity authentication process

You should familiarize yourself with the Google Cloud Workload Identity authentication process.

Requests for new and refreshed credentials are automated by using an appropriately configured OpenID Connect (OIDC) identity provider combined with IAM service accounts. Service account tokens that are trusted by Google Cloud are signed by Red Hat OpenShift Container Platform and can be projected into a pod and used for authentication. Tokens are refreshed after one hour.

The following diagram details the authentication flow between Google Cloud and the Red Hat OpenShift Container Platform cluster when using Google Cloud Workload Identity.

Detailed authentication flow between Google Cloud and the cluster when using Google Cloud Workload Identity
Figure 11. Google Cloud Workload Identity authentication flow
Google Cloud component secret formats

To change the content of the Google Cloud credentials that are provided to individual Red Hat OpenShift Container Platform components, you can use manual mode with Google Cloud Workload Identity.

Compare the following secret content:

Google Cloud secret format
apiVersion: v1
kind: Secret
metadata:
  namespace: <target_namespace>
  name: <target_secret_name>
data:
  service_account.json: <service_account>

where:

metadata.namespace

Specifies the namespace for the component.

metadata.name

Specifies the name of the component secret.

data.service_account.json

Specifies the Base64 encoded service account.

Content of the Base64 encoded service_account.json file using long-term credentials
{
   "type": "service_account",
   "project_id": "<project_id>",
   "private_key_id": "<private_key_id>",
   "private_key": "<private_key>",
   "client_email": "<client_email_address>",
   "client_id": "<client_id>",
   "auth_uri": "https://accounts.google.com/o/oauth2/auth",
   "token_uri": "https://oauth2.googleapis.com/token",
   "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
   "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/<client_email_address>"
}

where:

type

Specifies the credential type, in this example the type is service_account.

private_key

Specifies the private RSA key that is used to authenticate to Google Cloud. This key must be kept secure and is not rotated.

Content of the Base64 encoded service_account.json file using Google Cloud Workload Identity
{
   "type": "external_account",
   "audience": "//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/test-pool/providers/test-provider",
   "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
   "token_url": "https://sts.googleapis.com/v1/token",
   "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/<client_email_address>:generateAccessToken",
   "credential_source": {
      "file": "<path_to_token>",
      "format": {
         "type": "text"
      }
   }
}

where:

type

Specifies the credential type, in this example the type is external_account.

audience

Specifies the target audience is the Google Cloud Workload Identity provider.

service_account_impersonation_url

Specifies the resource URL of the service account that can be impersonated with these credentials.

credential_source.file

Specifies the path to the service account token inside the pod. By convention, this is /var/run/secrets/openshift/serviceaccount/token for Red Hat OpenShift Container Platform components.

Google Cloud component secret permissions requirements

Red Hat OpenShift Container Platform components require the following permissions. These values are in the CredentialsRequest custom resource (CR) for each component.

Note

These permissions apply to all resources. Unless specified, there are no request conditions on these permissions.
Component Custom resource Required permissions for services

Cloud Controller Manager Operator

openshift-gcp-ccm

Compute Engine

  • compute.addresses.create

  • compute.addresses.delete

  • compute.addresses.get

  • compute.addresses.list

  • compute.firewalls.create

  • compute.firewalls.delete

  • compute.firewalls.get

  • compute.firewalls.update

  • compute.forwardingRules.create

  • compute.forwardingRules.delete

  • compute.forwardingRules.get

  • compute.healthChecks.create

  • compute.healthChecks.delete

  • compute.healthChecks.get

  • compute.healthChecks.update

  • compute.httpHealthChecks.create

  • compute.httpHealthChecks.delete

  • compute.httpHealthChecks.get

  • compute.httpHealthChecks.update

  • compute.instanceGroups.create

  • compute.instanceGroups.delete

  • compute.instanceGroups.get

  • compute.instanceGroups.update

  • compute.instances.get

  • compute.instances.use

  • compute.regionBackendServices.create

  • compute.regionBackendServices.delete

  • compute.regionBackendServices.get

  • compute.regionBackendServices.update

  • compute.targetPools.addInstance

  • compute.targetPools.create

  • compute.targetPools.delete

  • compute.targetPools.get

  • compute.targetPools.removeInstance

  • compute.zones.list

Cloud Credential Operator

cloud-credential-operator-gcp-ro-creds

Identity and Access Management (IAM)

  • iam.roles.get

  • iam.serviceAccountKeys.list

  • iam.serviceAccounts.get

Resource Manager

  • resourcemanager.projects.get

  • resourcemanager.projects.getIamPolicy

Service Usage

  • serviceusage.services.list

Cluster Image Registry Operator

openshift-image-registry-gcs

Cloud Storage

  • storage.buckets.create

  • storage.buckets.createTagBinding

  • storage.buckets.delete

  • storage.buckets.get

  • storage.buckets.list

  • storage.buckets.listEffectiveTags

  • storage.objects.create

  • storage.objects.delete

  • storage.objects.get

  • storage.objects.list

Resource Manager

  • resourcemanager.tagValueBindings.create

  • resourcemanager.tagValues.get

  • resourcemanager.tagValues.list

Cluster Ingress Operator

openshift-ingress-gcp

Cloud DNS

  • dns.changes.create

  • dns.resourceRecordSets.create

  • dns.resourceRecordSets.delete

  • dns.resourceRecordSets.list

  • dns.resourceRecordSets.update

Cluster Network Operator

openshift-cloud-network-config-controller-gcp

Compute Engine

  • compute.instances.get

  • compute.instances.updateNetworkInterface

  • compute.subnetworks.get

  • compute.subnetworks.use

  • compute.zoneOperations.get

Cluster Storage Operator

openshift-gcp-pd-csi-driver-operator

Compute Engine

  • compute.instances.attachDisk

  • compute.instances.detachDisk

  • compute.instances.get

This component also requires the following Google Cloud predefined roles:

  • roles/compute.storageAdmin

  • roles/iam.serviceAccountUser

  • roles/resourcemanager.tagUser

Machine API Operator

openshift-machine-api-gcp

Compute Engine

  • compute.acceleratorTypes.get

  • compute.acceleratorTypes.list

  • compute.disks.create

  • compute.disks.createTagBinding

  • compute.disks.setLabels

  • compute.globalOperations.get

  • compute.globalOperations.list

  • compute.healthChecks.useReadOnly

  • compute.images.get

  • compute.images.getFromFamily

  • compute.images.useReadOnly

  • compute.instanceGroups.create

  • compute.instanceGroups.delete

  • compute.instanceGroups.get

  • compute.instanceGroups.list

  • compute.instanceGroups.update

  • compute.instances.create

  • compute.instances.createTagBinding

  • compute.instances.delete

  • compute.instances.get

  • compute.instances.list

  • compute.instances.setLabels

  • compute.instances.setMetadata

  • compute.instances.setServiceAccount

  • compute.instances.setTags

  • compute.instances.update

  • compute.instances.use

  • compute.machineTypes.get

  • compute.machineTypes.list

  • compute.projects.get

  • compute.regionBackendServices.create

  • compute.regionBackendServices.get

  • compute.regionBackendServices.update

  • compute.regions.get

  • compute.regions.list

  • compute.subnetworks.use

  • compute.subnetworks.useExternalIp

  • compute.targetPools.addInstance

  • compute.targetPools.delete

  • compute.targetPools.get

  • compute.targetPools.removeInstance

  • compute.zoneOperations.get

  • compute.zoneOperations.list

  • compute.zones.get

  • compute.zones.list

Identity and Access Management (IAM)

  • iam.serviceAccounts.actAs

  • iam.serviceAccounts.get

  • iam.serviceAccounts.list

Resource Manager

  • resourcemanager.tagValues.get

  • resourcemanager.tagValues.list

Service Usage

  • serviceusage.quotas.get

  • serviceusage.services.get

  • serviceusage.services.list
OLM-managed Operator support for authentication with GCP Workload Identity

To allow certain Operators that are managed by the Operator Lifecycle Manager (OLM) on Google Cloud clusters to authenticate with limited-privilege, short-term credentials that are managed outside the cluster, you can use manual mode with GCP Workload Identity.

To determine if an Operator supports authentication with GCP Workload Identity, see the Operator description in the software catalog.

← Previous: About AWS Security Token Service | ↑ Up: Manage cloud provider credentials | ⌂ Home: Red Hat OpenShift Container Platform | Next: About Microsoft Entra Workload ID →