openshift/openshift-docs
1
0
Fork 0
mirror of https://github.com/openshift/openshift-docs.git synced 2026-02-05 21:46:22 +01:00
Code Issues Releases Activity

Revert "OCPBUGS-48192: clarifying the role of the root cred in CCO mint mode"

Browse Source
This commit is contained in:
Jeana Routh
2025-01-15 12:43:30 -05:00
committed by GitHub
parent 3ff33feb5a
commit 03fdf43271
3 changed files with 8 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
authentication/managing_cloud_provider_credentials/cco-mode-mint.adoc
View File

@@ -11,14 +11,9 @@ Mint mode is the default Cloud Credential Operator (CCO) credentials mode for {p
[id="mint-mode-about"]
== Mint mode credentials management
For clusters that use the CCO in mint mode, the administrator-level credential is stored in the `kube-system` namespace.
The CCO uses the `admin` credential to process the `CredentialsRequest` objects in the cluster and create users for components with limited permissions.
For clusters that use the CCO in mint mode, the administrator-level credential is stored in the `kube-system` namespace. The CCO uses the `admin` credential to process the `CredentialsRequest` objects in the cluster and create users for components with limited permissions.
With mint mode, each cluster component has only the specific permissions it requires.
Cloud credential reconciliation is automatic and continuous so that components can perform actions that require additional credentials or permissions.
For example, a minor version cluster update (such as updating from {product-title} 4.16 to 4.17) might include an updated `CredentialsRequest` resource for a cluster component.
The CCO, operating in mint mode, uses the `admin` credential to process the `CredentialsRequest` resource and create users with limited permissions to satisfy the updated authentication requirements.
With mint mode, each cluster component has only the specific permissions it requires. The automatic, continuous reconciliation of cloud credentials in mint mode allows actions that require additional credentials or permissions, such as upgrading, to proceed.
[NOTE]
====

14
modules/manually-removing-cloud-creds.adoc
View File

@@ -1,27 +1,21 @@
// Module included in the following assemblies:
//
// * post_installation_configuration/changing-cloud-credentials-configuration.adoc
// * post_installation_configuration/cluster-tasks.adoc
:_mod-docs-content-type: PROCEDURE
[id="manually-removing-cloud-creds_{context}"]
= Removing cloud provider credentials
For clusters that use the Cloud Credential Operator (CCO) in mint mode, the administrator-level credential is stored in the `kube-system` namespace.
The CCO uses the `admin` credential to process the `CredentialsRequest` objects in the cluster and create users for components with limited permissions.
After installing an {product-title} cluster with the CCO in mint mode, you can remove the administrator-level credential secret from the `kube-system` namespace in the cluster.
The CCO only requires the administrator-level credential during changes that require reconciling new or modified `CredentialsRequest` custom resources, such as minor cluster version updates.
After installing an {product-title} cluster with the Cloud Credential Operator (CCO) in mint mode, you can remove the administrator-level credential secret from the `kube-system` namespace in the cluster. The administrator-level credential is required only during changes that require its elevated permissions, such as upgrades.
[NOTE]
====
Before performing a minor version cluster update (for example, updating from {product-title} 4.16 to 4.17), you must reinstate the credential secret with the administrator-level credential.
If the credential is not present, the update might be blocked.
Prior to a non z-stream upgrade, you must reinstate the credential secret with the administrator-level credential. If the credential is not present, the upgrade might be blocked.
====
.Prerequisites
* Your cluster is installed on a platform that supports removing cloud credentials from the CCO.
Supported platforms are AWS and GCP.
* Your cluster is installed on a platform that supports removing cloud credentials from the CCO. Supported platforms are AWS and GCP.
.Procedure

5
post_installation_configuration/changing-cloud-credentials-configuration.adoc
View File

@@ -31,16 +31,15 @@ include::modules/manually-rotating-cloud-creds.adoc[leveloffset=+2]
[role="_additional-resources"]
.Additional resources
* xref:../authentication/managing_cloud_provider_credentials/cco-mode-mint.adoc#cco-mode-mint[The Cloud Credential Operator in mint mode]
* xref:../authentication/managing_cloud_provider_credentials/cco-mode-passthrough.html#cco-mode-passthrough[The Cloud Credential Operator in passthrough mode]
* xref:../storage/container_storage_interface/persistent-storage-csi-vsphere.adoc#persistent-storage-csi-vsphere[vSphere CSI Driver Operator]
//Removing cloud provider credentials manually
include::modules/manually-removing-cloud-creds.adoc[leveloffset=+2]
//These additional resources are for the "Rotating or removing cloud provider credentials" section, do not separate them from that content.
[role="_additional-resources"]
.Additional resources
* xref:../authentication/managing_cloud_provider_credentials/cco-mode-mint.adoc#cco-mode-mint[The Cloud Credential Operator in mint mode]
* xref:../authentication/managing_cloud_provider_credentials/cco-mode-passthrough.adoc#admin-credentials-root-secret-formats_cco-mode-passthrough[Admin credentials root secret format]
[id="post-install-enable-token-auth_{context}"]
== Enabling token-based authentication