openshift/openshift-docs
1
0
Fork 0
mirror of https://github.com/openshift/openshift-docs.git synced 2026-02-05 12:46:18 +01:00
Code Issues Releases Activity

Reinstates AWS and GCP short term creds details

Browse Source
This commit is contained in:
Jeana Routh
2023-11-10 11:54:58 -05:00
committed by openshift-cherrypick-robot
parent 9232f0a851
commit b89158bf41
3 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
modules/cco-short-term-creds-auth-flows.adoc → _unused_topics/cco-short-term-creds-auth-flows.adoc
View File

2
modules/cco-short-term-creds-auth-flow-aws.adoc
View File

@@ -31,7 +31,7 @@ The following diagram illustrates the authentication flow between AWS and the {p
.AWS Security Token Service authentication flow
image::347_OpenShift_credentials_with_STS_updates_0623_AWS.png[Detailed authentication flow between AWS and the cluster when using AWS STS]
Requests for new and refreshed credentials are automated by using an appropriately configured AWS IAM OpenID Connect (OIDC) identity provider, combined with AWS IAM roles. {product-title} signs service account tokens that are trusted by AWS IAM, and can be projected into a pod and used for authentication.
Requests for new and refreshed credentials are automated by using an appropriately configured AWS IAM OpenID Connect (OIDC) identity provider, combined with AWS IAM roles. {product-title} signs service account tokens that are trusted by AWS IAM, and can be projected into a pod and used for authentication. Tokens are refreshed after one hour.
[id="cco-short-term-creds-auth-flow-aws-refresh-policy_{context}"]
== Token refreshing for AWS STS

2
modules/cco-short-term-creds-auth-flow-gcp.adoc
View File

@@ -6,6 +6,8 @@
[id="cco-short-term-creds-auth-flow-gcp_{context}"]
= GCP Workload Identity authentication process
Requests for new and refreshed credentials are automated by using an appropriately configured OpenID Connect (OIDC) identity provider combined with IAM service accounts. Service account tokens that are trusted by GCP are signed by {product-title} and can be projected into a pod and used for authentication. Tokens are refreshed after one hour.
The following diagram details the authentication flow between GCP and the {product-title} cluster when using GCP Workload Identity.
.GCP Workload Identity authentication flow