Skip to content

[OSDOCS-14567] Doc Story for Cross-Project Federated Identity Authentication for OSD-GCP #96854

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[OSDOCS-14567] Doc Story for Cross-Project Federated Identity Authentication for OSD-GCP #96854

wants to merge 1 commit into from

Conversation

mletalie
Copy link
Contributor

@mletalie mletalie commented Jul 30, 2025 •
edited
Loading

@openshift-ci openshift-ci bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jul 30, 2025
@ocpdocs-previewbot
Copy link

ocpdocs-previewbot commented Jul 30, 2025 •
edited
Loading

🤖 Wed Aug 06 13:27:22 - Prow CI generated the docs preview:

https://96854--ocpdocs-pr.netlify.app/openshift-dedicated/latest/osd_gcp_clusters/creating-a-gcp-cluster-with-workload-identity-federation.html
https://96854--ocpdocs-pr.netlify.app/openshift-dedicated/latest/osd_whats_new/osd-whats-new.html

ocpdocs-vale-bot
ocpdocs-vale-bot reviewed Jul 30, 2025
View reviewed changes
osd_planning/gcp-ccs.adoc Outdated
@@ -23,6 +23,7 @@ include::modules/osd-gcp-psc-firewall-prerequisites.adoc[leveloffset=+1]
== Additional resources

* xref:../support/remote_health_monitoring/about-remote-health-monitoring.adoc#about-remote-health-monitoring[About remote health monitoring]
<<<<<<< HEAD
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 [error] RedHat.MergeConflictMarkers: Do not commit Git merge conflict markers in source code. For more information, see RedHat.MergeConflictMarkers.

@mletalie mletalie changed the title Osdocs 14567 [OSDOCS-14567] Doc Story for Cross-Project Federated Identity Authentication for OSD-GCP Jul 30, 2025
@openshift-ci openshift-ci bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jul 30, 2025
@mletalie mletalie force-pushed the OSDOCS-14567 branch 2 times, most recently from 4f2dfea to cc3320d Compare July 30, 2025 17:12
@mletalie
Copy link
Contributor Author

mletalie commented Jul 30, 2025 •
edited
Loading

@shreyansvm,
Could you please review PR when you get a moment? I am not to what level of detail you would like added to the docs on top of what I have included: For example:

  • Do we need to specify the permissions that the user will need for both the project where the service accounts and other resources will live as well as the project that hosts the pools and providers?

  • Do we need to describe the different wif-config scenarios and how that would impact cluster creation?

Please let me know if there are any other pertinent details that you think needs to be added to the docs.

I will be creating a release note for this feature and add it to this PR ASAP. Thanks!

ocpdocs-vale-bot
ocpdocs-vale-bot reviewed Jul 30, 2025
View reviewed changes
osd_whats_new/osd-whats-new.adoc Outdated

=== Q3 2025
* ** Support for managing workload identity pools and providers in a dedicated {GCP} project.**
{product-title} on {GCP} now supports the option of creating and managing workload identity pools and providers in a specified dedicated project during the creation of a WIF configuration. For more information, see xref:../osd_gcp_clusters/creating-a-gcp-cluster-with-workload-identity-federation.adoc#create-wif-configuration_osd-creating-a-cluster-on-gcp-with-workload-identity-federation[Creating a WIF configuration].
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 [error] OpenShiftAsciiDoc.XrefContainsAnchorID: The xref is missing an anchor ID.

@svmrh
Copy link

svmrh commented Aug 4, 2025

We don;t need any additional permissions to create workload identity pools in a separate GCP project other than where the cluster gets installed.
We should add the following to the "..create wif-config.." command:

  • a new optional parameter "--federated-project" has been introduced
  • Describe what happens when "--federated-project" is passed/not passed during wif-config creation.
  • Also add a note that the support for updating existing wif-configs to use a different GCP project to host the workload identity pool from the project which hosts the OSD cluster, is coming soon.

Check the notes on this new optional parameter in the DDR: https://docs.google.com/document/d/1J4cd8IRW2wSFHSFBdS5g99kWst_kXU_Qu-SLYPlB_c0/edit?tab=t.0#heading=h.96e7yab648bk

There are no changes to the OCM UI.

@ckandag : Can you also review this PR?

When phase-2/milestone-2 XCMSTRAT-1320 is implemented, we need to add similar details on "--federated-project" to the "..update wif-config.." command.

image

@svmrh
Copy link

svmrh commented Aug 4, 2025

I noticed that you have already added details on "--federated-project" later in the document. Sorry, didn't notice this in the first place.

  • Can you please add the missing hyphen "--federated project <gcp_project_id>"
  • We still need to update step 5

5. To create a new WIF configuration, open a terminal window and run the following OCM CLI command.

image

@mletalie mletalie force-pushed the OSDOCS-14567 branch 4 times, most recently from a1ec55f to a7a0807 Compare August 5, 2025 13:55
ocpdocs-vale-bot
ocpdocs-vale-bot reviewed Aug 5, 2025
View reviewed changes
osd_whats_new/osd-whats-new.adoc

=== Q3 2025
* ** Support for managing workload identity pools and providers in a dedicated {GCP} project.**
{product-title} on {GCP} now supports the option of creating and managing workload identity pools and providers in a specified dedicated project during the creation of a WIF configuration. Red{nbsp}Hat plans on offering this option for existing WIF configurations in an upcoming release. For more information, see xref:../osd_gcp_clusters/creating-a-gcp-cluster-with-workload-identity-federation.adoc#create-wif-configuration_osd-creating-a-cluster-on-gcp-with-workload-identity-federation[Creating a WIF configuration].
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 [error] OpenShiftAsciiDoc.XrefContainsAnchorID: The xref is missing an anchor ID.

AedinC
AedinC reviewed Aug 6, 2025
View reviewed changes
Copy link
Contributor

@AedinC AedinC left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great @mletalie. Just one tiny quibble.

modules/create-wif-cluster-cli.adoc Outdated
----
<1> Replace `<wif_name>` with the name of your WIF configuration.
<2> Replace `<gcp_project_id>` with the ID of the {GCP} project where the WIF configuration will be implemented.
<3> Optional: Replace `<osd_version>` with the desired {product-title} version the wif-config will need to support. If you do not specify a version, the wif-config will support the latest {product-title} y-stream version as well as the last three supported {product-title} y-stream versions (beginning with version 4.17).
<4> Optional: Replace `<gcp_project_id>` with the ID of the dedicated project where the workload identity pools and providers will be created and managed. If `--federated-project` is not specified, the workload identity pools and providers will be created and managed in the project specified by the `--project flag`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<4> Optional: Replace `<gcp_project_id>` with the ID of the dedicated project where the workload identity pools and providers will be created and managed. If `--federated-project` is not specified, the workload identity pools and providers will be created and managed in the project specified by the `--project flag`.
<4> Optional: Replace `<gcp_project_id>` with the ID of the dedicated project where the workload identity pools and providers will be created and managed. If the `--federated-project` flag is not specified, the workload identity pools and providers will be created and managed in the project specified by the `--project` flag.

@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented Aug 6, 2025

@mletalie: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@AedinC AedinC AedinC left review comments

@ocpdocs-vale-bot ocpdocs-vale-bot ocpdocs-vale-bot left review comments

Assignees
No one assigned
Labels
size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@mletalie @ocpdocs-previewbot @svmrh @AedinC @ocpdocs-vale-bot