Skip to content

[OSDOCS-14567] Doc Story for Cross-Project Federated Identity Authentication for OSD-GCP #96854

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[OSDOCS-14567] Doc Story for Cross-Project Federated Identity Authentication for OSD-GCP #96854

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions modules/create-wif-cluster-cli.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,10 +46,26 @@ Alternatively, you can use the `manual` mode. In `manual` mode, you are provided
$ ocm gcp create wif-config --name <wif_name> \ <1>
--project <gcp_project_id> \ <2>
--version <osd_version> <3>
--federated-project <gcp_project_id> <4>
----
<1> Replace `<wif_name>` with the name of your WIF configuration.
<2> Replace `<gcp_project_id>` with the ID of the {GCP} project where the WIF configuration will be implemented.
<3> Optional: Replace `<osd_version>` with the desired {product-title} version the wif-config will need to support. If you do not specify a version, the wif-config will support the latest {product-title} y-stream version as well as the last three supported {product-title} y-stream versions (beginning with version 4.17).
<4> Optional: Replace `<gcp_project_id>` with the ID of the dedicated project where the workload identity pools and providers will be created and managed. If the `--federated-project` flag is not specified, the workload identity pools and providers will be created and managed in the project specified by the `--project` flag.
+

[NOTE]
=====
Using a dedicated project to create and manage workload identity pools and providers is recommended by {GCP}.
Using a dedicated project helps you to establish centralized governance over the configuration of workload identity pools and providers, enforce uniform attribute mappings and conditions throughout all projects and applications, and ensure that only authorized identity providers can authenticate with WIF.

For more information, see link:https://cloud.google.com/iam/docs/best-practices-for-using-workload-identity-federation#dedicated-project[Use a dedicated project to manage workload identity pools and providers].
=====
+
[IMPORTANT]
====
Creating and managing workload identity pools and providers in a dedicated project is only allowed during initial WIF configuration creation. The `--federated-project` flag cannot be applied to existing `wif-configs`.
====
+
--
.Example output
Expand Down
4 changes: 4 additions & 0 deletions modules/create-wif-cluster-ocm.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,13 @@
----
$ ocm gcp create wif-config --name <wif_name> \ <1>
--project <gcp_project_id> \ <2>
--version <osd_version> <3>
--federated-project <gcp_project_id> <4>
----
<1> Replace `<wif_name>` with the name of your WIF configuration.
<2> Replace `<gcp_project_id>` with the ID of the {GCP} project where the WIF configuration will be implemented.
<3> Optional: Replace `<osd_version>` with the desired {product-title} version the wif-config will need to support. If you do not specify a version, the wif-config will support the latest {product-title} y-stream version as well as the last three supported {product-title} y-stream versions (beginning with version 4.17).
<4> Optional: Replace `<gcp_project_id>` with the ID of the dedicated project where the workload identity pools and providers will be created and managed. If `--federated-project` is not specified, the workload identity pools and providers will be created and managed in the project specified by the `--project flag`.
+
. Select a configured WIF configuration from the *WIF configuration* drop-down list. If you want to select the WIF configuration you created in the last step, click *Refresh* first.
+
Expand Down
9 changes: 8 additions & 1 deletion osd_whats_new/osd-whats-new.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,18 @@ With its foundation in Kubernetes, {product-title} is a complete {OCP} cluster p
== New changes and updates

[id="osd-q2-2025_{context}"]

=== Q3 2025
* ** Support for managing workload identity pools and providers in a dedicated {GCP} project.**
{product-title} on {GCP} now supports the option of creating and managing workload identity pools and providers in a specified dedicated project during the creation of a WIF configuration. Red{nbsp}Hat plans on offering this option for existing WIF configurations in an upcoming release. For more information, see xref:../osd_gcp_clusters/creating-a-gcp-cluster-with-workload-identity-federation.adoc#create-wif-configuration_osd-creating-a-cluster-on-gcp-with-workload-identity-federation[Creating a WIF configuration].
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 [error] OpenShiftAsciiDoc.XrefContainsAnchorID: The xref is missing an anchor ID.




=== Q2 2025

// * **{product-title} SDN network plugin blocks future major upgrades**
* **Updated version requirements for migration from OpenShift SDN to OVN-Kubernetes.**
Your cluster version must be 4.16.43 or above to initiate live migration from the OpenShift SDN network plugin to the OVN-Kubernetes network plugin.
Your cluster version must be 4.16.43 or above to initiate live migration from the OpenShift SDN network plugin to the OVN-Kubernetes network plugin.
+
If your cluster uses the OpenShift SDN network plugin, you cannot upgrade to future major versions of {product-title} without migrating to OVN-Kubernetes.
+
Expand Down