From 5ae9e2fdf1891eb3b7d70bef3c539319e686d697 Mon Sep 17 00:00:00 2001 From: Shafer Slockett Date: Wed, 12 Aug 2026 06:15:48 -0400 Subject: [PATCH] OSDOCS-16997-installing-restricted-networks-gcp-installer-provisioned: CQA Co-Authored-By: Claude Opus 4.6 --- ...ed-networks-gcp-installer-provisioned.adoc | 61 ++++++++++--------- modules/installing-gcp-manual-modes.adoc | 16 +++++ modules/installing-gcp-short-term-creds.adoc | 14 +++++ ...nstalling-global-access-configuration.adoc | 29 +++++---- 4 files changed, 75 insertions(+), 45 deletions(-) create mode 100644 modules/installing-gcp-manual-modes.adoc create mode 100644 modules/installing-gcp-short-term-creds.adoc diff --git a/installing/installing_gcp/installing-restricted-networks-gcp-installer-provisioned.adoc b/installing/installing_gcp/installing-restricted-networks-gcp-installer-provisioned.adoc index 84021d62982..ba5b572ced7 100644 --- a/installing/installing_gcp/installing-restricted-networks-gcp-installer-provisioned.adoc +++ b/installing/installing_gcp/installing-restricted-networks-gcp-installer-provisioned.adoc @@ -17,20 +17,30 @@ You can install an {product-title} cluster by using mirrored installation releas [id="prerequisites_installing-restricted-networks-gcp-installer-provisioned"] == Prerequisites -* You reviewed details about the xref:../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] processes. -* You read the documentation on xref:../../installing/overview/installing-preparing.adoc#installing-preparing[selecting a cluster installation method and preparing it for users]. -* You xref:../../installing/installing_gcp/installing-gcp-account.adoc#installing-gcp-account[configured a {gcp-short} project] to host the cluster. -* You xref:../../disconnected/installing-mirroring-installation-images.adoc#installation-about-mirror-registry_installing-mirroring-installation-images[mirrored the images for a disconnected installation] to your registry and obtained the `imageContentSources` data for your version of {product-title}. +* You reviewed details about the {product-title} installation and update processes. +* You read the documentation on selecting a cluster installation method and preparing it for users. +* You configured a {gcp-short} project to host the cluster. +* You mirrored the images for a disconnected installation to your registry and obtained the `imageContentSources` data for your version of {product-title}. + [IMPORTANT] ==== Because the installation media is on the mirror host, you can use that computer to complete all installation steps. ==== -* You have an existing VPC in {gcp-short}. While installing a cluster in a restricted network that uses installer-provisioned infrastructure, you cannot use the installer-provisioned VPC. You must use a user-provisioned VPC that satisfies one of the following requirements: +* You have an existing VPC in {gcp-short}. When you install a cluster in a restricted network by using installer-provisioned infrastructure, you cannot use the VPC that the installation program creates. You must use a user-provisioned VPC that satisfies one of the following requirements: ** Contains the mirror registry ** Has firewall rules or a peering connection to access the mirror registry hosted elsewhere -* If you use a firewall, you xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall-module_configuring-firewall[configured it to allow the sites] that your cluster requires access to. While you might need to grant access to more sites, you must grant access to `*.googleapis.com` and `accounts.google.com`. -* If you are installing using a link:https://cloud.google.com/vpc/docs/private-service-connect[Private Service Connect (PSC) endpoint], you must configure the endpoint in the same Virtual Private Cloud (VPC) where you install the cluster, specified in the `install-config.yaml` file, as described in xref:../../installing/installing_gcp/installing-gcp-vpc.adoc#installing-gcp-vpc[Installing a cluster on {gcp-short} into an existing VPC]. +* If you use a firewall, you configured it to allow the sites that your cluster requires access to. You might need to grant access to more sites, but you must grant access to `*.googleapis.com` and `accounts.google.com`. +* If you are installing by using a Private Service Connect (PSC) endpoint, you must configure the endpoint in the same VPC where you install the cluster, as specified in the `install-config.yaml` file. + +[role="_additional-resources"] +.Additional resources +* xref:../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] +* xref:../../installing/overview/installing-preparing.adoc#installing-preparing[Selecting a cluster installation method and preparing it for users] +* xref:../../installing/installing_gcp/installing-gcp-account.adoc#installing-gcp-account[Configuring a {gcp-short} project] +* xref:../../disconnected/installing-mirroring-installation-images.adoc#installation-about-mirror-registry_installing-mirroring-installation-images[Mirroring images for a disconnected installation] +* xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall-module_configuring-firewall[Configuring your firewall] +* link:https://cloud.google.com/vpc/docs/private-service-connect[Private Service Connect] +* xref:../../installing/installing_gcp/installing-gcp-vpc.adoc#installing-gcp-vpc[Installing a cluster on {gcp-short} into an existing VPC] include::modules/installation-about-restricted-network.adoc[leveloffset=+1] @@ -91,23 +101,13 @@ include::modules/cli-installing-cli-windows.adoc[leveloffset=+1] // Installing the OpenShift CLI on macOS include::modules/cli-installing-cli-macos.adoc[leveloffset=+1] -[id="installing-gcp-manual-modes_{context}"] -== Alternatives to storing administrator-level secrets in the kube-system project - -By default, administrator secrets are stored in the `kube-system` project. If you configured the `credentialsMode` parameter in the `install-config.yaml` file to `Manual`, you must use one of the following alternatives: - -* To manage long-term cloud credentials manually, follow the procedure in xref:../../installing/installing_gcp/installing-restricted-networks-gcp-installer-provisioned.adoc#manually-create-iam_installing-restricted-networks-gcp-installer-provisioned[Manually creating long-term credentials]. - -* To implement short-term credentials that are managed outside the cluster for individual components, follow the procedures in xref:../../installing/installing_gcp/installing-restricted-networks-gcp-installer-provisioned.adoc#installing-gcp-with-short-term-creds_installing-restricted-networks-gcp-installer-provisioned[Configuring a {gcp-short} cluster to use short-term credentials]. +include::modules/installing-gcp-manual-modes.adoc[leveloffset=+1] //Manually creating long-term credentials include::modules/manually-create-identity-access-management.adoc[leveloffset=+2] //Supertask: Configuring a GCP cluster to use short-term credentials -[id="installing-gcp-with-short-term-creds_{context}"] -=== Configuring a {gcp-short} cluster to use short-term credentials - -To install a cluster that is configured to use {gcp-short} Workload Identity, you must configure the CCO utility and create the required {gcp-short} resources for your cluster. +include::modules/installing-gcp-short-term-creds.adoc[leveloffset=+2] //Task part 1: Configuring the Cloud Credential Operator utility include::modules/cco-ccoctl-configuring.adoc[leveloffset=+3] @@ -138,15 +138,16 @@ include::modules/cluster-telemetry.adoc[leveloffset=+1] [role="_additional-resources"] .Additional resources -* See xref:../../support/remote_health_monitoring/about-remote-health-monitoring.adoc#about-remote-health-monitoring[About remote health monitoring] for more information about the Telemetry service +* xref:../../support/remote_health_monitoring/about-remote-health-monitoring.adoc#about-remote-health-monitoring[About remote health monitoring] -[id="next-steps_installing-restricted-networks-gcp-installer-provisioned"] -== Next steps - -* xref:../../installing/validation_and_troubleshooting/validating-an-installation.adoc#validating-an-installation[Validate an installation]. -* xref:../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customize your cluster]. -* xref:../../post_installation_configuration/cluster-tasks.adoc#post-install-must-gather-disconnected[Configure image streams] for the Cluster Samples Operator and the `must-gather` tool. -* Learn how to xref:../../disconnected/using-olm.adoc#olm-restricted-networks[use Operator Lifecycle Manager in disconnected environments]. -* If the mirror registry that you used to install your cluster has a trusted CA, add it to the cluster by xref:../../openshift_images/image-configuration.adoc#images-configuration-cas_image-configuration[configuring additional trust stores]. -* If necessary, you can xref:../../support/remote_health_monitoring/remote-health-reporting.adoc#remote-health-reporting[Remote health reporting]. -* If necessary, see xref:../../support/remote_health_monitoring/remote-health-reporting.adoc#insights-operator-register-disconnected-cluster_remote-health-reporting[Registering your disconnected cluster] +[role="_additional-resources"] +[id="additional-resources_{context}"] +== Additional resources + +* xref:../../installing/validation_and_troubleshooting/validating-an-installation.adoc#validating-an-installation[Validating an installation] +* xref:../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customizing your cluster] +* xref:../../post_installation_configuration/cluster-tasks.adoc#post-install-must-gather-disconnected[Configuring image streams for a disconnected cluster] +* xref:../../disconnected/using-olm.adoc#olm-restricted-networks[Using Operator Lifecycle Manager in disconnected environments] +* xref:../../openshift_images/image-configuration.adoc#images-configuration-cas_image-configuration[Configuring additional trust stores] +* xref:../../support/remote_health_monitoring/remote-health-reporting.adoc#remote-health-reporting[Remote health reporting] +* xref:../../support/remote_health_monitoring/remote-health-reporting.adoc#insights-operator-register-disconnected-cluster_remote-health-reporting[Registering your disconnected cluster] diff --git a/modules/installing-gcp-manual-modes.adoc b/modules/installing-gcp-manual-modes.adoc new file mode 100644 index 00000000000..aa2aca51b2f --- /dev/null +++ b/modules/installing-gcp-manual-modes.adoc @@ -0,0 +1,16 @@ +// Module included in the following assemblies: +// +// * installing/installing_gcp/installing-gcp-customizations.adoc +// * installing/installing_gcp/installing-gcp-vpc.adoc +// * installing/installing_gcp/installing-restricted-networks-gcp-installer-provisioned.adoc + +:_mod-docs-content-type: REFERENCE +[id="installing-gcp-manual-modes_{context}"] += Alternatives to storing administrator-level secrets in the kube-system project + +[role="_abstract"] +By default, {product-title} stores administrator secrets in the `kube-system` project. If you configured the `credentialsMode` parameter in the `install-config.yaml` file to `Manual`, you must use one of the following alternatives. + +* To manage long-term cloud credentials manually, follow the procedure in "Manually creating long-term credentials". + +* To implement short-term credentials that are managed outside the cluster for individual components, follow the procedures in "Configuring a {gcp-short} cluster to use short-term credentials". diff --git a/modules/installing-gcp-short-term-creds.adoc b/modules/installing-gcp-short-term-creds.adoc new file mode 100644 index 00000000000..fde729b06be --- /dev/null +++ b/modules/installing-gcp-short-term-creds.adoc @@ -0,0 +1,14 @@ +// Module included in the following assemblies: +// +// * installing/installing_gcp/installing-gcp-customizations.adoc +// * installing/installing_gcp/installing-gcp-vpc.adoc +// * installing/installing_gcp/installing-restricted-networks-gcp-installer-provisioned.adoc + +:_mod-docs-content-type: CONCEPT +[id="installing-gcp-with-short-term-creds_{context}"] += Configuring a {gcp-short} cluster to use short-term credentials + +[role="_abstract"] +To install an {product-title} cluster that is configured to use {gcp-short} Workload Identity, you must configure the Cloud Credential Operator (CCO) utility and create the required {gcp-short} resources for your cluster. + +Cluster Operators use the credentials created by the CCO. The installation program does not use these credentials. diff --git a/modules/nw-gcp-installing-global-access-configuration.adoc b/modules/nw-gcp-installing-global-access-configuration.adoc index eed5128f7ed..361fb3978b4 100644 --- a/modules/nw-gcp-installing-global-access-configuration.adoc +++ b/modules/nw-gcp-installing-global-access-configuration.adoc @@ -7,7 +7,8 @@ [id="nw-gcp-global-access-configuration_{context}"] = Create an Ingress Controller with global access on {gcp-short} -You can create an Ingress Controller that has global access to a {gcp-first} cluster. Global access is only available to Ingress Controllers using internal load balancers. +[role="_abstract"] +You can create an Ingress Controller that has global access to a {gcp-first} cluster. Global access is available only to Ingress Controllers that use internal load balancers. .Prerequisites @@ -15,28 +16,25 @@ You can create an Ingress Controller that has global access to a {gcp-first} clu .Procedure -Create an Ingress Controller with global access on a new {gcp-short} cluster. - . Change to the directory that contains the installation program and create a manifest file: + [source,terminal] ---- -$ ./openshift-install create manifests --dir <1> +$ ./openshift-install create manifests --dir ---- -<1> For ``, specify the name of the directory that -contains the `install-config.yaml` file for your cluster. ++ +For `__`, specify the name of the directory that contains the `install-config.yaml` file for your cluster. + . Create a file that is named `cluster-ingress-default-ingresscontroller.yaml` in the `/manifests/` directory: + [source,terminal] ---- -$ touch /manifests/cluster-ingress-default-ingresscontroller.yaml <1> +$ touch /manifests/cluster-ingress-default-ingresscontroller.yaml ---- -<1> For ``, specify the directory name that contains the -`manifests/` directory for your cluster. + -After creating the file, several network configuration files are in the -`manifests/` directory, as shown: +For `__`, specify the directory name that contains the `manifests/` directory for your cluster. ++ +After creating the file, several network configuration files are in the `manifests/` directory, as shown: + [source,terminal] ---- @@ -64,10 +62,11 @@ cluster-ingress-default-ingresscontroller.yaml loadBalancer: providerParameters: gcp: - clientAccess: Global <1> + clientAccess: Global type: GCP - scope: Internal <2> + scope: Internal type: LoadBalancerService ---- -<1> Set `gcp.clientAccess` to `Global`. -<2> Global access is only available to Ingress Controllers using internal load balancers. ++ +* `gcp.clientAccess` is set to `Global` to provide global access for the Ingress Controller. +* `scope` is set to `Internal` because global access is available only to Ingress Controllers that use internal load balancers.