Deploy Red Hat OpenShift Dedicated with short-lived, least privileged access credentials using GCP Workload Identity Federation

Red Hat OpenShift Dedicated clusters on Google Cloud now support Workload Identity Federation (WIF) which is used to authenticate, authorize and access Google Cloud resources without the need for static credentials. This allows OpenShift Dedicated clusters to be deployed with short-lived, least privilege access credentials, reducing the need for maintenance and the security burden associated with the identity and access management (IAM) service account keys.

This article gives a short overview of Google CloudWIF and explains how it helps overcome the challenges around the use of long-lived credentials.

Current challenges

Prior to rollout of support for WIF, OpenShift Dedicated requires the user to create an osd-ccs-admin service account with a broad set of permissions. The user must create a service account JSON key in the Google Cloud console for this service account, and then export the key to use it while creating the OpenShift Dedicated cluster on Google Cloud.

While using a service account is a valid Google Cloud IAM method for accessing Google Cloud resources, it requires an expansive set of permissions and the service account keys have indefinite lifetimes. The end user has to manage the overhead of securing and maintaining these service account keys, which can be a security risk if not managed correctly. For this reason, Google Cloud recommends using WIF rather than  service account keys.

What is Workload Identity Federation and how is it used in the context of OpenShift Dedicated?

Workload Identity Federation (WIF) is a capability of Google Cloud IAM, and provides a keyless authentication mechanism for calling Google Cloud APIs.

OpenShift can be configured to use temporary credentials for different components with Google Cloud WIF. This enables an authentication flow allowing a component to assume an IAM service account resulting in short-lived credentials. It also automates requesting and refreshing of credentials using an OpenID Connect (OIDC) identity provider. OpenShift can sign service account tokens trusted by the provider which can be projected into a pod and used for authentication.

With WIF, OpenShift Dedicated no longer needs the broader set of permissions required on the osd-ccs-admin service account. This meta service account is broken down into service accounts required by individual OpenShift components, and the least amount of roles and permissions are assigned to these service accounts.

Deploying OpenShift Dedicated using short-lived, least privileged access credentials

WIF is only supported on OpenShift Dedicated version 4.17.0 or higher.

At a high-level, users must follow these steps to deploy OpenShift Dedicated using WIF:

1. Complete prerequisites to provision a WIF-enabled OpenShift Dedicated cluster. This includes roles and required APIs that must be enabled at the Google Cloud project level, gcloud and OpenShift Cluster Manager command-line interfaces (CLIs) that must be installed and steps to authenticate with the gcloud CLI
2. Register a WIF configuration (wif-config) using the OpenShift Cluster Manager CLI. This step creates the IAM resources needed to deploy OpenShift Dedicated on Google Cloud using short-lived credentials
3. Select ‘Workload Identity Federation’ authentication type while triggering an OpenShift Dedicated installation via the OpenShift Cluster Manager (OCM) Hybrid Cloud Console or using OpenShift Cluster Manager CLI

Since WIF is an install-time setting, existing OpenShift Dedicated clusters deployed on Google Cloud cannot be edited to support this new authentication type. You have to create new clusters to enable use of WIF.

Refer to the OpenShift Dedicated documentation for more details on prerequisites and steps to create an OpenShift Dedicated cluster on Google Cloud using WIF authentication type. 

There is no additional cost for provisioning OpenShift Dedicated clusters on Google Cloud with WIF.

Try OpenShift Dedicated from the Google Cloud Marketplace

OpenShift Dedicated purchased from the Google Cloud Marketplace is an easy and self-service way to try OpenShift Dedicated with a flexible pay-as-you-go consumption model. You can also use a portion of your Google Cloud committed spend when purchasing OpenShift Dedicated.

OpenShift Dedicated is a fully-managed application platform that helps you quickly build, deploy and scale applications, rather than having to deal with the underlying infrastructure yourself. Get started with OpenShift Dedicated on Google Cloud today.

Learn more

• Learn more about Google Cloud Workload Identity Federation
• Learn more about OpenShift Dedicated on GCP
• OpenShift Dedicated on Google Cloud Marketplace listing
• Steps to Create a cluster with Workload Identity Federation in OpenShift Dedicated documentation