From 6d769e7814f6c2027c6ed51c5f96d2aabd2da43f Mon Sep 17 00:00:00 2001 From: Patrick Dillon Date: Mon, 6 Jul 2026 13:49:52 -0400 Subject: [PATCH] GCP: Update Required Permissions Updates the credentialsrequests to include the minimal permissions required to provision a cluster in GCP. With the current implementation OpenShift does not use the mounted crdentials, provisioned from the credentials request. Instead it authenticates using the service account attached to the VM. When the mounted credentials are actually used, the cloud provider will fail due to the missing permissions which are added in this commit. --- ...-manager-operator_16_credentialsrequest-gcp.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml b/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml index 2137688f4..6a80ed2e3 100644 --- a/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml +++ b/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml @@ -18,9 +18,13 @@ spec: kind: GCPProviderSpec permissions: - "compute.addresses.create" + - "compute.addresses.createInternal" - "compute.addresses.delete" + - "compute.addresses.deleteInternal" - "compute.addresses.get" - "compute.addresses.list" + - "compute.addresses.use" + - "compute.addresses.useInternal" - "compute.firewalls.create" - "compute.firewalls.delete" - "compute.firewalls.get" @@ -32,25 +36,34 @@ spec: - "compute.healthChecks.delete" - "compute.healthChecks.get" - "compute.healthChecks.update" + - "compute.healthChecks.useReadOnly" - "compute.httpHealthChecks.create" - "compute.httpHealthChecks.delete" - "compute.httpHealthChecks.get" - "compute.httpHealthChecks.update" + - "compute.httpHealthChecks.useReadOnly" - "compute.instanceGroups.create" - "compute.instanceGroups.delete" - "compute.instanceGroups.get" + - "compute.instanceGroups.list" - "compute.instanceGroups.update" + - "compute.instanceGroups.use" - "compute.instances.get" + - "compute.instances.list" - "compute.instances.use" + - "compute.networks.updatePolicy" - "compute.regionBackendServices.create" - "compute.regionBackendServices.delete" - "compute.regionBackendServices.get" - "compute.regionBackendServices.update" + - "compute.regionBackendServices.use" + - "compute.subnetworks.use" - "compute.targetPools.addInstance" - "compute.targetPools.create" - "compute.targetPools.delete" - "compute.targetPools.get" - "compute.targetPools.removeInstance" + - "compute.targetPools.use" - "compute.zones.list" # If set to true, don't check whether the requested