Skip to content

Restrict overly permissive firewall permissions for Shared VPC and non-Shared VPC #196

@shreyansvm

Description

@shreyansvm

When deploying OSD on Google Cloud using WIF authentication type, reduce Compute Network Administrator and Compute Security Administrator required for Shared VPC installations, and the following during non-Shared VPC installations

  • compute.firewalls.create and compute.firewalls.delete in the osd_deployer_v4.xx role
  • compute.firewalls.create and compute.firewalls.delete in the gcp_cloud_controller_manager_v4.xx role
  • iam.serviceAccounts.actAs permission at the project level in the machine_api_gcp_v4.xx role
  • iam.serviceAccountUser role at the GCP project level in the operator-gcp-pd-csi-driver-operator's Service Account

Metadata

Metadata

Assignees

Labels

OSD-GCPRelates to OSD on Google Cloud

Type

No type
No fields configured for issues without a type.

Projects

Status
In Progress

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions