The Cloud Credential Operator (CCO) manages cloud provider credentials as custom resource definitions (CRDs). The CCO syncs on CredentialsRequest custom resources (CRs) to allow {product-title} components to request cloud provider credentials with the specific permissions that are required for the cluster to run.
By setting different values for the credentialsMode parameter in the install-config.yaml file, the CCO can be configured to operate in several different modes. If no mode is specified, or the credentialsMode parameter is set to an empty string (""), the CCO operates in its default mode.
By setting different values for the credentialsMode parameter in the install-config.yaml file, the CCO can be configured to operate in mint, passthrough, or manual mode. These options provide transparency and flexibility in how the CCO uses cloud credentials to process CredentialsRequest CRs in the cluster, and allow the CCO to be configured to suit the security requirements of your organization. Not all CCO modes are supported for all cloud providers.
-
Mint: In mint mode, the CCO uses the provided admin-level cloud credential to create new credentials for components in the cluster with only the specific permissions that are required.
-
Passthrough: In passthrough mode, the CCO passes the provided cloud credential to the components that request cloud credentials.
-
Manual mode with long-term credentials for components: In manual mode, you can manage long-term cloud credentials instead of the CCO.
-
Manual mode with short-term credentials for components: For some providers, you can use the CCO utility (
ccoctl) during installation to implement short-term credentials for individual components. These credentials are created and managed outside the {product-title} cluster.
| Cloud provider | Mint | Passthrough | Manual with long-term credentials | Manual with short-term credentials |
|---|---|---|---|---|
Amazon Web Services (AWS) |
X |
X |
X |
X |
Global Microsoft Azure |
X |
X |
X |
|
Microsoft Azure Stack Hub |
X |
|||
Google Cloud Platform (GCP) |
X |
X |
X |
X |
{ibm-cloud-name} |
X [1] |
|||
Nutanix |
X [1] |
|||
{rh-openstack-first} |
X |
|||
VMware vSphere |
X |
-
This platform uses the
ccoctlutility during installation to configure long-term credentials.
For platforms that support using the CCO in multiple modes, you can determine what mode the CCO is configured to use by using the web console or the CLI.
For platforms on which multiple modes are supported (AWS, Azure, and GCP), when the CCO operates in its default mode, it checks the provided credentials dynamically to determine for which mode they are sufficient to process CredentialsRequest CRs.
By default, the CCO determines whether the credentials are sufficient for mint mode, which is the preferred mode of operation, and uses those credentials to create appropriate credentials for components in the cluster. If the credentials are not sufficient for mint mode, it determines whether they are sufficient for passthrough mode. If the credentials are not sufficient for passthrough mode, the CCO cannot adequately process CredentialsRequest CRs.
If the provided credentials are determined to be insufficient during installation, the installation fails. For AWS, the installation program fails early in the process and indicates which required permissions are missing. Other providers might not provide specific information about the cause of the error until errors are encountered.
If the credentials are changed after a successful installation and the CCO determines that the new credentials are insufficient, the CCO puts conditions on any new CredentialsRequest CRs to indicate that it cannot process them because of the insufficient credentials.
To resolve insufficient credentials issues, provide a credential with sufficient permissions. If an error occurred during installation, try installing again. For issues with new CredentialsRequest CRs, wait for the CCO to try to process the CR again. As an alternative, you can configure your cluster to use a different CCO mode that is supported for your cloud provider.