changing-cloud-credentials-configuration.adoc

Changing the cloud provider credentials configuration

For supported configurations, you can change how {product-title} authenticates with your cloud provider.

To determine which cloud credentials strategy your cluster uses, see Determining the Cloud Credential Operator mode.

Rotating cloud provider service keys with the Cloud Credential Operator utility

Some organizations require the rotation of the service keys that authenticate the cluster. You can use the Cloud Credential Operator (CCO) utility (ccoctl) to update keys for clusters installed on the following cloud providers:

• {aws-first} with {sts-first}

• {gcp-first} with {gcp-wid-short}

• {azure-first} with {entra-short}

• {ibm-cloud-title}

modules/rotating-bound-service-keys.adoc :!context: key-rotation-aws

modules/rotating-bound-service-keys.adoc :!context: key-rotation-gcp

modules/rotating-bound-service-keys.adoc :!context: key-rotation-azure :context: changing-cloud-credentials-configuration

modules/refreshing-service-ids-ibm-cloud.adoc

Rotating cloud provider credentials

Some organizations require the rotation of the cloud provider credentials. To allow the cluster to use the new credentials, you must update the secrets that the Cloud Credential Operator (CCO) uses to manage cloud provider credentials.

modules/manually-rotating-cloud-creds.adoc

Additional resources

• The Cloud Credential Operator in mint mode

• The Cloud Credential Operator in passthrough mode

• vSphere CSI Driver Operator

Removing cloud provider credentials

After installing {product-title}, some organizations require the removal of the cloud provider credentials that were used during the initial installation. To allow the cluster to use the new credentials, you must update the secrets that the Cloud Credential Operator (CCO) uses to manage cloud provider credentials.

modules/manually-removing-cloud-creds.adoc

Additional resources

• The Cloud Credential Operator in mint mode

Enabling token-based authentication

After installing an {azure-first} {product-title} cluster, you can enable {entra-first} to use short-term credentials.

modules/cco-ccoctl-configuring.adoc

modules/enabling-entra-workload-id-existing-cluster.adoc

Additional resources

• Microsoft Entra Workload ID

• Configuring an Azure cluster to use short-term credentials

modules/cco-ccoctl-install-verifying.adoc

Additional resources

• About the Cloud Credential Operator