CNV-95910: Document cloud provider credential injection for VMs - #119623
CNV-95910: Document cloud provider credential injection for VMs#119623abrennan89 wants to merge 1 commit into
Conversation
Add draft documentation for injecting cloud provider service account tokens into VM guests using containerPath volumes and virtiofs on managed OpenShift platforms (ROSA, ARO). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@abrennan89: This pull request references CNV-95910 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
size/L
| ==== | ||
| Injecting cloud provider credentials into VMs by using containerPath volumes is a Technology Preview feature only. Technology Preview features are not supported with Red{nbsp}Hat production service level agreements (SLAs) and might not be functionally complete. Red{nbsp}Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. | ||
|
|
||
| For more information about the support scope of Red{nbsp}Hat Technology Preview features, see link:https://access.redhat.com/support/offerings/techpreview/[Technology Preview Features Support Scope]. |
There was a problem hiding this comment.
🤖 [error] AsciiDocDITA.ConceptLink: Move all links and cross references to Additional resources.
| annotations: | ||
| eks.amazonaws.com/role-arn: "arn:aws:iam::123456789012:role/my-role" <2> | ||
| ---- | ||
| <1> The name of the `ServiceAccount`. You reference this name in the VM manifest. |
There was a problem hiding this comment.
🤖 [error] AsciiDocDITA.CalloutList: Callouts are not supported in DITA.
| annotations: | ||
| azure.workload.identity/client-id: "<client-id>" <2> | ||
| ---- | ||
| <1> The name of the `ServiceAccount`. You reference this name in the VM manifest. |
There was a problem hiding this comment.
🤖 [error] AsciiDocDITA.CalloutList: Callouts are not supported in DITA.
| containerPath: | ||
| path: /var/run/secrets/eks.amazonaws.com/serviceaccount <4> | ||
| ---- | ||
| <1> The name of the `ServiceAccount` with the AWS IAM role annotation. |
There was a problem hiding this comment.
🤖 [error] AsciiDocDITA.CalloutList: Callouts are not supported in DITA.
| containerPath: | ||
| path: /var/run/secrets/azure/tokens <5> | ||
| ---- | ||
| <1> Required label for Azure Workload Identity webhook injection. |
There was a problem hiding this comment.
🤖 [error] AsciiDocDITA.CalloutList: Callouts are not supported in DITA.
| $ mount | grep virtiofs | ||
| $ ls /path/to/virtiofs/mount/ <1> | ||
| ---- | ||
| <1> The mount point depends on the guest operating system configuration. Check for the token file in the virtiofs-mounted directory. |
There was a problem hiding this comment.
🤖 [error] AsciiDocDITA.CalloutList: Callouts are not supported in DITA.
| $ mount | grep virtiofs | ||
| $ ls /path/to/virtiofs/mount/ <1> | ||
| ---- | ||
| <1> The mount point depends on the guest operating system configuration. Check for the token file in the virtiofs-mounted directory. |
There was a problem hiding this comment.
🤖 [error] AsciiDocDITA.CalloutList: Callouts are not supported in DITA.
|
@abrennan89: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
Summary
TODOs for SME review
ContainerPathVolumesfeature gate name and TP/GA statusNew files
virt/storage/virt-injecting-cloud-provider-credentials-into-vms.adocmodules/virt-about-cloud-identity-credential-injection.adocmodules/virt-injecting-cloud-provider-credentials-into-vm.adocmodules/virt-containerpath-volume-configuration-fields.adocModified files
_topic_maps/_topic_map_rosa.yml_topic_maps/_topic_map_osd.yml_topic_maps/_topic_map_rosa_hcp.ymlTest plan
🤖 Generated with Claude Code