Skip to content

Commit ff06c7a

Browse files
Clee2691cahartma
Clee2691
and
cahartma
authored
LOG-7348: Add CLO logic for GCP Workload Identity Federation (#3259)
* LOG-7348: Add WIF support for googleCloud output * rebase and add AzureLogsIngestion to getOutputBearerToken, add cred validation, add optional token field to gcp auth --------- Co-authored-by: Casey Hartman <cahartma@redhat.com>
1 parent 3c28f59 commit ff06c7a

19 files changed

Lines changed: 1231 additions & 41 deletions

‎api/observability/v1/output_types.go‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -719,11 +719,22 @@ type Elasticsearch struct {
719719

720720
// GoogleCloudLoggingAuthentication contains configuration for authenticating requests to a GoogleCloudLogging output.
721721
type GoogleCloudLoggingAuthentication struct {
722-
// Credentials points to the secret containing the `google-application-credentials.json`.
722+
// Credentials points to the secret containing the GCP credentials JSON file.
723+
// For service account auth, this is a service_account key file.
724+
// For Workload Identity Federation (WIF), this is an external_account configuration file.
723725
//
724726
// +kubebuilder:validation:Required
725727
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Secret with Credentials File"
726728
Credentials *SecretReference `json:"credentials"`
729+
730+
// Token specifies the source of the bearer token used as the subject token for
731+
// GCP Workload Identity Federation token exchange. Only needed when the credentials
732+
// file is an external_account type.
733+
//
734+
// +kubebuilder:validation:Optional
735+
// +nullable
736+
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Token"
737+
Token *BearerToken `json:"token,omitempty"`
727738
}
728739

729740
type GoogleCloudLoggingTuningSpec struct {

‎api/observability/v1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/cluster-logging.clusterserviceversion.yaml‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ metadata:
8282
categories: OpenShift Optional, Logging & Tracing, Observability
8383
certified: "false"
8484
containerImage: quay.io/openshift-logging/cluster-logging-operator:latest
85-
createdAt: "2026-04-24T14:35:45Z"
85+
createdAt: "2026-04-30T19:37:39Z"
8686
description: The Red Hat OpenShift Logging Operator for OCP provides a means for
8787
configuring and managing log collection and forwarding.
8888
features.operators.openshift.io/cnf: "false"
@@ -965,7 +965,10 @@ spec:
965965
- description: Authentication sets credentials for authenticating the requests.
966966
displayName: Authentication Options
967967
path: outputs[0].googleCloudLogging.authentication
968-
- description: Credentials points to the secret containing the `google-application-credentials.json`.
968+
- description: |-
969+
Credentials points to the secret containing the GCP credentials JSON file.
970+
For service account auth, this is a service_account key file.
971+
For Workload Identity Federation (WIF), this is an external_account configuration file.
969972
displayName: Secret with Credentials File
970973
path: outputs[0].googleCloudLogging.authentication.credentials
971974
- description: Key contains the name of the key inside the referenced Secret.
@@ -979,6 +982,29 @@ spec:
979982
path: outputs[0].googleCloudLogging.authentication.credentials.secretName
980983
x-descriptors:
981984
- urn:alm:descriptor:com.tectonic.ui:text
985+
- description: |-
986+
Token specifies the source of the bearer token used as the subject token for
987+
GCP Workload Identity Federation token exchange. Only needed when the credentials
988+
file is an external_account type.
989+
displayName: Token
990+
path: outputs[0].googleCloudLogging.authentication.token
991+
- description: From is the source from where to find the token
992+
displayName: Token Source
993+
path: outputs[0].googleCloudLogging.authentication.token.from
994+
- description: Use Secret if the value should be sourced from a Secret in the
995+
same namespace.
996+
displayName: Token Secret
997+
path: outputs[0].googleCloudLogging.authentication.token.secret
998+
- description: Name of the key used to get the value from the referenced Secret.
999+
displayName: Key Name
1000+
path: outputs[0].googleCloudLogging.authentication.token.secret.key
1001+
x-descriptors:
1002+
- urn:alm:descriptor:com.tectonic.ui:text
1003+
- description: Name of secret
1004+
displayName: Secret Name
1005+
path: outputs[0].googleCloudLogging.authentication.token.secret.name
1006+
x-descriptors:
1007+
- urn:alm:descriptor:com.tectonic.ui:text
9821008
- description: ID must be one of the required ID fields for the output
9831009
displayName: Logging ID
9841010
path: outputs[0].googleCloudLogging.id

‎bundle/manifests/observability.openshift.io_clusterlogforwarders.yaml‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2527,8 +2527,10 @@ spec:
25272527
the requests.
25282528
properties:
25292529
credentials:
2530-
description: Credentials points to the secret containing
2531-
the `google-application-credentials.json`.
2530+
description: |-
2531+
Credentials points to the secret containing the GCP credentials JSON file.
2532+
For service account auth, this is a service_account key file.
2533+
For Workload Identity Federation (WIF), this is an external_account configuration file.
25322534
properties:
25332535
key:
25342536
description: Key contains the name of the key inside
@@ -2542,6 +2544,42 @@ spec:
25422544
- key
25432545
- secretName
25442546
type: object
2547+
token:
2548+
description: |-
2549+
Token specifies the source of the bearer token used as the subject token for
2550+
GCP Workload Identity Federation token exchange. Only needed when the credentials
2551+
file is an external_account type.
2552+
nullable: true
2553+
properties:
2554+
from:
2555+
description: From is the source from where to find
2556+
the token
2557+
enum:
2558+
- secret
2559+
- serviceAccount
2560+
type: string
2561+
secret:
2562+
description: Use Secret if the value should be sourced
2563+
from a Secret in the same namespace.
2564+
properties:
2565+
key:
2566+
description: Name of the key used to get the
2567+
value from the referenced Secret.
2568+
type: string
2569+
name:
2570+
description: Name of secret
2571+
type: string
2572+
required:
2573+
- key
2574+
- name
2575+
type: object
2576+
required:
2577+
- from
2578+
type: object
2579+
x-kubernetes-validations:
2580+
- message: Additional secret spec is required when bearer
2581+
token is sourced from a secret
2582+
rule: self.from != 'secret' || has(self.secret)
25452583
required:
25462584
- credentials
25472585
type: object

‎config/crd/bases/observability.openshift.io_clusterlogforwarders.yaml‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2527,8 +2527,10 @@ spec:
25272527
the requests.
25282528
properties:
25292529
credentials:
2530-
description: Credentials points to the secret containing
2531-
the `google-application-credentials.json`.
2530+
description: |-
2531+
Credentials points to the secret containing the GCP credentials JSON file.
2532+
For service account auth, this is a service_account key file.
2533+
For Workload Identity Federation (WIF), this is an external_account configuration file.
25322534
properties:
25332535
key:
25342536
description: Key contains the name of the key inside
@@ -2542,6 +2544,42 @@ spec:
25422544
- key
25432545
- secretName
25442546
type: object
2547+
token:
2548+
description: |-
2549+
Token specifies the source of the bearer token used as the subject token for
2550+
GCP Workload Identity Federation token exchange. Only needed when the credentials
2551+
file is an external_account type.
2552+
nullable: true
2553+
properties:
2554+
from:
2555+
description: From is the source from where to find
2556+
the token
2557+
enum:
2558+
- secret
2559+
- serviceAccount
2560+
type: string
2561+
secret:
2562+
description: Use Secret if the value should be sourced
2563+
from a Secret in the same namespace.
2564+
properties:
2565+
key:
2566+
description: Name of the key used to get the
2567+
value from the referenced Secret.
2568+
type: string
2569+
name:
2570+
description: Name of secret
2571+
type: string
2572+
required:
2573+
- key
2574+
- name
2575+
type: object
2576+
required:
2577+
- from
2578+
type: object
2579+
x-kubernetes-validations:
2580+
- message: Additional secret spec is required when bearer
2581+
token is sourced from a secret
2582+
rule: self.from != 'secret' || has(self.secret)
25452583
required:
25462584
- credentials
25472585
type: object

‎config/manifests/bases/cluster-logging.clusterserviceversion.yaml‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -888,7 +888,10 @@ spec:
888888
- description: Authentication sets credentials for authenticating the requests.
889889
displayName: Authentication Options
890890
path: outputs[0].googleCloudLogging.authentication
891-
- description: Credentials points to the secret containing the `google-application-credentials.json`.
891+
- description: |-
892+
Credentials points to the secret containing the GCP credentials JSON file.
893+
For service account auth, this is a service_account key file.
894+
For Workload Identity Federation (WIF), this is an external_account configuration file.
892895
displayName: Secret with Credentials File
893896
path: outputs[0].googleCloudLogging.authentication.credentials
894897
- description: Key contains the name of the key inside the referenced Secret.
@@ -902,6 +905,29 @@ spec:
902905
path: outputs[0].googleCloudLogging.authentication.credentials.secretName
903906
x-descriptors:
904907
- urn:alm:descriptor:com.tectonic.ui:text
908+
- description: |-
909+
Token specifies the source of the bearer token used as the subject token for
910+
GCP Workload Identity Federation token exchange. Only needed when the credentials
911+
file is an external_account type.
912+
displayName: Token
913+
path: outputs[0].googleCloudLogging.authentication.token
914+
- description: From is the source from where to find the token
915+
displayName: Token Source
916+
path: outputs[0].googleCloudLogging.authentication.token.from
917+
- description: Use Secret if the value should be sourced from a Secret in the
918+
same namespace.
919+
displayName: Token Secret
920+
path: outputs[0].googleCloudLogging.authentication.token.secret
921+
- description: Name of the key used to get the value from the referenced Secret.
922+
displayName: Key Name
923+
path: outputs[0].googleCloudLogging.authentication.token.secret.key
924+
x-descriptors:
925+
- urn:alm:descriptor:com.tectonic.ui:text
926+
- description: Name of secret
927+
displayName: Secret Name
928+
path: outputs[0].googleCloudLogging.authentication.token.secret.name
929+
x-descriptors:
930+
- urn:alm:descriptor:com.tectonic.ui:text
905931
- description: ID must be one of the required ID fields for the output
906932
displayName: Logging ID
907933
path: outputs[0].googleCloudLogging.id

docs/features/logforwarding/outputs/aws-cross-account-forwarding.adoc renamed to docs/features/logforwarding/outputs/aws/aws-cross-account-forwarding.adoc

File renamed without changes.

docs/features/logforwarding/outputs/cloudwatch-sts-forwarding.adoc renamed to docs/features/logforwarding/outputs/aws/cloudwatch-sts-forwarding.adoc

File renamed without changes.

docs/features/logforwarding/outputs/s3-forwarding.adoc renamed to docs/features/logforwarding/outputs/aws/s3-forwarding.adoc

File renamed without changes.

docs/features/logforwarding/outputs/google-cloud-forwarding.adoc renamed to docs/features/logforwarding/outputs/googlecloud/google-cloud-forwarding.adoc

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

2-
=== Steps to send logs to Google Cloud Logging
2+
=== Steps to send logs to Google Cloud Logging using a service account key
33

4-
. Create a secret which contains google application credentials (the credentials which will be used to send logs to Google Cloud Logging)
4+
. Create a secret which contains the GCP service account key JSON file (the credentials which will be used to send logs to Google Cloud Logging)
55
+
66
----
77
oc -n openshift-logging create secret generic gcp-secret --from-file=google-application-credentials.json
@@ -26,6 +26,8 @@
2626
+
2727
Replace `project_id` and `private_key` with real values.
2828

29+
NOTE: The credentials file must have `"type": "service_account"`. The operator validates that the secret content matches the declared authentication type.
30+
2931
. Create a Cluster Log Forwarder instance with following yaml.
3032
+
3133
----
@@ -51,9 +53,9 @@ spec:
5153
id:
5254
type: project
5355
value: openshift-gce-devel
54-
logId : app-gcp
56+
logId: app-gcp
5557
authentication:
56-
credentials:
58+
credentials: # <1>
5759
key: google-application-credentials.json
5860
secretName: gcp-secret
5961
pipelines:
@@ -65,6 +67,9 @@ spec:
6567
outputRefs:
6668
- gcp-1
6769
----
70+
<1> Points to the secret containing the GCP service account key JSON file.
71+
72+
For Workload Identity Federation (WIF) authentication, see link:google-cloud-workload-identity.adoc[Google Cloud Logging with Workload Identity Federation].
6873

6974
. Login to google console and check logs
7075
+

0 commit comments

Comments
 (0)