:_mod-docs-content-type: ASSEMBLY
[id="cco-short-term-creds"]
= About the Cloud Credential Operator in manual mode with short-term credentials for components
include::_attributes/common-attributes.adoc[]
:context: cco-short-term-creds

toc::[]

[role="_abstract"]
During installation, you can configure the Cloud Credential Operator (CCO) to operate in manual mode and use the CCO utility (`ccoctl`) to implement short-term security credentials for individual components that are created and managed outside the {product-title} cluster.

[NOTE]
====
This credentials strategy is supported for {aws-first}, {gcp-first}, and global {azure-full} only.

For {aws-short} and {gcp-short} clusters, you must configure your cluster to use this strategy during installation of a new {product-title} cluster. 
You cannot configure an existing {aws-short} or {gcp-short} cluster that uses a different credentials strategy to use this feature.

If you did not configure your {azure-short} cluster to use {entra-first} during installation, you can enable this authentication method on an existing cluster. For information, see "Enabling token-based authentication".
====

//todo: Should provide some more info about the benefits of this here as well. Note: Azure is not yet limited-priv, but still gets the benefit of not storing root creds on the cluster and some sort of time-based rotation

Cloud providers use different terms for their implementation of this authentication method.

.Short-term credentials provider terminology
|====
|Cloud provider |Provider nomenclature

|{aws-first}
|{aws-short} {sts-first}

|{gcp-first}
|{gcp-wid-short}

|Global Microsoft Azure
|{entra-first}

|====

// About Security Token Service (STS)
include::modules/cco-short-term-creds-aws-sts.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources
* xref:../../installing/installing_aws/ipi/installing-aws-customizations.adoc#installing-aws-with-short-term-creds_installing-aws-customizations[Configuring an {aws-short} cluster to use short-term credentials]

//AWS Security Token Service authentication process
include::modules/cco-short-term-creds-auth-flow-aws.adoc[leveloffset=+2]

//AWS component secret formats
include::modules/cco-short-term-creds-format-aws.adoc[leveloffset=+2]

//AWS component secret permissions requirements
include::modules/cco-short-term-creds-component-permissions-aws.adoc[leveloffset=+2]

//OLM-managed Operator support for authentication with AWS STS
include::modules/cco-short-term-creds-aws-olm.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources
* xref:../../operators/operator_sdk/token_auth/osdk-cco-aws-sts.adoc#osdk-cco-aws-sts[CCO-based workflow for OLM-managed Operators with {aws-short} {sts-short}]

// Content stub for later addition:
////
// Application support for AWS STS service account tokens
// Extra context so module can be reused within assembly (unset in module)
:context: aws
// Attributes used in module with cloud-specific values (unset in module)
:cloud-auth-first: {aws-short} {sts-first}
:cloud-auth-short: {aws-short} {sts-short}
include::modules/cco-short-term-creds-workloads.adoc[leveloffset=+2] 

[role="_additional-resources"]
.Additional resources
* xr3f:../../nodes/pods/nodes-pods-short-term-auth.adoc#nodes-pods-short-term-auth-configuring-aws_nodes-pods-short-term-auth[Configuring {aws-short} {sts-short} authentication for pods on {aws-short}]

:context: cco-short-term-creds
////

// About Google Cloud Platform Workload Identity
include::modules/cco-short-term-creds-gcp-wid.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources
* xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#installing-gcp-with-short-term-creds_installing-gcp-customizations[Configuring a {gcp-short} cluster to use short-term credentials]

//GCP Workload Identity authentication process
include::modules/cco-short-term-creds-auth-flow-gcp.adoc[leveloffset=+2]

//GCP component secret formats
include::modules/cco-short-term-creds-format-gcp.adoc[leveloffset=+2]

//GCP component secret permissions requirements
include::modules/cco-short-term-creds-component-permissions-gcp.adoc[leveloffset=+2]

//OLM-managed Operator support for authentication with GCP Workload Identity
include::modules/cco-short-term-creds-gcp-olm.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources
* xref:../../operators/operator_sdk/token_auth/osdk-cco-gcp.adoc#osdk-cco-gcp[CCO-based workflow for OLM-managed Operators with {gcp-wid-first}]

// Application support for GCP Workload Identity service account tokens
// Extra context so module can be reused within assembly (unset in module)
:context: gcp
// Attributes used in module with cloud-specific values (unset in module)
:cloud-auth-first: {gcp-wid-first}
:cloud-auth-short: {gcp-wid-short}
include::modules/cco-short-term-creds-workloads.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources
* xref:../../nodes/pods/nodes-pods-short-term-auth.adoc#nodes-pods-short-term-auth-configuring-gcp_nodes-pods-short-term-auth[Configuring {gcp-wid-short} authentication for applications on {gcp-short}]

:context: cco-short-term-creds

// About Microsoft Entra Workload ID
include::modules/cco-short-term-creds-gcp-entra.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources
* xref:../../installing/installing_azure/ipi/installing-azure-customizations.adoc#installing-azure-with-short-term-creds_installing-azure-customizations[Configuring a global {azure-first} cluster to use short-term credentials]

//Microsoft Entra Workload ID authentication process
include::modules/cco-short-term-creds-auth-flow-azure.adoc[leveloffset=+2]

//Azure component secret formats
include::modules/cco-short-term-creds-format-azure.adoc[leveloffset=+2]

//Azure component secret permissions requirements
include::modules/cco-short-term-creds-component-permissions-azure.adoc[leveloffset=+2]

//OLM-managed Operator support for authentication with Microsoft Entra Workload ID
include::modules/cco-short-term-creds-azure-olm.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources
* xref:../../operators/operator_sdk/token_auth/osdk-cco-azure.adoc#osdk-cco-azure[CCO-based workflow for OLM-managed Operators with {entra-first}]

// Content stub for later addition:
////
// Application support for Microsoft Entra Workload ID service account tokens
// Extra context so module can be reused within assembly (unset in module)
:context: azure
// Attributes used in module with cloud-specific values (unset in module)
:cloud-auth-first: {entra-first}
:cloud-auth-short: {entra-short}
include::modules/cco-short-term-creds-workloads.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources
* xr3f:../../nodes/pods/nodes-pods-short-term-auth.adoc#nodes-pods-short-term-auth-configuring-azure_nodes-pods-short-term-auth[Configuring {entra-first} authentication for pods on {azure-short}]

:context: cco-short-term-creds
////

[role="_additional-resources"]
[id="additional-resources_{context}"]
== Additional resources

* xref:../../post_installation_configuration/changing-cloud-credentials-configuration.adoc#post-install-enable-token-auth_changing-cloud-credentials-configuration[Enabling token-based authentication]
* xref:../../installing/installing_aws/ipi/installing-aws-customizations.adoc#installing-aws-with-short-term-creds_installing-aws-customizations[Configuring an {aws-short} cluster to use short-term credentials]
* xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#installing-gcp-with-short-term-creds_installing-gcp-customizations[Configuring a {gcp-short} cluster to use short-term credentials]
* xref:../../installing/installing_azure/ipi/installing-azure-customizations.adoc#installing-azure-with-short-term-creds_installing-azure-customizations[Configuring a global {azure-first} cluster to use short-term credentials]
* xref:../../updating/preparing_for_updates/preparing-manual-creds-update.adoc#preparing-manual-creds-update[Preparing to update a cluster with manually maintained credentials]
