Set up a trusted profile in the CLI

Follow the steps to create and set up a trusted profile in the CLI.

Once you add a trusted profile to a cluster, it cannot be removed and you cannot resume using an API key for your resources. Make sure you follow these steps carefully to ensure that your trusted profile is set up correctly.

1. Log in to the IBM Cloud CLI.

   ibmcloud login --apikey <API_KEY> -g <RESOURCE_GROUP>
   

2. Run the command to create a trusted profile. For a complete list of command options, see the IAM CLI docs.

   ibmcloud iam trusted-profile-create NAME --description "Identity for storage"
   

3. Attach a rule to scope usage to the kube‑system namespace. For a complete list of command options, see the IAM CLI docs.

   ibmcloud iam trusted-profile-rule-create --name NAME --type Profile-CR --cr-type ROKS_SA  --conditions claim:namespace,operator:EQUALS,value:kube-system 
   

4. For VPC clusters: Create and assign access policies to the trusted profile. This example assigns the minimum permissions required for all storage components. For a list of permissions required for individual components only, see Minimum requirements for individual storage components. Specify the name or ID of the trusted profile you want to assign the policy to. For a complete list of command options, see the IAM CLI docs. This step does not apply to classic clusters. Add policies for the VPC Infrastructure service.

   ibmcloud iam trusted-profile-policy-create NAME|ID  --roles Editor,Writer --service-name is
   

   Add policies for the billing service.

   ibmcloud iam trusted-profile-policy-create NAME|ID --roles Editor --service-name billing
   

   Add policies for the Kubernetes service.

   ibmcloud iam trusted-profile-policy-create NAME|ID --roles Administrator --service-name "containers-kubernetes"
   

   Add policies for the relevant resource group that the trusted profile is applied to. Specify the resource group that the trusted profile is applied to.

   ibmcloud iam trusted-profile-policy-create NAME|ID --roles Operator  --resource-type "resource-group" --resource "my-resource-group"
   

5. For classic clusters: Run the command to add the minimum required permissions to the trusted profile. Specify the user ID that is created for the trusted profile.

   ibmcloud oc sl user permission-edit TRUSTED_PROFILE_ID --permission NAS_MANAGE,ADD_SERVICE_STORAGE
   

6. After you have created the trusted profile and assigned the required access policies, set the trusted profile for either the cluster or the resource group that your clusters are in. Setting the trusted profile applies it to your storage components.

Set up a trusted profile with the UI

Follow the steps to create and set up a trusted profile in the CLI.

Once you add a trusted profile to a cluster, it cannot be removed and you cannot resume using an API key for your resources. Make sure you follow these steps carefully to ensure that your trusted profile is set up correctly.

1. Log in to your IBM Cloud account and navigate to the Trusted Profiles page.

2. Create a trusted profile.

3. Create a trust relationship with the Red Hat OpenShift on IBM Cloud service.

   1. In the Select trusted entity type section, click Compute resources.
   2. Under Create trust relationship, choose Red Hat OpenShift.
   3. Select All service resources. Then add a condition to allow access when Namespace is Equal to kube-system.
      • Note: You can instead choose specific resources that exist in your account.

4. Click Create.

5. VPC only. Add access policies to the trusted profile.

   1. From the Trusted profiles page, click the trusted profile you just created.
   2. From the Access tab, click Assign access.
   3. In the How do you want to assign access? section, click Access policy.
   4. Add the services and roles to meet the minimum requirements for the relevant components. Apply the policy to all resources.

6. Classic only. Add permissions to the trusted profile.

   1. From the Trusted profiles page, click the trusted profile you just created.
   2. Navigate to the Classic Infrastructure tab.
   3. In the permissions drop down, select the required permissions to meet the minimum requirements for the relevant components.

Set up a trusted profile with the API

1. Create a trusted profile.

   curl --request POST \
   --url https://iam.test.cloud.ibm.com/v1/profiles \
   --header 'Content-Type: application/json' \
   --data '{
       "name":"<PROFILE_NAME>",
       "account_id":"<ACCOUNT_ID>"
   }'
   

2. Attach a rule to scope usage to the kube‑system namespace.

   curl --request POST \
   --url https://iam.test.cloud.ibm.com/v1/profiles/<PROFILE_NAME>/rules \
   --header 'Content-Type: application/json' \
   --data '{
       "type": "Profile-CR",
       "cr_type":"ROKS_SA",
       "conditions": [
           {
               "claim": "namespace",
               "operator": "EQUALS",
               "value": "\"kube-system\""
           }
       ]
   }'
   

3. For VPC clusters: Attach access policies to VPC components. These examples assign the minimum permissions required for all storage components.

   curl --request POST \
   --url https://iam.test.cloud.ibm.com/v1/policies \
   --header 'Content-Type: application/json' \
   --data '{
       "type": "access",
       "description": "Writer, Operator role for VPC infrastructure services",
       "subjects": [
           {
               "attributes": [
                   {
                       "name": "iam_id",
                       "value": "<IAM_PROFILE>"
                   }
               ]
           }
       ],
       "roles": [
           {
               "role_id": "crn:v1:bluemix:public:iam::::serviceRole:Writer"
           },
           {
               "role_id": "crn:v1:bluemix:public:iam::::role:Editor"
           }
       ],
       "resources": [
           {
               "attributes": [
                   {
                       "name": "accountId",
                       "value": "<ACCOUNT_ID>"
                   },
                   {
                       "name": "serviceName",
                       "value": "is"
                   }
               ]
           }
       ]
   }'
   

   curl --request POST \
   --url https://iam.test.cloud.ibm.com/v1/policies \
   --header 'Content-Type: application/json' \
   --data '{
       "type": "access",
       "description": "Editor role for billing services",
       "subjects": [
           {
               "attributes": [
                   {
                       "name": "iam_id",
                       "value": "<IAM_PROFILE>"
                   }
               ]
           }
       ],
       "roles": [
           {
               "role_id": "crn:v1:bluemix:public:iam::::role:Editor"
           }
       ],
       "resources": [
           {
               "attributes": [
                   {
                       "name": "accountId",
                       "value": "<ACCOUNT_ID>"
                   },
                   {
                       "name": "serviceName",
                       "value": "billing"
                   }
               ]
           }
       ]
   }'
   

   curl --request POST \
   --url https://iam.test.cloud.ibm.com/v1/policies \
   --header 'Content-Type: application/json' \
   --data '{	
       "type": "access",
       "description": "Administrator role for containers-kubernetes services",
       "subjects": [
           {
               "attributes": [
                   {
                       "name": "iam_id",
                       "value": "<IAM_PROFILE>"
                   }
               ]
           }
       ],
       "roles": [
           {
               "role_id": "crn:v1:bluemix:public:iam::::role:Administrator"
           }
       ],
       "resources": [
           {
               "attributes": [
                   {
                       "name": "accountId",
                       "value": "<ACCOUNT_ID>"
                   },
                   {
                       "name": "serviceName",
                       "value": "containers-kubernetes"
                   }
               ]
           }
       ]
   }'
   

   curl --request POST \
   --url https://iam.test.cloud.ibm.com/v1/policies \
   --header 'Content-Type: application/json' \
   --data '{	
       "type": "access",
       "subjects": [
           {
               "attributes": [
                   {
                       "name": "iam_id",
                       "value": "<IAM_PROFILE>"
                   }
               ]
           }
       ],
       "roles": [
           {
               "role_id": "crn:v1:bluemix:public:iam::::role:Operator"
           }
       ],
       "resources": [
           {
               "attributes": [
                   {
                       "name": "accountId",
                       "value": "<ACCOUNT_ID>"
                   },
                   {
                       "name": "resource",
                       "value": "<RESOURCE_GROUP_ID>"
                   },
                   {
                       "name": "resourceType",
                       "value": "resource-group"
                   },
               ]
           }
       ]
   }
   

4. For classic clusters: Add permissions to the trusted profile by using the UI.

   1. Log in to your IBM Cloud account and navigate to the Trusted Profiles page.
   2. Click the trusted profile you just created.
   3. Navigate to the Classic Infrastructure tab.
   4. In the permissions drop down, select the required permissions to meet the minimum requirements for the relevant components.