Bug 1385295

Document URL: 

https://docs.openshift.com/container-platform/3.3/install_config/configuring_gce.html

https://docs.openshift.com/container-platform/3.3/install_config/persistent_storage/persistent_storage_gce.html

https://docs.openshift.com/container-platform/3.3/install_config/registry/extended_registry_configuration.html#docker-registry-configuration-reference-reporting

Section Number and Name: 

Describe the issue: 

The documentation explains the configurations to be done to activate various integrations with the underlying cloud provider, such as:
1. load balancing
2. dynamically provisioned storage
3. object storage for the registry

The documentation explains to a certain extent what to do to authenticate with the underlying cloud provider APIs. for google cloud this is nothing because all the instances are automatically authenticated with service accounts.

The documentation does not explain what permission those service accounts should have in order for the various operations to succeed.

based on my experience (https://github.com/raffaelespazzoli/openshift-enablement-exam) the following is needed (in google cloud permission are give in the form of oath scopes):
"https://www.googleapis.com/auth/compute" : to work with forwarding rules and attached storage
"https://www.googleapis.com/auth/devstorage.read_write" : to work with object storage.

I haven;t finished my experiments, there may be others that are needed.

I'm working on google cloud, but the same concept may apply to other cloud providers.


Suggestions for improvement: 

add the information to correctly configure permissions. suggest to use the minimal permission that allow to complete the job. for example "https://www.googleapis.com/auth/compute" is a sort of root access, there may be a better, more fine tuned scope.

Additional information: