@@ -18,18 +18,18 @@ ifdef::rotate-aws[= Rotating {aws-short} OIDC bound service account signer keys]
1818ifdef::rotate-gcp[= Rotating {gcp-short} OIDC bound service account signer keys]
1919ifdef::rotate-azure[= Rotating {azure-short} OIDC bound service account signer keys]
2020
21- If the Cloud Credential Operator (CCO) for your {product-title} cluster
21+ If the Cloud Credential Operator (CCO) for your {product-title} cluster
2222ifdef::rotate-aws[on {aws-first}]
2323ifdef::rotate-gcp[on {gcp-first}]
2424ifdef::rotate-azure[on {azure-first}]
25- is configured to operate in manual mode with
25+ is configured to operate in manual mode with
2626ifdef::rotate-aws[{sts-short},]
2727ifdef::rotate-gcp[{gcp-wid-short},]
2828ifdef::rotate-azure[{entra-first},]
2929you can rotate the bound service account signer key.
3030
3131To rotate the key, you delete the existing key on your cluster, which causes the Kubernetes API server to create a new key.
32- To reduce authentication failures during this process, you must immediately add the new public key to the existing issuer file.
32+ To reduce authentication failures during this process, you must immediately add the new public key to the existing issuer file.
3333After the cluster is using the new key for authentication, you can remove any remaining keys.
3434
3535//Modified version of the disclaimer from enabling Azure WID on an existing cluster, since there are similar concerns:
@@ -52,8 +52,10 @@ To mitigate this impact, you can temporarily halt these services and then redepl
5252.Prerequisites
5353
5454* You have access to the {oc-first} as a user with the `cluster-admin` role.
55+
5556//Permissions requirements (per platform, for install and key rotation)
5657include::snippets/ccoctl-provider-permissions-requirements.adoc[]
58+
5759* You have configured the `ccoctl` utility.
5860* Your cluster is in a stable state.
5961You can confirm that the cluster is stable by running the following command:
@@ -312,7 +314,7 @@ $ az storage blob upload \
312314----
313315endif::rotate-azure[]
314316
315- . Wait for the Kubernetes API server to update and use the new key.
317+ . Wait for the Kubernetes API server to update and use the new key.
316318You can monitor the update progress by running the following command:
317319+
318320[source,terminal]
0 commit comments