OSDOCS-15819 User managed firewall rules for GCP #104757

bscott-rh · 2026-01-13T20:37:50Z

Version(s):
4.21

Issue:
https://issues.redhat.com/browse/OSDOCS-15819

Link to docs preview:
Managing your own firewall rules
non-XPN permissions
XPN permissions
Existing VPC prerequisites
Shared VPC prerequisites
Installation configuration parameters

QE review:

QE has approved this change.

TBD: Day 2

ocpdocs-previewbot · 2026-01-13T20:43:55Z

🤖 Thu Jan 15 15:57:31 - Prow CI generated the docs preview:
https://104757--ocpdocs-pr.netlify.app
Complete list of updated preview URLs: artifacts/updated_preview_urls.txt

ocpdocs-vale-bot · 2026-01-13T20:44:40Z

installing/installing_gcp/installing-gcp-account.adoc

🤖 [error] AsciiDocDITA.ShortDescription: Assign [role="_abstract"] to a paragraph to use it as in DITA.

ocpdocs-vale-bot · 2026-01-13T20:44:43Z

installing/installing_gcp/installing-gcp-shared-vpc.adoc

🤖 [error] AsciiDocDITA.ShortDescription: Assign [role="_abstract"] to a paragraph to use it as in DITA.

ocpdocs-vale-bot · 2026-01-13T20:44:45Z

installing/installing_gcp/installing-gcp-vpc.adoc

🤖 [error] AsciiDocDITA.ShortDescription: Assign [role="_abstract"] to a paragraph to use it as in DITA.

ocpdocs-vale-bot · 2026-01-13T20:44:50Z

modules/installation-configuration-parameters.adoc

+|platform:
+  gcp:
+    firewallRulesManagement:
+|Specifies the firewall management policy for the cluster. `Managed` indicates that the firewall rules will be created and destroyed by the cluster. `Unmanaged` indicates that the user should create and destroy the firewall rules. For shared VPC installation, if the installer credential doesn't have firewall rules management permissions, the `firewallRulesManagement` parameter can be absent or set to `Unmanaged`. For non-shared VPC installation, if the installer credential doesn't have firewall rules management permissions, the `firewallRulesManagement` parameter must be set to `Unmanaged`. If you manage your own firewall rules, you must pre-configure the VPC network and the firewall rules before the installation.


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2026-01-13T20:44:52Z

modules/installation-configuration-parameters.adoc

+|platform:
+  gcp:
+    firewallRulesManagement:
+|Specifies the firewall management policy for the cluster. `Managed` indicates that the firewall rules will be created and destroyed by the cluster. `Unmanaged` indicates that the user should create and destroy the firewall rules. For shared VPC installation, if the installer credential doesn't have firewall rules management permissions, the `firewallRulesManagement` parameter can be absent or set to `Unmanaged`. For non-shared VPC installation, if the installer credential doesn't have firewall rules management permissions, the `firewallRulesManagement` parameter must be set to `Unmanaged`. If you manage your own firewall rules, you must pre-configure the VPC network and the firewall rules before the installation.


🤖 [error] RedHat.TermsErrors: Use 'installation program' rather than 'the installer'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2026-01-13T20:44:55Z

modules/installation-gcp-user-managed-firewall-rules.adoc

+
+If you are installing into an existing VPC, you must enable the `firewallRulesManagement` parameter in your `install-config.yaml` file. If you are installing into a shared VPC, you can either enable the `firewallRulesManagement` parameter, or exclude the `compute.firewalls.create` and `compute.firewalls.delete` permissions, which will indicate to the installation program that you are managing your own firewall rules.
+
+You must create the following firewall rules prior to installation if you want to manage your own firewall rules:


🤖 [error] RedHat.TermsErrors: Use 'before' rather than 'prior to'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2026-01-13T20:44:57Z

modules/installation-gcp-user-managed-firewall-rules.adoc

+`<compute_node_tags>`:: Specifies the network tags that apply to the compute machines in your cluster. These tags must be specified in the `install-config.yaml` file you use to deploy the cluster.
+`<internal_network_cidr>`:: Specifies the network CIDR of the machine network that contains all the machines in your cluster.
+
+After installation, you can reduce the port range of the `ingress-k8s-http-hc` rule to the port that the ingress load balancer service uses, which is not known prior to installation. You can determine the service port by running the following command:


🤖 [error] RedHat.TermsErrors: Use 'before' rather than 'prior to'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2026-01-13T20:44:59Z

modules/minimum-required-permissions-ipi-gcp-xpn.adoc

🤖 [error] AsciiDocDITA.TaskContents: The '.Procedure' block title is missing.

ocpdocs-vale-bot · 2026-01-13T20:45:01Z

modules/minimum-required-permissions-ipi-gcp-xpn.adoc

🤖 [error] AsciiDocDITA.ShortDescription: Assign [role="_abstract"] to a paragraph to use it as in DITA.

ocpdocs-vale-bot · 2026-01-13T20:52:50Z

modules/installation-gcp-user-managed-firewall-rules.adoc

+`<compute_node_tags>`:: Specifies the network tags that apply to the compute machines in your cluster. These tags must be specified in the `install-config.yaml` file you use to deploy the cluster.
+`<internal_network_cidr>`:: Specifies the network CIDR of the machine network that contains all the machines in your cluster.
+
+After installation, you can reduce the port range of the `ingress-k8s-http-hc` and `internal-cluster` rules from `tcp:30000-32767` to the individual port that the ingress load balancer service uses, which is not known prior to installation. You can determine the service port by running the following command after installation:


🤖 [error] RedHat.TermsErrors: Use 'before' rather than 'prior to'. For more information, see RedHat.TermsErrors.

ocpdocs-vale-bot · 2026-01-13T20:52:54Z

modules/minimum-required-permissions-ipi-gcp.adoc

🤖 [error] AsciiDocDITA.ShortDescription: Assign [role="_abstract"] to a paragraph to use it as in DITA.

bscott-rh · 2026-01-14T20:01:38Z

@patrickdillon @jianli-wei Hi Patrick and Jianli, please take a look at this docs PR covering user-managed firewall rules for GCP. This PR adds a new section Managing your own firewall rules to the "configuring a google cloud project" page, as well as modifications to the permissions content and install config parameters table. I will resolve the vale linting errors once the content is ready to go. Thank you

patrickdillon · 2026-01-14T20:05:16Z

cc @barbacbd

modules/installation-gcp-user-managed-firewall-rules.adoc

ocpdocs-vale-bot · 2026-01-15T15:58:44Z

modules/installation-gcp-user-managed-firewall-rules.adoc

+[role="_abstract"]
+You can manage your own firewall rules when installing a cluster on {gcp-short} into an existing VPC by enabling the `firewallRulesManagement` parameter in the `install-config.yaml` file. You can limit the permissions that you grant to the installation program by managing your own firewall rules.
+
+If you want to manage your own firewall rules, you must create the following rules prior to installation:


🤖 [error] RedHat.TermsErrors: Use 'before' rather than 'prior to'. For more information, see RedHat.TermsErrors.

openshift-ci · 2026-01-15T15:58:54Z

@bscott-rh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jianli-wei · 2026-01-16T08:06:02Z

/verified by jiwei

openshift-ci-robot · 2026-01-16T08:06:18Z

@jianli-wei: This PR has been marked as verified by jiwei.

Details

In response to this:

/verified by jiwei

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bscott-rh added the branch/enterprise-4.21 label Jan 13, 2026

openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jan 13, 2026

ocpdocs-vale-bot reviewed Jan 13, 2026

View reviewed changes

OSDOCS-15819 User managed firewall rules for GCP

0c6c4ef

ocpdocs-vale-bot reviewed Jan 13, 2026

View reviewed changes

bscott-rh force-pushed the OSDOCS-15819 branch from e0e9c9a to 0c6c4ef Compare January 13, 2026 20:44

ocpdocs-vale-bot reviewed Jan 13, 2026

View reviewed changes

patrickdillon reviewed Jan 14, 2026

View reviewed changes

modules/installation-gcp-user-managed-firewall-rules.adoc Outdated Show resolved Hide resolved

modules/installation-gcp-user-managed-firewall-rules.adoc Outdated Show resolved Hide resolved

patrickdillon reviewed Jan 14, 2026

View reviewed changes

modules/installation-gcp-user-managed-firewall-rules.adoc Outdated Show resolved Hide resolved

SME review feedback

53075a5

ocpdocs-vale-bot reviewed Jan 15, 2026

View reviewed changes

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jan 16, 2026


		If you are installing into an existing VPC, you must enable the `firewallRulesManagement` parameter in your `install-config.yaml` file. If you are installing into a shared VPC, you can either enable the `firewallRulesManagement` parameter, or exclude the `compute.firewalls.create` and `compute.firewalls.delete` permissions, which will indicate to the installation program that you are managing your own firewall rules.

		You must create the following firewall rules prior to installation if you want to manage your own firewall rules:

OSDOCS-15819 User managed firewall rules for GCP #104757

Are you sure you want to change the base?

OSDOCS-15819 User managed firewall rules for GCP #104757

Uh oh!

Conversation

bscott-rh commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bscott-rh commented Jan 14, 2026

Uh oh!

patrickdillon commented Jan 14, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Jan 15, 2026

Uh oh!

jianli-wei commented Jan 16, 2026

Uh oh!

openshift-ci-robot commented Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

bscott-rh commented Jan 13, 2026 •

edited

Loading

ocpdocs-previewbot commented Jan 13, 2026 •

edited

Loading