--- title: Installing the Zero Trust Workload Identity Manager --- # Installing the Zero Trust Workload Identity Manager {#zero-trust-manager-install} Install Zero Trust Workload Identity Manager to help ensure secure communication between your workloads. You can install the Zero Trust Workload Identity Manager by using either the web console or CLI. If you install the Operator into a custom namespace (for example, `my-custom-namespace`), all managed operand resources are deployed within that same namespace. All secrets and ConfigMaps referenced by the Custom Resources (CRs) must also exist in that custom namespace. > [!IMPORTANT] > The Operator installation is not supported in the `openshift-*` namespaces and the `default` namespace. ## Installing the Zero Trust Workload Identity Manager by using the web console {#zero-trust-manager-install-console_zero-trust-manager-install} Use the Software Catalog in the OpenShift Container Platform web console to install the Zero Trust Workload Identity Manager. This process streamlines deployment and helps ensure the Operator is installed in the correct namespace with the appropriate installation mode. > [!NOTE] > A minimum of 1Gi persistent volume is required to install the SPIRE Server. **Prerequisites** - You have access to the cluster with `cluster-admin` privileges. - You have access to the OpenShift Container Platform web console. **Procedure** 1. Log in to the OpenShift Container Platform web console. 2. Go to **Ecosystem** → **Software Catalog**. 3. Search for **Zero Trust Workload Identity Manager**. 4. On the **Install Operator** page: 1. Update the **Update channel**, if necessary. The channel defaults to `stable-v1`, which installs the latest `stable-v1` release of the Zero Trust Workload Identity Manager. 2. Choose the **Installed Namespace** for the Operator. The default Operator namespace is `zero-trust-workload-identity-manager`. If the `zero-trust-workload-identity-manager` namespace does not exist, it is created for you. > [!NOTE] > The Operator and operands are deployed in the same namespace. 3. Select an **Update Approval** strategy - The **Automatic strategy** allows Operator Lifecycle Manager (OLM) to automatically update the Operator when a new version is available. - The **Manual strategy** requires a user with appropriate credentials to approve the Operator update. 5. Click **Install**. **Verification** 1. Navigate to **Ecosystem** → **Installed Operators**. 1. Verify that **Zero Trust Workload Identity Manager** is listed with a **Status** of **Succeeded** in the `zero-trust-workload-identity-manager` namespace. 2. Verify that Zero Trust Workload Identity Manager controller manager deployment is ready and available by running the following command: ```terminal $ oc get deployment -l name=zero-trust-workload-identity-manager -n zero-trust-workload-identity-manager ``` ```terminal {title="Example output"} NAME READY UP-TO-DATE AVAILABLE AGE zero-trust-workload-identity-manager-controller-manager 1/1 1 1 3h36m ``` 2. To check the Operator logs, run the following command: ```terminal $ oc logs -f deployment/zero-trust-workload-identity-manager-controller-manager -n zero-trust-workload-identity-manager ``` ## Installing the Zero Trust Workload Identity Manager by using the CLI {#zero-trust-manager-install-cli_zero-trust-manager-install} Install the Zero Trust Workload Identity Manager by using the command-line interface (CLI) to create the required project, `OperatorGroup`, and `Subscription` objects. You can then deploy the Operator components necessary for managing workload identities on your OpenShift Container Platform cluster. **Prerequisites** - You have access to the cluster with `cluster-admin` privileges. > [!NOTE] > A minimum of 1Gi persistent volume is required to install the SPIRE Server. **Procedure** 1. Create a new project named `zero-trust-workload-identity-manager` by running the following command: ```terminal $ oc new-project zero-trust-workload-identity-manager ``` 2. Create an `OperatorGroup` object: 1. Create a YAML file, for example, `operatorGroup.yaml`, with the following content: ```yaml apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: name: openshift-zero-trust-workload-identity-manager namespace: zero-trust-workload-identity-manager spec: upgradeStrategy: Default ``` 2. Create the `OperatorGroup` object by running the following command: ```terminal $ oc create -f operatorGroup.yaml ``` 3. Create a `Subscription` object: 1. Create a YAML file, for example, `subscription.yaml`, that defines the `Subscription` object: ```yaml apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: openshift-zero-trust-workload-identity-manager namespace: zero-trust-workload-identity-manager spec: channel: stable-v1 name: openshift-zero-trust-workload-identity-manager source: redhat-operators sourceNamespace: openshift-marketplace installPlanApproval: Automatic ``` 2. Create the `Subscription` object by running the following command: ```terminal $ oc create -f subscription.yaml ``` **Verification** - Verify that the OLM subscription is created by running the following command: ```terminal $ oc get subscription -n zero-trust-workload-identity-manager ``` ```terminal {title="Example output"} NAME PACKAGE SOURCE CHANNEL openshift-zero-trust-workload-identity-manager zero-trust-workload-identity-manager redhat-operators stable-v1 ``` - Verify whether the Operator is successfully installed by running the following command: ```terminal $ oc get csv -n zero-trust-workload-identity-manager ``` ```terminal {title="Example output"} NAME DISPLAY VERSION PHASE zero-trust-workload-identity-manager.v1.0.0 Zero Trust Workload Identity Manager 1.0.0 Succeeded ``` - Verify that the Zero Trust Workload Identity Manager controller manager is ready by running the following command: ```terminal $ oc get deployment -l name=zero-trust-workload-identity-manager -n zero-trust-workload-identity-manager ``` ```terminal {title="Example output"} NAME READY UP-TO-DATE AVAILABLE AGE zero-trust-workload-identity-manager-controller-manager 1/1 1 1 43m ```