kubernetes/kops

Feature - Support GCP IAM Roles for Service Accounts

Open

#14,695 opened on 2022年11月30日

GitHub で見る
 (4 comments) (3 reactions) (1 assignee)Go (14,270 stars) (4,389 forks)batch import
area/provider/gcphelp wantedkind/feature

説明

/kind feature

1. Describe IN DETAIL the feature/behavior/change you would like to see. GCP has support for IAM Roles using K8s service accounts, and I think it would be great if kOps could handle configuring this automatically. GKE Workload Identity docs.

kOps already supports AWS IAM Roles for service accounts docs. Example of kOps cluster spec stanza:

spec:
  serviceAccountIssuerDiscovery:
    discoveryStore: s3://publicly-readable-store
    enableAWSOIDCProvider: true

Ideally, I would define a similar stanza for serviceAccountIssuerDiscovery but with GCP specific values

spec:
  serviceAccountIssuerDiscovery:
    discoveryStore: gs://publicly-readable-store
    enableGCPOIDCProvider: true

I've also found gcp-workload-identity-federation-webhook which does the same things as amazon-eks-pod-identity-webhook. Maybe kOps can add that to addons as well.

FR for AWS IAM Role for Service accounts - https://github.com/kubernetes/kops/issues/8264

2. Feel free to provide a design supporting your feature request.

コントリビューターガイド

技術スタック
gogcp
領域
backendcloudsecurity
Issue 種別
feature
難度新しい貢献者にとっての実装難度です。1 は非常に小さな変更、5 は専門的な作業です。
4
推定時間経験ある貢献者が調査、実装、テスト、pull request 準備にかけるおおよその時間範囲です。
over 1 week
活動状況Issue が今どれだけ取り組みやすいかを示します。新しい、活発、古い、ブロック中、またはメンテナー入力待ちなどです。
blocked
明確さ期待される変更、受け入れ条件、次の手順がどれだけ明確かを示します。
mostly clear
前提条件
Knowledge of kOpsGCP IAMKubernetes service accounts
初心者向け度初回貢献者にどれだけ取り組みやすいかを 1-100 で推定したスコアです。
20
調査方針
This issue requests GCP IAM Roles for service accounts, similar to the existing AWS IRSA feature. The current implementation is in the `serviceAccountIssuerDiscovery` config. To start, examine the AWS IRSA code in kOps (e.g., `pkg/...` related to service account discovery). The linked GKE Workload Identity docs and the gcp workload identity federation webhook repository provide reference implementations. The assignee may already have a design in mind; check comments for any updates. The scope involves adding a GCP OIDC provider and potentially a webhook addon.