Add multi-tenant workload identity support for GCP Bucket #1862
Conversation
Signed-off-by: cappyzawa <cappyzawa@gmail.com>
| @@ -15,6 +15,7 @@ rules: | |||
| - "" | |||
| resources: | |||
| - secrets | |||
| - serviceaccounts | |||
There was a problem hiding this comment.
I assume this change is auto-generated due to the following?
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch
| The `gcp` provider can be used to authenticate automatically using OAuth scopes | ||
| or Workload Identity, and by extension gain access to Google Cloud Storage. |
There was a problem hiding this comment.
| The `gcp` provider can be used to authenticate automatically using OAuth scopes | |
| or Workload Identity, and by extension gain access to Google Cloud Storage. | |
| The `gcp` provider can be used to authenticate automatically using Workload Identity, | |
| and by extension gain access to Google Cloud Storage. |
I'd not mention OAuth scopes anywhere in these docs, they're kind of a very negligible implementation detail, we don't even use specific scopes per service in the implementation, we actually use a single wildcard scope for all of them:
https://www.googleapis.com/auth/cloud-platform
| name: source-controller | ||
| ``` | ||
|
|
||
| The Google Cloud Storage service uses the permission `storage.objects.get` |
There was a problem hiding this comment.
We can just point here: https://fluxcd.io/flux/integrations/gcp/#for-google-cloud-storage
| be enabled. Add the following environment variable to the source-controller | ||
| deployment: | ||
|
|
||
| ```yaml | ||
| env: | ||
| - name: ENABLE_OBJECT_LEVEL_WORKLOAD_IDENTITY | ||
| value: "true" | ||
| ``` |
There was a problem hiding this comment.
Let's remove this, the environment variable is set automatically by the controller main() when the feature gate is enabled (auth.EnableObjectLevelWorkloadIdentity()):
Lines 179 to 185 in c2b572b
| @@ -590,6 +607,12 @@ func (r *BucketReconciler) reconcileDelete(ctx context.Context, obj *sourcev1.Bu | |||
| // Remove our finalizer from the list | |||
| controllerutil.RemoveFinalizer(obj, sourcev1.SourceFinalizer) | |||
|
|
|||
| // Cleanup caches. | |||
| if r.TokenCache != nil { | |||
There was a problem hiding this comment.
There's already a guard inside .DeleteEventsForObject() 👍 We can remove this if like in all other controllers
| @@ -430,6 +435,18 @@ func (r *BucketReconciler) reconcileStorage(ctx context.Context, sp *patch.Seria | |||
| // the provider. If this fails, it records v1.FetchFailedCondition=True on | |||
| // the object and returns early. | |||
| func (r *BucketReconciler) reconcileSource(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.Bucket, index *index.Digester, dir string) (sreconcile.Result, error) { | |||
| usesObjectLevelWorkloadIdentity := obj.Spec.Provider != sourcev1.BucketProviderGeneric && obj.Spec.SecretRef == nil && obj.Spec.ServiceAccountName != "" | |||
There was a problem hiding this comment.
| usesObjectLevelWorkloadIdentity := obj.Spec.Provider != sourcev1.BucketProviderGeneric && obj.Spec.SecretRef == nil && obj.Spec.ServiceAccountName != "" | |
| usesObjectLevelWorkloadIdentity := obj.Spec.Provider != "" && obj.Spec.Provider != sourcev1.BucketProviderGeneric && obj.Spec.ServiceAccountName != "" |
| httpClient, err := o.newCustomHTTPClient(ctx, o) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| clientOpts = append(clientOpts, option.WithHTTPClient(httpClient)) | ||
| case len(o.authOpts) > 0: | ||
| // Object-level workload identity: Create TokenSource using auth options |
There was a problem hiding this comment.
| // Object-level workload identity: Create TokenSource using auth options | |
| // Workload identity: Create TokenSource using auth options |
| httpClient, err := o.newCustomHTTPClient(ctx, o) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| clientOpts = append(clientOpts, option.WithHTTPClient(httpClient)) | ||
| case len(o.authOpts) > 0: |
There was a problem hiding this comment.
| case len(o.authOpts) > 0: | |
| default: |
If .spec.provider is gcp and .spec.secretRef is not set, we should use the auth package logic
| // No explicit authentication - controller-level workload identity uses Application Default Credentials | ||
| // TODO: https://github.com/fluxcd/flux2/issues/5465 will add lockdown support to prevent unintended usage of this fallback |
There was a problem hiding this comment.
| // No explicit authentication - controller-level workload identity uses Application Default Credentials | |
| // TODO: https://github.com/fluxcd/flux2/issues/5465 will add lockdown support to prevent unintended usage of this fallback |
See the default: case comment above
xref: fluxcd/flux2#5022