Workload identity not working with spinnaker about spinnaker-for-gcp HOT 7 CLOSED

For starters, we can document the steps we've taken to verify it works. If that all goes smoothly, scripting those steps shouldn't be too much additional work.

from spinnaker-for-gcp.

Thanks for raising this, Adam!

A quick question to clarify: are we talking about using the identity attached to the clouddriver pod (via Workload Identity) as the credential that is used to deploy to other clusters? Or do you have something different in mind here?

from spinnaker-for-gcp.

Yeah, that exactly. It's much more secure than storing a secret, but I also understand that it's very gke specific. Not sure if spinnaker wants to go down the route of supporting gke only kubernetes features

from spinnaker-for-gcp.

@duftler FYI ^^

from spinnaker-for-gcp.

These are the rough steps that will be required to make Spinnaker for GCP work with Workload Identity:

• Add newer google auth library to kork: spinnaker/kork#390
• Update each service to match the changes that were made to front50 here (thanks for doing all the digging on this, @adamdavis40208 ): spinnaker/front50#605
• Add logic to Spinnaker for GCP to:
  • Enable workload identity on the cluster
  • Create "Spinnaker service"-specific Kubernetes service accounts
  • Create "Spinnaker service"-specific Google service accounts
  • Create GCP IAM bindings between the pairs of service accounts
  • Annotate each Kubernetes service account, telling it which Google service account to use when calling GCP api's
  • Modify each service's pod spec to specify the appropriate Kubernetes service account (have verified that halyard will allow for the service accounts to be specified via configuration: spinnaker/halyard#1450)

from spinnaker-for-gcp.

Thanks for the investigation, @duftler! It looks like the first two items will require changes to Spinnaker OSS; once that's done, is there a way for users to run through the remaining steps "by hand" to validate this approach before we consider how to automate this?

from spinnaker-for-gcp.

This PR adds an experimental script that will enable workload identity: #142

from spinnaker-for-gcp.