Enable Workload Identity for provider-gcp when running on GKE

[hasheddan]

What problem are you facing?

Currently, credentials for provider-gcp to authenticate to the GCP API are manually provided as a Kubernetes Secret. While this is a viable short-term solution, this post from GCP describes the shortcomings of this technique:

As an application developer, you could generate individual IAM service accounts for each application, and then download and store the keys as a Kubernetes secret that you manually rotate. Not only is this process burdensome, but service account keys only expire every 10 years (or until you manually rotate them). In the case of a breach or compromise, an unaccounted-for key could mean prolonged access for an attacker. This potential blind spot, plus the management overhead of key inventory and rotation, makes using service account keys as secrets a less than ideal method for authenticating GKE workloads.

How could Crossplane help solve your problem?

A more secure method of authentication would be through enabling Workload Identity. While this does enable some manual setup for the time-being, users who are already using the functionality can easily adopt it by annotating the the stack-gcp ServiceAccount with the appropriate Google service account tag (work is being done to make this a more streamlined process here). To enable this within stack-gcp, the Provider should be updated with a useServiceAccount field that can instruct the controllers to authenticate via credentials present in the Pod rather than looking for a Secret.

This is similar to the recent work on stack-aws: crossplane-contrib/provider-aws#126

[hasheddan]

Related: crossplane/crossplane#1098

[nlamirault]

Any news on this feature @turkenh ? It could be nice to configure like that :

---
apiVersion: pkg.crossplane.io/v1alpha1
kind: ControllerConfig
metadata:
  name: crossplane-gcp
  annotations:
    iam.gke.io/gcp-service-account: crossplane@crossplane-test-gcp.iam.gserviceaccount.com
spec:
  podSecurityContext:
    fsGroup: 2000