Skip to content

Commit 4f90210

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #1504 from salasberryfin/feat-support-workload-identity
feat: add fields to support workload identity & binary authorization
2 parents 993f7ee + 4e497c7 commit 4f90210

File tree

6 files changed

+184
-0
lines changed

6 files changed

+184
-0
lines changed

‎cloud/services/container/clusters/reconcile.go‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,15 +267,20 @@ func (s *Service) createCluster(ctx context.Context, log *logr.Logger) error {
267267
ReleaseChannel: &containerpb.ReleaseChannel{
268268
Channel: convertToSdkReleaseChannel(s.scope.GCPManagedControlPlane.Spec.ReleaseChannel),
269269
},
270+
BinaryAuthorization: &containerpb.BinaryAuthorization{
271+
EvaluationMode: convertToSdkBinaryAuthorizationEvaluationMode(s.scope.GCPManagedControlPlane.Spec.BinaryAuthorization),
272+
},
270273
ControlPlaneEndpointsConfig: &containerpb.ControlPlaneEndpointsConfig{
271274
IpEndpointsConfig: &containerpb.ControlPlaneEndpointsConfig_IPEndpointsConfig{
272275
AuthorizedNetworksConfig: convertToSdkMasterAuthorizedNetworksConfig(s.scope.GCPManagedControlPlane.Spec.MasterAuthorizedNetworksConfig),
273276
},
274277
},
275278
}
279+
276280
if initialClusterVersionFromSpec := s.scope.GetControlPlaneVersion(); initialClusterVersionFromSpec != nil {
277281
cluster.InitialClusterVersion = convertToSdkMasterVersion(*initialClusterVersionFromSpec)
278282
}
283+
279284
if s.scope.GCPManagedControlPlane.Spec.ClusterNetwork != nil {
280285
cn := s.scope.GCPManagedControlPlane.Spec.ClusterNetwork
281286
if cn.UseIPAliases {
@@ -284,16 +289,19 @@ func (s *Service) createCluster(ctx context.Context, log *logr.Logger) error {
284289
cluster.IpAllocationPolicy.ClusterIpv4CidrBlock = cn.Pod.CidrBlock
285290
cluster.IpAllocationPolicy.ServicesIpv4CidrBlock = cn.Service.CidrBlock
286291
}
292+
287293
if cn.PrivateCluster != nil {
288294
cluster.PrivateClusterConfig = &containerpb.PrivateClusterConfig{}
289295

290296
enablePublicEndpoint := !cn.PrivateCluster.EnablePrivateEndpoint
291297
cluster.ControlPlaneEndpointsConfig.IpEndpointsConfig.EnablePublicEndpoint = &enablePublicEndpoint
298+
292299
if cn.PrivateCluster.EnablePrivateEndpoint {
293300
cluster.ControlPlaneEndpointsConfig.IpEndpointsConfig.AuthorizedNetworksConfig = &containerpb.MasterAuthorizedNetworksConfig{
294301
Enabled: true,
295302
}
296303
}
304+
297305
cluster.NetworkConfig.DefaultEnablePrivateNodes = &cn.PrivateCluster.EnablePrivateNodes
298306

299307
cluster.PrivateClusterConfig.MasterIpv4CidrBlock = cn.PrivateCluster.ControlPlaneCidrBlock
@@ -306,16 +314,35 @@ func (s *Service) createCluster(ctx context.Context, log *logr.Logger) error {
306314
}
307315
}
308316
}
317+
309318
if !s.scope.IsAutopilotCluster() {
310319
cluster.NodePools = scope.ConvertToSdkNodePools(nodePools, machinePools, isRegional, cluster.GetName())
320+
311321
if s.scope.GCPManagedControlPlane.Spec.LoggingService != nil {
312322
cluster.LoggingService = s.scope.GCPManagedControlPlane.Spec.LoggingService.String()
313323
}
324+
314325
if s.scope.GCPManagedControlPlane.Spec.MonitoringService != nil {
315326
cluster.MonitoringService = s.scope.GCPManagedControlPlane.Spec.MonitoringService.String()
316327
}
317328
}
318329

330+
if s.scope.GCPManagedControlPlane.Spec.ClusterSecurity != nil {
331+
cs := s.scope.GCPManagedControlPlane.Spec.ClusterSecurity
332+
if cs.WorkloadIdentityConfig != nil {
333+
cluster.WorkloadIdentityConfig = &containerpb.WorkloadIdentityConfig{
334+
WorkloadPool: cs.WorkloadIdentityConfig.WorkloadPool,
335+
}
336+
}
337+
338+
if cs.AuthenticatorGroupConfig != nil {
339+
cluster.AuthenticatorGroupsConfig = &containerpb.AuthenticatorGroupsConfig{
340+
Enabled: true,
341+
SecurityGroup: cs.AuthenticatorGroupConfig.SecurityGroups,
342+
}
343+
}
344+
}
345+
319346
createClusterRequest := &containerpb.CreateClusterRequest{
320347
Cluster: cluster,
321348
Parent: s.scope.ClusterLocation(),
@@ -425,6 +452,22 @@ func convertToSdkMasterAuthorizedNetworksConfig(config *infrav1exp.MasterAuthori
425452
}
426453
}
427454

455+
// convertToSdkBinaryAuthorizationEvaluationMode converts the BinaryAuthorization string to the SDK int32 value.
456+
func convertToSdkBinaryAuthorizationEvaluationMode(mode *infrav1exp.BinaryAuthorization) containerpb.BinaryAuthorization_EvaluationMode {
457+
if mode == nil {
458+
return containerpb.BinaryAuthorization_EVALUATION_MODE_UNSPECIFIED
459+
}
460+
461+
switch *mode {
462+
case infrav1exp.EvaluationModeDisabled:
463+
return containerpb.BinaryAuthorization_DISABLED
464+
case infrav1exp.EvaluationModeProjectSingletonPolicyEnforce:
465+
return containerpb.BinaryAuthorization_PROJECT_SINGLETON_POLICY_ENFORCE
466+
default:
467+
return containerpb.BinaryAuthorization_EVALUATION_MODE_UNSPECIFIED
468+
}
469+
}
470+
428471
func (s *Service) checkDiffAndPrepareUpdate(existingCluster *containerpb.Cluster, log *logr.Logger) (bool, *containerpb.UpdateClusterRequest) {
429472
log.V(4).Info("Checking diff and preparing update.")
430473

‎config/crd/bases/infrastructure.cluster.x-k8s.io_gcpmanagedcontrolplanes.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,14 @@ spec:
6666
spec:
6767
description: GCPManagedControlPlaneSpec defines the desired state of GCPManagedControlPlane.
6868
properties:
69+
binaryAuthorization:
70+
description: |-
71+
BinaryAuthorization represents the mode of operation of Binary Authorization for the GKE cluster.
72+
This feature is disabled if this field is not specified.
73+
enum:
74+
- disabled
75+
- project_singleton_policy_enforce
76+
type: string
6977
clusterName:
7078
description: |-
7179
ClusterName allows you to specify the name of the GKE cluster.
@@ -132,6 +140,34 @@ spec:
132140
pod IPs in the cluster.
133141
type: boolean
134142
type: object
143+
clusterSecurity:
144+
description: ClusterSecurity defines the cluster security.
145+
properties:
146+
authenticatorGroupConfig:
147+
description: AuthenticatorGroupConfig is RBAC security group for
148+
use with Google security groups in Kubernetes RBAC.
149+
properties:
150+
securityGroups:
151+
description: SecurityGroups is the name of the security group-of-groups
152+
to be used.
153+
type: string
154+
required:
155+
- securityGroups
156+
type: object
157+
workloadIdentityConfig:
158+
description: |-
159+
WorkloadIdentityConfig allows workloads in your GKE clusters to impersonate Identity and Access Management (IAM)
160+
service accounts to access Google Cloud services
161+
properties:
162+
workloadPool:
163+
description: |-
164+
WorkloadPool is the workload pool to attach all Kubernetes service accounts to Google Cloud services.
165+
Only relevant when enabled is true
166+
type: string
167+
required:
168+
- workloadPool
169+
type: object
170+
type: object
135171
controlPlaneVersion:
136172
description: |-
137173
ControlPlaneVersion represents the control plane version of the GKE cluster.

‎config/crd/bases/infrastructure.cluster.x-k8s.io_gcpmanagedcontrolplanetemplates.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,14 @@ spec:
5353
description: GCPManagedControlPlaneTemplateResourceSpec specifies
5454
an GCP managed control plane template resource.
5555
properties:
56+
binaryAuthorization:
57+
description: |-
58+
BinaryAuthorization represents the mode of operation of Binary Authorization for the GKE cluster.
59+
This feature is disabled if this field is not specified.
60+
enum:
61+
- disabled
62+
- project_singleton_policy_enforce
63+
type: string
5664
clusterNetwork:
5765
description: ClusterNetwork define the cluster network.
5866
properties:
@@ -115,6 +123,35 @@ spec:
115123
pod IPs in the cluster.
116124
type: boolean
117125
type: object
126+
clusterSecurity:
127+
description: ClusterSecurity defines the cluster security.
128+
properties:
129+
authenticatorGroupConfig:
130+
description: AuthenticatorGroupConfig is RBAC security
131+
group for use with Google security groups in Kubernetes
132+
RBAC.
133+
properties:
134+
securityGroups:
135+
description: SecurityGroups is the name of the security
136+
group-of-groups to be used.
137+
type: string
138+
required:
139+
- securityGroups
140+
type: object
141+
workloadIdentityConfig:
142+
description: |-
143+
WorkloadIdentityConfig allows workloads in your GKE clusters to impersonate Identity and Access Management (IAM)
144+
service accounts to access Google Cloud services
145+
properties:
146+
workloadPool:
147+
description: |-
148+
WorkloadPool is the workload pool to attach all Kubernetes service accounts to Google Cloud services.
149+
Only relevant when enabled is true
150+
type: string
151+
required:
152+
- workloadPool
153+
type: object
154+
type: object
118155
enableAutopilot:
119156
description: EnableAutopilot indicates whether to enable autopilot
120157
for this GKE cluster.

‎exp/api/v1beta1/gcpmanagedcontrolplane_types.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,30 @@ type AuthenticatorGroupConfig struct {
113113
SecurityGroups string `json:"securityGroups,omitempty"`
114114
}
115115

116+
// BinaryAuthorization is the Binary Authorization evaluation mode of the GKE cluster
117+
// +kubebuilder:validation:Enum=disabled;project_singleton_policy_enforce
118+
type BinaryAuthorization string
119+
120+
const (
121+
// EvaluationModeDisabled disables BinaryAuthorization.
122+
EvaluationModeDisabled BinaryAuthorization = "disabled"
123+
// EvaluationModeProjectSingletonPolicyEnforce enforces Kubernetes admission requests with BinaryAuthorization using the
124+
// project's singleton policy. This is equivalent to setting the
125+
EvaluationModeProjectSingletonPolicyEnforce BinaryAuthorization = "project_singleton_policy_enforce"
126+
)
127+
128+
// ClusterSecurity defines the cluster security options.
129+
type ClusterSecurity struct {
130+
// WorkloadIdentityConfig allows workloads in your GKE clusters to impersonate Identity and Access Management (IAM)
131+
// service accounts to access Google Cloud services
132+
// +optional
133+
WorkloadIdentityConfig *WorkloadIdentityConfig `json:"workloadIdentityConfig,omitempty"`
134+
135+
// AuthenticatorGroupConfig is RBAC security group for use with Google security groups in Kubernetes RBAC.
136+
// +optional
137+
AuthenticatorGroupConfig *AuthenticatorGroupConfig `json:"authenticatorGroupConfig,omitempty"`
138+
}
139+
116140
// GCPManagedControlPlaneSpec defines the desired state of GCPManagedControlPlane.
117141
type GCPManagedControlPlaneSpec struct {
118142
GCPManagedControlPlaneClassSpec `json:",inline"`

‎exp/api/v1beta1/types_class.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ type GCPManagedControlPlaneClassSpec struct {
3131
// +optional
3232
ClusterNetwork *ClusterNetwork `json:"clusterNetwork,omitempty"`
3333

34+
// ClusterSecurity defines the cluster security.
35+
// +optional
36+
ClusterSecurity *ClusterSecurity `json:"clusterSecurity,omitempty"`
37+
3438
// Project is the name of the project to deploy the cluster to.
3539
Project string `json:"project"`
3640

@@ -50,6 +54,11 @@ type GCPManagedControlPlaneClassSpec struct {
5054
// +optional
5155
ReleaseChannel *ReleaseChannel `json:"releaseChannel,omitempty"`
5256

57+
// BinaryAuthorization represents the mode of operation of Binary Authorization for the GKE cluster.
58+
// This feature is disabled if this field is not specified.
59+
// +optional
60+
BinaryAuthorization *BinaryAuthorization `json:"binaryAuthorization,omitempty"`
61+
5362
// MasterAuthorizedNetworksConfig represents configuration options for master authorized networks feature of the GKE cluster.
5463
// This feature is disabled if this field is not specified.
5564
// +optional

‎exp/api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 35 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)