Gcp Service Account Controller
this controller manges gcp service account over kubernetes resources.
The Helm chart can be found in the Kiwigrid helm repo. Add it via:
helm repo add kiwigrid https://kiwigrid.github.ioThe Helm charts source can be found at:
https://github.com/kiwigrid/helm-charts/tree/master/charts/gcp-serviceaccount-controller
Features
- creates gcp service accounts and creates secrets from the service account keyfile
- handles the full lifecycle of a service account via CRD
- keyfiles are only exists inside kubernetes and not saved outside
- with version 0.2.0 you can restrict enabled roles per namespace via regular expressions (this feature is enabled by default; can be disabled with
DISABLE_RESTRICTION_CHECK)
Deployment
First you need to create a GCP service account with at least the following permissions:
- iam.serviceAccounts.create
- iam.serviceAccounts.delete
- iam.serviceAccounts.get
- iam.serviceAccounts.list
- iam.serviceAccounts.update
- iam.serviceAccountKeys.create
- iam.serviceAccountKeys.delete
- iam.serviceAccountKeys.get
- iam.serviceAccountKeys.list
- pubsub.subscriptions.getIamPolicy
- pubsub.subscriptions.setIamPolicy
- pubsub.topics.getIamPolicy
- pubsub.topics.setIamPolicy
- storage.buckets.getIamPolicy
- storage.buckets.setIamPolicy
- resourcemanager.projects.getIamPolicy
- resourcemanager.projects.setIamPolicyYou can use the helm chart to deploy
Then add the base64 encoded file to the gcpCredentials value.
helm upgrade -i -f <YOUR_VALUES_FILE> <RELEASE_NAME> helm/Example
This is an example resource definition for a service account:
apiVersion: gcp.kiwigrid.com/v1beta1
kind: GcpServiceAccount
metadata:
name: gcpserviceaccount-sample
spec:
serviceAccountIdentifier: kube-example
serviceAccountDescription: kube-example
secretName: kube-example-secret
bindings:
- resource: "//cloudresourcemanager.googleapis.com/projects/<PROJECT_NAME>"
roles:
- "roles/cloudsql.editor"Example for buckets:
apiVersion: gcp.kiwigrid.com/v1beta1
kind: GcpServiceAccount
metadata:
name: gcpserviceaccount-bucket-sample
spec:
serviceAccountIdentifier: kube-bucket-example
serviceAccountDescription: kube-bucket-example
secretName: kube-bucket-example-secret
bindings:
- resource: buckets/my-bucket-name
roles:
- roles/storage.objectAdminExample for namespace restriction:
apiVersion: gcp.kiwigrid.com/v1beta1
kind: GcpNamespaceRestriction
metadata:
labels:
name: gcpnamespacerestriction-sample
spec:
namespace: test
regex: true
restrictions:
- resource: "^buckets/my-bucket-name$"
roles:
- "^roles/storage\.objectAdmin$"
- resource: "^pubsub/.*$"
roles:
- "^roles/.*$"