GKE Workload Identity

Google Cloud supports mapping Kubernetes service accounts to Google Cloud IAM service accounts using a feature called Workload Identity Federation.

Objective

Bindplane requires access to Google Pub/Sub when operating in High Availability using a multi-replica Deployment.

Bindplane can authenticate to Pub/Sub using OAuth Scopes or with Workload Identity Federation. This guide will focus on how to configure workload identity.

Prerequisites

You must have access to a Google Kubernetes Engine cluster with workload identity enabled. GKE Autopilot has workload identity enabled by default.

Configuration

Review the Configure applications to use Workload Identity Federation for GKE instructions.

If you deploy Bindplane to a cluster without the Pub/Sub OAUTH scopes, you can expect to see the following error logs:

{
  "level": "error",
  "timestamp": "2024-04-25T18:49:15.243Z",
  "message": "failed to build server during server startup",
  "error": "failed to init eventbus: create topic: check topic: rpc error: code = PermissionDenied desc = User not authorized to perform this action."
}

This is because the Kubernetes service account has not been mapped to IAM.

Kubernetes Service Account

The Bindplane Helm Chart creates service accounts for you. The name of the service account is derived from the name of your Helm deployment.

You can find your service account with kubectl -n <namespace> get sa.

$ kubectl -n default get sa

NAME        SECRETS   AGE
bindplane   0         12m
default     0         19m

$ kubectl -n default get sa bindplane -o yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    meta.helm.sh/release-name: bindplane
    meta.helm.sh/release-namespace: default
  labels:
    app.kubernetes.io/instance: bindplane
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: bindplane
    app.kubernetes.io/stack: bindplane
  name: bindplane
  namespace: default

All pods deployed by the Helm chart will use this service account.

IAM Mapping

Step 4 in Configure applications to use Workload Identity Federation for GKE instructs you to create an IAM policy binding that binds the Kubernetes service account to your project's IAM.

gcloud projects add-iam-policy-binding projects/PROJECT_ID \
    --role=roles/pubsub.admin \
    --member=principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/PROJECT_ID.svc.id.goog/subject/ns/NAMESPACE/sa/KSA_NAME \
    --condition=None

Restart Bindplane

If you previously deployed Bindplane, and the pods are crashing due to Pub/Sub permission errors, restart the pods by deleting them or using the kubectl rollout restart command.

Once the new pods are started, they will not return Pub/Sub errors if the workload identity mapping was successful.

Resources

• Bindplane Helm Chart

• Workload Identity Federation

• Workload Identity How To