GKE Workload Identity
Google Cloud supports mapping Kubernetes service accounts to Google Cloud IAM service accounts using a feature called Workload Identity Federation.
Objective
Bindplane requires access to Google Pub/Sub when operating in High Availability using a multi-replica Deployment.
Bindplane can authenticate to Pub/Sub using OAuth Scopes or with Workload Identity Federation. This guide will focus on how to configure workload identity.
Prerequisites
You must have access to a Google Kubernetes Engine cluster with workload identity enabled. GKE Autopilot has workload identity enabled by default.
Configuration
Review the Configure applications to use Workload Identity Federation for GKE instructions.
If you deploy Bindplane to a cluster without the Pub/Sub OAUTH scopes, you can expect to see the following error logs:
{
"level": "error",
"timestamp": "2024-04-25T18:49:15.243Z",
"message": "failed to build server during server startup",
"error": "failed to init eventbus: create topic: check topic: rpc error: code = PermissionDenied desc = User not authorized to perform this action."
}This is because the Kubernetes service account has not been mapped to IAM.
Kubernetes Service Account
The Bindplane Helm Chart creates service accounts for you. The name of the service account is derived from the name of your Helm deployment.
You can find your service account with kubectl -n <namespace> get sa.
All pods deployed by the Helm chart will use this service account.
IAM Mapping
Step 4 in Configure applications to use Workload Identity Federation for GKE instructs you to create an IAM policy binding that binds the Kubernetes service account to your project's IAM.
Restart Bindplane
If you previously deployed Bindplane, and the pods are crashing due to Pub/Sub permission errors, restart the pods by deleting them or using the kubectl rollout restart command.
Once the new pods are started, they will not return Pub/Sub errors if the workload identity mapping was successful.
Resources
Was this helpful?