fix(gcp): Use IAMPolicyMember for workload identity bindings (kubeflo…

…w#1347)

* fix profile controller iam binding

* rename

gcp/v2/cnrm/iam/admin-manages-user-policy.yaml

@@ -0,0 +1,13 @@
+apiVersion: iam.cnrm.cloud.google.com/v1beta1
+kind: IAMPolicyMember
+metadata:
+ name: name-admin-manages-user # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
+spec:
+ member: serviceAccount:[email protected] # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"},{"name":"gcloud.core.project","value":"project-id"}]}}
+ # "roles/serviceAccountAdmin" grants kf-admin service account permission to
+ # manage workload identity binding policies for kf-user service account.
+ role: roles/iam.serviceAccountAdmin
+ resourceRef:
+ apiVersion: iam.cnrm.cloud.google.com/v1beta1
+ kind: IAMServiceAccount
+ name: name-user # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}

gcp/v2/cnrm/iam/kf-admin-policy.yaml

@@ -165,17 +165,3 @@ spec:
  apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
  kind: Project
  external: projects/project-id # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}
----
-apiVersion: iam.cnrm.cloud.google.com/v1beta1
-kind: IAMPolicy
-metadata:
- name: name-admin-workload-identity-users # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
-spec:
- resourceRef:
- apiVersion: iam.cnrm.cloud.google.com/v1beta1
- kind: IAMServiceAccount
- name: name-admin # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
- bindings:
- - role: roles/iam.workloadIdentityUser
- members:
- - serviceAccount:project-id.svc.id.goog[kubeflow/profiles-controller-service-account] # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}

gcp/v2/cnrm/iam/kf-admin-workload-identity-bindings.yaml

@@ -0,0 +1,11 @@
+apiVersion: iam.cnrm.cloud.google.com/v1beta1
+kind: IAMPolicyMember
+metadata:
+ name: name-admin-workload-identity-user # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
+spec:
+ member: serviceAccount:project-id.svc.id.goog[kubeflow/profiles-controller-service-account] # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}
+ role: roles/iam.workloadIdentityUser
+ resourceRef:
+ apiVersion: iam.cnrm.cloud.google.com/v1beta1
+ kind: IAMServiceAccount
+ name: name-admin # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}

gcp/v2/cnrm/iam/kf-user-policy.yaml

@@ -141,19 +141,3 @@ spec:
  apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
  kind: Project
  external: projects/project-id # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}
----
-apiVersion: iam.cnrm.cloud.google.com/v1beta1
-kind: IAMPolicy
-metadata:
- name: name-user-workload-identity-users # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
-spec:
- resourceRef:
- apiVersion: iam.cnrm.cloud.google.com/v1beta1
- kind: IAMServiceAccount
- name: name-user # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
- bindings:
- - role: roles/iam.workloadIdentityUser
- members:
- - serviceAccount:project-id.svc.id.goog[kubeflow/ml-pipeline-ui] # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}
- - serviceAccount:project-id.svc.id.goog[kubeflow/ml-pipeline-visualizationserver] # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}
- - serviceAccount:project-id.svc.id.goog[kubeflow/pipeline-runner] # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}

gcp/v2/cnrm/iam/kf-user-workload-identity-bindings.yaml

@@ -0,0 +1,35 @@
+apiVersion: iam.cnrm.cloud.google.com/v1beta1
+kind: IAMPolicyMember
+metadata:
+ name: name-user-workload-identity-user-ml-pipeline-ui # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
+spec:
+ member: serviceAccount:project-id.svc.id.goog[kubeflow/ml-pipeline-ui] # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}
+ role: roles/iam.workloadIdentityUser
+ resourceRef:
+ apiVersion: iam.cnrm.cloud.google.com/v1beta1
+ kind: IAMServiceAccount
+ name: name-user # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
+---
+apiVersion: iam.cnrm.cloud.google.com/v1beta1
+kind: IAMPolicyMember
+metadata:
+ name: name-user-workload-identity-user-ml-pipeline-visualizationserver # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
+spec:
+ member: serviceAccount:project-id.svc.id.goog[kubeflow/ml-pipeline-visualizationserver] # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}
+ role: roles/iam.workloadIdentityUser
+ resourceRef:
+ apiVersion: iam.cnrm.cloud.google.com/v1beta1
+ kind: IAMServiceAccount
+ name: name-user # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
+---
+apiVersion: iam.cnrm.cloud.google.com/v1beta1
+kind: IAMPolicyMember
+metadata:
+ name: name-user-workload-identity-user-pipeline-runner # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}
+spec:
+ member: serviceAccount:project-id.svc.id.goog[kubeflow/pipeline-runner] # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"gcloud.core.project","value":"project-id"}]}}
+ role: roles/iam.workloadIdentityUser
+ resourceRef:
+ apiVersion: iam.cnrm.cloud.google.com/v1beta1
+ kind: IAMServiceAccount
+ name: name-user # {"type":"string","x-kustomize":{"setBy":"kpt","partialSetters":[{"name":"name","value":"name"}]}}

gcp/v2/cnrm/iam/kustomization.yaml

@@ -5,3 +5,6 @@ resources:
 - kf-admin-sa.yaml
 - kf-user-policy.yaml
 - kf-user-sa.yaml
+- kf-admin-workload-identity-bindings.yaml
+- kf-user-workload-identity-bindings.yaml
+- admin-manages-user-policy.yaml