Gke service account generator

[natasha41575]

This PR implements a generator for GKE service accounts.

It is based on the resource in step 6 of "Authenticating to Google Cloud" here: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#yaml

ALLOW_MODULE_SPAN

[max-sixty]

@natasha41575 asked me to comment in kubernetes-sigs/cli-experimental#158

One issue we face is that GKE service accounts are a resource that requires the project, which isn't known until the final aggregation of manifests. So I think this solves that well, because the project can be patched in once at the final aggregation.

It doesn't solve the general problem though, IIUC; here's another example: GoogleCloudPlatform/k8s-config-connector#271. (this is no longer be an issue for us, since we don't use the tool, though we'd like to at some point)

There are also a couple of other areas where we'd like to be able to patch arbitrary strings; to the extent that's possible without complicating the very nice abstractions that kustomize offers.

[natasha41575]

@monopole had a chat with about this with @justinsb offline. Will summarize the convo in a doc tomorrow and we can discuss

[monopole]

this is going to be very useful!

[monopole]

I'd say put all the effort into the filter test for now.

and/or drive this via the generators field e.g.

• chartinflatorplugin_test.go
• inlinetransformer_test.go

[KnVerey]

Given that this is cloud-provider-specific, does it need to be a top-level field, or could we make it generators-only? Is there a need for a similar generator for other cloud providers? Are the inputs required similar enough to share an abstraction? If not will we accept a bunch of top-level fields?

[natasha41575]

@KnVerey had a chat with @monopole this morning. We are thinking having one top level field that has an option like cloud: gke to tell us which cloud provider to generate for. When we want to have something for other cloud providers, we can add more options to this generator.

[natasha41575]

@monopole I've updated this PR based on your comments

I would like to update this generator to add GKE resources such as IAMServiceAccount and IAMPolicyMember in a follow-up PR.

[monopole]

/lgtm

great start!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: monopole, natasha41575

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [monopole,natasha41575]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment