docs(gke): detail how to configure workload identity #4373

userbradley · 2024-04-09T10:56:58Z

Description

Updating the GKE workload identity page as per #4362, as the way it works has changed in the past 2 weeks

I have also made the decision to move the workload identity section higher up in the documentation and below is my logic

Google strongly recommend users do not use the default service account, or node service accounts
Google has published a flow chart on this where they recommend they (users) use Workload identity

Fixes #4362

Checklist

Unit tests updated (No code (eg: go) was changed in this PR)
End user documentation updated

Commits signed, and I should have an existing CLA with the CNCF

…tatic credentials or the node service accounts as per googles best practices [noted here](https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys#alternatives) and their [flow diagram](https://cloud.google.com/docs/authentication#auth-decision-tree) where it noted GKE users should use workload identity

k8s-ci-robot · 2024-04-09T10:57:07Z

Welcome @userbradley!

It looks like this is your first PR to kubernetes-sigs/external-dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/external-dns has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2024-04-09T10:57:07Z

Hi @userbradley. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

userbradley · 2024-04-09T10:58:39Z

docs/tutorials/gke.md

@@ -14,7 +14,7 @@ This solution will only work when both CloudDNS and GKE are provisioned in the s

 ### Configure Project Environment

-Setup your environment to work with Google Cloud Platform. Fill in your variables as needed, e.g. target project.
+Set up your environment to work with Google Cloud Platform. Fill in your variables as needed, e.g. target project.


the word set up is used to make arrangements

userbradley · 2024-04-09T10:59:12Z

docs/tutorials/gke.md

+
+You have an option to chose from using the gcloud CLI or using Terraform.
+
+=== "gcloud CLI"


Allows for a tabbed view, users can click gcloud CLI or terraform opposed to a new ### section that could confuse users

I tested it locally. It looks good. Thanks 👍

userbradley · 2024-04-09T11:00:29Z

docs/tutorials/gke.md

+!!! note "Only required if not enabled on all nodes"
+    If you have GKE Workload Identity enabled on all nodes in your cluster, the below step is not necessary 
+


If users have enabled workload identity on the cluster, all nodes should have the metadata API daemon set on them, so I've added this in in case users think they need to do this

userbradley · 2024-04-10T10:02:54Z

@mloiseleur PR is ready for your review please

mloiseleur · 2024-04-10T11:43:18Z

Thanks for providing also Terraform code example.
/lgtm

mloiseleur · 2024-04-10T11:44:05Z

/retitle docs(gke): detail how to configure workload identity

userbradley · 2024-04-11T20:41:33Z

Hey @mloiseleur this is my first time contributing to k8's and I'm a little confused on what's the next steps for my PR?

I'd like to be put down as the SME for the Google GKE docs, but I've got 0 clue what to do next haha.

Appreciate your guidance here

mloiseleur · 2024-04-12T07:12:47Z

@userbradley Don't worry. It will be reviewed by an other maintainer and then, merged.

Raffo · 2024-04-18T15:53:55Z

/approve

k8s-ci-robot · 2024-04-18T15:54:01Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Raffo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Raffo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

userbradley added 2 commits April 9, 2024 11:49

Updating GKE docs on workload identity

9e47e5c

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Apr 9, 2024

k8s-ci-robot requested review from johngmyers and mloiseleur April 9, 2024 10:57

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Apr 9, 2024

userbradley commented Apr 9, 2024

View reviewed changes

k8s-ci-robot assigned mloiseleur Apr 10, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 10, 2024

k8s-ci-robot changed the title ~~[Resolved 4362] Updating Workload Identity page for GKE~~ docs(gke): detail how to configure workload identity Apr 10, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 18, 2024

k8s-ci-robot merged commit de08c4e into kubernetes-sigs:master Apr 18, 2024
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs(gke): detail how to configure workload identity #4373

docs(gke): detail how to configure workload identity #4373

userbradley commented Apr 9, 2024

k8s-ci-robot commented Apr 9, 2024

k8s-ci-robot commented Apr 9, 2024

userbradley Apr 9, 2024

userbradley Apr 9, 2024

mloiseleur Apr 10, 2024

userbradley Apr 9, 2024

userbradley commented Apr 10, 2024

mloiseleur commented Apr 10, 2024

mloiseleur commented Apr 10, 2024

userbradley commented Apr 11, 2024

mloiseleur commented Apr 12, 2024

Raffo commented Apr 18, 2024

k8s-ci-robot commented Apr 18, 2024


		You have an option to chose from using the gcloud CLI or using Terraform.

		=== "gcloud CLI"

		!!! note "Only required if not enabled on all nodes"
		If you have GKE Workload Identity enabled on all nodes in your cluster, the below step is not necessary

docs(gke): detail how to configure workload identity #4373

docs(gke): detail how to configure workload identity #4373

Conversation

userbradley commented Apr 9, 2024

k8s-ci-robot commented Apr 9, 2024

k8s-ci-robot commented Apr 9, 2024

userbradley Apr 9, 2024

Choose a reason for hiding this comment

userbradley Apr 9, 2024

Choose a reason for hiding this comment

mloiseleur Apr 10, 2024

Choose a reason for hiding this comment

userbradley Apr 9, 2024

Choose a reason for hiding this comment

userbradley commented Apr 10, 2024

mloiseleur commented Apr 10, 2024

mloiseleur commented Apr 10, 2024

userbradley commented Apr 11, 2024

mloiseleur commented Apr 12, 2024

Raffo commented Apr 18, 2024

k8s-ci-robot commented Apr 18, 2024