ComputeBackendService support to reference IAPIdentityAwareProxyClient

[toumorokoshi]

Describe the feature or resource

ComputeBackendService supports iap values, but it does not support a way to link this to the status.secret field of IAPIdentityAwareProxyClient.

It looks like ComputeBackService.spec.iap already provides support for referencing a secret value via iap.oauth2ClientSecret.valueFrom, so this may be better handled by converting IAPIdentityAwareProxyClient.status.secret into a Secret kind.

Importance

Requested by @tonybenchsci in #325.

[jcanseco]

Yes one idea I had is if it would make sense to have IAPIdentityAwareProxyClient emit a Secret that contains the value of status.secret to allow for ComputeBackendService to reference that Secret in spec.iap.oauth2ClientSecret.

However, it seems this alone would not be sufficient since the original request also requests for the ability to set ComputeBackendService's spec.iap.oauth2ClientId using IAPIdentityAwareProxyClient as well. It seems that IAPIdentityAwareProxyClient on GCP contains a clientId on its relative path.

[tonybenchsci]

Could we simply just add another key to status.secret that is the ClientId?
I do like your idea @jcanseco of emitting a k8s secret which is a pattern we use when we need the private key for a IAMServiceAccount

[jcanseco]

Could we simply just add another key to status.secret that is the ClientId?

Yep that is certainly one option we could look into!

[jacek-jablonski]

Hi!
Is it now possible to emit k8s secret? I've got same case as @jcanseco and emitting a secret would solve the problem.

[jcanseco]

Hi @jacek-jablonski, unfortunately we haven't gotten around to delving into this issue quite yet. We'll update this thread accordingly when we get to it.

[lauraseidler]

This would also be great for us. we're not using ComputeBackendService, but BackendConfigs to enable IAP for k8s services. Having a secret we can reference by name would work for this case too.

[lauraseidler]

In case it's helpful for someone else, we worked around this issue using https://github.com/IBM/composable, which allows us to compose resources (in this case, a secret) from fields in other resources:

---
apiVersion: ibmcloud.ibm.com/v1alpha1
kind: Composable
metadata:
  name: my-secret
spec:
  template:
    apiVersion: v1
    kind: Secret
    metadata:
      name: my-secret
    data:
      client_id:
        getValueFrom:
          kind: IAPIdentityAwareProxyClient
          name: my-client
          path: "{.spec.resourceID}"
          format-transformers:
            - StringToBase64
      client_secret:
        getValueFrom:
          kind: IAPIdentityAwareProxyClient
          name: my-client
          path: "{.status.secret}"
          format-transformers:
            - StringToBase64