Allow serviceaccount from SQLInstance to be referenced in IAM(Partial)Policy(Member)

[wmuizelaar]

Checklist

• I did not find a related open enhancement request.
• I understand that enhancement requests filed in the GitHub repository are by default low priority.
• If this request is time-sensitive, I have submitted a corresponding issue with GCP support.

Describe the feature or resource

Hi,
I would like to be able to reference to the status.serviceAccountEmailAddress fields of an SQLInstance in an IAM policy. This way we can create an IAMPolicy on for example a Storagebucket, so the SQL Instance can write database exports to the bucket.

In the current situation, we need to first deploy the SQLInstance, wait for the status to be filled with the actual value, read that value, craft it into an IAM Policy resource, and apply that.

That's not very declarative - and I would really like this to be declarative as possible.

A possible layout for the adjusted memberFrom part could be:

memberFrom:
  sqlInstanceRef:
    name: <instance-name>
    namespace: <instance-namespace>

just like the existing:

memberFrom:
  serviceAccountRef:
    name: <sa-name>
    namespace: <sa-namespace>

Additional information

No response

Importance

To make the usage of KCC resources fully declarative, this change would be needed.

[jcanseco]

Thanks @wmuizelaar. Agreed on all points.

For now, our recommendation to customers is to use a tool that is able to extract values from resources to set fields in other resources, such as kpt and its apply-time-mutation feature.

Do you think that would work for you? It is currently our best recommendation given that it is not likely we'll be able to develop a native KCC feature to solve this problem any time soon.

[wmuizelaar]

Hey @jcanseco - thanks for replying so quickly!

I'll experiment with kpt's applytime-mutation.

Out of curiosity and to consider: since KCC is now open source - would you be open for a contribution on this kind of feature?

[jcanseco]

No problem @wmuizelaar :)

And thank you for interest in contributing! I would say hold on to your dev cycles for now since we still need to establish a good way to accept contributions (we're working on it). But yes, in the future, we would like to be able to accept such contributions.

[wmuizelaar]

The kpt applytime-mutation works, but only if you run kpt live apply locally. It does not work properly in combination with config sync, as I found out through thid thread: https://kubernetes.slack.com/archives/C0155NSPJSZ/p1658838453136579

[jcanseco]

Gotcha, apologies @wmuizelaar. I just confirmd with the Config Sync and kpt teams that that is true. Is this a blocker for you?

[wleese]

@jcanseco as @wmuizelaar colleague, I can try to provide an answer.

Is this a blocker for you?

As described in the original post, some very common workflows are not possible using KCC, without extra steps.

Config Sync effectively removes some control over the apply-to-cluster process. Without apply-mutation-time support, the KCC + Config Sync combination becomes impossible (as far as I can tell) to use for common use cases out-of-the-box such as CloudSQL with a backup-to-bucket as documented here: https://cloud.google.com/sql/docs/mysql/backup-recovery/scheduling-backups.

Indeed I'd say this is a blocker to using Config Sync and KCC together for our use case.

[jcanseco]

Thank you @wleese. Agreed.

Could you file a separate support case for this request? It would help raise visibility of your use-case and allow us to prioritize accordingly.

[wleese]

@jcanseco , did so. Not sure if it's available to you, but here's the link: https://console.cloud.google.com/support/cases/detail/v2/40462527?project=bolcom-pro

[jcanseco]

Thanks. And no we don't have visibility into support cases by default.

I suggest just mentioning that the product team asked you to create a support case for purposes of tracking, and that the support team can just escalate the case directly to us.

[diviner524]

This is now supported in v1.94.0. Please give it a try and let us know if you see any issues.

[wleese]

Excellent, thanks! This'll take a while to test. We'll get back to you if it doesn't work out for some reason. Thanks again :)