GCP IAP: Create OAuth clients for IAP programmatically

GoogleCloudPlatform / kubeflow-distribution

Blueprints for Deploying Kubeflow on Google Cloud Platform and Anthos

Apache License 2.0

75 stars 63 forks source link

Open kunmingg opened 4 years ago

kunmingg commented 4 years ago

Currently GCP users need to setup IAP client manually: https://www.kubeflow.org/docs/gke/deploy/oauth-setup/

Since IAP API is now GA: https://cloud.google.com/iap/docs/programmatic-oauth-clients kfctl should create OAuth clients for IAP programmatically when env var like CLIENT_ID is not set.

issue-label-bot[bot] commented 4 years ago

Issue-Label Bot is automatically applying the labels:

Label	Probability
kind/feature	0.72

Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback! Links: app homepage, dashboard and code for this bot.

schmidt-jake commented 4 years ago

This would be great.

issue-label-bot[bot] commented 4 years ago

Issue-Label Bot is automatically applying the labels:

Label	Probability
platform/gcp	1.00

Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback! Links: app homepage, dashboard and code for this bot.

issue-label-bot[bot] commented 4 years ago

Issue-Label Bot is automatically applying the labels:

Label	Probability
platform/gcp	1.00
kind/feature	0.96

Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback! Links: app homepage, dashboard and code for this bot.

jlewi commented 4 years ago

I think the issue here is that we use GKE's BackendConfig to enable IAP. Currently, that requires a client id/client secret in order to setup IAP.

So I think we need GKE's BackendConfig to support setting up IAP using programmatic OAuth clients