Mengaktifkan IAP untuk GKE

Halaman ini menjelaskan cara mengamankan instance Google Kubernetes Engine (GKE) dengan Identity-Aware Proxy (IAP).

Ringkasan

IAP terintegrasi melalui Ingress untuk GKE. Integrasi ini memungkinkan Anda mengontrol akses tingkat resource untuk karyawan, bukan menggunakan VPN.

Di cluster GKE, traffic masuk ditangani oleh Load Balancing HTTP(S), komponen dari Cloud Load Balancing. Load balancer HTTP(S) biasanya dikonfigurasi oleh pengontrol Kubernetes Ingress. Pengontrol Ingress mendapatkan informasi konfigurasi dari objek Ingress Kubernetes yang dikaitkan dengan satu atau beberapa objek Layanan. Setiap objek Layanan menyimpan informasi pemilihan rute yang digunakan untuk mengarahkan permintaan masuk ke Pod dan port tertentu.

Mulai Kubernetes versi 1.10.5-gke.3, Anda dapat menambahkan konfigurasi untuk load balancer dengan mengaitkan Layanan dengan objek BackendConfig. BackendConfig adalah definisi resource kustom (CRD) yang ditentukan di repositori kubernetes/ingress-gce.

Pengontrol Ingress Kubernetes membaca informasi konfigurasi dari BackendConfig dan menyiapkan load balancer yang sesuai. BackendConfig menyimpan informasi konfigurasi yang khusus untuk Cloud Load Balancing, dan memungkinkan Anda menentukan konfigurasi terpisah untuk setiap layanan backend Load Balancing HTTP(S).

Sebelum memulai

Untuk mengaktifkan IAP untuk GKE, Anda memerlukan hal berikut:

• Project konsol Google Cloud yang mengaktifkan penagihan.
• Grup satu atau beberapa instance GKE, yang ditayangkan oleh load balancer HTTPS. Load balancer akan dibuat secara otomatis saat Anda membuat objek Ingress di cluster GKE.
  • Pelajari cara membuat Ingress untuk HTTPS.
• Nama domain yang terdaftar ke alamat load balancer Anda.
• Kode aplikasi untuk memverifikasi bahwa semua permintaan memiliki identitas.
  • Pelajari cara mendapatkan identitas pengguna.

Mengaktifkan IAP

If you haven't configured your project's OAuth consent screen, you'll be prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen.

Setting up IAP access

1. Go to the Identity-Aware Proxy page.
   Go to the Identity-Aware Proxy page
2. Select the project you want to secure with IAP.

3. Select the checkbox next to the resource you want to grant access to.

   If you don't see a resource, ensure that the resource is created and that the BackendConfig Compute Engine ingress controller is synced.

   To verify that the backend service is available, run the following gcloud command:

   gcloud compute backend-services list
4. On the right side panel, click Add principal.
5. In the Add principals dialog that appears, enter the email addresses of groups or individuals who should have the IAP-secured Web App User role for the project.

   The following kinds of principals can have this role:

   • Google Account: [e-mail]
   • Google Group: [e-mail]
   • Service account: [e-mail]
   • Google Workspace domain: example.com

   Make sure to add a Google Account that you have access to.

6. Select Cloud IAP > IAP-secured Web App User from the Roles drop-down list.
7. Click Save.

Configuring BackendConfig

To configure BackendConfig for IAP, create a Kubernetes Secret and then add an iap block to the BackendConfig.

Creating a Kubernetes Secret

The BackendConfig uses a Kubernetes Secret to wrap the OAuth client you created earlier. Kubernetes Secrets are managed like other Kubernetes objects by using the kubectl command-line interface (CLI). To create a Secret, run the following command where client_id_key and client_secret_key are the keys from the JSON file you downloaded when you created OAuth credentials:

kubectl create secret generic my-secret --from-literal=client_id=client_id_key \
    --from-literal=client_secret=client_secret_key

The preceding command displays output to confirm when the Secret is successfully created:

secret "my-secret" created

Adding an iap block to the BackendConfig

To configure the BackendConfig for IAP, you need to specify the enabled and secretName values. To specify these values, ensure that you have the compute.backendServices.update permission and add the iap block to BackendConfig. In this block, my-secret is the Kubernetes Secret name you created previously:

Note: You can't enable both IAP and Cloud CDN (Cloud CDN) in a BackendConfig. If the BackendConfig doesn't have a IAP block, then any existing IAP settings on the backend service are inherited.

For GKE versions 1.16.8-gke.3 and higher, use the `cloud.google.com/v1` API version. If you are using an earlier GKE version, use `cloud.google.com/v1beta1`.

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: config-default
  namespace: my-namespace
spec:
  iap:
    enabled: true
    oauthclientCredentials:
      secretName: my-secret

You also need to associate Service ports with your BackendConfig to trigger turning on IAP. One way to make this association is to make all ports for the service default to your BackendConfig, which you can do by adding the following annotation to your Service resource:

metadata:
  annotations:
    beta.cloud.google.com/backend-config: '{"default": "config-default"}'

To test the configuration, run kubectl get event. If you see the message "no BackendConfig for service port exists", then you successfully associated a service port with your BackendConfig, but the BackendConfig resource wasn't found. This error can occur if you haven't created the BackendConfig resource, created it in the wrong namespace, or misspelled the reference in the Service annotation.

Note: IAP adds the gcp-iap-mode=AUTHENTICATING query parameter to the redirected request that occurs after OAuth authentication, so be sure to check your ingress load balancer's routing configuration to ensure that redirected requests are going to the correct backend service after a user authenticates through OAuth.

If the secretName you referenced doesn't exist or isn't structured properly, one of the following error messages will display:

• BackendConfig default/config-default is not valid: error retrieving secret "foo": secrets "foo" not found. To resolve this error, make sure that you've created the Kubernetes Secret correctly as described in the previous section.
• BackendConfig default/config-default is not valid: secret "foo" missing client_secret data. To resolve this error, make sure that you've created the OAuth credentials correctly. Also, make sure that you referenced the correct client_id and client_secret keys in the JSON you downloaded previously.

When the enabled flag is set to true and the secretName is correctly set, IAP is configured for your selected resource.

Note: You might get an `Add firewall rule` warning message on the IAP configuration page for network endpoint group (NEG) based backends even though the correct firewall rule exists. The firewall rule warning is informational and can be safely ignored.

Turning IAP off

To turn IAP off, you must set enabled to false in the BackendConfig. If you delete the IAP block from BackendConfig, the settings will persist. For example, if IAP is enabled with secretName: my_secret and you delete the block, then IAP will still be turned on with the OAuth credentials stored in my_secret.

Langkah selanjutnya

• Pelajari cara menyiapkan Cloud CDN di GKE.
• Pelajari cara mengonfigurasi Cloud Armor untuk GKE.
• Pelajari resource BackendConfig lebih lanjut.