K8s-config-connector: Support referencing IAMCustomRole from IAMPolicyMember and IAMPolicy

[ppennanen]

There is a CRD for IAMCustomRole however it appears impossible to refer to a custom role from IAMPolicy and IAMPolicyMember, since the pattern for the role field is specified as ^roles/[\w\.]+$.

It would be useful to allow binding custom roles with paths like projects/<project id>/roles/<role id> or organization/<organization id>/roles/<role id> .

[xiaobaitusi]

Hi ppennanen@, thanks for your feedback. I'll mark it as enhancement for this feature request. Ack that we should support binding custom roles.

[kibbles-n-bytes]

@ppennanen As a temporary workaround, if you are blocked, we have confirmed that removing the pattern: ^roles/[\w\.]+$ restriction within the JSON schema for the IAMPolicy and IAMPolicyMember CRDs and using a relative resource name like projects/[PROJECT]/roles/[CUSTOM_ROLE] works.

You can do so via the following:

• Before installing, remove the validation string in install-bundle/crds.yaml with: sed -i '/pattern: \^roles/d' install-bundle/crds.yaml

OR

• After installing, remove the validation string from the CRDs by:
  
  
  
  • Run kubectl edit crd iampolicies.iam.cnrm.cloud.google.com
  
  
  • Find the line that says pattern: ^roles/[\w\.]+$ and delete it
  
  
  • Repeat the above two steps, but for iampolicymembers.iam.cnrm.cloud.google.com instead of iampolicies.iam.cnrm.cloud.google.com
  
  

Now something like this should work:

apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: iampolicymember-sample
spec:
    member: user:[USER]@google.com
    resourceRef:
      kind: Project
    role: projects/[PROJECT]/roles/iamcustomrolesample

Please note that our official support may look a bit different as we will want to be able to reference IAMCustomRole objects within the cluster as well.

[ppennanen]

Cool. Thank you!

[dan-j]

If you want to maintain validation, you could also edit the regex like so:

pattern: ^(roles|projects)/[\w-/\.]+$

This isn't the most restrictive but gets the job done, it allows for - in project names too.

[govinda-attal]

It will be great, to have this feature included. Any update is highly appreciated :-).

As the intent of IAMPolicy custom resource is to be full declaration at project level, and IAMPolicyMember is too granular for our use-case. It will be great to have this if IAMPolicyMember CR could refer to a custom role.

Else would it be appropriate to have IAMPolicyMemberMapping where one member could be mapped to multiple resources. I will raise a separate issue for this request.

[regadas]

Hi! 👋

With KCC 1.13.1 projects/[PROJECT]/roles/[CUSTOM_ROLE] are supported but it would be great if we had organizations/<organization id>/roles/<role id> as well.

The mentioned workaround worked for org level roles, but included support would be great!

[jcanseco]

Hi @regadas, sure thing, we'll add it to our backlog and let you know when we have updates.

[spew]

This will be fixed in this week's release.

[xiaobaitusi]

This should be fixed in version 1.19.1

[jcanseco]

Closing since issue has now been fixed.