Support for WID Principals ?

[dirsigler]

Question

As documented in the official documentation, Workload Identity identities like serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KUBERNETES_SERVICE_ACCOUNT] are considered legacy.

It is recommend to use Principals or PrincipalSets. Is there any way the CloudSQL Proxy can support IAM authentication based on IAM Principals ?

In best case I would prefer to deploy my service applications with IAM Principals and stripping away all the individual GSAs of applications. Then have the App Principals act as one central IAM GSA to authenticate based on impersonation.

Code

Additional Details

No response

[hessjcg]

Yes, the Auth Proxy and Cloud SQL Connectors support Workload Identity principals.

When the auth proxy starts it will load its credentials from Google Cloud Application Default Credentials one of these places, in priority order:

1. Explicit credentials set using the command line arguments or equivalent environment variables: --token or --credentials-file
2. The GOOGLE_APPLICATION_CREDENTIALS environment variable
3. A credential file created by using the gcloud auth application-default login command
4. The attached service account, returned by the metadata server

For example: suppose the Auth Proxy starts in a pod on GKE that is configured with a workload identity principal. The Auth Proxy uses the GKE metadata server to get an auth token. The GKE metadata server will return a token based on the pod's workload identity. The proxy then uses this identity to call the Cloud SQL Admin API, and then it will create a secure connection to the Cloud SQL database instance.

Additionally, the Auth Proxy can be configured to use that IAM principal as the database user, see Configuring IAM Database Authentication

Finally, the proxy can be configured with service account impersonation as well. The proxy will use the Workload Identity principal to impersonate another principal, then use that other principal to connect to the database.

[allevimi]

sorry, I don't get if it can be possible using IAM Principals as DB user, as per docs it seems not, or I must have to impersonate a different google service account?