[GEP-26] Add support for Workload Identity credentials to etcd backups #1151

vpnachev · 2025-08-25T16:30:56Z

How to categorize this PR?
/area security ipcei documentation
/kind enhancement
/platform gcp

What this PR does / why we need it:
[GEP-26] Add support for Workload Identity credentials to etcd backups

Which issue(s) this PR fixes:
Part of gardener/gardener#9586

Special notes for your reviewer:
etcd-backup-restore will add support for WorkloadIdentity credentials with gardener/etcd-backup-restore#908

If anybody wants to try this change locally with gardener with extensions, the following patch to gardener is required

spoiler for patch:

diff --git a/pkg/apis/core/validation/backupbucket.go b/pkg/apis/core/validation/backupbucket.go
index 28d485980b..515bc47c5f 100644
--- a/pkg/apis/core/validation/backupbucket.go
+++ b/pkg/apis/core/validation/backupbucket.go
@@ -9,7 +9,6 @@ import (
 	"k8s.io/apimachinery/pkg/util/validation/field"
 
 	"github.com/gardener/gardener/pkg/apis/core"
-	securityv1alpha1 "github.com/gardener/gardener/pkg/apis/security/v1alpha1"
 )
 
 // ValidateBackupBucket validates a BackupBucket object.
@@ -61,11 +60,11 @@ func validateCredentials(spec *core.BackupBucketSpec, fldPath *field.Path) field
 	} else {
 		allErrs = append(allErrs, ValidateCredentialsRef(*spec.CredentialsRef, fldPath.Child("credentialsRef"))...)
 
-		// TODO(vpnachev): Allow WorkloadIdentities once the support in the controllers and components is fully implemented.
-		if spec.CredentialsRef.APIVersion == securityv1alpha1.SchemeGroupVersion.String() &&
-			spec.CredentialsRef.Kind == "WorkloadIdentity" {
-			allErrs = append(allErrs, field.Forbidden(fldPath.Child("credentialsRef"), "support for WorkloadIdentity as backup credentials is not yet fully implemented"))
-		}
+		// // TODO(vpnachev): Allow WorkloadIdentities once the support in the controllers and components is fully implemented.
+		// if spec.CredentialsRef.APIVersion == securityv1alpha1.SchemeGroupVersion.String() &&
+		// 	spec.CredentialsRef.Kind == "WorkloadIdentity" {
+		// 	allErrs = append(allErrs, field.Forbidden(fldPath.Child("credentialsRef"), "support for WorkloadIdentity as backup credentials is not yet fully implemented"))
+		// }
 	}
 
 	return allErrs
diff --git a/pkg/apis/core/validation/seed.go b/pkg/apis/core/validation/seed.go
index 746e96e4ac..4b8cae227a 100644
--- a/pkg/apis/core/validation/seed.go
+++ b/pkg/apis/core/validation/seed.go
@@ -17,7 +17,6 @@ import (
 	"github.com/gardener/gardener/pkg/apis/core"
 	"github.com/gardener/gardener/pkg/apis/core/helper"
 	v1beta1constants "github.com/gardener/gardener/pkg/apis/core/v1beta1/constants"
-	securityv1alpha1 "github.com/gardener/gardener/pkg/apis/security/v1alpha1"
 	"github.com/gardener/gardener/pkg/utils"
 	cidrvalidation "github.com/gardener/gardener/pkg/utils/validation/cidr"
 	featuresvalidation "github.com/gardener/gardener/pkg/utils/validation/features"
@@ -259,11 +258,11 @@ func validateSeedBackup(seedBackup *core.Backup, seedProviderType string, fldPat
 	} else {
 		allErrs = append(allErrs, ValidateCredentialsRef(*seedBackup.CredentialsRef, fldPath.Child("credentialsRef"))...)
 
-		// TODO(vpnachev): Allow WorkloadIdentities once the support in the controllers and components is fully implemented.
-		if seedBackup.CredentialsRef.APIVersion == securityv1alpha1.SchemeGroupVersion.String() &&
-			seedBackup.CredentialsRef.Kind == "WorkloadIdentity" {
-			allErrs = append(allErrs, field.Forbidden(fldPath.Child("credentialsRef"), "support for WorkloadIdentity as backup credentials is not yet fully implemented"))
-		}
+		// // TODO(vpnachev): Allow WorkloadIdentities once the support in the controllers and components is fully implemented.
+		// if seedBackup.CredentialsRef.APIVersion == securityv1alpha1.SchemeGroupVersion.String() &&
+		// 	seedBackup.CredentialsRef.Kind == "WorkloadIdentity" {
+		// 	allErrs = append(allErrs, field.Forbidden(fldPath.Child("credentialsRef"), "support for WorkloadIdentity as backup credentials is not yet fully implemented"))
+		// }
 	}
 
 	return allErrs
diff --git a/skaffold.yaml b/skaffold.yaml
index c8c90f1491..b5f9be37af 100644
--- a/skaffold.yaml
+++ b/skaffold.yaml
@@ -1608,6 +1608,14 @@ deploy:
             - name: gardener-node-agent
               repository: '{{.IMAGE_REPO_local_skaffold_gardener_node_agent}}'
               tag: '{{.IMAGE_TAG_local_skaffold_gardener_node_agent}}@{{.IMAGE_DIGEST_local_skaffold_gardener_node_agent}}'
+          componentImageVectorOverwrites: |
+            components:
+            - name: etcd-druid
+              imageVectorOverwrite: |
+                images:
+                - name: etcd-backup-restore
+                  tag: v0.38.0-gcs-v4
+                  repository: ghcr.io/vpnachev/etcdbrctl
         createNamespace: true
         wait: true
     hooks:

cc @dimityrmirchev

Release note:

This extension now supports `WorkloadIdentity`s as credentials for etcd backup.

…g locally

dimityrmirchev

Thanks!

pkg/controller/backupentry/actuator.go

dimityrmirchev · 2025-08-27T11:52:34Z

pkg/apis/gcp/validation/workloadidentity.go


 		if !slices.Contains(allowedTokenURLs, rawTokenURL) {
-			allErrs = append(allErrs, field.Invalid(fldPath.Child("credentialsConfig").Child(keyTokenURL), cfg[keyTokenURL], "should be one of the allowed URLs: "+strings.Join(allowedTokenURLs, ", ")))
+			allErrs = append(allErrs, field.NotSupported(fldPath.Child("credentialsConfig").Child(keyTokenURL), cfg[keyTokenURL], allowedTokenURLs))


I think Forbidden should be the proper word to describe a value that can be allowed otherwise. This is also what the documentation suggests.

Suggested change

allErrs = append(allErrs, field.NotSupported(fldPath.Child("credentialsConfig").Child(keyTokenURL), cfg[keyTokenURL], allowedTokenURLs))

allErrs = append(allErrs, field.Forbidden(fldPath.Child("credentialsConfig").Child(keyTokenURL), cfg[keyTokenURL], allowedTokenURLs))

I do not think so, looking the docs for https://pkg.go.dev/k8s.io/[email protected]/pkg/util/validation/field#Forbidden and https://pkg.go.dev/k8s.io/[email protected]/pkg/util/validation/field#NotSupported NotSupported is the correct one as we have list of supported values, forbidden means that in certain conditions the value is acceptable, but in the particular case it is not allowed.

forbidden means that in certain conditions the value is acceptable

Exactly, if the admission is configured to allow the value then this value will be accepted. In the documentation it even mentions as an example a security policy, which is exactly the case here. We allow only known token URLs.

Not supported as mentioned in the documentation "This is used to report unknown values for enumerated fields (e.g. a list of valid values)" would be used to indicate a value is not supported, e.g. you input a "mode" and the modes can be any of ["low", "medium", "high"] but not "ultra" as per the application and not configuration.

Done with ea48800

pkg/apis/gcp/validation/workloadidentity_test.go

pkg/controller/backupbucket/actuator.go

pkg/apis/gcp/helper/scheme.go

pkg/gcp/credentialsconfig.go

pkg/controller/backupentry/actuator.go

Co-authored-by: Dimitar Mirchev <[email protected]>

W.r.t. what kind of error to be token_url validation

dimityrmirchev

Thank you for addressing my comments!

/lgtm

kon-angelo

/lgtm

vpnachev added 9 commits August 25, 2025 19:24

Move BackupBucket docs from usage to operations

34592c4

Improve operations doc

4b2c51d

Fix hook-me makefile target

1868b49

Extract logic from EnsureCloudProviderSecret to util func

b2e92c8

Minor various improvements

84f492a

Set GCP client to fall back to its construction from 'confg' data key

84ee098

Use constant to store secret data key projectID

7e47be6

Inject workload identity data into etcd-backup secret

7a3552f

Address linter findings

5e37c5f

vpnachev requested a review from a team as a code owner August 25, 2025 16:30

gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Aug 25, 2025

vpnachev added 2 commits August 26, 2025 15:03

Add unit test for GetETCDSecretData

34e3f28

Set extension controller to use external shoot kubeconfig when runnin…

89a27bf

…g locally

dimityrmirchev requested changes Aug 27, 2025

View reviewed changes

gardener-robot added the needs/changes Needs (more) changes label Aug 27, 2025

vpnachev and others added 2 commits August 27, 2025 23:05

Address review feedback

b092fd0

Co-authored-by: Dimitar Mirchev <[email protected]>

Address review feedback

ea48800

W.r.t. what kind of error to be token_url validation

dimityrmirchev approved these changes Aug 29, 2025

View reviewed changes

gardener-robot added reviewed/lgtm Has approval for merging and removed needs/changes Needs (more) changes needs/review Needs review needs/second-opinion Needs second review by someone else labels Aug 29, 2025

vpnachev mentioned this pull request Sep 12, 2025

☂️ [GEP-26] Workload Identity - Trust Based Authentication gardener/gardener#9586

Open

kon-angelo approved these changes Sep 17, 2025

View reviewed changes

kon-angelo merged commit f152674 into gardener:master Sep 17, 2025
25 checks passed

gardener-robot added the status/closed Issue is closed (either delivered or triaged) label Sep 17, 2025

vpnachev deleted the gep26/support-workload-identity-for-backups branch September 19, 2025 05:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[GEP-26] Add support for Workload Identity credentials to etcd backups #1151

[GEP-26] Add support for Workload Identity credentials to etcd backups #1151

Uh oh!

vpnachev commented Aug 25, 2025 •

edited

Loading

Uh oh!

dimityrmirchev left a comment

Uh oh!

Uh oh!

dimityrmirchev Aug 27, 2025

Uh oh!

vpnachev Aug 27, 2025

Uh oh!

dimityrmirchev Aug 28, 2025

Uh oh!

vpnachev Aug 28, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dimityrmirchev left a comment

Uh oh!

kon-angelo left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	allErrs = append(allErrs, field.NotSupported(fldPath.Child("credentialsConfig").Child(keyTokenURL), cfg[keyTokenURL], allowedTokenURLs))
	allErrs = append(allErrs, field.Forbidden(fldPath.Child("credentialsConfig").Child(keyTokenURL), cfg[keyTokenURL], allowedTokenURLs))

[GEP-26] Add support for Workload Identity credentials to etcd backups #1151

[GEP-26] Add support for Workload Identity credentials to etcd backups #1151

Uh oh!

Conversation

vpnachev commented Aug 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dimityrmirchev left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dimityrmirchev Aug 27, 2025

Choose a reason for hiding this comment

Uh oh!

vpnachev Aug 27, 2025

Choose a reason for hiding this comment

Uh oh!

dimityrmirchev Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

vpnachev Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dimityrmirchev left a comment

Choose a reason for hiding this comment

Uh oh!

kon-angelo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

vpnachev commented Aug 25, 2025 •

edited

Loading