Can we create credentials.json file using gcloud auth login? Requirement is - user should use personal account in the minikube and use cred.json file as a secret in their cluster. Current setup - For QA we have a service account key which get mounted on the gke cluster as secret.
2 Answers
To access to google cloud API, you need an OAuth2 access_token and you can generate it with user credential (and after a gcloud auth login)
So, you can call this command or directly the API with an access token in parameter
Example with curl
curl -H "Authorization: Bearer $(gcloud auth print-access-token)"
EDIT
As explained before, a user credential created with gcloud auth login can only, today, create an access_token.
Access token are required to access to Google API (included Google Cloud products). If it's your use case, you can use it.
However, if you need an id_token, for example to access to private Cloud Functions, private Cloud Run, App Engine behind IAP, you can't (not directly, I have a fix for this if you want).
Based on the principle of least privilege, each developer should have his own dedicated GCP Service Account:
Account created like that should have assigned only the necessary roles.
You can generate a key for this account with a following command:
gcloud iam service-accounts keys create key.json \
--iam-account=${DEVELOPER_USERNAME}
key.json<-- is a file name and can be changed (example:username-access-token.json)
More reference can be found in the official documentation:
With above key you can communicate with GCP API's. You will need a Secret mounted to a Pod with this access token as well as an env variable in a Pod like one below:
GOOGLE_APPLICATION_CREDENTIALS=${PATH_TO_MOUNTED_SECRET_WITH_ACCESS_TOKEN}
By following this way, a developer could "see" the access token from a Secret but won't be able to do anything besides what the role bindings to his gcp service account allows him to do.
You can also have unified process of creating such user accounts. One of the tools that would allow it is Terraform. You can read more about the modules that will create such accounts and keys here:
Related