Configure credentials for GCP Bucket remote storage

Set up GCP Cloud Storage credentials for the App Framework.

Configure credentials for GCP Cloud Storage using Workload Identity or Kubernetes secrets. You can connect to GCP Bucket remote storage using one of the following approaches.

Compare GCP Workload Identity and Service Account Keys

Feature Workload Identity Service Account Keys
Credential Management Eliminates the need to manage credentials manually. Requires handling and securely storing JSON keys.
Security Enhanced security by using Kubernetes-native identities. Higher risk due to potential key leakage.
Ease of Rotation GCP manages credential rotation automatically. Manual rotation of keys is necessary.
Granularity Fine-grained access control via Kubernetes Service Accounts. Access is tied to the service account key.
Integration Complexity Requires additional setup but offers better security and manageability. Simpler to set up initially but harder to manage.
Use Cases Ideal for Kubernetes-native environments requiring enhanced security. Suitable for simpler setups or legacy systems.

When to use which

  • Workload Identity

    • Preferable for Kubernetes-native deployments requiring robust security.
    • Ideal for scenarios where automatic credential management and rotation are beneficial.

  • Service Account Keys

    • Use when simplicity is a priority and the security implications are manageable.
    • Suitable for environments where Workload Identity is not supported or feasible.

Set up GCP Bucket access with Workload Identity

Workload Identity allows Kubernetes workloads to authenticate to GCP services without managing service account keys. This method binds Kubernetes service accounts to GCP service accounts.

  1. Enable Workload Identity on Your GKE Cluster

    Ensure your GKE cluster is created with Workload Identity enabled. If not, enable it during cluster creation or update an existing cluster.

    During cluster creation

    Run the following gcloud command:

    CODE 
    gcloud container clusters create splunkOperatorWICluster \
  --resource-group splunkOperatorWorkloadIdentityRG \
  --workload-pool=<PROJECT_ID>.svc.id.goog \
  --enable-workload-identity

    Replace PROJECT_ID with your GCP project ID.

    For existing clusters

    Run the following gcloud command:

    CODE 
    gcloud container clusters update splunkOperatorWICluster \
  --resource-group splunkOperatorWorkloadIdentityRG \
  --workload-pool=<PROJECT_ID>.svc.id.goog
    Note: Enabling Workload Identity on an existing cluster might require cluster reconfiguration and might cause temporary downtime.

  2. Create a GCP Service Account and Assign Permissions

    Create

    Run the following gcloud command:

    CODE 
    gcloud iam service-accounts create splunk-app-framework-sa \
  --display-name "Splunk App Framework Service Account"

    Grant

    Run the following gcloud command:

    CODE 
    gcloud projects add-iam-policy-binding <PROJECT_ID> \
  --member "serviceAccount:splunk-app-framework-sa@<PROJECT_ID>.iam.gserviceaccount.com" \
  --role "roles/storage.objectViewer"

    Replace PROJECT_ID with your GCP project ID.

  3. Create a Kubernetes Service Account

    Run the following kubectl command:

    CODE 
    kubectl create serviceaccount splunk-operator-sa \
  -n splunk-operator

  4. Associate the GCP Service Account with the Kubernetes Service Account

    Run the following gcloud command:

    CODE 
    gcloud iam service-accounts add-iam-policy-binding splunk-app-framework-sa@<PROJECT_ID>.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:<PROJECT_ID>.svc.id.goog[splunk-operator/splunk-operator-sa]"

  5. Annotate the Kubernetes Service Account

    Run the following kubectl command:

    CODE 
    kubectl annotate serviceaccount splunk-operator-sa \
  --namespace splunk-operator \
  iam.gke.io/gcp-service-account=splunk-app-framework-sa@<PROJECT_ID>.iam.gserviceaccount.com

  6. Update Splunk Operator Deployment

    Use the following YAML with serviceAccountName set to splunk-operator-sa and the annotation azure.workload.identity/use: "true":

    CODE 
    apiVersion: apps/v1
kind: Deployment
metadata:
  name: splunk-operator
  namespace: your-splunk-operator-namespace
  labels:
    app: splunk-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      app: splunk-operator
  template:
    metadata:
      labels:
        app: splunk-operator
      annotations:
        azure.workload.identity/use: "true"
    spec:
      serviceAccountName: splunk-operator-sa
      containers:
      - name: splunk-operator
        image: your-splunk-operator-image

    Save the manifest as splunk-operator-deployment-wi.yaml and apply it:

    CODE 
    kubectl apply -f splunk-operator-deployment-wi.yaml

  7. Configure Splunk Operator to Use Workload Identity

    Set serviceAccount to splunk-operator-sa in the CRD, for example:

    JSON 
    apiVersion: enterprise.splunk.com/v3
kind: Standalone
metadata:
  name: example-splunk-app
  namespace: splunk-operator
spec:
  appRepo:
      appInstallPeriodSeconds: 90
      appSources:
      - location: c3appfw-idxc-mj00
        name: appframework-idxc-clusterypt
        premiumAppsProps:
          esDefaults: {}
        scope: cluster
        volumeName: appframework-test-volume-idxc-k3r
      appsRepoPollIntervalSeconds: 60
      defaults:
        premiumAppsProps:
          esDefaults: {}
        scope: cluster
        volumeName: appframework-test-volume-idxc-k3r
      installMaxRetries: 2
      volumes:
      - endpoint: https://storage.googleapis.com
        name: appframework-test-volume-idxc-k3r
        path: splk-integration-test-bucket
        provider: gcp
        region: ""
        serviceAccount: splunk-operator-sa
        storageType: gcs

  8. Verify the Configuration

    Check pods:

    CODE 
    kubectl get pods -n splunk-operator

    Inspect logs with kubectl (replace the pod name placeholder):

    CODE 
    kubectl logs <splunk-operator-pod-name> -n splunk-operator

Set up GCP Bucket access with Kubernetes secrets

  1. Create a GCP Service Account

    Open Google Cloud Console. Navigate to IAM & Admin > Service Accounts. Create a service account named splunk-app-framework-sa and grant the Storage Object Viewer role.

  2. Download the Service Account Key

    On the Service Accounts page, find splunk-app-framework-sa. Select Actions > Manage Keys > Add Key > Create New Key > JSON. Store the downloaded file securely.

  3. Create a Kubernetes Secret

    Run the following kubectl command, replacing /path/to/splunk-app-framework-sa-key.json with your key file path:

    CODE 
    kubectl create secret generic gcs-secret --from-file=key.json=/path/to/splunk-app-framework-sa-key.json -n splunk-operator

  4. Configure Splunk Operator CRD to Reference the Secret

    Use a volume definition similar to the Workload Identity example, but set secretRef to splunk-s3-index-masterc3appfw-iwz-vzv instead of serviceAccount:

    JSON 
    apiVersion: enterprise.splunk.com/v3
kind: Standalone
metadata:
  name: example-splunk-app
  namespace: splunk-operator
spec:
  appRepo:
      appInstallPeriodSeconds: 90
      appSources:
      - location: c3appfw-idxc-mj00
        name: appframework-idxc-clusterypt
        premiumAppsProps:
          esDefaults: {}
        scope: cluster
        volumeName: appframework-test-volume-idxc-k3r
      appsRepoPollIntervalSeconds: 60
      defaults:
        premiumAppsProps:
          esDefaults: {}
        scope: cluster
        volumeName: appframework-test-volume-idxc-k3r
      installMaxRetries: 2
      volumes:
      - endpoint: https://storage.googleapis.com
        name: appframework-test-volume-idxc-k3r
        path: splk-integration-test-bucket
        provider: gcp
        region: ""
        secretRef: splunk-s3-index-masterc3appfw-iwz-vzv
        storageType: gcs

  5. Deploy or Update

    Run kubectl against your CRD manifest (for example splunk-app-crd.yaml):

    CODE 
    kubectl apply -f splunk-app-crd.yaml

  6. Verify

    Check pods and inspect logs using kubectl as in the Workload Identity section.

GCP Bucket authorization recommendations

  1. Adhere to the Least Privilege Principle

    Assign only the necessary roles to service accounts or managed identities to minimize security risks.

  2. Use Workload Identity Where Possible

    Use Workload Identity for Kubernetes deployments to enhance security and simplify credential management.

  3. Secure Namespace Configuration

    Limit Service Accounts to specific namespaces to prevent unauthorized access across the cluster.

  4. Regularly Audit IAM Roles and Permissions

    Periodically review and adjust roles so they align with current access requirements.

  5. Monitor Access Logs

    Use GCP logging and monitoring tools to track access patterns and detect anomalies.

  6. Automate Infrastructure as Code (IaC)

    Use tools like Terraform or Helm to manage service accounts, IAM roles, and Kubernetes configurations for consistency and repeatability.

  7. Implement Network Security Controls

    Configure VPC Service Controls or firewall rules to restrict access to GCS buckets from authorized sources only.