Grant Config Connector controller perms for per-env SA provisioning#15
Open
pcholakov wants to merge 4 commits into
Open
Grant Config Connector controller perms for per-env SA provisioning#15pcholakov wants to merge 4 commits into
pcholakov wants to merge 4 commits into
Conversation
pcholakov
marked this pull request as ready for review
May 22, 2026 08:41
pcholakov
force-pushed
the
pavel/gcp-env-identity
branch
2 times, most recently
from
May 25, 2026 13:39
83e3c74 to
5fbfbc7
Compare
Without proxy.nativeSidecar=true the linkerd-proxy is injected as a regular container that never exits. Jobs (notably restate-wi-canary) get stuck 1/2 NotReady on a failure, so the Job's backoffLimit retry never fires and a transient first-attempt failure (e.g. GCP IAM eventual consistency on the Workload Identity binding for a freshly created env namespace) leaves the env unable to come up. With native sidecar, the proxy is an init container with restartPolicy: Always — Kubernetes terminates it when the main container exits, the pod transitions to Failed/Succeeded, and the Job retries normally.
Moves the four kyverno cluster policies (linkerd-injection annotation mutate, linkerd authz generate, and the two RBAC ClusterRoles that grant kyverno permission to create policy.linkerd.io resources) into the sandbox TF as kubectl_manifest resources. They were previously declared as Nuon [[policy]] type=kubernetes_cluster entries in restate-byoc-gcp/policies.toml, but Nuon does not actually deploy them for this app -- the install config state has no policies field, and verifying on the canary cluster post-reprovision confirmed none were applied. Moving them into the sandbox makes them part of the substrate alongside kyverno itself, so a reprovision installs everything needed for new env namespaces to be linkerd-meshed correctly.
GKE Autopilot allocates the services CIDR from Google's managed range (34.118.224.0/20 on the canary cluster), which isn't covered by linkerd's default clusterNetworks (RFC1918 + IPv6 link-local). Without this, linkerd-proxy treats traffic to ClusterIP services as off-cluster egress and routes it through the EgressNetwork, losing identity-aware in-cluster policy and skewing observability for service-to-service calls. Pulled dynamically from the cluster resource so it stays correct on any GKE Autopilot cluster, not just the current canary.
…ning Add a project-level binding so the CC controller SA can create and delete per-environment IAMServiceAccount CRs, plus a sandbox output that exposes the CC controller SA email so a sibling component can attach the matching bucket-scoped binding for managing per-env GCS IAMPolicyMember resources on the install's snapshot bucket. Preserves the existing serviceAccount-scoped binding required by the restate-operator's v2.3.0 Workload Identity automation.
pcholakov
force-pushed
the
pavel/gcp-env-identity
branch
from
May 25, 2026 16:29
5fbfbc7 to
aacba5a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related: restatedev/restate-cloud#833 (architecture overview, locked decisions, e2e validation summary)
Summary
Grants the Config Connector controller SA the permissions it needs to provision per-environment GCP service accounts on the install project. Companion to:
What changed
Validation
Test plan
End-to-end against the GCP dev canary install after the cloud control-plane code lands (Track 2b). See `restate-cloud/docs/testing/gcp-env-identity-e2e.md`.