#3965 [Core feature] Make Flyte work with GCP Identity Aware Proxy (IAP) Issue created by fg91 Motivation: Why do you think this is important? GCP Identity Aware Proxy (IAP) is a managed service that makes it easy to protect applications deployed on GCP by verifying user identity and using context to determine whether a user should be granted access. Because requests to applications protected with IAP first have to pass IAP before they can reach the protected application, IAP provides a convenient way to implement a zero-trust access model. (In contrast, if applications are protected using their own auth mechanism, unauthenticated requests typically first hit the application which only then redirects to e.g. a google login page. With IAP, no unauthenticated request can ever hit the application.) Since IAP makes it very easy to implement a zero-trust model, many organizations using GCP have a security policy that any internal tool has to be protected with it. Goal: What should the final outcome look like, ideally? Flyte currently does not work with IAP but there is a need in the community to enable this integration: • > My company has a strict requirement to use IAP everywhere. We’ve been able to get authentication to work on the console but I can’t get access via the flytectl to work. Any tips here? (source) • > We have our flyte cluster url enabled with IAP (Identity-Aware Proxy). While the UI access to flyte cluster works fine using the google account login but accessing flyte cluster using flytectl fails at authentication (source) • > we [...] currently port forward for everything except Flyte Console (source) Describe alternatives you've considered In organizations where there is a security policy to use IAP, workarounds typically include 1) deploying flyte itself without authentication enabled and instead with IAP in front of flyteconsole and 2) port-forwarding flyteadmin's gRPC server to localhost or interacting with it only from within the cluster/the VPC (as

pyflyte

and

flytectl

cannot reach flyteadmin through IAP). None of this is great. Propose: Link/Inline OR Additional context This issue tracks the integration of flyte with IAP, consisting of the following tickets: • flyteorg/flytekit#1795 Adding a plugin, providing a CLI that can be used by

flytekit

(and

flytectl

) as an external command to generate access tokens for IAP (see here for "external command" authentication in flyte). To create this token, the plugin performs a standard OAuth 2.0 flow with

<https://accounts.google.com>

(not with flyteadmin). • flyteorg/flytekit#1787 Giving `flytekit`'s

Remote

(used by

pyflyte

) the ability to send

"proxy-authorization"

headers valid for IAP (generated with the new plugin) with every request, including the unauthenticated requests during the authentication flow with flyteadmin. In flyte's client config this will look as follows:

admin:
      endpoint: dns:///flyte.my-company.com
      insecure: false
      authType: Pkce  # or ClientSecret, ExternalCommand, ...
      proxyCommand: ["flyte-iap", "", "generate-user-id-token", "--desktop_client_id", "..."]

If a request, even one that is not yet authenticated with flyteadmin (via

"authorization"

headers), includes a valid

"proxy-authorization"

header, IAP strips this

"proxy-authorization"

header and forwards the request to flyteadmin without touching the

"authorization"

header used by Flyte. If no valid

"proxy-authorization"

is included, the request is denied at the load balancer. This means that the existing authentication flow `flytekit`'s

Remote

performs with

flyteadmin

is not modified.

flyteadmin

itself is not aware that it is protected with IAP. • Implementing the same for

flytectl

. The external command can of course be reused. • (Fixing a bug in the flyte helm chart that breaks deployments with the GCE ingress controller (instead of nginx) as IAP only works with GCE ingresses. #3964) <- Not needed anymore, see reason • Adding documentation on how to deploy the flyte helm chart with a GCE ingress, GCP managed certificate, and IAP. The guide is currently documented in the

README.md

of the flytekit iap plugin added in flyteorg/flytekit#1795 (It could be moved from there.) Are you sure this issue hasn't been raised already? ☑︎ Yes Have you read the Code of Conduct? ☑︎ Yes flyteorg/flyte