Support External ID

[randomvariable]

Fixes #236

This supports External ID via annotations as per updated readme.

[pingles]

Exciting, thanks for working on this @randomvariable

[harishspqr]

@pingles Could you please share whats blocking this PR and why the checks have failed ? I am unable to open the details about this failure.

[randomvariable]

@harishspqr I hadn't finished it previously, but have done now via the annotations.

Have had a look to see if we could support external ID via a reference to a secret or some other thing.

One of the issues is that if we leveraged a SecretRef, kiam's server would need RBAC permissions to potentially read all secrets in all namespaces, which is less than ideal.

Could get around this by introducing a new CRD, as in this branch: https://github.com/randomvariable/kiam/tree/external-id-crd
(definition)

Then kiam can have an RBAC policy to be able to inspect only those CRD types.

The approach in the branch is pretty much that of PodSecurityPolicies - read all the IAM CRDs, find the service account of the pod, and find the first IAM object that passes SubjectAccessReview when ordered alphabetically. To finish that branch, someone would need to continue to rework the interfaces and the cache behaviour to make it work. Potentially a big enough change it should be in a different repository.

That said, this PR is ready in terms of a simple extension via an annotation.

[harishspqr]

@randomvariable Awesome!
Thanks for the details.

[harishspqr]

@randomvariable Can we create a secret in a particular namespace and create Role that is limited to the secrets resource in that namespace alone ? Is it possible ?

[randomvariable]

@harishspqr Maybe, if it's done as a SecretReference. I probably won't have any time to do anything like that, but if you want to run with it in a separate PR, feel free.

[danmx]

@randomvariable are you proposing moving kiam towards an operator?

[randomvariable]

@pingles @Joseph-Irving I've rebased this on master. Ready for merge.

[randomvariable]

Replaced by #360