feat: per cluster credentials

api/v1alpha3/gcpcluster_conversion.go

@@ -49,6 +49,10 @@ func (src *GCPCluster) ConvertTo(dstRaw conversion.Hub) error { // nolint
 		}
 	}
 
+	if restored.Spec.CredentialsRef != nil {
+		dst.Spec.CredentialsRef = restored.Spec.CredentialsRef
+	}
+
 	return nil
 }
 

api/v1alpha4/conversion_test.go

@@ -25,22 +25,22 @@ import (
 
 func TestFuzzyConversion(t *testing.T) {
 	t.Run("for GCPCluster", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
-		Hub:    &v1beta1.GCPCluster{},
-		Spoke:  &GCPCluster{},
+		Hub:   &v1beta1.GCPCluster{},
+		Spoke: &GCPCluster{},
 	}))
 
 	t.Run("for GCPClusterTemplate", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
-		Hub:    &v1beta1.GCPClusterTemplate{},
-		Spoke:  &GCPClusterTemplate{},
+		Hub:   &v1beta1.GCPClusterTemplate{},
+		Spoke: &GCPClusterTemplate{},
 	}))
 
 	t.Run("for GCPMachine", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
-		Hub:    &v1beta1.GCPMachine{},
-		Spoke:  &GCPMachine{},
+		Hub:   &v1beta1.GCPMachine{},
+		Spoke: &GCPMachine{},
 	}))
 
 	t.Run("for GCPMachineTemplate", utilconversion.FuzzTestFunc(utilconversion.FuzzTestFuncInput{
-		Hub:    &v1beta1.GCPMachineTemplate{},
-		Spoke:  &GCPMachineTemplate{},
+		Hub:   &v1beta1.GCPMachineTemplate{},
+		Spoke: &GCPMachineTemplate{},
 	}))
 }

api/v1alpha4/gcpcluster_conversion.go

@@ -19,6 +19,7 @@ package v1alpha4
 import (
 	apiconversion "k8s.io/apimachinery/pkg/conversion"
 	infrav1beta1 "sigs.k8s.io/cluster-api-provider-gcp/api/v1beta1"
+	v1beta1 "sigs.k8s.io/cluster-api-provider-gcp/api/v1beta1"
 	utilconversion "sigs.k8s.io/cluster-api/util/conversion"
 	"sigs.k8s.io/controller-runtime/pkg/conversion"
 )
@@ -47,6 +48,9 @@ func (src *GCPCluster) ConvertTo(dstRaw conversion.Hub) error { // nolint
 			break
 		}
 	}
+	if restored.Spec.CredentialsRef != nil {
+		dst.Spec.CredentialsRef = restored.Spec.CredentialsRef.DeepCopy()
+	}
 
 	return nil
 }
@@ -83,3 +87,8 @@ func (dst *GCPClusterList) ConvertFrom(srcRaw conversion.Hub) error { // nolint
 func Convert_v1beta1_SubnetSpec_To_v1alpha4_SubnetSpec(in *infrav1beta1.SubnetSpec, out *SubnetSpec, s apiconversion.Scope) error {
 	return autoConvert_v1beta1_SubnetSpec_To_v1alpha4_SubnetSpec(in, out, s)
 }
+
+// Convert_v1beta1_GCPClusterSpec_To_v1alpha4_GCPClusterSpec is an autogenerated conversion function.
+func Convert_v1beta1_GCPClusterSpec_To_v1alpha4_GCPClusterSpec(in *v1beta1.GCPClusterSpec, out *GCPClusterSpec, s apiconversion.Scope) error {
+	return autoConvert_v1beta1_GCPClusterSpec_To_v1alpha4_GCPClusterSpec(in, out, s)
+}

api/v1alpha4/gcpclustertemplate_conversion.go

@@ -50,6 +50,10 @@ func (src *GCPClusterTemplate) ConvertTo(dstRaw conversion.Hub) error { // nolin
 		}
 	}
 
+	if restored.Spec.Template.Spec.CredentialsRef != nil {
+		dst.Spec.Template.Spec.CredentialsRef = restored.Spec.Template.Spec.CredentialsRef.DeepCopy()
+	}
+
 	return nil
 }
 

api/v1beta1/gcpcluster_types.go

@@ -53,6 +53,11 @@ type GCPClusterSpec struct {
 	// ones added by default.
 	// +optional
 	AdditionalLabels Labels `json:"additionalLabels,omitempty"`
+
+	// CredentialsRef is a reference to a Secret that contains the credentials to use for provisioning this cluster. If not
+	// supplied then the credentials of the controller will be used.
+	// +optional
+	CredentialsRef *ObjectReference `json:"credentialsRef,omitempty"`
 }
 
 // GCPClusterStatus defines the observed state of GCPCluster.

api/v1beta1/gcpcluster_webhook.go

@@ -75,6 +75,13 @@ func (c *GCPCluster) ValidateUpdate(oldRaw runtime.Object) error {
 		)
 	}
 
+	if !reflect.DeepEqual(c.Spec.CredentialsRef, old.Spec.CredentialsRef) {
+		allErrs = append(allErrs,
+			field.Invalid(field.NewPath("spec", "CredentialsRef"),
+				c.Spec.CredentialsRef, "field is immutable"),
+		)
+	}
+
 	if len(allErrs) == 0 {
 		return nil
 	}

api/v1beta1/types.go

@@ -255,3 +255,15 @@ type ServiceAccount struct {
 	// account.
 	Scopes []string `json:"scopes,omitempty"`
 }
+
+// ObjectReference is a reference to another Kubernetes object instance.
+type ObjectReference struct {
+	// Namespace of the referent.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
+	// +kubebuilder:validation:Required
+	Namespace string `json:"namespace"`
+	// Name of the referent.
+	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+	// +kubebuilder:validation:Required
+	Name string `json:"name"`
+}

cloud/scope/cluster.go

@@ -24,6 +24,9 @@ import (
 
 	"github.com/pkg/errors"
 	"google.golang.org/api/compute/v1"
+	"google.golang.org/api/option"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/utils/pointer"
 	infrav1 "sigs.k8s.io/cluster-api-provider-gcp/api/v1beta1"
 	"sigs.k8s.io/cluster-api-provider-gcp/cloud"
@@ -42,7 +45,7 @@ type ClusterScopeParams struct {
 
 // NewClusterScope creates a new Scope from the supplied parameters.
 // This is meant to be called for each reconcile iteration.
-func NewClusterScope(params ClusterScopeParams) (*ClusterScope, error) {
+func NewClusterScope(ctx context.Context, params ClusterScopeParams) (*ClusterScope, error) {
 	if params.Cluster == nil {
 		return nil, errors.New("failed to generate new scope from nil Cluster")
 	}
@@ -51,7 +54,7 @@ func NewClusterScope(params ClusterScopeParams) (*ClusterScope, error) {
 	}
 
 	if params.GCPServices.Compute == nil {
-		computeSvc, err := compute.NewService(context.TODO())
+		computeSvc, err := createComputeService(ctx, params)
 		if err != nil {
 			return nil, errors.Errorf("failed to create gcp compute client: %v", err)
 		}
@@ -73,6 +76,39 @@ func NewClusterScope(params ClusterScopeParams) (*ClusterScope, error) {
 	}, nil
 }
 
+func createComputeService(ctx context.Context, params ClusterScopeParams) (*compute.Service, error) {
+	if params.GCPCluster.Spec.CredentialsRef == nil {
+		computeSvc, err := compute.NewService(ctx)
+		if err != nil {
+			return nil, errors.Errorf("failed to create gcp compute client: %v", err)
+		}
+
+		return computeSvc, nil
+	}
+
+	secretRefName := types.NamespacedName{
+		Name:      params.GCPCluster.Spec.CredentialsRef.Name,
+		Namespace: params.GCPCluster.Spec.CredentialsRef.Namespace,
+	}
+
+	credSecret := &corev1.Secret{}
+	if err := params.Client.Get(ctx, secretRefName, credSecret); err != nil {
+		return nil, fmt.Errorf("getting credentials secret %s\\%s: %w", secretRefName.Namespace, secretRefName.Name, err)
+	}
+
+	rawData, ok := credSecret.Data["credentials"]
+	if !ok {
+		return nil, errors.New("no credentials key in secret")
+	}
+
+	computeSvc, err := compute.NewService(ctx, option.WithCredentialsJSON(rawData))
+	if err != nil {
+		return nil, errors.Errorf("failed to create gcp compute client with credentials secret: %v", err)
+	}
+
+	return computeSvc, nil
+}
+
 // ClusterScope defines the basic context for an actuator to operate upon.
 type ClusterScope struct {
 	client      client.Client

cloud/services/compute/instances/reconcile_test.go

@@ -133,7 +133,7 @@ func TestService_createOrGetInstance(t *testing.T) {
 		WithObjects(fakeBootstrapSecret).
 		Build()
 
-	clusterScope, err := scope.NewClusterScope(scope.ClusterScopeParams{
+	clusterScope, err := scope.NewClusterScope(context.TODO(), scope.ClusterScopeParams{
 		Client:     fakec,
 		Cluster:    fakeCluster,
 		GCPCluster: fakeGCPCluster,
@@ -155,7 +155,7 @@ func TestService_createOrGetInstance(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	clusterScopeWithoutFailureDomain, err := scope.NewClusterScope(scope.ClusterScopeParams{
+	clusterScopeWithoutFailureDomain, err := scope.NewClusterScope(context.TODO(), scope.ClusterScopeParams{
 		Client:     fakec,
 		Cluster:    fakeCluster,
 		GCPCluster: fakeGCPClusterWithOutFailureDomain,

cloud/services/compute/subnets/reconcile_test.go

@@ -82,7 +82,7 @@ func TestService_Reconcile(t *testing.T) {
 		WithScheme(scheme.Scheme).
 		Build()
 
-	clusterScope, err := scope.NewClusterScope(scope.ClusterScopeParams{
+	clusterScope, err := scope.NewClusterScope(context.TODO(), scope.ClusterScopeParams{
 		Client:     fakec,
 		Cluster:    fakeCluster,
 		GCPCluster: fakeGCPCluster,
@@ -179,7 +179,7 @@ func TestService_Delete(t *testing.T) {
 		WithScheme(scheme.Scheme).
 		Build()
 
-	clusterScope, err := scope.NewClusterScope(scope.ClusterScopeParams{
+	clusterScope, err := scope.NewClusterScope(context.TODO(), scope.ClusterScopeParams{
 		Client:     fakec,
 		Cluster:    fakeCluster,
 		GCPCluster: fakeGCPCluster,

config/crd/bases/infrastructure.cluster.x-k8s.io_gcpclusters.yaml

@@ -521,6 +521,21 @@ spec:
                 - host
                 - port
                 type: object
+              credentialsRef:
+                description: CredentialsRef is a reference to a Secret that contains
+                  the credentials to use for provisioning this cluster. If not supplied
+                  then the credentials of the controller will be used.
+                properties:
+                  name:
+                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                    type: string
+                  namespace:
+                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                    type: string
+                required:
+                - name
+                - namespace
+                type: object
               failureDomains:
                 description: FailureDomains is an optional field which is used to
                   assign selected availability zones to a cluster FailureDomains if

config/crd/bases/infrastructure.cluster.x-k8s.io_gcpclustertemplates.yaml

@@ -235,6 +235,22 @@ spec:
                         - host
                         - port
                         type: object
+                      credentialsRef:
+                        description: CredentialsRef is a reference to a Secret that
+                          contains the credentials to use for provisioning this cluster.
+                          If not supplied then the credentials of the controller will
+                          be used.
+                        properties:
+                          name:
+                            description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                            type: string
+                          namespace:
+                            description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                            type: string
+                        required:
+                        - name
+                        - namespace
+                        type: object
                       failureDomains:
                         description: FailureDomains is an optional field which is
                           used to assign selected availability zones to a cluster

controllers/gcpcluster_controller.go

@@ -57,6 +57,7 @@ type GCPClusterReconciler struct {
 // +kubebuilder:rbac:groups=cluster.x-k8s.io,resources=clusters;clusters/status,verbs=get;list;watch
 // +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=gcpclusters,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=infrastructure.cluster.x-k8s.io,resources=gcpclusters/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
 
 func (r *GCPClusterReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manager, options controller.Options) error {
 	log := log.FromContext(ctx).WithValues("controller", "GCPCluster")
@@ -133,7 +134,7 @@ func (r *GCPClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 		return ctrl.Result{}, nil
 	}
 
-	clusterScope, err := scope.NewClusterScope(scope.ClusterScopeParams{
+	clusterScope, err := scope.NewClusterScope(ctx, scope.ClusterScopeParams{
 		Client:     r.Client,
 		Cluster:    cluster,
 		GCPCluster: gcpCluster,

controllers/gcpmachine_controller.go

@@ -180,7 +180,7 @@ func (r *GCPMachineReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 	}
 
 	// Create the cluster scope
-	clusterScope, err := scope.NewClusterScope(scope.ClusterScopeParams{
+	clusterScope, err := scope.NewClusterScope(ctx, scope.ClusterScopeParams{
 		Client:     r.Client,
 		Cluster:    cluster,
 		GCPCluster: gcpCluster,