Enabling IAP with Gateway resources

[jlewi]

With the new Gateway resource is IAP still configured the same way using BackendConfig or has this changed?

I'm using the new Kubernetes Gateway Resource to create an external loadbalancer to expose services.
https://cloud.google.com/kubernetes-engine/docs/how-to/gatewayclass-capabilities#gateway

I use a GKE Backend config to enable IAP. This doesn't appear to properly enable IAP on the backend service that gets created.

The gateway resource shows the error

Warning SYNC 28s sc-gateway-controller error ensuring load balancer: generic::invalid_argument: Update: Invalid value for field 'resource.iap.oauth2ClientId': ''. IAP OAuth2 client ID must be set if IAP is enabled.

However my BackendConfig resource correctly sets the oauth2credentials secret (see below)

When I go to the IAP UI, I see an error that the oauth client id is not set and telling me to reenable IAP. When I reenable IAP on the backend service via the UI; it is turned on and everything works correctly. The only place I specified the OAuth2 config is in the BackendConfig so it does appear to be getting the OAuth2 credentials from there.

The documentation is unclear about whether this is supported or not. I'm not sure if the "-" for IAP on the capabilities page means IAP doesn't work with the gateway resource or it means its not configured by the gateway resource but via the BackendConfig. I'm assuming the latter.

I'm using the gateway class: gke-l7-global-external-managed

Here's the YAML for my GKEBackendConfig

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
name: mesh
spec:
healthCheck:
type: HTTP
requestPath: /healthz/ready
port: 15021
iap:
enabled: true
oauthclientCredentials:
secretName: iap-oauth

[Willbin]

Hello jlewi,

Welcome to Google Cloud Community!

You may use these documents for Enabling IAP in GKE and Configuring BackendConfig.

[jlewi]

I'm following those docs. I'm setting my BackendConfig as provided in my original post but the gateway controller is giving me an error and not turning on IAP unless I toggle it on and off.

[garisingh]

IAP is not currently supported by Gateway, but we will be releasing support soon!

[NissesSenap]

Couldn't find any issue around this, but I created https://issuetracker.google.com/issues/286372106  sadly after I saw garisingh comment about it's coming.

Ohh well, hopefully people be able to find this post trough there if nothing else.

[rueth]

IAP is now available for the GKE Gateway:
https://cloud.google.com/kubernetes-engine/docs/how-to/configure-gateway-resources#configure_iap

[gratus]

Thanks @rueth - is there a way to apply IAP to only a path?

I have two paths that go to the same backend service - /api, and /console - I want to only put /console behind IAP.

Thanks

[gratus]

What I have done for now is to define two services and apply IAP to one service. The services target the same pods, but are matched to all the paths that need IAP.