IaP not on by default for HTTPRoute & public Gateway, how to enforce to avoid public access

[pascalwhoop]

Hi all,

we use HTTPRoute + Gateway on GKE. We also have IaP in front of our applications. However, when I create a new HTTPRoute to e.g. ArgoCD or MLFlow, it is by default not protected. I need to remember going into the UI and manually enabling IaP for that application in the Console.

Is there any way to set a rule in GKE globally that any HTTPRoute needs to be IaP protected for a specific gateway? 

[garisingh]

There is not global setting for this, but you can use GCPBackendPolicy to attach IAP policy as part of deploying services.

apiVersion: networking.gke.io/v1
kind: GCPBackendPolicy
metadata:
  name: backend-policy
spec:
  default:
    iap:
      enabled: true
      oauth2ClientSecret:
        name: SECRET_NAME
      clientID: CLIENT_ID
  targetRef:
    group: ""
    kind: Service
    name: lb-service