Google: Implement groups fetch by default service account from metadata (support for GKE workload identity)

[vsychov]

Overview

Hello,

This pull request addresses the need to fetch groups using the default service account from metadata in the Dex Google Connector. It adds more robust support for Google Cloud Platform environments, particularly GKE Workload Identity, and increases the module's resilience and versatility.

What this PR does / why we need it

Fix #2676

Special notes for your reviewer

Does this PR introduce a user-facing change?

No

Implement groups fetch by default service account from metadata (support for GKE workload identity)

Docs PR: dexidp/website#138

[nabokihms]

Hello, @vsychov. Thank you for opening this PR. For now, non of the maintainers has access to the Google provider, so testing changes for us is a special kind of pain.

Probably, we will hold with this PR for a while until we find a proper way to test it. Sorry for the inconvenience 😞

[LaloLoop]

Hello @nabokihms, I have access to a Google provider. I'll start by building an image and use it to try it out. Please let me know if I can help out further with the review process.
Thanks!

[milesarmstrong]

@nabokihms I notice this was added v2.38.0 milestone, anything we can do to help it progress?

[jace-ys]

👋🏻 FWIW, we've recently tested a very similar change (with domain delegation) in another tool that we use, and things seem to work as expected!

gocardless/theatre#330

[czuares]

@nabokihms the documentation change merged in dexidp/website#138 references features that are not available yet as this PR was not merged. This caused some confusion for myself and my team.

[mikebryant]

We just hit this too - relied on the docs and have only found this after debugging it not working :(

[irons]

There's a small merge conflict in the go.mod file, but after fixing that locally, I also get good results from this PR, after banging my head on the failure. (We disable service account key creation org-wide, so we either have to rely on workload identity for group retrieval, or give up on Dex and the Google connector.) There's a pile of moving parts to rule out whenever something related to Workload Identity goes wrong, so it took a frustrating couple of days to suspect and then prove that the code simply wasn't doing what it's documented to do.

[vsychov]

Hey @nabokihms , I've resolved conflicts with the master. Is there a chance this will be merged? This is a working PR that has been tested by several people under different conditions, as seen from the comments above.

[vsychov]

Hello @sagikazarmark , maybe you also can take a look?

[nightwatch92]

Is this going to be merged ?

[nabokihms]

It's been a while since PR was introduced. Thanks everyone for waiting. We decided to take this as it is now and hope everything will be fine.

@vsychov thanks you a lot for your effort and patience.

[StepanKuksenko]

Thank you guys I've just tested this feature and it works well.
The only thing left is to bring the documentation dexidp/website#166 back to the website.