Google: Implement groups fetch by default service account from metadata (support for GKE workload identity)

[vsychov]

Overview

Hello,

This pull request addresses the need to fetch groups using the default service account from metadata in the Dex Google Connector. It adds more robust support for Google Cloud Platform environments, particularly GKE Workload Identity, and increases the module's resilience and versatility.

What this PR does / why we need it

Fix #2676

Special notes for your reviewer

Does this PR introduce a user-facing change?

No

Implement groups fetch by default service account from metadata (support for GKE workload identity)

Docs PR: https://github.com/dexidp/website/pull/138

[LaloLoop]

Hello @nabokihms, I have access to a Google provider. I'll start by building an image and use it to try it out. Please let me know if I can help out further with the review process. Thanks!

[milesarmstrong]

@nabokihms I notice this was added v2.38.0 milestone, anything we can do to help it progress?

[jace-ys]

👋🏻 FWIW, we've recently tested a very similar change (with domain delegation) in another tool that we use, and things seem to work as expected!

https://github.com/gocardless/theatre/pull/330

[czuares]

@nabokihms the documentation change merged in dexidp/website#138 references features that are not available yet as this PR was not merged. This caused some confusion for myself and my team.

[mikebryant]

We just hit this too - relied on the docs and have only found this after debugging it not working :(

[irons]

There's a small merge conflict in the go.mod file, but after fixing that locally, I also get good results from this PR, after banging my head on the failure. (We disable service account key creation org-wide, so we either have to rely on workload identity for group retrieval, or give up on Dex and the Google connector.) There's a pile of moving parts to rule out whenever something related to Workload Identity goes wrong, so it took a frustrating couple of days to suspect and then prove that the code simply wasn't doing what it's documented to do.

[vsychov]

Hey @nabokihms , I've resolved conflicts with the master. Is there a chance this will be merged? This is a working PR that has been tested by several people under different conditions, as seen from the comments above.

[vsychov]

Hello @sagikazarmark , maybe you also can take a look?

[nightwatch92]

Is this going to be merged ?

[StepanKuksenko]

Thank you guys I've just tested this feature and it works well. The only thing left is to bring the documentation https://github.com/dexidp/website/pull/166 back to the website.