Integration with GCP IAM

[pramodsetlur]

Describe the feature

Integrate Capsule with GKE and GCP IAM.

What would the new user story look like?

The ability to create a tenant with IAM users/groups in GCP would be helpful.

Eg:

apiVersion: capsule.clastix.io/v1beta1
kind: Tenant
metadata:
  annotations:
    clusterrolenames.capsule.clastix.io/user.pramod.setlur@emailaddress.com: editor,manager
  name: test-tenant
spec:
  owners:
    - kind: User
      name: pramod.setlur@emailaddress.com

Applying the above results in

The Tenant "test-tenant" is invalid: metadata.annotations: Invalid value: "clusterrolenames.capsule.clastix.io/user.pramod.setlur@emailaddress.com": name part must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]')

A user like pramod.setlur@emailaddress.com or a group like our-company-group@company.com can be used in giving the group/user Viewer access at the GCP project level but in turn have Capsule scope the permissions at the namespace level using Tenants.

Expected behavior

Ability to create a Capsule Tenant attached to the GCP IAM users/groups would allow an organization like ours to use existing GCP IAM and bind it with Tenants.