GCP CLI access

[r0mant]

Description

Teleport currently provides a way to log users in AWS console using federation API as well as access to AWS API via tsh aws and tsh proxy aws commands:

https://goteleport.com/docs/application-access/guides/aws-console/

Accessing Azure console/API is currently in progress.

We would like to add support for similar functionality for accessing GCP.

Success criteria

• Teleport provides tsh gcp command users can use to interact with GCP API.
• Users can start local GCP proxy with tsh proxy gcp which GCP API clients can use (e.g. terraform).

Next steps

Console access:

• Users can register a GCP dashboard in app access and connect to it with a selected user/role.
  • We need to investigate if GCP provides similar kind of functionality as AWS federation API that would allow Teleport to generate a sign-in link.
  • As far as we know this isn't possible. We will be able to support this once Teleport as SAML IdP #18043 is delivered.

Useful references

• Umbrella ticket for AWS/Azure/GCP access: Add support for Azure/GCP console access using SAML IdP #11780
• Azure access ticket (no PRs yet): Azure CLI access #16401
• AWS console access PR: AWS console access #7590
• AWS CLI access PR: AWS CLI access #8151

[r0mant]

@mdwn As we talked about before, let's start with GCP CLI access so cover only checkboxes 2 and 3 from the description.

Web console access will be covered later when we implement OIDC provider interface in Teleport which should work for both Azure and GCP. @Tener @smallinsky just FYI

[mdwn]

The draft branch for the RFD covering this can be seen here: https://github.com/gravitational/teleport/blob/mike.wilson/gcp-cli-rfd/rfd/0095-gcp-cli-support.md. This is very much in early stages, but if you're curious about where/what I'm thinking so far, you can see it there.

[Tener]

@mdwn As we talked about before, let's start with GCP CLI access so cover only checkboxes 2 and 3 from the description.

Web console access will be covered later when we implement OIDC provider interface in Teleport which should work for both Azure and GCP. @Tener @smallinsky just FYI

@r0mant I have started the work on Azure CLI access already; there are some Azure peculiarities to work through, but my initial impressions are good. I have az commands working already (in a totally hackish way), including az login which requires special treatment.

Web access will indeed most likely require Teleport to implement an OIDC provider interface (or a SAML IdP?).