Task: Implement Service Provider google config connector (kcc)

Understand the Task

Description

Deploy the google config operator via its Helm Chart by creating a Flux OCIRepository and HelmRelease on the platform cluster in the respective namespace (the namespace is given by the service provider template). (Probably)

KCC does not officially support Workload Identity Federation for non-GKE clusters. However, there is a workaround:

Workaround for WIF Support:

1. Create Kind cluster with custom OIDC issuer - Configure the API server with a custom service-account-issuer URL
2. Export JWKS and upload to GCP - Extract the cluster's public keys (/openid/v1/jwks) and register them with a GCP Workload Identity Pool + OIDC Provider
3. Patch Config Connector StatefulSet - After installation, patch cnrm-controller-manager to:
   • Mount a projected ServiceAccount token with the correct WIF audience
   • Mount a credential configuration file (type: external_account)
   • Set GOOGLE_APPLICATION_CREDENTIALS to point to the credential config
4. Scale down Config Connector Operator - The operator must be stopped to prevent it from reverting the patches
5. Increase webhook memory limit - Default 128Mi causes OOMKilled errors; increase to 512Mi

Note: This workaround requires manual patching after each Config Connector upgrade.

Since WIF would be a great addition, we should discuss if were able to add this, or if it does not meet the quality standarts.

Any further valuable resources.

• https://docs.cloud.google.com/config-connector/docs/overview
• https://github.com/GoogleCloudPlatform/k8s-config-connector

What is required to accept the Task as done.

Done Criteria

• ...
• Code has been reviewed by other team members
• Internal technical Documentation created/updated
• New / changed code is documented
• Unit Tests created for new code or existing Unit Tests updated
• Integration Test Suite updated
• Enduser Documentation updated (if applicable)
• Successful demonstration in Review

Start by reading the Config Connector overview and the linked k8s-config-connector project, then review how the service provider template supplies its namespace. Define the OCIRepository and HelmRelease deployment requirements, including whether the non-GKE Workload Identity Federation workaround is acceptable; the issue's done criteria need to be completed before implementation can be considered finished.