Add Upbound auth source and support for federated identity

[hasheddan]

Description of your changes

Adds an Upbound identity source to ProviderConfig to support federated
identity via OIDC.

Signed-off-by: hasheddan georgedanielmangum@gmail.com

TODO:
- Add example manifests

I have:

• Run make reviewable test to ensure this PR is ready for review.

How has this code been tested

Tested creating a bucket and was able to do so successfully. Also verified various invalid conditions:

1. The attached service account does not have enough permissions.

    - lastTransitionTime: "2023-02-02T20:18:25Z"
      message: 'apply failed: googleapi: Error 403: proidc-dev-test@crossplane-playground.iam.gserviceaccount.com
        does not have storage.buckets.create access to the Google Cloud project. Permission
        ''storage.buckets.create'' denied on resource (or it may not exist)., forbidden: '
      reason: ApplyFailure
      status: "False"
      type: LastAsyncOperation

2. The audience of the token is invalid.

    - lastTransitionTime: "2023-02-02T20:34:36Z"
      message: 'observe failed: cannot run refresh: refresh failed: Error when reading
        or editing Storage Bucket "really-cool-proidc-test": Get "https://storage.googleapis.com/storage/v1/b/really-cool-proidc-test?alt=json&prettyPrint=false":
        oauth2/google: unable to generate access token: Post "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/proidc-dev-test@crossplane-playground.iam.gserviceaccount.com:generateAccessToken":
        oauth2/google: status code 400: {"error":"invalid_grant","error_description":"The
        audience in ID Token [sts.amazonaws.com] does not match the expected audience
        sts.amazonaws.coms."}: '
      reason: ReconcileError
      status: "False"
      type: Synced

3. The token does not satisfy constraints for performing the exchange.

    - lastTransitionTime: "2023-02-02T20:26:13Z"
      message: 'observe failed: cannot run refresh: refresh failed: Error when reading
        or editing Storage Bucket "really-cool-proidc-test": Get "https://storage.googleapis.com/storage/v1/b/really-cool-proidc-test?alt=json&prettyPrint=false":
        oauth2/google: unable to generate access token: Post "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/proidc-dev-test@crossplane-playground.iam.gserviceaccount.com:generateAccessToken":
        oauth2/google: status code 400: {"error":"unauthorized_client","error_description":"The
        given credential is rejected by the attribute condition."}: '
      reason: ReconcileError
      status: "False"
      type: Synced

[hasheddan]

This diff appears to be unrelated to changes here -- same check was failing on master.

[ezgidemirel]

Hey @hasheddan, the change LGTM. But I leave the decision to @ulucinar and @sergenyalcin :)

[ulucinar]

Suggested change

	Federation *Federation `json:"federation"`
	Federation *Federation `json:"federation,omitempty"`

[hasheddan]

Ah good catch!

[ulucinar]

I assume the credential file does not contain the name of the service account, right?

[hasheddan]

@ulucinar correct -- the mechanics are somewhat subtle: the file being referenced is the Upbound identity token, and we are using it to construct the GCP federated identity data (which is usually stored as a file, but we are just constructing it in-memory). So the credential source file here is just a JWT.

[ulucinar]

nit: Should we add some validation markers for these (at least to make sure they are non-empty)?

[hasheddan]

@ulucinar I would love to -- what is y'all's current standard here? Just using validation such as min-length or have y'all started incorporating CEL experessions?

[ulucinar]

I believe just a length check would be great for now if you also think it's worth. I don't know of any examples of regex checking or CEL-expressions yet. Unfortunately, we do not have a high standard here yet :)

[hasheddan]

@ulucinar sounds reasonable -- thanks for the suggestion and context!

[hasheddan]

updated!

[ulucinar]

Thank you @hasheddan, lgtm.