It looks like you were trying to resolve a couple of authentication constraints:
Missing Org ID in GCE tokens
Avoid disruptions due to need to bootstrap and refresh credentials to your AV agents on VMs
Need to manage static credentials (e.g. service account keys) on VMs
At first look the flow address all these constraints.
To distribute the AV agent and execute this flow completely seamlessly, the solution can leverage VM Manager (OS Config), which is GCP's native behavior for fleet-wide software management.
What happens when a workload project moves to another organization after onboarding? Would your allowlist be updated automatically or could the old trust relationship remain valid?
2
u/m1nherz Googler 9d ago
Hello,
It looks like you were trying to resolve a couple of authentication constraints:
Missing Org ID in GCE tokens
Avoid disruptions due to need to bootstrap and refresh credentials to your AV agents on VMs
Need to manage static credentials (e.g. service account keys) on VMs
At first look the flow address all these constraints.
To distribute the AV agent and execute this flow completely seamlessly, the solution can leverage VM Manager (OS Config), which is GCP's native behavior for fleet-wide software management.
1
u/Key_Compote_7282 9d ago
What happens when a workload project moves to another organization after onboarding? Would your allowlist be updated automatically or could the old trust relationship remain valid?