Support Service Account Impersonation

[hessjcg]

Add support for configuring the proxy's Service Account Impersonation flag --impersonate-service-account

[enocom]

I think we should hold off on this until there's compelling user interest. Closing for now.

[jadenlemmon]

@enocom Answering question from here.

Our use case is we have a pod that needs access to GCP services such as Cloud Storage. This same pod also needs to access Cloud SQL. We access Cloud SQL via an IAM user added as a user on the instance. We don't want to add the pod service account as an IAM user on the Cloud SQL instance but prefer to access via service account impersonation.

This is so we can maintain simplicity at the Postgres level itself by only managing one user but can grant access to the Cloud SQL instance by granting impersonation rights to other acting service accounts.

[enocom]

Sounds totally legitimate. Thanks for the info. We'll get this feature merged.