My GCP project has an instance running a Jenkins server behind an IAP-protected load balancer.
Adding the IAP protection has caused me 2 related issues that I didn't manage to resolve (and I guess both could be resolved in a similar manner):
I used to have a physical Jenkins slave (that must be physical as it's connected to special hardware) that was connected to the cloud Jenkins server. Now that the cloud server is protected by IAP, the on-premises Jenkins slave can no longer cannot to it as the slave JNLP app doesn't know how to authorize with the Google login interface. (EDIT: I got around this specific issue eventually by creating an SSH tunnel for the slave directly to the Jenkins server machine)
I used to have a BitBucket-Cloud repository that
POSTs to the Jenkins server via BitBucket's webhook functionality. BitBucket also doesn't know how to authorize with IAP so it too doesn't work anymore.
It seems that Google supports authorization programmatically but in both cases I have no programmatic control over the entity that needs to communicate with the Jenkins server.
Is there any way to get around this issue? I have several directions in mind, but I'm not sure what's the best way to do it / if it's even possible:
Is there any way to simply white-list specific URL's in IAP so they don't require any authorization? For example, allow authorization-free access for everyone to
https://my.jenkins.domain.com/bitbucket-scmsource-hook/notifyso BitBucket can webhook? (I know it's not optimal security-wise)
Is there any way to white-list access from specific IP's? Allow all requests from BitBucket Cloud and all requests from the physical slave to go through without IAP requiring their authentication. It's obviously also not optimal security wise.
Maybe create another parallel IAP-less load-balancer that also routes to the Jenkins server which I will specifically configure to white-list the URL/IP's as I described above and black-list everything else, and have BitBucket and the physical slave connect to it instead of the regular load-balancer. Same security issues considerations as the solutions above, very complicated, required another domain name. Not optimal at all. But it's the only practical solution I can think of.
What do you think? Do you have better, simpler, more secure ideas? Maybe I'm missing some obvious way to do this? I couldn't find anything in the IAP documentation regarding how to achieve something like this.