<p>I've follow the documentation about <a href="https://cloud.google.com/iap/docs/enabling-kubernetes-howto" rel="nofollow noreferrer">how to enable IAP on GKE</a>.</p>

<p>I've:</p>

<ol>
<li>configured the consent screen</li>
<li>Create OAuth credentials</li>
<li>Add the universal redirect URL</li>
<li>Add myself as <code>IAP-secured Web App User</code></li>
</ol>

<p>And write my deployment like this:</p>

<pre class="lang-yaml prettyprint-override"><code>data:
  client_id: &lt;my_id&gt;
  client_secret: &lt;my_secret&gt;
kind: Secret
metadata:
  name: backend-iap-secret
type: Opaque
---
apiVersion: v1
kind: Service
metadata:
  name: grafana
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 3000
  selector:
    k8s-app: grafana
  type: NodePort
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: grafana
spec:
  replicas: 1
  template:
    metadata:
      labels:
        k8s-app: grafana
    spec:
      containers:
      - env:
        - name: GF_SERVER_HTTP_PORT
          value: "3000"
        image: docker.io/grafana/grafana:6.7.1
        name: grafana
        ports:
        - containerPort: 3000
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /api/health
            port: 3000
---
apiVersion: cloud.google.com/v1beta1
kind: BackendConfig
metadata:
  name: backend-config-iap
spec:
  iap:
    enabled: true
    oauthclientCredentials:
      secretName: backend-iap-secret
---
apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
  name: monitoring-tls
spec:
  domains:
  - monitoring.foo.com
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    beta.cloud.google.com/backend-config: '{"default": "backend-config-iap"}'
    kubernetes.io/ingress.global-static-ip-name: monitoring
    networking.gke.io/managed-certificates: monitoring-tls
  name: grafana
spec:
  backend:
    serviceName: grafana
    servicePort: 443

</code></pre>

<p>When I look at my ingress I've this:</p>

<pre class="lang-sh prettyprint-override"><code>$ k describe ingress
Name:             grafana
[...]
Annotations:  beta.cloud.google.com/backend-config: {"default": "backend-config-iap"}
              ingress.kubernetes.io/backends: {"k8s-blabla":"HEALTHY"}
              [...] 
Events:       &lt;none&gt;
$
</code></pre>

<p>I can connect to the web page without any problem, the grafana is up and running, but I can also connect without being authenticated (witch is a problem).</p>

<p>So everything look fine, but IAP is not activated, why ?</p>

<p>The worst is that, if I enable it manualy it work but if I redo <code>kubectl apply -f monitoring.yaml</code> IAP is disabled.</p>

<p>What am I missing ?</p>

<hr>

<p>Because my secret values are stored in secret manager (and retrieved at build time) I suspected my secret to have some glitches (spaces, \n, etc.) in them so I've add a script to test it:</p>

<pre class="lang-sh prettyprint-override"><code>gcloud compute backend-services update \
  --project=&lt;my_project_id&gt; \
  --global \
  $(kubectl get ingress grafana -o json | jq -r '.metadata.annotations."ingress.kubernetes.io/backends"' | jq -r 'keys[0]') \
  --iap=enabled,oauth2-client-id=$(gcloud --project="&lt;my_project_id&gt;" beta secrets versions access latest --secret=Monitoring_client_id),oauth2-client-secret=$(gcloud --project="&lt;my_project_id&gt;" beta secrets versions access latest --secret=Monitoring_secret)
</code></pre>

<p>And now IAP is properly enabled with the correct OAuth Client, so my secrets are "clean"</p>

<p>By the way, I also tried to rename secret variables like this (from client_id):
* oauth_client_id
* oauth-client-id
* clientID (<a href="https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig#oauthclientcredentials_v1beta1_cloudgooglecom" rel="nofollow noreferrer">like in backend documentation</a> )</p>

<p>I've also write the value in the backend like this:</p>

<pre class="lang-yaml prettyprint-override"><code>kind: BackendConfig
metadata:
  name: backend-config-iap
spec:
  iap:
    enabled: true
    oauthclientCredentials:
      secretName: backend-iap-secret
      clientID: &lt;value&gt;
      clientSecret: &lt;value&gt;
</code></pre>

<p>But doesn't work either.</p>

<hr>

<p><strong>Erratum</strong>:</p>

<p>The fact that the IAP is destroyed when I deploy again (after I enable it in web UI) is part of my deployment script in this test (I made a kubectl delete before).</p>

<p>But nevertheless, I can't enable IAP only with my backend configuration.</p>

<hr>

<p>As suggested I've filed a bug report: <a href="https://issuetracker.google.com/issues/153475658" rel="nofollow noreferrer">https://issuetracker.google.com/issues/153475658</a></p>

<hr>

<p>Solution given by <a href="https://stackoverflow.com/users/1432893/totem">Totem</a></p>

<p>Change given yaml with this:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.global-static-ip-name: monitoring
    networking.gke.io/managed-certificates: monitoring-tls
  name: grafana
[...]
---
apiVersion: v1
kind: Service
metadata:
  name: grafana
  annotations:
    beta.cloud.google.com/backend-config: '{"default": "backend-config-iap"}'
[...]
</code></pre>

<p>The backend is associated with the service and not the Ingress...
Now it Works !</p>

<p>You did everything right, just a one small change:
The annotation should be added on the Service resource</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  annotations:
    beta.cloud.google.com/backend-config: '{"ports": { "443":"backend-config-iap"}}'
  name: grafana
</code></pre>

<p>Usually you need to associate it with a port so ive added this example above, but make sure it works with 443 as expected.</p>

<p>this is based on internal example im using:</p>

<pre><code>beta.cloud.google.com/backend-config: '{"ports": { "3000":"be-cfg}}'
</code></pre>
