Could not configure CICD pipeline for stages repositories

[gabyshev]

Hello,

I'm following FAST step by step and got stuck and the configuration of CICD repositories.

Root level README.md says that cloud foundation fabric repo supposed to be forked. Ok, I did that.

In 0-bootstrap stage there is a CICD section. I did extra stage to automate the creation of private repos for initial stages (I'm working with Github).
In that repos, source is pointing at git@github.com:GoogleCloudPlatform/cloud-foundation-fabric.git//source-repository?ref=v27.0.0. I changed that to point to my forked repo of cloud foundation fabric (I guess that's my modules?).

Added deploy key but then I see that in generated workflow file for my 0-bootstrap stage it also needs CICD_MODULES_KEY. I put the same public key as in my modules repo.

After that I created a test PR and it failed at step Copy Terraform Output files.

All variables are looking correct. Here is the error message. What am I doing wrong?

Run gcloud alpha storage cp -r \
  gcloud alpha storage cp -r \
    "gs://xxx-iac-core-outputs-0/providers/0-bootstrap-providers.tf" ./
  shell: /usr/bin/bash -e {0}
  env:
    FAST_OUTPUTS_BUCKET: xxx-iac-core-outputs-0
    FAST_SERVICE_ACCOUNT: xxx-bootstrap-1@xxx-iac-core-0.iam.gserviceaccount.com
    FAST_WIF_PROVIDER: projects/123123/locations/global/workloadIdentityPools/xxx-bootstrap/providers/xxx-bootstrap-github-sample
    SSH_AUTH_SOCK: /tmp/ssh_agent.sock
    TF_PROVIDERS_FILE: 0-bootstrap-providers.tf
    TF_VERSION: 1.4.4
    CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE: /home/runner/work/fast_00_bootstrap/fast_00_bootstrap/gha-creds-123123.json
    GOOGLE_APPLICATION_CREDENTIALS: /home/runner/work/fast_00_bootstrap/fast_00_bootstrap/gha-creds-123123.json
    GOOGLE_GHA_CREDS_PATH: /home/runner/work/fast_00_bootstrap/fast_00_bootstrap/gha-creds-123123.json
    CLOUDSDK_CORE_PROJECT: xxx-iac-core-0
    CLOUDSDK_PROJECT: xxx-iac-core-0
    GCLOUD_PROJECT: xxx-iac-core-0
    GCP_PROJECT: xxx-iac-core-0
    GOOGLE_CLOUD_PROJECT: xxx-iac-core-0
    CLOUDSDK_METRICS_ENVIRONMENT: github-actions-setup-gcloud
  

ERROR: (gcloud.alpha.storage.cp) There was a problem refreshing your current auth tokens: ('Unable to acquire impersonated credentials', '{\n  "error": {\n    "code": 403,\n    "message": "Permission \'iam.serviceAccounts.getAccessToken\' denied on resource (or it may not exist).",\n    "status": "PERMISSION_DENIED",\n    "details": [\n      {\n        "@type": "type.googleapis.com/google.rpc.ErrorInfo",\n        "reason": "IAM_PERMISSION_DENIED",\n        "domain": "iam.googleapis.com",\n        "metadata": {\n          "permission": "iam.serviceAccounts.getAccessToken"\n        }\n      }\n    ]\n  }\n}\n')
Please run:

  $ gcloud auth login

to obtain new credentials.

If you have already logged in with a different account, run:

  $ gcloud config set account ACCOUNT

to select an already authenticated account to use.
Error: Process completed with exit code 1.

When executing 0-bootstrap stage I put those variable regarding federated identity providers and cicd:

federated_identity_providers = {
  github-sample = {
    attribute_condition = "attribute.repository_owner==\"myorg""
    issuer              = "github"
  }
}

cicd_repositories = {
  bootstrap = {
    branch            = "main"
    identity_provider = "github-sample"
    name              = "myorg/fast_00_bootstrap"
    type              = "github"
  }

[ludoo]

Remove the main branch:

cicd_repositories = {
  bootstrap = {
    branch            = null
    identity_provider = "github-sample"
    name              = "myorg/fast_00_bootstrap"
    type              = "github"
  }

[gabyshev]

Thanks @ludoo ! It helped but now it got stuck at terraform init step.

Apparently it could not get modules from cloud foundation fabric forked repository. What is the right way to setup modules?

[ludoo]

Well it depends: we usually implement a separate modules repo, but you can also reference our public repo. You need to change each module source = "" declaration in the stage of course.

It's not our design, it's just regular Terraform modules.

[gabyshev]

I found what was the source of the problem.

The generated source looked like this:

  source       = "git@github.com:GoogleCloudPlatform/cloud-foundation-fabric.git//iam-service-account?ref=v27.0.0"

I changed that to:

  source       = "git@github.com:GoogleCloudPlatform/cloud-foundation-fabric.git//modules/iam-service-account?ref=v27.0.0"

Thanks for the support @ludoo !