Skip to content

Commit db124d2

Browse files
henrydehenryde
committed
feat: workload identity federation
1 parent bd04193 commit db124d2

File tree

21 files changed

+167
-45
lines changed

21 files changed

+167
-45
lines changed

‎README.md

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -138,11 +138,13 @@ Before opening a Pull Request, we recommend following the below steps to get a f
138138

139139
| Name | Version |
140140
|------|---------|
141-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
141+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
142142

143143
## Providers
144144

145-
No providers.
145+
| Name | Version |
146+
|------|---------|
147+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
146148

147149
## Modules
148150

@@ -154,7 +156,10 @@ No providers.
154156

155157
## Resources
156158

157-
No resources.
159+
| Name | Type |
160+
|------|------|
161+
| [google_iam_workload_identity_pool.meshstack](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/iam_workload_identity_pool) | resource |
162+
| [google_iam_workload_identity_pool_provider.meshstack](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/iam_workload_identity_pool_provider) | resource |
158163

159164
## Inputs
160165

@@ -173,6 +178,8 @@ No resources.
173178
| <a name="input_org_id"></a> [org\_id](#input\_org\_id) | GCP Organization ID that holds the projects that generate billing data that the service account should import. | `string` | n/a | yes |
174179
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | GCP Project ID where to create the resources. This is typically a 'meshstack-root' project. | `string` | n/a | yes |
175180
| <a name="input_replicator_sa_name"></a> [replicator\_sa\_name](#input\_replicator\_sa\_name) | Name of the service account to create for Replicator. | `string` | `"mesh-replicator-service-tf"` | no |
181+
| <a name="input_service_account_keys"></a> [service\_account\_keys](#input\_service\_account\_keys) | Create service account keys for authentication. | `bool` | `true` | no |
182+
| <a name="input_workload_identity_federation"></a> [workload\_identity\_federation](#input\_workload\_identity\_federation) | Setup workload identity federation for authentication. | <pre>object({<br> workload_identity_pool_identifier = string<br> issuer = string<br> audience = string<br> replicator_subject = string<br> kraken_subject = string<br> })</pre> | `null` | no |
176183

177184
## Outputs
178185

‎main.tf

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@ module "kraken_sa" {
88

99
cloud_billing_export_project_id = var.cloud_billing_export_project_id
1010
cloud_billing_export_dataset_id = var.cloud_billing_export_dataset_id
11+
12+
service_account_key = var.service_account_keys
13+
workload_identity_federation = var.workload_identity_federation == null ? null : {
14+
pool_id = google_iam_workload_identity_pool.meshstack[0].name
15+
subject = var.workload_identity_federation.kraken_subject
16+
}
1117
}
1218

1319
module "replicator_sa" {
@@ -21,6 +27,12 @@ module "replicator_sa" {
2127
landing_zone_folder_ids = var.landing_zone_folder_ids
2228

2329
billing_account_id = var.billing_account_id
30+
31+
service_account_key = var.service_account_keys
32+
workload_identity_federation = var.workload_identity_federation == null ? null : {
33+
pool_id = google_iam_workload_identity_pool.meshstack[0].name
34+
subject = var.workload_identity_federation.replicator_subject
35+
}
2436
}
2537

2638
module "carbon_export" {
@@ -31,4 +43,4 @@ module "carbon_export" {
3143

3244
cloud_carbon_export_project_id = var.cloud_carbon_export_project_id # using the same project as for billing
3345
cloud_carbon_export_dataset_id = var.cloud_carbon_export_dataset_id
34-
}
46+
}

‎modules/meshcloud-carbon-export/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
6+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
77

88
## Providers
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_google"></a> [google](#provider\_google) | 4.11.0 |
12+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
1313

1414
## Modules
1515

@@ -19,7 +19,7 @@ No modules.
1919

2020
| Name | Type |
2121
|------|------|
22-
| [google_bigquery_dataset_iam_member.read_carbon_export](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/bigquery_dataset_iam_member) | resource |
22+
| [google_bigquery_dataset_iam_member.read_carbon_export](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/bigquery_dataset_iam_member) | resource |
2323

2424
## Inputs
2525

‎modules/meshcloud-carbon-export/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
google = {
44
source = "hashicorp/google"
5-
version = "4.11.0"
5+
version = "5.19.0"
66
}
77
}
88
}

‎modules/meshcloud-kraken-service-account/README.md

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
6+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
77

88
## Providers
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_google"></a> [google](#provider\_google) | 4.11.0 |
12+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
1313

1414
## Modules
1515

@@ -19,13 +19,14 @@ No modules.
1919

2020
| Name | Type |
2121
|------|------|
22-
| [google_bigquery_dataset_iam_member.read_billing_export](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/bigquery_dataset_iam_member) | resource |
23-
| [google_folder_iam_member.kraken_service](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/folder_iam_member) | resource |
24-
| [google_organization_iam_custom_role.meshcloud_kraken_sa](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/organization_iam_custom_role) | resource |
25-
| [google_project_iam_member.bigquery_jobuser](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/project_iam_member) | resource |
26-
| [google_project_service.bigquery_api](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/project_service) | resource |
27-
| [google_service_account.meshcloud_kraken_sa](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/service_account) | resource |
28-
| [google_service_account_key.sa_key](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/service_account_key) | resource |
22+
| [google_bigquery_dataset_iam_member.read_billing_export](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/bigquery_dataset_iam_member) | resource |
23+
| [google_folder_iam_member.kraken_service](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/folder_iam_member) | resource |
24+
| [google_organization_iam_custom_role.meshcloud_kraken_sa](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/organization_iam_custom_role) | resource |
25+
| [google_project_iam_member.bigquery_jobuser](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/project_iam_member) | resource |
26+
| [google_project_service.bigquery_api](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/project_service) | resource |
27+
| [google_service_account.meshcloud_kraken_sa](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/service_account) | resource |
28+
| [google_service_account_iam_member.kraken](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/service_account_iam_member) | resource |
29+
| [google_service_account_key.sa_key](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/service_account_key) | resource |
2930

3031
## Inputs
3132

@@ -37,6 +38,8 @@ No modules.
3738
| <a name="input_meshstack_root_project_id"></a> [meshstack\_root\_project\_id](#input\_meshstack\_root\_project\_id) | GCP Project ID where to create the service account. This is typically a 'meshstack-root' project. | `string` | n/a | yes |
3839
| <a name="input_org_id"></a> [org\_id](#input\_org\_id) | GCP Organization ID that holds the projects that generate billing data that the service account should import. | `string` | n/a | yes |
3940
| <a name="input_sa_name"></a> [sa\_name](#input\_sa\_name) | Name of the service account to create. | `string` | n/a | yes |
41+
| <a name="input_service_account_key"></a> [service\_account\_key](#input\_service\_account\_key) | n/a | `bool` | `true` | no |
42+
| <a name="input_workload_identity_federation"></a> [workload\_identity\_federation](#input\_workload\_identity\_federation) | n/a | <pre>object({<br> pool_id = string<br> subject = string<br> })</pre> | n/a | yes |
4043

4144
## Outputs
4245

‎modules/meshcloud-kraken-service-account/module.tf

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,21 @@ resource "google_folder_iam_member" "kraken_service" {
5050
member = "serviceAccount:${google_service_account.meshcloud_kraken_sa.email}"
5151
}
5252

53-
# You can obtain the json representation of the sa key to put it into vault
54-
# from the terraform state. Simply base64 decode what's in the private_key field
5553
resource "google_service_account_key" "sa_key" {
54+
count = var.service_account_key ? 1 : 0
5655
service_account_id = google_service_account.meshcloud_kraken_sa.id
5756
}
57+
58+
moved {
59+
from = google_service_account_key.sa_key
60+
to = google_service_account_key.sa_key[0]
61+
}
62+
63+
# For workload identity federation create an IAM policy allowing the kraken subject to impersonate the service account.
64+
resource "google_service_account_iam_member" "kraken" {
65+
count = var.workload_identity_federation == null ? 0 : 1
66+
67+
service_account_id = google_service_account.meshcloud_kraken_sa.id
68+
role = "roles/iam.workloadIdentityUser"
69+
member = "principal://iam.googleapis.com/${var.workload_identity_federation.pool_id}/subject/${var.workload_identity_federation.subject}"
70+
}

‎modules/meshcloud-kraken-service-account/outputs.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
output "sa_key" {
2-
value = google_service_account_key.sa_key.private_key
2+
value = var.service_account_key ? google_service_account_key.sa_key[0].private_key : null
33
description = "Service account key (base64 encoded credential.json)."
44
sensitive = true
55
}

‎modules/meshcloud-kraken-service-account/variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,15 @@ variable "landing_zone_folder_ids" {
2727
type = set(string)
2828
description = "GCP Folders that make up the Landing Zone. The service account will only receive permissions on these folders."
2929
}
30+
31+
variable "service_account_key" {
32+
default = true
33+
type = bool
34+
}
35+
36+
variable "workload_identity_federation" {
37+
type = object({
38+
pool_id = string
39+
subject = string
40+
})
41+
}

‎modules/meshcloud-kraken-service-account/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
google = {
44
source = "hashicorp/google"
5-
version = "4.11.0"
5+
version = "5.19.0"
66
}
77
}
88
}

‎modules/meshcloud-replicator-lz-access-cloudfunction/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
6+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
77

88
## Providers
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_google"></a> [google](#provider\_google) | 4.11.0 |
12+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
1313

1414
## Modules
1515

@@ -19,7 +19,7 @@ No modules.
1919

2020
| Name | Type |
2121
|------|------|
22-
| [google_cloudfunctions_function_iam_member.invoker](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/cloudfunctions_function_iam_member) | resource |
22+
| [google_cloudfunctions_function_iam_member.invoker](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/cloudfunctions_function_iam_member) | resource |
2323

2424
## Inputs
2525

0 commit comments

Comments
 (0)