Skip to content

Commit db124d2

Browse files
henrydehenryde
committed
feat: workload identity federation
1 parent bd04193 commit db124d2

File tree

21 files changed

+167
-45
lines changed

21 files changed

+167
-45
lines changed

‎README.md

+10-3
Original file line numberDiff line numberDiff line change
@@ -138,11 +138,13 @@ Before opening a Pull Request, we recommend following the below steps to get a f
138138

139139
| Name | Version |
140140
|------|---------|
141-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
141+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
142142

143143
## Providers
144144

145-
No providers.
145+
| Name | Version |
146+
|------|---------|
147+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
146148

147149
## Modules
148150

@@ -154,7 +156,10 @@ No providers.
154156

155157
## Resources
156158

157-
No resources.
159+
| Name | Type |
160+
|------|------|
161+
| [google_iam_workload_identity_pool.meshstack](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/iam_workload_identity_pool) | resource |
162+
| [google_iam_workload_identity_pool_provider.meshstack](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/iam_workload_identity_pool_provider) | resource |
158163

159164
## Inputs
160165

@@ -173,6 +178,8 @@ No resources.
173178
| <a name="input_org_id"></a> [org\_id](#input\_org\_id) | GCP Organization ID that holds the projects that generate billing data that the service account should import. | `string` | n/a | yes |
174179
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | GCP Project ID where to create the resources. This is typically a 'meshstack-root' project. | `string` | n/a | yes |
175180
| <a name="input_replicator_sa_name"></a> [replicator\_sa\_name](#input\_replicator\_sa\_name) | Name of the service account to create for Replicator. | `string` | `"mesh-replicator-service-tf"` | no |
181+
| <a name="input_service_account_keys"></a> [service\_account\_keys](#input\_service\_account\_keys) | Create service account keys for authentication. | `bool` | `true` | no |
182+
| <a name="input_workload_identity_federation"></a> [workload\_identity\_federation](#input\_workload\_identity\_federation) | Setup workload identity federation for authentication. | <pre>object({<br> workload_identity_pool_identifier = string<br> issuer = string<br> audience = string<br> replicator_subject = string<br> kraken_subject = string<br> })</pre> | `null` | no |
176183

177184
## Outputs
178185

‎main.tf

+13-1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@ module "kraken_sa" {
88

99
cloud_billing_export_project_id = var.cloud_billing_export_project_id
1010
cloud_billing_export_dataset_id = var.cloud_billing_export_dataset_id
11+
12+
service_account_key = var.service_account_keys
13+
workload_identity_federation = var.workload_identity_federation == null ? null : {
14+
pool_id = google_iam_workload_identity_pool.meshstack[0].name
15+
subject = var.workload_identity_federation.kraken_subject
16+
}
1117
}
1218

1319
module "replicator_sa" {
@@ -21,6 +27,12 @@ module "replicator_sa" {
2127
landing_zone_folder_ids = var.landing_zone_folder_ids
2228

2329
billing_account_id = var.billing_account_id
30+
31+
service_account_key = var.service_account_keys
32+
workload_identity_federation = var.workload_identity_federation == null ? null : {
33+
pool_id = google_iam_workload_identity_pool.meshstack[0].name
34+
subject = var.workload_identity_federation.replicator_subject
35+
}
2436
}
2537

2638
module "carbon_export" {
@@ -31,4 +43,4 @@ module "carbon_export" {
3143

3244
cloud_carbon_export_project_id = var.cloud_carbon_export_project_id # using the same project as for billing
3345
cloud_carbon_export_dataset_id = var.cloud_carbon_export_dataset_id
34-
}
46+
}

‎modules/meshcloud-carbon-export/README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
6+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
77

88
## Providers
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_google"></a> [google](#provider\_google) | 4.11.0 |
12+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
1313

1414
## Modules
1515

@@ -19,7 +19,7 @@ No modules.
1919

2020
| Name | Type |
2121
|------|------|
22-
| [google_bigquery_dataset_iam_member.read_carbon_export](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/bigquery_dataset_iam_member) | resource |
22+
| [google_bigquery_dataset_iam_member.read_carbon_export](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/bigquery_dataset_iam_member) | resource |
2323

2424
## Inputs
2525

‎modules/meshcloud-carbon-export/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
google = {
44
source = "hashicorp/google"
5-
version = "4.11.0"
5+
version = "5.19.0"
66
}
77
}
88
}

‎modules/meshcloud-kraken-service-account/README.md

+12-9
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
6+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
77

88
## Providers
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_google"></a> [google](#provider\_google) | 4.11.0 |
12+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
1313

1414
## Modules
1515

@@ -19,13 +19,14 @@ No modules.
1919

2020
| Name | Type |
2121
|------|------|
22-
| [google_bigquery_dataset_iam_member.read_billing_export](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/bigquery_dataset_iam_member) | resource |
23-
| [google_folder_iam_member.kraken_service](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/folder_iam_member) | resource |
24-
| [google_organization_iam_custom_role.meshcloud_kraken_sa](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/organization_iam_custom_role) | resource |
25-
| [google_project_iam_member.bigquery_jobuser](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/project_iam_member) | resource |
26-
| [google_project_service.bigquery_api](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/project_service) | resource |
27-
| [google_service_account.meshcloud_kraken_sa](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/service_account) | resource |
28-
| [google_service_account_key.sa_key](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/service_account_key) | resource |
22+
| [google_bigquery_dataset_iam_member.read_billing_export](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/bigquery_dataset_iam_member) | resource |
23+
| [google_folder_iam_member.kraken_service](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/folder_iam_member) | resource |
24+
| [google_organization_iam_custom_role.meshcloud_kraken_sa](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/organization_iam_custom_role) | resource |
25+
| [google_project_iam_member.bigquery_jobuser](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/project_iam_member) | resource |
26+
| [google_project_service.bigquery_api](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/project_service) | resource |
27+
| [google_service_account.meshcloud_kraken_sa](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/service_account) | resource |
28+
| [google_service_account_iam_member.kraken](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/service_account_iam_member) | resource |
29+
| [google_service_account_key.sa_key](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/service_account_key) | resource |
2930

3031
## Inputs
3132

@@ -37,6 +38,8 @@ No modules.
3738
| <a name="input_meshstack_root_project_id"></a> [meshstack\_root\_project\_id](#input\_meshstack\_root\_project\_id) | GCP Project ID where to create the service account. This is typically a 'meshstack-root' project. | `string` | n/a | yes |
3839
| <a name="input_org_id"></a> [org\_id](#input\_org\_id) | GCP Organization ID that holds the projects that generate billing data that the service account should import. | `string` | n/a | yes |
3940
| <a name="input_sa_name"></a> [sa\_name](#input\_sa\_name) | Name of the service account to create. | `string` | n/a | yes |
41+
| <a name="input_service_account_key"></a> [service\_account\_key](#input\_service\_account\_key) | n/a | `bool` | `true` | no |
42+
| <a name="input_workload_identity_federation"></a> [workload\_identity\_federation](#input\_workload\_identity\_federation) | n/a | <pre>object({<br> pool_id = string<br> subject = string<br> })</pre> | n/a | yes |
4043

4144
## Outputs
4245

‎modules/meshcloud-kraken-service-account/module.tf

+15-2
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,21 @@ resource "google_folder_iam_member" "kraken_service" {
5050
member = "serviceAccount:${google_service_account.meshcloud_kraken_sa.email}"
5151
}
5252

53-
# You can obtain the json representation of the sa key to put it into vault
54-
# from the terraform state. Simply base64 decode what's in the private_key field
5553
resource "google_service_account_key" "sa_key" {
54+
count = var.service_account_key ? 1 : 0
5655
service_account_id = google_service_account.meshcloud_kraken_sa.id
5756
}
57+
58+
moved {
59+
from = google_service_account_key.sa_key
60+
to = google_service_account_key.sa_key[0]
61+
}
62+
63+
# For workload identity federation create an IAM policy allowing the kraken subject to impersonate the service account.
64+
resource "google_service_account_iam_member" "kraken" {
65+
count = var.workload_identity_federation == null ? 0 : 1
66+
67+
service_account_id = google_service_account.meshcloud_kraken_sa.id
68+
role = "roles/iam.workloadIdentityUser"
69+
member = "principal://iam.googleapis.com/${var.workload_identity_federation.pool_id}/subject/${var.workload_identity_federation.subject}"
70+
}

‎modules/meshcloud-kraken-service-account/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
output "sa_key" {
2-
value = google_service_account_key.sa_key.private_key
2+
value = var.service_account_key ? google_service_account_key.sa_key[0].private_key : null
33
description = "Service account key (base64 encoded credential.json)."
44
sensitive = true
55
}

‎modules/meshcloud-kraken-service-account/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,15 @@ variable "landing_zone_folder_ids" {
2727
type = set(string)
2828
description = "GCP Folders that make up the Landing Zone. The service account will only receive permissions on these folders."
2929
}
30+
31+
variable "service_account_key" {
32+
default = true
33+
type = bool
34+
}
35+
36+
variable "workload_identity_federation" {
37+
type = object({
38+
pool_id = string
39+
subject = string
40+
})
41+
}

‎modules/meshcloud-kraken-service-account/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
google = {
44
source = "hashicorp/google"
5-
version = "4.11.0"
5+
version = "5.19.0"
66
}
77
}
88
}

‎modules/meshcloud-replicator-lz-access-cloudfunction/README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
6+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
77

88
## Providers
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_google"></a> [google](#provider\_google) | 4.11.0 |
12+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
1313

1414
## Modules
1515

@@ -19,7 +19,7 @@ No modules.
1919

2020
| Name | Type |
2121
|------|------|
22-
| [google_cloudfunctions_function_iam_member.invoker](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/cloudfunctions_function_iam_member) | resource |
22+
| [google_cloudfunctions_function_iam_member.invoker](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/cloudfunctions_function_iam_member) | resource |
2323

2424
## Inputs
2525

‎modules/meshcloud-replicator-lz-access-cloudfunction/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
google = {
44
source = "hashicorp/google"
5-
version = "4.11.0"
5+
version = "5.19.0"
66
}
77
}
88
}

‎modules/meshcloud-replicator-lz-access-gdm-template/README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
6+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
77

88
## Providers
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_google"></a> [google](#provider\_google) | 4.11.0 |
12+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
1313

1414
## Modules
1515

@@ -19,8 +19,8 @@ No modules.
1919

2020
| Name | Type |
2121
|------|------|
22-
| [google_project_iam_custom_role.replicator_service](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/project_iam_custom_role) | resource |
23-
| [google_storage_bucket_iam_member.google_deployment_manager_service_account](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/storage_bucket_iam_member) | resource |
22+
| [google_project_iam_custom_role.replicator_service](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/project_iam_custom_role) | resource |
23+
| [google_storage_bucket_iam_member.google_deployment_manager_service_account](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/storage_bucket_iam_member) | resource |
2424

2525
## Inputs
2626

‎modules/meshcloud-replicator-lz-access-gdm-template/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
google = {
44
source = "hashicorp/google"
5-
version = "4.11.0"
5+
version = "5.19.0"
66
}
77
}
88
}

‎modules/meshcloud-replicator-service-account/README.md

+14-11
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,13 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_google"></a> [google](#requirement\_google) | 4.11.0 |
6+
| <a name="requirement_google"></a> [google](#requirement\_google) | 5.19.0 |
77

88
## Providers
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_google"></a> [google](#provider\_google) | 4.11.0 |
12+
| <a name="provider_google"></a> [google](#provider\_google) | 5.19.0 |
1313

1414
## Modules
1515

@@ -19,15 +19,16 @@ No modules.
1919

2020
| Name | Type |
2121
|------|------|
22-
| [google_billing_account_iam_member.replicator_service](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/billing_account_iam_member) | resource |
23-
| [google_folder_iam_member.replicator_service](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/folder_iam_member) | resource |
24-
| [google_organization_iam_custom_role.replicator_billing](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/organization_iam_custom_role) | resource |
25-
| [google_organization_iam_custom_role.replicator_service](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/organization_iam_custom_role) | resource |
26-
| [google_project_service.admin_api](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/project_service) | resource |
27-
| [google_project_service.cloudbilling_api](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/project_service) | resource |
28-
| [google_project_service.cloudresourcemanager_api](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/project_service) | resource |
29-
| [google_service_account.replicator_service](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/service_account) | resource |
30-
| [google_service_account_key.sa_key](https://registry.terraform.io/providers/hashicorp/google/4.11.0/docs/resources/service_account_key) | resource |
22+
| [google_billing_account_iam_member.replicator_service](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/billing_account_iam_member) | resource |
23+
| [google_folder_iam_member.replicator_service](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/folder_iam_member) | resource |
24+
| [google_organization_iam_custom_role.replicator_billing](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/organization_iam_custom_role) | resource |
25+
| [google_organization_iam_custom_role.replicator_service](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/organization_iam_custom_role) | resource |
26+
| [google_project_service.admin_api](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/project_service) | resource |
27+
| [google_project_service.cloudbilling_api](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/project_service) | resource |
28+
| [google_project_service.cloudresourcemanager_api](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/project_service) | resource |
29+
| [google_service_account.replicator_service](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/service_account) | resource |
30+
| [google_service_account_iam_member.replicator](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/service_account_iam_member) | resource |
31+
| [google_service_account_key.sa_key](https://registry.terraform.io/providers/hashicorp/google/5.19.0/docs/resources/service_account_key) | resource |
3132

3233
## Inputs
3334

@@ -39,6 +40,8 @@ No modules.
3940
| <a name="input_org_id"></a> [org\_id](#input\_org\_id) | GCP Organization Id | `string` | n/a | yes |
4041
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | GCP Project ID where to create the resources. This is typically a 'meshstack-root' project | `string` | n/a | yes |
4142
| <a name="input_sa_name"></a> [sa\_name](#input\_sa\_name) | name of the service account to create | `string` | n/a | yes |
43+
| <a name="input_service_account_key"></a> [service\_account\_key](#input\_service\_account\_key) | n/a | `bool` | `true` | no |
44+
| <a name="input_workload_identity_federation"></a> [workload\_identity\_federation](#input\_workload\_identity\_federation) | n/a | <pre>object({<br> pool_id = string<br> subject = string<br> })</pre> | n/a | yes |
4245

4346
## Outputs
4447

‎modules/meshcloud-replicator-service-account/module.tf

+14
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,20 @@ resource "google_billing_account_iam_member" "replicator_service" {
8989
}
9090

9191
resource "google_service_account_key" "sa_key" {
92+
count = var.service_account_key ? 1 : 0
9293
service_account_id = google_service_account.replicator_service.id
9394
}
9495

96+
moved {
97+
from = google_service_account_key.sa_key
98+
to = google_service_account_key.sa_key[0]
99+
}
100+
101+
# For workload identity federation create an IAM policy allowing the replicator subject to impersonate the service account.
102+
resource "google_service_account_iam_member" "replicator" {
103+
count = var.workload_identity_federation == null ? 0 : 1
104+
105+
service_account_id = google_service_account.replicator_service.id
106+
role = "roles/iam.workloadIdentityUser"
107+
member = "principal://iam.googleapis.com/${var.workload_identity_federation.pool_id}/subject/${var.workload_identity_federation.subject}"
108+
}

‎modules/meshcloud-replicator-service-account/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ output "sa_unique_id" {
44
}
55

66
output "sa_key" {
7-
value = google_service_account_key.sa_key.private_key
7+
value = var.service_account_key ? google_service_account_key.sa_key[0].private_key : null
88
description = "Service account key (base64 encoded credential.json)."
99
sensitive = true
1010
}

‎modules/meshcloud-replicator-service-account/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,15 @@ variable "billing_account_id" {
2727
type = string
2828
description = "The GCP Billing Account in your organization."
2929
}
30+
31+
variable "service_account_key" {
32+
default = true
33+
type = bool
34+
}
35+
36+
variable "workload_identity_federation" {
37+
type = object({
38+
pool_id = string
39+
subject = string
40+
})
41+
}

‎modules/meshcloud-replicator-service-account/versions.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ terraform {
22
required_providers {
33
google = {
44
source = "hashicorp/google"
5-
version = "4.11.0"
5+
version = "5.19.0"
66
}
77
}
88
}

0 commit comments

Comments
 (0)