zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

allow using cicd service accounts in build triggers

This commit is contained in:
Ludovico Magnocavallo 2022-06-16 22:16:43 +02:00
parent 6d8f3f7e22
commit a35ed1ca0f
5 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fast/stages/01-resman/cicd-data-platform.tf
View File

@ -96,7 +96,9 @@ module "branch-dp-dev-sa-cicd" {
iam = (
each.value.type == "sourcerepo"
# used directly from the cloud build trigger for source repos
? {}
? {
"roles/iam.serviceAccountUser" = [local.automation_resman_sa]
}
# impersonated via workload identity federation for external repos
: {
"roles/iam.workloadIdentityUser" = [
@ -135,7 +137,9 @@ module "branch-dp-prod-sa-cicd" {
iam = (
each.value.type == "sourcerepo"
# used directly from the cloud build trigger for source repos
? {}
? {
"roles/iam.serviceAccountUser" = [local.automation_resman_sa]
}
# impersonated via workload identity federation for external repos
: {
"roles/iam.workloadIdentityUser" = [

4
fast/stages/01-resman/cicd-networking.tf
View File

@ -63,7 +63,9 @@ module "branch-network-sa-cicd" {
iam = (
each.value.type == "sourcerepo"
# used directly from the cloud build trigger for source repos
? {}
? {
"roles/iam.serviceAccountUser" = [local.automation_resman_sa]
}
# impersonated via workload identity federation for external repos
: {
"roles/iam.workloadIdentityUser" = [

4
fast/stages/01-resman/cicd-security.tf
View File

@ -63,7 +63,9 @@ module "branch-security-sa-cicd" {
iam = (
each.value.type == "sourcerepo"
# used directly from the cloud build trigger for source repos
? {}
? {
"roles/iam.serviceAccountUser" = [local.automation_resman_sa]
}
# impersonated via workload identity federation for external repos
: {
"roles/iam.workloadIdentityUser" = [

8
fast/stages/01-resman/cicd-teams.tf
View File

@ -96,7 +96,9 @@ module "branch-teams-dev-pf-sa-cicd" {
iam = (
each.value.type == "sourcerepo"
# used directly from the cloud build trigger for source repos
? {}
? {
"roles/iam.serviceAccountUser" = [local.automation_resman_sa]
}
# impersonated via workload identity federation for external repos
: {
"roles/iam.workloadIdentityUser" = [
@ -135,7 +137,9 @@ module "branch-teams-prod-pf-sa-cicd" {
iam = (
each.value.type == "sourcerepo"
# used directly from the cloud build trigger for source repos
? {}
? {
"roles/iam.serviceAccountUser" = [local.automation_resman_sa]
}
# impersonated via workload identity federation for external repos
: {
"roles/iam.workloadIdentityUser" = [

6
fast/stages/01-resman/main.tf
View File

@ -16,6 +16,10 @@
locals {
# convenience flags that express where billing account resides
automation_resman_sa = format(
"serviceAccount:%s",
data.google_client_openid_userinfo.provider_identity.email
)
billing_ext = var.billing_account.organization_id == null
billing_org = var.billing_account.organization_id == var.organization.id
billing_org_ext = !local.billing_ext && !local.billing_org
@ -64,3 +68,5 @@ locals {
try(var.automation.federated_identity_providers, null), {}
)
}
data "google_client_openid_userinfo" "provider_identity" {}