zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add repository_owner to GitHub identity attributes (#699) 

* add repository_owner to GitHub identity attributes

* fix errors on null identity provider custom settings
This commit is contained in:
Ludovico Magnocavallo 2022-06-23 08:06:25 +02:00 committed by GitHub
parent 93cf3b0888
commit c59ce76e97
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fast/stages/00-bootstrap/automation.tf
View File

@ -119,7 +119,7 @@ module "automation-tf-bootstrap-sa" {
} }
} }
# resource hierarchy stage's bucket and service account # cicd stage's bucket and service account
module "automation-tf-cicd-gcs" { module "automation-tf-cicd-gcs" {
source = "../../../modules/gcs" source = "../../../modules/gcs"

28
fast/stages/00-bootstrap/identity-providers.tf
View File

@ -19,18 +19,20 @@
locals { locals {
identity_providers = { identity_providers = {
for k, v in var.federated_identity_providers : k => merge( for k, v in var.federated_identity_providers : k => merge(
v, lookup(local.identity_providers_defs, v.issuer, {}), v,
{ for kk, vv in lookup(v, "custom_settings", {}) : kk => vv if vv != null } lookup(local.identity_providers_defs, v.issuer, {})
) )
} }
identity_providers_defs = { identity_providers_defs = {
# https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect
github = { github = {
attribute_mapping = { attribute_mapping = {
"google.subject" = "assertion.sub" "google.subject" = "assertion.sub"
"attribute.sub" = "assertion.sub" "attribute.sub" = "assertion.sub"
"attribute.actor" = "assertion.actor" "attribute.actor" = "assertion.actor"
"attribute.repository" = "assertion.repository" "attribute.repository" = "assertion.repository"
"attribute.ref" = "assertion.ref" "attribute.repository_owner" = "assertion.repository_owner"
"attribute.ref" = "assertion.ref"
} }
issuer_uri = "https://token.actions.githubusercontent.com" issuer_uri = "https://token.actions.githubusercontent.com"
principal_tpl = "principal://iam.googleapis.com/%s/subject/repo:%s:ref:refs/heads/%s" principal_tpl = "principal://iam.googleapis.com/%s/subject/repo:%s:ref:refs/heads/%s"
@ -80,7 +82,15 @@ resource "google_iam_workload_identity_pool_provider" "default" {
attribute_condition = each.value.attribute_condition attribute_condition = each.value.attribute_condition
attribute_mapping = each.value.attribute_mapping attribute_mapping = each.value.attribute_mapping
oidc { oidc {
allowed_audiences = try(each.value.allowed_audiences, null) allowed_audiences = (
issuer_uri = each.value.issuer_uri try(each.value.custom_settings.allowed_audiences, null) != null
? each.value.custom_settings.allowed_audiences
: try(each.value.allowed_audiences, null)
)
issuer_uri = (
try(each.value.custom_settings.issuer_uri, null) != null
? each.value.custom_settings.issuer_uri
: try(each.value.issuer_uri, null)
)
} }
} }