Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: updated workload identity #18

Merged
merged 1 commit into from
Apr 29, 2024
Merged

feat: updated workload identity #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 6 additions & 10 deletions examples/gcp-pubsub/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,18 +53,16 @@ The workload service account will be automatically assigned to the necessary rol
graph TD;
topic["GCP Pub/Sub topic"]
sub["GCP Pub/Sub subscription"]
topic_account["GCP Service account"]
sub_account["GCP Service account"]
subgraph GKE Cluster
topic_pod[workload pod]
topic_service[Service Account]
topic_service[k8s service account]
sub_pod[workload pod]
sub_service[Service Account]
sub_service[k8s service account]
end
topic_service --> topic_account -- bind role on --> topic
topic_service -- bind role on --> topic
topic_service --> topic_pod
topic --> topic_pod
sub_service --> sub_account -- bind role on --> sub
sub_service -- bind role on --> sub
sub_service --> sub_pod
sub --> sub_pod
sub --> topic
Expand Down Expand Up @@ -105,12 +103,11 @@ graph LR;

| Name | Source | Version |
|------|--------|---------|
| gcp\_service\_account\_workload | ../../humanitec-resource-defs/gcp-service-account/workload | n/a |
| gps\_basic\_subscriber | ../../humanitec-resource-defs/gcp-pubsub-subscription/delegator | n/a |
| gpt\_basic\_publisher | ../../humanitec-resource-defs/gcp-pubsub-topic/delegator | n/a |
| iam\_role\_binding\_gcp\_pubsub\_subscription\_subscriber | ../../humanitec-resource-defs/gcp-iam-policy-binding/basic | n/a |
| iam\_role\_binding\_gcp\_pubsub\_topic\_publisher | ../../humanitec-resource-defs/gcp-iam-policy-binding/basic | n/a |
| k8s\_service\_account | ../../humanitec-resource-defs/k8s/service-account | n/a |
| k8s\_service\_account\_workload | ../../humanitec-resource-defs/k8s-service-account/workload | n/a |
| pubsub\_subscription\_basic | ../../humanitec-resource-defs/gcp-pubsub-subscription/basic | n/a |
| pubsub\_topic\_basic | ../../humanitec-resource-defs/gcp-pubsub-topic/basic | n/a |
| workload | ../../humanitec-resource-defs/workload/service-account | n/a |
Expand All @@ -124,12 +121,11 @@ graph LR;
| [google_service_account_key.humanitec_provisioner](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_key) | resource |
| [humanitec_application.example](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/application) | resource |
| [humanitec_resource_account.humanitec_provisioner](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_account) | resource |
| [humanitec_resource_definition_criteria.gcp_service_account_workload](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.gps_basic_subscriber](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.gpt_basic_publisher](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.iam_role_binding_gcp_pubsub_subscription_subscriber](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.iam_role_binding_gcp_pubsub_topic_publisher](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.k8s_service_account](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.k8s_service_account_workload](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.pubsub_subscription_basic](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.pubsub_topic_basic](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.workload](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
Expand Down
22 changes: 4 additions & 18 deletions examples/gcp-pubsub/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,20 +51,8 @@ locals {

# Required resources for workload identity

module "k8s_service_account" {
source = "../../humanitec-resource-defs/k8s/service-account"

prefix = var.prefix
}

resource "humanitec_resource_definition_criteria" "k8s_service_account" {
resource_definition_id = module.k8s_service_account.id
app_id = humanitec_application.example.id
force_delete = true
}

module "gcp_service_account_workload" {
source = "../../humanitec-resource-defs/gcp-service-account/workload"
module "k8s_service_account_workload" {
source = "../../humanitec-resource-defs/k8s-service-account/workload"

resource_packs_gcp_url = var.resource_packs_gcp_url
resource_packs_gcp_rev = var.resource_packs_gcp_rev
Expand All @@ -73,12 +61,10 @@ module "gcp_service_account_workload" {

project = var.project
prefix = var.prefix

name = "hrp-ps-$${context.res.id}"
}

resource "humanitec_resource_definition_criteria" "gcp_service_account_workload" {
resource_definition_id = module.gcp_service_account_workload.id
resource "humanitec_resource_definition_criteria" "k8s_service_account_workload" {
resource_definition_id = module.k8s_service_account_workload.id
app_id = humanitec_application.example.id
force_delete = true
}
Expand Down
8 changes: 3 additions & 5 deletions examples/gcs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ graph TD;
gcs["Google Cloud Storage"]
subgraph GKE Cluster
pod[workload pod]
service[Service Account]
service[k8s service account]
end
service -- bind role on --> gcs
service --> pod
Expand Down Expand Up @@ -78,13 +78,12 @@ graph LR;

| Name | Source | Version |
|------|--------|---------|
| gcp\_service\_account\_workload | ../../humanitec-resource-defs/gcp-service-account/workload | n/a |
| gcs\_basic | ../../humanitec-resource-defs/gcs/basic | n/a |
| gcs\_basic\_admin | ../../humanitec-resource-defs/gcs/delegator | n/a |
| gcs\_basic\_read\_only | ../../humanitec-resource-defs/gcs/delegator | n/a |
| iam\_role\_binding\_gcs\_admin | ../../humanitec-resource-defs/gcp-iam-policy-binding/basic | n/a |
| iam\_role\_binding\_gcs\_read\_only | ../../humanitec-resource-defs/gcp-iam-policy-binding/basic | n/a |
| k8s\_service\_account | ../../humanitec-resource-defs/k8s/service-account | n/a |
| k8s\_service\_account\_workload | ../../humanitec-resource-defs/k8s-service-account/workload | n/a |
| workload | ../../humanitec-resource-defs/workload/service-account | n/a |

### Resources
Expand All @@ -96,13 +95,12 @@ graph LR;
| [google_service_account_key.humanitec_provisioner](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_key) | resource |
| [humanitec_application.example](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/application) | resource |
| [humanitec_resource_account.humanitec_provisioner](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_account) | resource |
| [humanitec_resource_definition_criteria.gcp_service_account_workload](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.gcs_basic](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.gcs_basic_admin](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.gcs_basic_read_only](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.iam_role_binding_gcs_admin](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.iam_role_binding_gcs_read_only](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.k8s_service_account](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.k8s_service_account_workload](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.workload](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |

### Inputs
Expand Down
21 changes: 4 additions & 17 deletions examples/gcs/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,21 +155,8 @@ resource "humanitec_resource_definition_criteria" "gcs_basic_read_only" {

# Required resources for workload identity


module "k8s_service_account" {
source = "../../humanitec-resource-defs/k8s/service-account"

prefix = var.prefix
}

resource "humanitec_resource_definition_criteria" "k8s_service_account" {
resource_definition_id = module.k8s_service_account.id
app_id = humanitec_application.example.id
force_delete = true
}

module "gcp_service_account_workload" {
source = "../../humanitec-resource-defs/gcp-service-account/workload"
module "k8s_service_account_workload" {
source = "../../humanitec-resource-defs/k8s-service-account/workload"

resource_packs_gcp_url = var.resource_packs_gcp_url
resource_packs_gcp_rev = var.resource_packs_gcp_rev
Expand All @@ -180,8 +167,8 @@ module "gcp_service_account_workload" {
prefix = var.prefix
}

resource "humanitec_resource_definition_criteria" "gcp_service_account_workload" {
resource_definition_id = module.gcp_service_account_workload.id
resource "humanitec_resource_definition_criteria" "k8s_service_account_workload" {
resource_definition_id = module.k8s_service_account_workload.id
app_id = humanitec_application.example.id
force_delete = true
}
Expand Down
10 changes: 3 additions & 7 deletions examples/postgres/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@ CloudSQL IAM Authentication is enabled by automatically injecting the [Cloud SQL
graph TD
subgraph GCP IAM
gcp_db_serviceaccount[GCP Service Account - db user]
gcp_k8s_serviceaccount[GCP Service Account - k8s user]
end

subgraph VPC
Expand All @@ -51,9 +50,8 @@ subgraph VPC
workload-container --> cloud-sql-proxy-container
cloud-sql-proxy-container -- CloudSQL User with iam authentication using GCP Service Account [db user] --> database
end
service[K8s Service Account] --> gcp_k8s_serviceaccount
k8s_serviceaccount[K8s Service Account] -- workload identity user --> gcp_db_serviceaccount
end
gcp_k8s_serviceaccount -- workload identity user --> gcp_db_serviceaccount
end

gcp_db_serviceaccount --> user
Expand Down Expand Up @@ -95,9 +93,8 @@ graph LR;

| Name | Source | Version |
|------|--------|---------|
| gcp\_service\_account\_workload | ../../humanitec-resource-defs/gcp-service-account/workload | n/a |
| iam\_role\_binding\_service\_account\_workload\_identity | ../../humanitec-resource-defs/gcp-iam-policy-binding/basic | n/a |
| k8s\_service\_account | ../../humanitec-resource-defs/k8s/service-account | n/a |
| k8s\_service\_account\_workload | ../../humanitec-resource-defs/k8s-service-account/workload | n/a |
| postgres | ../../humanitec-resource-defs/postgres/workload-identity | n/a |
| postgres\_instance | ../../humanitec-resource-defs/postgres-instance/basic | n/a |
| workload | ../../humanitec-resource-defs/workload/service-account | n/a |
Expand All @@ -114,9 +111,8 @@ graph LR;
| [google_service_networking_connection.private_vpc_connection](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_networking_connection) | resource |
| [humanitec_application.example](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/application) | resource |
| [humanitec_resource_account.humanitec_provisioner](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_account) | resource |
| [humanitec_resource_definition_criteria.gcp_service_account_workload](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.iam_role_binding_service_account_workload_identity](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.k8s_service_account](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.k8s_service_account_workload](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.postgres](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.postgres_instance](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
| [humanitec_resource_definition_criteria.workload](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
Expand Down
22 changes: 4 additions & 18 deletions examples/postgres/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,20 +149,8 @@ resource "humanitec_resource_definition_criteria" "iam_role_binding_service_acco

# Required resources for workload identity

module "k8s_service_account" {
source = "../../humanitec-resource-defs/k8s/service-account"

prefix = var.prefix
}

resource "humanitec_resource_definition_criteria" "k8s_service_account" {
resource_definition_id = module.k8s_service_account.id
app_id = humanitec_application.example.id
force_delete = true
}

module "gcp_service_account_workload" {
source = "../../humanitec-resource-defs/gcp-service-account/workload"
module "k8s_service_account_workload" {
source = "../../humanitec-resource-defs/k8s-service-account/workload"

resource_packs_gcp_url = var.resource_packs_gcp_url
resource_packs_gcp_rev = var.resource_packs_gcp_rev
Expand All @@ -171,12 +159,10 @@ module "gcp_service_account_workload" {

project = var.project
prefix = var.prefix

name = "hrp-pg-$${context.res.id}"
}

resource "humanitec_resource_definition_criteria" "gcp_service_account_workload" {
resource_definition_id = module.gcp_service_account_workload.id
resource "humanitec_resource_definition_criteria" "k8s_service_account_workload" {
resource_definition_id = module.k8s_service_account_workload.id
app_id = humanitec_application.example.id
force_delete = true
}
Expand Down
2 changes: 1 addition & 1 deletion ...fs/gcp-service-account/workload/README.md → ...fs/k8s-service-account/workload/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,4 +36,4 @@
| Name | Description |
|------|-------------|
| id | n/a |
<!-- END_TF_DOCS -->
<!-- END_TF_DOCS -->
13 changes: 7 additions & 6 deletions ...defs/gcp-service-account/workload/main.tf → ...defs/k8s-service-account/workload/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
resource "humanitec_resource_definition" "main" {
driver_type = "humanitec/terraform"
id = "${var.prefix}gcp-service-account-workload"
name = "${var.prefix}gcp-service-account-workload"
type = "gcp-service-account"
id = "${var.prefix}k8s-service-account-workload"
name = "${var.prefix}k8s-service-account-workload"
type = "k8s-service-account"

driver_account = var.driver_account
driver_inputs = {
values_string = jsonencode({
source = {
path = "modules/gcp-service-account/workload"
path = "modules/k8s-service-account/workload"
rev = var.resource_packs_gcp_rev
url = var.resource_packs_gcp_url
}
Expand All @@ -25,8 +25,7 @@ resource "humanitec_resource_definition" "main" {
project = var.project
roles = var.roles

prefix = var.prefix
name = var.name
name = var.name

namespace = "$${resources.k8s-namespace#k8s-namespace.outputs.namespace}"

Expand All @@ -36,6 +35,8 @@ resource "humanitec_resource_definition" "main" {
app_id = "$${context.app.id}"
env_id = "$${context.env.id}"
}

manifests_output = "manifests"
})
}
}
0 ...s/gcp-service-account/workload/outputs.tf → ...s/k8s-service-account/workload/outputs.tf
View file
Open in desktop
File renamed without changes.
0 ...gcp-service-account/workload/providers.tf → ...k8s-service-account/workload/providers.tf
View file
Open in desktop
File renamed without changes.
0 ...account/workload/terraform.tfvars.example → ...account/workload/terraform.tfvars.example
View file
Open in desktop
File renamed without changes.
0 ...gcp-service-account/workload/variables.tf → ...k8s-service-account/workload/variables.tf
View file
Open in desktop
File renamed without changes.
32 changes: 0 additions & 32 deletions humanitec-resource-defs/k8s/service-account/README.md
View file
Open in desktop

This file was deleted.

34 changes: 0 additions & 34 deletions humanitec-resource-defs/k8s/service-account/main.tf
View file
Open in desktop

This file was deleted.

3 changes: 0 additions & 3 deletions humanitec-resource-defs/k8s/service-account/outputs.tf
View file
Open in desktop

This file was deleted.

10 changes: 0 additions & 10 deletions humanitec-resource-defs/k8s/service-account/providers.tf
View file
Open in desktop

This file was deleted.

1 change: 0 additions & 1 deletion humanitec-resource-defs/k8s/service-account/terraform.tfvars.example
View file
Open in desktop

This file was deleted.

4 changes: 0 additions & 4 deletions humanitec-resource-defs/k8s/service-account/variables.tf
View file
Open in desktop

This file was deleted.

Loading
Loading