Skip to content

Commit f0128b4

Browse files
stevenyang72BBBmau
stevenyang72
authored and
BBBmau
committed
Add workload identity pool managed identity. (GoogleCloudPlatform#14048)
1 parent 2d7b88e commit f0128b4

File tree

6 files changed

+397
-0
lines changed

6 files changed

+397
-0
lines changed

‎mmv1/products/iambeta/WorkloadIdentityPoolManagedIdentity.yaml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# Copyright 2025 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: 'WorkloadIdentityPoolManagedIdentity'
16+
description: |
17+
Represents a managed identity for a workload identity pool namespace.
18+
references:
19+
guides:
20+
'Configure managed workload identity authentication for Compute Engine': 'https://cloud.google.com/iam/docs/create-managed-workload-identities'
21+
'Configure managed workload identity authentication for GKE': 'https://cloud.google.com/iam/docs/create-managed-workload-identities-gke'
22+
api: 'https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.namespaces.managedIdentities'
23+
min_version: beta
24+
base_url: 'projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities'
25+
self_link: 'projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities/{{workload_identity_pool_managed_identity_id}}'
26+
create_url: 'projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities?workloadIdentityPoolManagedIdentityId={{workload_identity_pool_managed_identity_id}}'
27+
update_verb: 'PATCH'
28+
update_mask: true
29+
import_format:
30+
- 'projects/{{project}}/locations/global/workloadIdentityPools/{{workload_identity_pool_id}}/namespaces/{{workload_identity_pool_namespace_id}}/managedIdentities/{{workload_identity_pool_managed_identity_id}}'
31+
autogen_async: true
32+
custom_code:
33+
constants: 'templates/terraform/constants/iam_workload_identity_pool_managed_identity.go.tmpl'
34+
decoder: 'templates/terraform/decoders/treat_deleted_state_as_gone.go.tmpl'
35+
test_check_destroy: 'templates/terraform/custom_check_destroy/iam_workload_identity_pool_managed_identity.go.tmpl'
36+
examples:
37+
- name: 'iam_workload_identity_pool_managed_identity_basic'
38+
primary_resource_id: 'example'
39+
vars:
40+
workload_identity_pool_id: 'example-pool'
41+
workload_identity_pool_namespace_id: 'example-namespace'
42+
workload_identity_pool_managed_identity_id: 'example-managed-identity'
43+
- name: 'iam_workload_identity_pool_managed_identity_full'
44+
primary_resource_id: 'example'
45+
vars:
46+
workload_identity_pool_id: 'example-pool'
47+
workload_identity_pool_namespace_id: 'example-namespace'
48+
workload_identity_pool_managed_identity_id: 'example-managed-identity'
49+
parameters:
50+
- name: 'workload_identity_pool_id'
51+
type: String
52+
required: true
53+
immutable: true
54+
url_param_only: true
55+
description: |
56+
The ID to use for the pool, which becomes the final component of the resource name. This
57+
value should be 4-32 characters, and may contain the characters [a-z0-9-]. The prefix
58+
`gcp-` is reserved for use by Google, and may not be specified.
59+
- name: 'workload_identity_pool_namespace_id'
60+
type: String
61+
required: true
62+
immutable: true
63+
url_param_only: true
64+
description: |
65+
The ID to use for the namespace. This value must:
66+
* contain at most 63 characters
67+
* contain only lowercase alphanumeric characters or `-`
68+
* start with an alphanumeric character
69+
* end with an alphanumeric character
70+
71+
72+
The prefix `gcp-` will be reserved for future uses.
73+
- name: 'workload_identity_pool_managed_identity_id'
74+
type: String
75+
required: true
76+
immutable: true
77+
url_param_only: true
78+
description: |
79+
The ID to use for the managed identity. This value must:
80+
* contain at most 63 characters
81+
* contain only lowercase alphanumeric characters or `-`
82+
* start with an alphanumeric character
83+
* end with an alphanumeric character
84+
85+
86+
The prefix `gcp-` will be reserved for future uses.
87+
properties:
88+
- name: 'name'
89+
type: String
90+
description: |
91+
The resource name of the managed identity as
92+
`projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}/namespaces/{workload_identity_pool_namespace_id}/managedIdentities/{workload_identity_pool_managed_identity_id}`.
93+
output: true
94+
- name: 'description'
95+
type: String
96+
description: |
97+
A description of the managed identity. Cannot exceed 256 characters.
98+
- name: 'state'
99+
type: Enum
100+
description: |
101+
The current state of the managed identity.
102+
* `ACTIVE`: The managed identity is active.
103+
* `DELETED`: The managed identity is soft-deleted. Soft-deleted managed identities are
104+
permanently deleted after approximately 30 days. You can restore a soft-deleted managed
105+
identity using UndeleteWorkloadIdentityPoolManagedIdentity. You cannot reuse the ID of a
106+
soft-deleted managed identity until it is permanently deleted.
107+
output: true
108+
enum_values:
109+
- 'ACTIVE'
110+
- 'DELETED'
111+
- name: 'disabled'
112+
type: Boolean
113+
description: |
114+
Whether the managed identity is disabled. If disabled, credentials may no longer be issued for
115+
the identity, however existing credentials will still be accepted until they expire.

‎mmv1/templates/terraform/constants/iam_workload_identity_pool_managed_identity.go.tmpl‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
const workloadIdentityPoolManagedIdentityIdRegexp = `^[0-9a-z-]+$`
2+
3+
func ValidateWorkloadIdentityPoolManagedIdentityId(v interface{}, k string) (ws []string, errors []error) {
4+
value := v.(string)
5+
6+
if !regexp.MustCompile(workloadIdentityPoolManagedIdentityIdRegexp).MatchString(value) {
7+
errors = append(errors, fmt.Errorf(
8+
"%q must contain only lowercase letters (a-z), numbers (0-9), or dashes (-)", k))
9+
}
10+
11+
if len(value) < 2 {
12+
errors = append(errors, fmt.Errorf(
13+
"%q cannot be less than 2 characters", k))
14+
return
15+
}
16+
17+
if len(value) > 63 {
18+
errors = append(errors, fmt.Errorf(
19+
"%q cannot be greater than 63 characters", k))
20+
}
21+
22+
isLowerAlphaNumeric := func(r byte) bool {
23+
return (r >= '0' && r <= '9') || (r >= 'a' && r <= 'z')
24+
}
25+
26+
firstChar := value[0]
27+
if !isLowerAlphaNumeric(firstChar) {
28+
errors = append(errors, fmt.Errorf(
29+
"%q must start with an alphanumeric character", k))
30+
}
31+
32+
lastChar := value[len(value) - 1]
33+
if !isLowerAlphaNumeric(lastChar) {
34+
errors = append(errors, fmt.Errorf(
35+
"%q must end with an alphanumeric character", k))
36+
}
37+
38+
if strings.HasPrefix(value, "gcp-") {
39+
errors = append(errors, fmt.Errorf(
40+
"%q (%q) can not start with \"gcp-\"", k, value))
41+
}
42+
43+
return
44+
}

‎mmv1/templates/terraform/custom_check_destroy/iam_workload_identity_pool_managed_identity.go.tmpl‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
config := acctest.GoogleProviderConfig(t)
2+
3+
url, err := tpgresource.ReplaceVarsForTest(config, rs, "{{"{{"}}IAMBetaBasePath{{"}}"}}projects/{{"{{"}}project{{"}}"}}/locations/global/workloadIdentityPools/{{"{{"}}workload_identity_pool_id{{"}}"}}/namespaces/{{"{{"}}workload_identity_pool_namespace_id{{"}}"}}/managedIdentities/{{"{{"}}workload_identity_pool_managed_identity_id{{"}}"}}")
4+
if err != nil {
5+
return err
6+
}
7+
8+
res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
9+
Config: config,
10+
Method: "GET",
11+
RawURL: url,
12+
UserAgent: config.UserAgent,
13+
})
14+
if err != nil {
15+
return nil
16+
}
17+
18+
if v := res["state"]; v == "DELETED" {
19+
return nil
20+
}
21+
22+
return fmt.Errorf("IAMBetaWorkloadIdentityPoolManagedIdentity still exists at %s", url)

‎mmv1/templates/terraform/examples/iam_workload_identity_pool_managed_identity_basic.tf.tmpl‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resource "google_iam_workload_identity_pool" "pool" {
2+
provider = google-beta
3+
4+
workload_identity_pool_id = "{{index $.Vars "workload_identity_pool_id"}}"
5+
mode = "TRUST_DOMAIN"
6+
}
7+
8+
resource "google_iam_workload_identity_pool_namespace" "ns" {
9+
provider = google-beta
10+
11+
workload_identity_pool_id = google_iam_workload_identity_pool.pool.workload_identity_pool_id
12+
workload_identity_pool_namespace_id = "{{index $.Vars "workload_identity_pool_namespace_id"}}"
13+
}
14+
15+
resource "google_iam_workload_identity_pool_managed_identity" "{{$.PrimaryResourceId}}" {
16+
provider = google-beta
17+
18+
workload_identity_pool_id = google_iam_workload_identity_pool.pool.workload_identity_pool_id
19+
workload_identity_pool_namespace_id = google_iam_workload_identity_pool_namespace.ns.workload_identity_pool_namespace_id
20+
workload_identity_pool_managed_identity_id = "{{index $.Vars "workload_identity_pool_managed_identity_id"}}"
21+
}

‎mmv1/templates/terraform/examples/iam_workload_identity_pool_managed_identity_full.tf.tmpl‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
resource "google_iam_workload_identity_pool" "pool" {
2+
provider = google-beta
3+
4+
workload_identity_pool_id = "{{index $.Vars "workload_identity_pool_id"}}"
5+
mode = "TRUST_DOMAIN"
6+
}
7+
8+
resource "google_iam_workload_identity_pool_namespace" "ns" {
9+
provider = google-beta
10+
11+
workload_identity_pool_id = google_iam_workload_identity_pool.pool.workload_identity_pool_id
12+
workload_identity_pool_namespace_id = "{{index $.Vars "workload_identity_pool_namespace_id"}}"
13+
}
14+
15+
resource "google_iam_workload_identity_pool_managed_identity" "{{$.PrimaryResourceId}}" {
16+
provider = google-beta
17+
18+
workload_identity_pool_id = google_iam_workload_identity_pool.pool.workload_identity_pool_id
19+
workload_identity_pool_namespace_id = google_iam_workload_identity_pool_namespace.ns.workload_identity_pool_namespace_id
20+
workload_identity_pool_managed_identity_id = "{{index $.Vars "workload_identity_pool_managed_identity_id"}}"
21+
description = "Example Managed Identity in a Workload Identity Pool Namespace"
22+
disabled = true
23+
}

0 commit comments

Comments
 (0)