Skip to content

Commit 594fdb9

Browse files
author
Nils
committed
init
1 parent 9121297 commit 594fdb9

File tree

17 files changed

+532
-58
lines changed

17 files changed

+532
-58
lines changed

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ First off, thanks for taking the time to contribute!
22

33
## Please Complete the Following
44

5-
- [ ] I read [CONTRIBUTING.md](https://github.com/Cyclenerd/template/blob/master/CONTRIBUTING.md)
5+
- [ ] I read [CONTRIBUTING.md](https://github.com/Cyclenerd/terraform-google-wif-gitlab/blob/master/CONTRIBUTING.md)
66

77
## Notes
88

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,25 +7,14 @@ on:
77

88
jobs:
99
test:
10-
name: CI/CD Test
11-
# https://github.com/actions/virtual-environments/
10+
name: CI Test
1211
runs-on: ubuntu-latest
1312
steps:
14-
15-
- name: 🛎️ Checkout
13+
- name: Checkout
1614
uses: actions/checkout@v3
17-
18-
# Test
19-
- name: 🌡️ Test
20-
run: uname -a
21-
22-
# Test Linux operating systems
23-
- name: 🐧 Test Debian 11 (Bullseye)
24-
run: |
25-
docker pull debian:11
26-
docker run -v $PWD:/temp/test debian:11 uname -a
27-
28-
- name: 🐧 Test Rocky Linux 8
29-
run: |
30-
docker pull rockylinux:8
31-
docker run -v $PWD:/temp/test rockylinux:8 uname -a
15+
- name: Init
16+
run: terraform init
17+
- name: Validate
18+
run: terraform validate
19+
- name: Formatting
20+
run: terraform fmt -check

‎.gitignore‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
crash.*.log
11+
12+
# Ignore override files as they are usually used to override resources locally and so
13+
# are not checked in
14+
override.tf
15+
override.tf.json
16+
*_override.tf
17+
*_override.tf.json
18+
19+
# Include override files you do wish to add to version control using negated pattern
20+
# !example_override.tf
21+
22+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
23+
# example: *tfplan*
24+
25+
# Ignore CLI configuration files
26+
.terraformrc
27+
terraform.rc
28+
29+
*.lock.hcl
30+
*.json
31+
32+
*.tfvars

‎.gitpod.yml‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎.terraform-docs.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
formatter: "markdown"
2+
output:
3+
file: "README.md"
4+
mode: inject
5+
template: |-
6+
<!-- BEGIN_TF_DOCS -->
7+
{{ .Content }}
8+
<!-- END_TF_DOCS -->
9+
settings:
10+
indent: 2
11+
content: |-
12+
{{ .Providers }}
13+
14+
{{ .Inputs }}
15+
16+
{{ .Outputs }}

‎CONTRIBUTING.md‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,8 @@ $ git commit -m "A brief summary of the commit
1919
Start reading the code and you'll get the hang of it. It is optimized for readability:
2020

2121
* Please also update the documentation.
22-
* Space before the opening curly of a multi-line BLOCK.
23-
* No space before the semicolon.
24-
* Space around most operators.
25-
* No space between function name and its opening parenthesis.
26-
* Line up corresponding things vertically, especially if it'd be too long to fit on one line anyway.
27-
* Please use tabs to indent.
22+
* Please stick to the [Terraform style conventions](https://www.terraform.io/language/syntax/style).
23+
* Please run `terraform fmt`.
2824
* Be nice.
2925

3026
One more thing:

‎README.md‎

Lines changed: 95 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,109 @@
1-
# My Template
1+
# Google Cloud Workload Identity Pool and Provider for GitLab
22

3-
This is my template repository to generate new repositories with the same directory structure and files.
3+
[![Bagde: Google Cloud](https://img.shields.io/badge/Google%20Cloud-%234285F4.svg?logo=google-cloud&logoColor=white)](https://github.com/Cyclenerd/terraform-google-wif-gitlab#readme)
4+
[![Badge: Terraform](https://img.shields.io/badge/Terraform-%235835CC.svg?logo=terraform&logoColor=white)](https://github.com/Cyclenerd/terraform-google-wif-gitlab#readme)
5+
[![Bagde: CI](https://github.com/Cyclenerd/terraform-google-wif-gitlab/actions/workflows/ci.yml/badge.svg)](https://github.com/Cyclenerd/terraform-google-wif-gitlab/actions/workflows/ci.yml)
6+
[![Bagde: GitHub](https://img.shields.io/github/license/cyclenerd/terraform-google-wif-gitlab)](https://github.com/Cyclenerd/google-cloud-pricing-cost-calculator/blob/master/LICENSE)
47

5-
1. Replace `template` with new repo name (<kbd>Crtl</kbd>+<kbd>Shift</kbd>+<kbd>H</kbd>)
8+
This Terraform module creates a Workload Identity Pool and Provider for GitLab.
69

7-
[![CI](https://github.com/Cyclenerd/template/actions/workflows/ci.yml/badge.svg)](https://github.com/Cyclenerd/template/actions/workflows/ci.yml)
8-
[![GitHub](https://img.shields.io/github/license/cyclenerd/template)](https://github.com/Cyclenerd/template/blob/master/LICENSE)
9-
[![Subreddit subscribers](https://img.shields.io/reddit/subreddit-subscribers/googlecloud?label=Google%20Cloud%20Platform&style=social)](https://www.reddit.com/r/googlecloud/comments/va0cc0/automating_cost_control_by_capping_google_cloud/)
10+
Service account keys are a security risk if compromised.
11+
Avoid service account keys and instead use the [Workload Identity Federation](https://cloud.google.com/iam/docs/configuring-workload-identity-federation).
12+
For more information about Workload Identity Federation and how to best authenticate service accounts on Google Cloud, please see my GitHub repo [Cyclenerd/google-workload-identity-federation](https://github.com/Cyclenerd/google-workload-identity-federation#readme).
1013

11-
## 🧑‍💻 Development
14+
> There is also a ready-to-use Terraform module for [GitHub](https://github.com/Cyclenerd/terraform-google-wif-github#readme).
1215
13-
[![Open in Gitpod](https://gitpod.io/button/open-in-gitpod.svg)](https://gitpod.io/#https://github.com/Cyclenerd/template)
16+
## Example
1417

15-
### Requirements
18+
Create Workload Identity Pool and Provider:
1619

17-
* A
18-
* B
19-
* C
20+
```hcl
21+
# Create Workload Identity Pool Provider for GitLab
22+
module "gitlab-wif" {
23+
source = "Cyclenerd/wif-gitlab/google"
24+
version = "1.0.0"
25+
project_id = "your-project-id"
26+
}
2027
21-
## ❤️ Contributing
28+
# Get the Workload Identity Pool Provider resource name for GitLab CI configuration
29+
output "gitlab-workload-identity-provider" {
30+
description = "The Workload Identity Provider resource name"
31+
value = module.gitlab-wif.provider_name
32+
}
33+
```
2234

23-
Have a patch that will benefit this project?
24-
Awesome! Follow these steps to have it accepted.
35+
> An example of a working GitLab CI configuration (`.gitlab-ci.yml`) can be found [here](https://gitlab.com/Cyclenerd/google-workload-identity-federation-for-gitlab/-/blob/master/.gitlab-ci.yml).
2536
26-
1. Please read [how to contribute](CONTRIBUTING.md).
27-
1. Fork this Git repository and make your changes.
28-
1. Create a Pull Request.
29-
1. Incorporate review feedback to your changes.
30-
1. Accepted!
37+
Allow service account to login via Workload Identity Provider and limit login only from the GitLab repository (project path) `octo-org/octo-repo`:
3138

39+
```hcl
40+
# Get existing service account for GitLab CI
41+
data "google_service_account" "gitlab" {
42+
project = "your-project-id"
43+
account_id = "existing-account-for-gitlab-ci"
44+
}
3245
33-
## 📜 License
46+
# Allow service account to login via WIF and only from GitLab repository (project path)
47+
module "gitlab-service-account" {
48+
source = "Cyclenerd/wif-service-account/google"
49+
version = "1.0.0"
50+
project_id = "your-project-id"
51+
pool_name = module.gitlab-wif.pool_name
52+
account_id = data.google_service_account.gitlab.account_id
53+
repository = "octo-org/octo-repo"
54+
}
55+
```
3456

35-
All files in this repository are under the [Apache License, Version 2.0](LICENSE) unless noted otherwise.
57+
> Terraform module [`Cyclenerd/wif-service-account/google`](https://github.com/Cyclenerd/terraform-google-wif-service-account) is used.
58+
59+
👉 [**More examples**](https://github.com/Cyclenerd/terraform-google-wif-gitlab/tree/master/examples)
60+
61+
## OIDC Token Attribute Mapping
62+
63+
Attribute mapping:
64+
65+
| Attribute | Claim |
66+
|------------------------|-------------------------------------------------------|
67+
| `google.subject` | `assertion.sub` |
68+
| `attribute.sub` | `assertion.sub` |
69+
| `attribute.actor` | `assertion.actor` |
70+
| `attribute.repository` | `assertion.project_path` (not `assertion.repository`) |
71+
72+
<!-- BEGIN_TF_DOCS -->
73+
## Providers
74+
75+
| Name | Version |
76+
|------|---------|
77+
| <a name="provider_google"></a> [google](#provider\_google) | >= 4.61.0 |
3678

37-
Please note: No warranty
79+
## Inputs
80+
81+
| Name | Description | Type | Default | Required |
82+
|------|-------------|------|---------|:--------:|
83+
| <a name="input_allowed_audiences"></a> [allowed\_audiences](#input\_allowed\_audiences) | Workload Identity Pool Provider allowed audiences | `string` | `"https://gitlab.com"` | no |
84+
| <a name="input_issuer_uri"></a> [issuer\_uri](#input\_issuer\_uri) | Workload Identity Pool Provider issuer URI | `string` | `"https://gitlab.com"` | no |
85+
| <a name="input_pool_description"></a> [pool\_description](#input\_pool\_description) | Workload Identity Pool description | `string` | `"Workload Identity Pool for GitLab (Terraform managed)"` | no |
86+
| <a name="input_pool_disabled"></a> [pool\_disabled](#input\_pool\_disabled) | Workload Identity Pool disabled | `bool` | `false` | no |
87+
| <a name="input_pool_display_name"></a> [pool\_display\_name](#input\_pool\_display\_name) | Workload Identity Pool display name | `string` | `"gitlab.com"` | no |
88+
| <a name="input_pool_id"></a> [pool\_id](#input\_pool\_id) | Workload Identity Pool ID | `string` | `"gitlab-com"` | no |
89+
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | The ID of the project | `string` | n/a | yes |
90+
| <a name="input_provider_description"></a> [provider\_description](#input\_provider\_description) | Workload Identity Pool Provider description | `string` | `"Workload Identity Pool Provider for GitLab (Terraform managed)"` | no |
91+
| <a name="input_provider_disabled"></a> [provider\_disabled](#input\_provider\_disabled) | Workload Identity Pool Provider disabled | `bool` | `false` | no |
92+
| <a name="input_provider_display_name"></a> [provider\_display\_name](#input\_provider\_display\_name) | Workload Identity Pool Provider display name | `string` | `"gitlab.com OIDC"` | no |
93+
| <a name="input_provider_id"></a> [provider\_id](#input\_provider\_id) | Workload Identity Pool Provider ID | `string` | `"gitlab-com-oidc"` | no |
94+
95+
## Outputs
96+
97+
| Name | Description |
98+
|------|-------------|
99+
| <a name="output_pool_id"></a> [pool\_id](#output\_pool\_id) | Identifier for the pool |
100+
| <a name="output_pool_name"></a> [pool\_name](#output\_pool\_name) | The resource name for the pool |
101+
| <a name="output_pool_state"></a> [pool\_state](#output\_pool\_state) | State of the pool |
102+
| <a name="output_provider_id"></a> [provider\_id](#output\_provider\_id) | Identifier for the provider |
103+
| <a name="output_provider_name"></a> [provider\_name](#output\_provider\_name) | The resource name of the provider |
104+
| <a name="output_provider_state"></a> [provider\_state](#output\_provider\_state) | State of the provider |
105+
<!-- END_TF_DOCS -->
106+
107+
## License
108+
109+
All files in this repository are under the [Apache License, Version 2.0](LICENSE) unless noted otherwise.

‎examples/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Examples
2+
3+
* [GitLab CI](./gitlab-ci/)

‎examples/gitlab-ci/.terraform-docs.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
formatter: "markdown"
2+
output:
3+
file: "README.md"
4+
mode: inject
5+
template: |-
6+
<!-- BEGIN_TF_DOCS -->
7+
{{ .Content }}
8+
<!-- END_TF_DOCS -->
9+
settings:
10+
indent: 2
11+
content: |-
12+
13+
```hcl
14+
{{ include "main.tf" }}
15+
```
16+
17+
{{ .Inputs }}
18+
19+
{{ .Outputs }}

‎examples/gitlab-ci/README.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# GitLab CI
2+
3+
The following example shows you how to configure Workload Identity Federation via Terraform IaC for GitLab CI.
4+
5+
## Example
6+
7+
With this example the following steps are executed and configured:
8+
9+
1. Create Workload Identity Pool Provider for GitLab
10+
1. Create new service account for GitLab CI
11+
1. Allow login via Workload Identity Provider and limit login only from the GitLab repository (project path)
12+
1. Output the Workload Identity Pool Provider resource name for GitLab CI configuration
13+
14+
> An example of a working GitLab CI configuration (`.gitlab-ci.yml`) can be found [here](https://gitlab.com/Cyclenerd/google-workload-identity-federation-for-gitlab/-/blob/master/.gitlab-ci.yml).
15+
16+
<!-- BEGIN_TF_DOCS -->
17+
18+
```hcl
19+
# Create Workload Identity Pool Provider for GitLab
20+
module "gitlab-wif" {
21+
source = "Cyclenerd/wif-gitlab/google"
22+
version = "1.0.0"
23+
project_id = var.project_id
24+
}
25+
26+
# Create new service account for GitLab CI
27+
resource "google_service_account" "gitlab" {
28+
project = var.project_id
29+
account_id = var.gitlab_account_id
30+
display_name = "GitLab CI (WIF)"
31+
description = "Service Account for GitLab CI ${var.gitlab_repository} (Terraform managed)"
32+
}
33+
34+
# Allow service account to login via WIF and only from GitLab repository (project path)
35+
module "github-service-account" {
36+
source = "Cyclenerd/wif-service-account/google"
37+
version = "1.0.0"
38+
project_id = var.project_id
39+
pool_name = module.gitlab-wif.pool_name
40+
account_id = google_service_account.gitlab.account_id
41+
repository = var.gitlab_repository
42+
}
43+
44+
# Get the Workload Identity Pool Provider resource name for GitLab CI configuration
45+
output "gitlab-workload-identity-provider" {
46+
description = "The Workload Identity Provider resource name"
47+
value = module.gitlab-wif.provider_name
48+
}
49+
```
50+
51+
## Inputs
52+
53+
| Name | Description | Type | Default | Required |
54+
|------|-------------|------|---------|:--------:|
55+
| <a name="input_gitlab_account_id"></a> [gitlab\_account\_id](#input\_gitlab\_account\_id) | The account id of the service account for GitLab CI | `string` | n/a | yes |
56+
| <a name="input_gitlab_repository"></a> [gitlab\_repository](#input\_gitlab\_repository) | The GitLab repository (project path) | `string` | n/a | yes |
57+
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | The ID of the project | `string` | n/a | yes |
58+
59+
## Outputs
60+
61+
| Name | Description |
62+
|------|-------------|
63+
| <a name="output_gitlab-workload-identity-provider"></a> [gitlab-workload-identity-provider](#output\_gitlab-workload-identity-provider) | The Workload Identity Provider resource name |
64+
<!-- END_TF_DOCS -->

0 commit comments

Comments
 (0)