Move to service account (#76)

* Move to service account

* Restore missing env and tools

Author: enolfc

.github/workflows/deploy.yaml

@@ -24,26 +24,28 @@ jobs:
         with:
           python-version: 3.x
       - name: Install environment
-        env:
-          MYTOKEN: ${{ secrets.MYTOKEN }}
         run: |
           curl -L https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 > jq
           chmod +x jq
           pip install yq ansible git+https://github.com/tdviet/fedcloudclient.git
-          curl -L https://github.com/oidc-mytoken/client/releases/download/v0.5.2/mytoken_0.5.2_linux_64-bit.tar.gz \
-            | tar -xzf -
-          mkdir ~/.mytoken
-          curl https://raw.githubusercontent.com/oidc-mytoken/client/master/config/example-config.yaml \
-            | sed 's/default_provider:/default_provider: "egi"/g' \
-            > ~/.mytoken/config.yaml
           # add PWD to the PATH
           echo "$PWD" >> "$GITHUB_PATH"
-          # add OIDC access token to ENV
-          OIDC_TOKEN=$(./mytoken AT --MT-env MYTOKEN)
-          echo "::add-mask::$OIDC_TOKEN"
-          echo "OIDC_TOKEN=$OIDC_TOKEN" >> "$GITHUB_ENV"
       - name: Configure providers access
+        env:
+          CLIENT_ID: ${{ secrets.CLIENT_ID }}
+          CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
         run: |
+          # using parametric scopes to only have access to cloud.egi.eu VO
+          SCOPE="openid%20email%20profile%20voperson_id"
+          SCOPE="$SCOPE%20eduperson_entitlement:urn:mace:egi.eu:group:cloud.egi.eu:role=vm_operator#aai.egi.eu"
+          SCOPE="$SCOPE%20eduperson_entitlement:urn:mace:egi.eu:group:cloud.egi.eu:role=member#aai.egi.eu"
+          SCOPE="$SCOPE%20entitlements:urn:mace:egi.eu:group:cloud.egi.eu:role=vm_operator#aai.egi.eu"
+          SCOPE="$SCOPE%20entitlements:urn:mace:egi.eu:group:cloud.egi.eu:role=member#aai.egi.eu"
+          OIDC_TOKEN=$(curl -X POST "https://aai.egi.eu/auth/realms/egi/protocol/openid-connect/token" \
+                            -d "grant_type=client_credentials&client_id=$CLIENT_ID&scope=$SCOPE&client_secret=$CLIENT_SECRET" \
+                          | jq -r ".access_token")
+          echo "::add-mask::$OIDC_TOKEN"
+          echo "OIDC_TOKEN=$OIDC_TOKEN" >> "$GITHUB_ENV"
           cd deployment
           ./site-config.sh
       - name: Setup Terraform