Skip to content

Commit c6dba46

Browse files
modular-magicianJieqing(Jay) Chen
modular-magician
and
Jieqing(Jay) Chen
authored
Added optional field jwks_json to workloadidentityprovider (#8067) (#5789)
```release-note:enhancement container: Added optional field `jwks_json` to `workloadidentityprovider` ``` Signed-off-by: Modular Magician <[email protected]> Co-authored-by: Jieqing(Jay) Chen <[email protected]>
1 parent 3c2d846 commit c6dba46

File tree

5 files changed

+172
-1
lines changed

5 files changed

+172
-1
lines changed

‎.changelog/8067.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
container: Added optional field `jwks_json` to `workloadidentityprovider`
3+
```

‎google-beta/resource_iam_beta_workload_identity_pool_provider_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,7 @@ EOT
165165
oidc {
166166
allowed_audiences = ["https://example.com/gcp-oidc-federation", "example.com/gcp-oidc-federation"]
167167
issuer_uri = "https://sts.windows.net/azure-tenant-id-full"
168+
jwks_json = "{\"keys\":[{\"kty\":\"RSA\",\"alg\":\"RS256\",\"kid\":\"sif0AR-F6MuvksAyAOv-Pds08Bcf2eUMlxE30NofddA\",\"use\":\"sig\",\"e\":\"AQAB\",\"n\":\"ylH1Chl1tpfti3lh51E1g5dPogzXDaQseqjsefGLknaNl5W6Wd4frBhHyE2t41Q5zgz_Ll0-NvWm0FlaG6brhrN9QZu6sJP1bM8WPfJVPgXOanxi7d7TXCkeNubGeiLTf5R3UXtS9Lm_guemU7MxDjDTelxnlgGCihOVTcL526suNJUdfXtpwUsvdU6_ZnAp9IpsuYjCtwPm9hPumlcZGMbxstdh07O4y4O90cVQClJOKSGQjAUCKJWXIQ0cqffGS_HuS_725CPzQ85SzYZzaNpgfhAER7kx_9P16ARM3BJz0PI5fe2hECE61J4GYU_BY43sxDfs7HyJpEXKLU9eWw\"}]}"
168169
}
169170
}
170171
`, context)
@@ -196,6 +197,8 @@ EOT
196197
oidc {
197198
allowed_audiences = ["https://example.com/gcp-oidc-federation-update", "example.com/gcp-oidc-federation-update"]
198199
issuer_uri = "https://sts.windows.net/azure-tenant-id-update"
200+
jwks_json = "{\"keys\":[{\"kty\":\"RSA\",\"alg\":\"RS256\",\"kid\":\"F6MuvksAyAOv-Pds08Bcf2eUMlxE30NofddA\",\"use\":\"sig\",\"e\":\"AQAB\",\"n\":\"ylH1Chl1tpfti3lh51E1g5dPogzXDaQseqjsefGLknaNl5W6Wd4frBhHyE2t41Q5zgz_Ll0-NvWm0FlaG6brhrN9QZu6sJP1bM8WPfJVPgXOanxi7d7TXCkeNubGeiLTf5R3UXtS9Lm_guemU7MxDjDTelxnlgGCihOVTcL526suNJUdfXtpwUsvdU6_ZnAp9IpsuYjCtwPm9hPumlcZGMbxstdh07O4y4O90cVQClJOKSGQjAUCKJWXIQ0cqffGS_HuS_725CPzQ85SzYZzaNpgfhAER7kx_9P16ARM3BJz0PI5fe2hECE61J4GYU_BY43sxDfs7HyJpEXKLU9eWw\"}]}"
201+
199202
}
200203
}
201204
`, context)

‎google-beta/resource_iam_workload_identity_pool_provider_generated_test.go‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,63 @@ EOT
221221
`, context)
222222
}
223223

224+
func TestAccIAMBetaWorkloadIdentityPoolProvider_iamWorkloadIdentityPoolProviderOidcUploadKeyExample(t *testing.T) {
225+
t.Parallel()
226+
227+
context := map[string]interface{}{
228+
"random_suffix": RandString(t, 10),
229+
}
230+
231+
VcrTest(t, resource.TestCase{
232+
PreCheck: func() { acctest.AccTestPreCheck(t) },
233+
ProtoV5ProviderFactories: ProtoV5ProviderFactories(t),
234+
CheckDestroy: testAccCheckIAMBetaWorkloadIdentityPoolProviderDestroyProducer(t),
235+
Steps: []resource.TestStep{
236+
{
237+
Config: testAccIAMBetaWorkloadIdentityPoolProvider_iamWorkloadIdentityPoolProviderOidcUploadKeyExample(context),
238+
},
239+
{
240+
ResourceName: "google_iam_workload_identity_pool_provider.example",
241+
ImportState: true,
242+
ImportStateVerify: true,
243+
ImportStateVerifyIgnore: []string{"workload_identity_pool_id", "workload_identity_pool_provider_id"},
244+
},
245+
},
246+
})
247+
}
248+
249+
func testAccIAMBetaWorkloadIdentityPoolProvider_iamWorkloadIdentityPoolProviderOidcUploadKeyExample(context map[string]interface{}) string {
250+
return tpgresource.Nprintf(`
251+
resource "google_iam_workload_identity_pool" "pool" {
252+
workload_identity_pool_id = "tf-test-example-pool%{random_suffix}"
253+
}
254+
255+
resource "google_iam_workload_identity_pool_provider" "example" {
256+
workload_identity_pool_id = google_iam_workload_identity_pool.pool.workload_identity_pool_id
257+
workload_identity_pool_provider_id = "tf-test-example-prvdr%{random_suffix}"
258+
display_name = "Name of provider"
259+
description = "OIDC identity pool provider for automated test"
260+
disabled = true
261+
attribute_condition = "\"e968c2ef-047c-498d-8d79-16ca1b61e77e\" in assertion.groups"
262+
attribute_mapping = {
263+
"google.subject" = "\"azure::\" + assertion.tid + \"::\" + assertion.sub"
264+
"attribute.tid" = "assertion.tid"
265+
"attribute.managed_identity_name" = <<EOT
266+
{
267+
"8bb39bdb-1cc5-4447-b7db-a19e920eb111":"workload1",
268+
"55d36609-9bcf-48e0-a366-a3cf19027d2a":"workload2"
269+
}[assertion.oid]
270+
EOT
271+
}
272+
oidc {
273+
allowed_audiences = ["https://example.com/gcp-oidc-federation", "example.com/gcp-oidc-federation"]
274+
issuer_uri = "https://sts.windows.net/azure-tenant-id"
275+
jwks_json = "{\"keys\":[{\"kty\":\"RSA\",\"alg\":\"RS256\",\"kid\":\"sif0AR-F6MuvksAyAOv-Pds08Bcf2eUMlxE30NofddA\",\"use\":\"sig\",\"e\":\"AQAB\",\"n\":\"ylH1Chl1tpfti3lh51E1g5dPogzXDaQseqjsefGLknaNl5W6Wd4frBhHyE2t41Q5zgz_Ll0-NvWm0FlaG6brhrN9QZu6sJP1bM8WPfJVPgXOanxi7d7TXCkeNubGeiLTf5R3UXtS9Lm_guemU7MxDjDTelxnlgGCihOVTcL526suNJUdfXtpwUsvdU6_ZnAp9IpsuYjCtwPm9hPumlcZGMbxstdh07O4y4O90cVQClJOKSGQjAUCKJWXIQ0cqffGS_HuS_725CPzQ85SzYZzaNpgfhAER7kx_9P16ARM3BJz0PI5fe2hECE61J4GYU_BY43sxDfs7HyJpEXKLU9eWw\"}]}"
276+
}
277+
}
278+
`, context)
279+
}
280+
224281
func testAccCheckIAMBetaWorkloadIdentityPoolProviderDestroyProducer(t *testing.T) func(s *terraform.State) error {
225282
return func(s *terraform.State) error {
226283
for name, rs := range s.RootModule().Resources {

‎google-beta/services/iambeta/resource_iam_workload_identity_pool_provider.go‎

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,33 @@ https://iam.googleapis.com/projects/<project-number>/locations/<location>/worklo
245245
Type: schema.TypeString,
246246
},
247247
},
248+
"jwks_json": {
249+
Type: schema.TypeString,
250+
Optional: true,
251+
Description: `OIDC JWKs in JSON String format. For details on definition of a
252+
JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
253+
use the 'jwks_uri' from the discovery document fetched from the
254+
.well-known path for the 'issuer_uri'. Currently, RSA and EC asymmetric
255+
keys are supported. The JWK must use following format and include only
256+
the following fields:
257+
'''
258+
{
259+
"keys": [
260+
{
261+
"kty": "RSA/EC",
262+
"alg": "<algorithm>",
263+
"use": "sig",
264+
"kid": "<key-id>",
265+
"n": "",
266+
"e": "",
267+
"x": "",
268+
"y": "",
269+
"crv": ""
270+
}
271+
]
272+
}
273+
'''`,
274+
},
248275
},
249276
},
250277
ExactlyOneOf: []string{"aws", "oidc"},
@@ -558,7 +585,8 @@ func resourceIAMBetaWorkloadIdentityPoolProviderUpdate(d *schema.ResourceData, m
558585

559586
if d.HasChange("oidc") {
560587
updateMask = append(updateMask, "oidc.allowed_audiences",
561-
"oidc.issuer_uri")
588+
"oidc.issuer_uri",
589+
"oidc.jwks_json")
562590
}
563591
// updateMask is a URL parameter but not present in the schema, so ReplaceVars
564592
// won't set it
@@ -730,6 +758,8 @@ func flattenIAMBetaWorkloadIdentityPoolProviderOidc(v interface{}, d *schema.Res
730758
flattenIAMBetaWorkloadIdentityPoolProviderOidcAllowedAudiences(original["allowedAudiences"], d, config)
731759
transformed["issuer_uri"] =
732760
flattenIAMBetaWorkloadIdentityPoolProviderOidcIssuerUri(original["issuerUri"], d, config)
761+
transformed["jwks_json"] =
762+
flattenIAMBetaWorkloadIdentityPoolProviderOidcJwksJson(original["jwksJson"], d, config)
733763
return []interface{}{transformed}
734764
}
735765
func flattenIAMBetaWorkloadIdentityPoolProviderOidcAllowedAudiences(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
@@ -740,6 +770,10 @@ func flattenIAMBetaWorkloadIdentityPoolProviderOidcIssuerUri(v interface{}, d *s
740770
return v
741771
}
742772

773+
func flattenIAMBetaWorkloadIdentityPoolProviderOidcJwksJson(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
774+
return v
775+
}
776+
743777
func expandIAMBetaWorkloadIdentityPoolProviderDisplayName(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
744778
return v, nil
745779
}
@@ -813,6 +847,13 @@ func expandIAMBetaWorkloadIdentityPoolProviderOidc(v interface{}, d tpgresource.
813847
transformed["issuerUri"] = transformedIssuerUri
814848
}
815849

850+
transformedJwksJson, err := expandIAMBetaWorkloadIdentityPoolProviderOidcJwksJson(original["jwks_json"], d, config)
851+
if err != nil {
852+
return nil, err
853+
} else if val := reflect.ValueOf(transformedJwksJson); val.IsValid() && !tpgresource.IsEmptyValue(val) {
854+
transformed["jwksJson"] = transformedJwksJson
855+
}
856+
816857
return transformed, nil
817858
}
818859

@@ -824,6 +865,10 @@ func expandIAMBetaWorkloadIdentityPoolProviderOidcIssuerUri(v interface{}, d tpg
824865
return v, nil
825866
}
826867

868+
func expandIAMBetaWorkloadIdentityPoolProviderOidcJwksJson(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
869+
return v, nil
870+
}
871+
827872
func resourceIAMBetaWorkloadIdentityPoolProviderDecoder(d *schema.ResourceData, meta interface{}, res map[string]interface{}) (map[string]interface{}, error) {
828873
if v := res["state"]; v == "DELETED" {
829874
return nil, nil

‎website/docs/r/iam_workload_identity_pool_provider.html.markdown‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,43 @@ EOT
139139
}
140140
}
141141
```
142+
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
143+
<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=iam_workload_identity_pool_provider_oidc_upload_key&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
144+
<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
145+
</a>
146+
</div>
147+
## Example Usage - Iam Workload Identity Pool Provider Oidc Upload Key
148+
149+
150+
```hcl
151+
resource "google_iam_workload_identity_pool" "pool" {
152+
workload_identity_pool_id = "example-pool"
153+
}
154+
155+
resource "google_iam_workload_identity_pool_provider" "example" {
156+
workload_identity_pool_id = google_iam_workload_identity_pool.pool.workload_identity_pool_id
157+
workload_identity_pool_provider_id = "example-prvdr"
158+
display_name = "Name of provider"
159+
description = "OIDC identity pool provider for automated test"
160+
disabled = true
161+
attribute_condition = "\"e968c2ef-047c-498d-8d79-16ca1b61e77e\" in assertion.groups"
162+
attribute_mapping = {
163+
"google.subject" = "\"azure::\" + assertion.tid + \"::\" + assertion.sub"
164+
"attribute.tid" = "assertion.tid"
165+
"attribute.managed_identity_name" = <<EOT
166+
{
167+
"8bb39bdb-1cc5-4447-b7db-a19e920eb111":"workload1",
168+
"55d36609-9bcf-48e0-a366-a3cf19027d2a":"workload2"
169+
}[assertion.oid]
170+
EOT
171+
}
172+
oidc {
173+
allowed_audiences = ["https://example.com/gcp-oidc-federation", "example.com/gcp-oidc-federation"]
174+
issuer_uri = "https://sts.windows.net/azure-tenant-id"
175+
jwks_json = "{\"keys\":[{\"kty\":\"RSA\",\"alg\":\"RS256\",\"kid\":\"sif0AR-F6MuvksAyAOv-Pds08Bcf2eUMlxE30NofddA\",\"use\":\"sig\",\"e\":\"AQAB\",\"n\":\"ylH1Chl1tpfti3lh51E1g5dPogzXDaQseqjsefGLknaNl5W6Wd4frBhHyE2t41Q5zgz_Ll0-NvWm0FlaG6brhrN9QZu6sJP1bM8WPfJVPgXOanxi7d7TXCkeNubGeiLTf5R3UXtS9Lm_guemU7MxDjDTelxnlgGCihOVTcL526suNJUdfXtpwUsvdU6_ZnAp9IpsuYjCtwPm9hPumlcZGMbxstdh07O4y4O90cVQClJOKSGQjAUCKJWXIQ0cqffGS_HuS_725CPzQ85SzYZzaNpgfhAER7kx_9P16ARM3BJz0PI5fe2hECE61J4GYU_BY43sxDfs7HyJpEXKLU9eWw\"}]}"
176+
}
177+
}
178+
```
142179

143180
## Argument Reference
144181

@@ -286,6 +323,32 @@ The following arguments are supported:
286323
(Required)
287324
The OIDC issuer URL.
288325
326+
* `jwks_json` -
327+
(Optional)
328+
OIDC JWKs in JSON String format. For details on definition of a
329+
JWK, see https:tools.ietf.org/html/rfc7517. If not set, then we
330+
use the `jwks_uri` from the discovery document fetched from the
331+
.well-known path for the `issuer_uri`. Currently, RSA and EC asymmetric
332+
keys are supported. The JWK must use following format and include only
333+
the following fields:
334+
```
335+
{
336+
"keys": [
337+
{
338+
"kty": "RSA/EC",
339+
"alg": "<algorithm>",
340+
"use": "sig",
341+
"kid": "<key-id>",
342+
"n": "",
343+
"e": "",
344+
"x": "",
345+
"y": "",
346+
"crv": ""
347+
}
348+
]
349+
}
350+
```
351+
289352
## Attributes Reference
290353
291354
In addition to the arguments listed above, the following computed attributes are exported:

0 commit comments

Comments
 (0)