1
- import * as pulumi from "@pulumi/pulumi" ;
1
+ // Copyright 2025, Pulumi Corporation. All rights reserved.
2
+
2
3
import * as gcp from "@pulumi/gcp" ;
3
- import * as random from "@pulumi/random " ;
4
+ import * as pulumi from "@pulumi/pulumi " ;
4
5
import * as pcloud from "@pulumi/pulumiservice" ;
6
+ import * as random from "@pulumi/random" ;
5
7
6
8
const config = new pulumi . Config ( ) ;
7
9
const gcpConfig = new pulumi . Config ( "gcp" ) ;
@@ -27,48 +29,50 @@ const randomSuffix = new random.RandomString(`random-suffix`, {
27
29
length : 5 ,
28
30
lower : true ,
29
31
upper : false ,
30
- special : false
32
+ special : false ,
31
33
} ) ;
32
34
33
35
// The Workload Identity Pool id uses a random suffix so that this stack can be
34
36
// brought up and down repeatably: Workload Identity Pools only soft deletes and
35
37
// will auto-purge after 30 days. It is not possible to force a hard delete:
36
38
const identityPool = new gcp . iam . WorkloadIdentityPool ( `identity-pool` , {
37
- workloadIdentityPoolId : pulumi . interpolate `${ workloadIdentityPoolId } -${ randomSuffix . result } `
39
+ workloadIdentityPoolId : pulumi . interpolate `${ workloadIdentityPoolId } -${ randomSuffix . result } ` ,
38
40
} ) ;
39
41
40
42
const oidcProvider = new gcp . iam . WorkloadIdentityPoolProvider ( `identity-pool-provider` , {
41
43
workloadIdentityPoolId : identityPool . workloadIdentityPoolId ,
42
44
workloadIdentityPoolProviderId : `pulumi-cloud-${ pulumi . getOrganization ( ) } -oidc` ,
43
45
oidc : {
44
46
issuerUri : "https://api.pulumi.com/oidc" ,
45
- allowedAudiences : [ `gcp:${ pulumi . getOrganization ( ) } ` ]
47
+ allowedAudiences : [ `gcp:${ pulumi . getOrganization ( ) } ` ] ,
46
48
} ,
47
49
attributeMapping : {
48
- "google.subject" : "assertion.sub"
49
- }
50
+ "google.subject" : "assertion.sub" ,
51
+ } ,
50
52
} ) ;
51
53
52
54
const serviceAccount = new gcp . serviceaccount . Account ( "service-account" , {
53
55
accountId : serviceAccountId ,
54
- project : gcpProjectName
56
+ project : gcpProjectName ,
55
57
} ) ;
56
58
59
+ // tslint:disable-next-line:no-unused-expression
57
60
new gcp . projects . IAMMember ( "service-account" , {
58
61
member : pulumi . interpolate `serviceAccount:${ serviceAccount . email } ` ,
59
62
role : "roles/admin" ,
60
- project : gcpProjectName
63
+ project : gcpProjectName ,
61
64
} ) ;
62
65
66
+ // tslint:disable-next-line:no-unused-expression
63
67
new gcp . serviceaccount . IAMBinding ( "service-account" , {
64
68
serviceAccountId : serviceAccount . id ,
65
69
role : "roles/iam.workloadIdentityUser" ,
66
- members : [ pulumi . interpolate `principalSet://iam.googleapis.com/${ identityPool . name } /*` ]
70
+ members : [ pulumi . interpolate `principalSet://iam.googleapis.com/${ identityPool . name } /*` ] ,
67
71
} ) ;
68
72
69
73
// fn::open::gcp-login requires project number instead of project name:
70
74
const projectNumber = gcp . projects . getProjectOutput ( {
71
- filter : `name:${ gcpProjectName } `
75
+ filter : `name:${ gcpProjectName } ` ,
72
76
} ) . projects [ 0 ] . number
73
77
. apply ( projectNumber => + projectNumber ) ; // this casts it from string to a number
74
78
@@ -104,4 +108,5 @@ const environment = new pcloud.Environment("environment", {
104
108
yaml : envYaml ,
105
109
} ) ;
106
110
107
- export const escEnvId = environment . id ;
111
+
112
+ export const escEnvId = environment . id ;
0 commit comments