update integration tests

Author: renato-rudnicki

5-app-infra/business_unit_1/development/outputs.tf

@@ -52,3 +52,14 @@ output "region" {
   value       = module.gce_instance.region
 }
 
+output "workload_pool_provider_id" {
+  description = "Workload pool provider used by confidential space."
+  value       = module.confidential_space.workload_pool_provider_id
+}
+
+output "workload_identity_pool_id" {
+  description = "Workload identity pool ID."
+  value       = module.confidential_space.workload_identity_pool_id
+
+}
+

5-app-infra/business_unit_1/nonproduction/outputs.tf

@@ -52,3 +52,14 @@ output "region" {
   value       = module.gce_instance.region
 }
 
+output "workload_pool_provider_id" {
+  description = "Workload pool provider used by confidential space."
+  value       = module.confidential_space.workload_pool_provider_id
+}
+
+output "workload_identity_pool_id" {
+  description = "Workload identity pool ID."
+  value       = module.confidential_space.workload_identity_pool_id
+
+}
+

5-app-infra/business_unit_1/production/outputs.tf

@@ -52,3 +52,14 @@ output "region" {
   value       = module.gce_instance.region
 }
 
+output "workload_pool_provider_id" {
+  description = "Workload pool provider used by confidential space."
+  value       = module.confidential_space.workload_pool_provider_id
+}
+
+output "workload_identity_pool_id" {
+  description = "Workload identity pool ID."
+  value       = module.confidential_space.workload_identity_pool_id
+
+}
+

5-app-infra/modules/confidential_space/outputs.tf

@@ -39,3 +39,14 @@ output "confidential_image_digest" {
   value       = var.confidential_image_digest
 }
 
+output "workload_pool_provider_id" {
+  description = "Workload pool provider used by confidential space."
+  value       = google_iam_workload_identity_pool_provider.attestation_verifier.workload_identity_pool_provider_id
+}
+
+output "workload_identity_pool_id" {
+  description = "Workload identity pool ID."
+  value       = google_iam_workload_identity_pool.confidential_space_pool.workload_identity_pool_id
+
+}
+

test/integration/app-infra/app_infra_test.go

@@ -70,13 +70,16 @@ func TestAppInfra(t *testing.T) {
 			appInfra.DefineVerify(
 				func(assert *assert.Assertions) {
 					projectID := appInfra.GetStringOutput("project_id")
+					workloadPoolProvider := appInfra.GetStringOutput("workload_pool_provider_id")
+					workloadIdentityPool := appInfra.GetStringOutput("workload_identity_pool_id")
 					instanceName := terraform.OutputList(t, appInfra.GetTFOptions(), "instances_names")[0]
 					instanceZone := terraform.OutputList(t, appInfra.GetTFOptions(), "instances_zones")[0]
 					machineType := fmt.Sprintf("https://www.googleapis.com/compute/v1/projects/%s/zones/%s/machineTypes/f1-micro", projectID, instanceZone)
 
 					gcOps := gcloud.WithCommonArgs([]string{"--project", projectID, "--zone", instanceZone, "--format", "json"})
 					instance := gcloud.Run(t, fmt.Sprintf("compute instances describe %s", instanceName), gcOps)
 					assert.Equal(machineType, instance.Get("machineType").String(), "should have machine_type f1-micro")
+					
 					computeInstanceList := gcloud.Run(t, fmt.Sprintf("compute instances list --format=json --project %s --filter name=confidential-instance", projectID))
 					assert.Len(computeInstanceList.Array(), 1)
 					computeInstance := computeInstanceList.Array()[0]
@@ -87,6 +90,11 @@ func TestAppInfra(t *testing.T) {
 					serviceAccounts := computeInstance.Get("serviceAccounts").Array()
 					assert.Len(serviceAccounts, 1)
 					assert.Equal(fmt.Sprintf("confidential-space-workload-sa@%s.iam.gserviceaccount.com", projectID), serviceAccounts[0].Get("email").String())
+					workloadIdentityPoolProviderID := gcloud.Runf(t, "iam workload-identity-pools providers describe %s --workload-identity-pool=confidential-space-pool --location=global --project %s", workloadPoolProvider, projectID)
+					assert.Equal(workloadPoolProvider, workloadIdentityPoolProviderID.Get("displayName").String(), fmt.Sprintf("workload identity pool provider should have name equals to %s", workloadIdentityPoolProviderID))
+					gcPoolOps := gcloud.WithCommonArgs([]string{"--project", projectID, "--format", "value(name.basename())"})
+					workloadIdentityPoolName := gcloud.Runf(t, fmt.Sprintf("iam workload-identity-pools describe confidential-space-pool --location=global"), gcPoolOps)
+					assert.Equal(workloadIdentityPool, workloadIdentityPoolName.Get("name").String(), fmt.Sprintf("workload identity pool should have name equals to %s", workloadIdentityPoolName))
 				})
 
 			appInfra.Test()