Skip to content

Commit 8e757ce

Browse files
mateuszjenekmateuszjenek
committed
feat: use dynamic credentials
1 parent b5cd9b2 commit 8e757ce

22 files changed

+203
-35
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ Once you are finished with the reference architecture, you can remove all provis
264264
| environment\_type | The environment type to associate the reference architecture with. | `string` | `"development"` | no |
265265
| gar\_repository\_id | Google Artifact Registry repository ID. | `string` | `"htc-ref-arch"` | no |
266266
| github\_org\_id | GitHub org id (required for Backstage) | `string` | `null` | no |
267-
| humanitec\_org\_id | Humanitec Organization ID (required for Backstage) | `string` | `null` | no |
267+
| humanitec\_org\_id | Humanitec Organization ID. | `string` | `null` | no |
268268
| humanitec\_prefix | A prefix that will be attached to all IDs created in Humanitec. | `string` | `"htc-ref-arch-"` | no |
269269
| with\_backstage | Deploy Backstage | `bool` | `false` | no |
270270
<!-- END_TF_DOCS -->

‎main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module "base" {
55
project_id = var.project_id
66
region = var.region
77
humanitec_prefix = var.humanitec_prefix
8+
humanitec_org_id = var.humanitec_org_id
89
environment = var.environment
910
environment_type = var.environment_type
1011

‎modules/base/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717

1818
| Name | Source | Version |
1919
|------|--------|---------|
20+
| credentials | ../dynamic_creds | n/a |
2021
| k8s | ../gke | n/a |
2122
| network | ../network | n/a |
2223
| res\_defs | ../htc_res_defs | n/a |
@@ -40,6 +41,7 @@
4041
| gke\_autopilot | Whether GKE Autopilot should be used | `bool` | `true` | no |
4142
| gke\_cluster\_name | The name of the GKE Cluster. Must be unique within the project. | `string` | `"htc-ref-arch-cluster"` | no |
4243
| gke\_subnet\_name | The name of the subnet to allocate IPs for the GKE Cluster from. If vpc\_subnet is set, this must be updated. | `string` | `"htc-ref-arch-subnet"` | no |
44+
| humanitec\_org\_id | Humanitec Organization ID. | `string` | `null` | no |
4345
| humanitec\_prefix | A prefix that will be attached to all IDs created in Humanitec. | `string` | `""` | no |
4446
| vpc\_description | VPC Description | `string` | `"VPC for Humanitec Reference Architecture Implementation for GCP. https://github.com/humanitec-architecture/reference-archietcture-gcp"` | no |
4547
| vpc\_name | VPC Name | `string` | `"htc-ref-arch-vpc"` | no |

‎modules/base/main.tf‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -44,17 +44,28 @@ module "k8s" {
4444
gar_repository_location = var.gar_repository_location
4545
}
4646

47+
# ######################################################################
48+
# # DYNAMIC CREDENTIALS
49+
# ######################################################################
50+
module "credentials" {
51+
source = "../dynamic_creds"
52+
humanitec_org = var.humanitec_org_id
53+
gcp_project_id = var.project_id
54+
55+
}
56+
57+
4758
# ######################################################################
4859
# # HUMANITEC MODULE
4960
# ######################################################################
5061
module "res_defs" {
51-
source = "../htc_res_defs"
52-
k8s_cluster_name = module.k8s.cluster_name
53-
k8s_loadbalancer = module.k8s.loadbalancer
54-
k8s_region = var.region
55-
k8s_project_id = var.project_id
56-
k8s_credentials = module.k8s.credentials
57-
environment = var.environment
58-
environment_type = var.environment_type
59-
prefix = var.humanitec_prefix
62+
source = "../htc_res_defs"
63+
k8s_cluster_name = module.k8s.cluster_name
64+
k8s_loadbalancer = module.k8s.loadbalancer
65+
k8s_region = var.region
66+
k8s_project_id = var.project_id
67+
environment = var.environment
68+
environment_type = var.environment_type
69+
prefix = var.humanitec_prefix
70+
humanitec_cloud_account = module.credentials.humanitec_cloud_account
6071
}

‎modules/base/terraform.tfvars.example‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ gke_cluster_name = "htc-ref-arch-cluster"
2020
# The name of the subnet to allocate IPs for the GKE Cluster from. If vpc_subnet is set, this must be updated.
2121
gke_subnet_name = "htc-ref-arch-subnet"
2222

23+
# Humanitec Organization ID.
24+
humanitec_org_id = ""
25+
2326
# A prefix that will be attached to all IDs created in Humanitec.
2427
humanitec_prefix = ""
2528

‎modules/base/variables.tf‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,17 @@ variable "project_id" {
77
description = "GCP Project ID to provision resources in."
88
}
99

10-
1110
variable "region" {
1211
type = string
1312
description = "GCP Region to provision resources in."
1413
}
1514

15+
variable "humanitec_org_id" {
16+
description = "Humanitec Organization ID."
17+
type = string
18+
default = null
19+
}
20+
1621
##########################################
1722
# OPTIONAL INPUTS
1823
##########################################

‎modules/dynamic_creds/README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
### Requirements
3+
4+
| Name | Version |
5+
|------|---------|
6+
| terraform | >= 1.3.0 |
7+
| google | ~> 5.1 |
8+
| humanitec | ~> 1.0 |
9+
10+
### Providers
11+
12+
| Name | Version |
13+
|------|---------|
14+
| google | ~> 5.1 |
15+
| humanitec | ~> 1.0 |
16+
17+
### Resources
18+
19+
| Name | Type |
20+
|------|------|
21+
| [google_iam_workload_identity_pool.pool](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool) | resource |
22+
| [google_iam_workload_identity_pool_provider.pool_provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider) | resource |
23+
| [google_project_iam_member.cloud_account_container_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
24+
| [google_service_account.service_account](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
25+
| [google_service_account_iam_binding.iam-binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_iam_binding) | resource |
26+
| [humanitec_resource_account.cloud_account](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_account) | resource |
27+
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
28+
29+
### Inputs
30+
31+
| Name | Description | Type | Default | Required |
32+
|------|-------------|------|---------|:--------:|
33+
| gcp\_project\_id | The ID of the GCP project to which resources will be deployed. | `string` | n/a | yes |
34+
| humanitec\_org | The identifier of the Humanitec organization used for managing deployments and resources. | `string` | n/a | yes |
35+
| gcp\_service\_account\_id | The ID of the service account used for authenticating and managing GCP resources. | `string` | `"humanitec-cloud-account"` | no |
36+
| gcp\_workload\_identity\_pool\_id | The ID of the Workload Identity Pool in GCP, which allows you to manage resources within the GCP project. | `string` | `"humanitec-wif-pool"` | no |
37+
| gcp\_workload\_identity\_pool\_provider\_id | The ID of the Workload Identity Pool Provider within the specified Workload Identity Pool in GCP, enabling integration with Humanitec. | `string` | `"humanitec-wif"` | no |
38+
39+
### Outputs
40+
41+
| Name | Description |
42+
|------|-------------|
43+
| humanitec\_cloud\_account | The ID of the Humanitec Cloud Account. |
44+
<!-- END_TF_DOCS -->

‎modules/dynamic_creds/main.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
data "google_project" "project" {
2+
project_id = var.gcp_project_id
3+
}
4+
5+
resource "google_iam_workload_identity_pool" "pool" {
6+
workload_identity_pool_id = var.gcp_workload_identity_pool_id
7+
display_name = "Humanitec Identity Pool"
8+
description = "Identity pool for platform orchiestration"
9+
}
10+
11+
resource "google_iam_workload_identity_pool_provider" "pool_provider" {
12+
workload_identity_pool_id = google_iam_workload_identity_pool.pool.workload_identity_pool_id
13+
workload_identity_pool_provider_id = var.gcp_workload_identity_pool_provider_id
14+
attribute_mapping = {
15+
"google.subject" = "assertion.sub"
16+
}
17+
oidc {
18+
issuer_uri = "https://idtoken.humanitec.io"
19+
}
20+
}
21+
22+
resource "google_service_account" "service_account" {
23+
account_id = var.gcp_service_account_id
24+
display_name = "Humanitec GCP dynamic cloud account"
25+
description = "Used by Humanitec Platform Orchestrator Cloud Account"
26+
}
27+
28+
resource "humanitec_resource_account" "cloud_account" {
29+
id = "humanitec-gcp-dynamic-cloud-account"
30+
name = "Humanitec GCP dynamic cloud account"
31+
type = "gcp-identity"
32+
credentials = jsonencode({
33+
"gcp_service_account" = "${google_service_account.service_account.account_id}@${var.gcp_project_id}.iam.gserviceaccount.com"
34+
"gcp_audience" = "//iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.pool.workload_identity_pool_id}/providers/${google_iam_workload_identity_pool_provider.pool_provider.workload_identity_pool_provider_id}"
35+
})
36+
}
37+
38+
resource "google_service_account_iam_binding" "iam-binding" {
39+
service_account_id = google_service_account.service_account.name
40+
role = "roles/iam.workloadIdentityUser"
41+
42+
members = [
43+
"principal://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/humanitec-wif-pool/subject/${var.humanitec_org}/${humanitec_resource_account.cloud_account.id}",
44+
]
45+
}
46+
47+
resource "google_project_iam_member" "cloud_account_container_role" {
48+
project = var.gcp_project_id
49+
role = "roles/container.admin"
50+
member = "serviceAccount:${google_service_account.service_account.email}"
51+
}

‎modules/dynamic_creds/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "humanitec_cloud_account" {
2+
value = humanitec_resource_account.cloud_account.id
3+
description = "The ID of the Humanitec Cloud Account."
4+
}

‎modules/dynamic_creds/providers.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
terraform {
2+
required_providers {
3+
humanitec = {
4+
source = "humanitec/humanitec"
5+
version = "~> 1.0"
6+
}
7+
google = {
8+
source = "hashicorp/google"
9+
version = "~> 5.1"
10+
}
11+
}
12+
required_version = ">= 1.3.0"
13+
}

0 commit comments

Comments
 (0)