Google cloud oidc integration #55
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
goruha
requested changes
Dec 13, 2024
| @@ -163,6 +166,7 @@ runs: | |||
| - name: Configure Plan AWS Credentials | |||
| if: ${{ steps.config.outputs.aws-region != '' && | |||
| steps.config.outputs.aws-region != 'null' && | |||
| steps.config.outputs.backend == 'aws' && | |||
There was a problem hiding this comment.
Suggested change
| steps.config.outputs.backend == 'aws' && |
Comment on lines
+179
to
+185
| - name: Configure Google Credentials | ||
| if: ${{ steps.config.outputs.backend == 'google' }} | ||
| uses: google-github-actions/auth@v2 | ||
| with: | ||
| workload_identity_provider: ${{ steps.config.outputs.google-workload-identity-provider }} | ||
| service_account: ${{ steps.config.outputs.google-service-account }} | ||
|
|
There was a problem hiding this comment.
This is a bit confusing part. Let's discuss.
The current atmos gitops pattern assume there are 2 types of AWS creds
integrations:
github:
gitops:
....
artifact-storage:
....
role: arn:aws:iam::xxxxxxxxxxxx:role/cptest-core-ue2-auto-gitops-gha
role:
plan: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops
apply: arn:aws:iam::yyyyyyyyyyyy:role/cptest-core-gbl-identity-gitops
....
- IAM role
integration.github.gitops.artifact-storage.rolethat used to read/write plan file to storage - IAM role
integration.github.gitops.role.plan/integration.github.gitops.role.applythat used to run terraform plan / apply.
The second ones have wider permissions.
Really, eventually, we'd like to deprecate that part of the config.
Allow external AWS auth actions because we can not support all levels of AWS auth.
I had a feeling that in the case of Google Cloud, you mixed those two types of auth.
I think we do not need the step.
There was a problem hiding this comment.
Moved auth step to GH worklfow in our own project. As you were saying it is not needed here.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
what
Use google services when creating plan
why
For those who use google cloud it is hard to adopt atmos as all the GH tooling is built around AWS. This PR and several other fixes that.
references
See also related PRs in:
need help
To proper name the fields in metadata for google cloud.