Skip to content

Commit 8e757ce

Browse files
mateuszjenekmateuszjenek
committed
feat: use dynamic credentials
1 parent b5cd9b2 commit 8e757ce

22 files changed

+203
-35
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ Once you are finished with the reference architecture, you can remove all provis
264264
| environment\_type | The environment type to associate the reference architecture with. | `string` | `"development"` | no |
265265
| gar\_repository\_id | Google Artifact Registry repository ID. | `string` | `"htc-ref-arch"` | no |
266266
| github\_org\_id | GitHub org id (required for Backstage) | `string` | `null` | no |
267-
| humanitec\_org\_id | Humanitec Organization ID (required for Backstage) | `string` | `null` | no |
267+
| humanitec\_org\_id | Humanitec Organization ID. | `string` | `null` | no |
268268
| humanitec\_prefix | A prefix that will be attached to all IDs created in Humanitec. | `string` | `"htc-ref-arch-"` | no |
269269
| with\_backstage | Deploy Backstage | `bool` | `false` | no |
270270
<!-- END_TF_DOCS -->

‎main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module "base" {
55
project_id = var.project_id
66
region = var.region
77
humanitec_prefix = var.humanitec_prefix
8+
humanitec_org_id = var.humanitec_org_id
89
environment = var.environment
910
environment_type = var.environment_type
1011

‎modules/base/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717

1818
| Name | Source | Version |
1919
|------|--------|---------|
20+
| credentials | ../dynamic_creds | n/a |
2021
| k8s | ../gke | n/a |
2122
| network | ../network | n/a |
2223
| res\_defs | ../htc_res_defs | n/a |
@@ -40,6 +41,7 @@
4041
| gke\_autopilot | Whether GKE Autopilot should be used | `bool` | `true` | no |
4142
| gke\_cluster\_name | The name of the GKE Cluster. Must be unique within the project. | `string` | `"htc-ref-arch-cluster"` | no |
4243
| gke\_subnet\_name | The name of the subnet to allocate IPs for the GKE Cluster from. If vpc\_subnet is set, this must be updated. | `string` | `"htc-ref-arch-subnet"` | no |
44+
| humanitec\_org\_id | Humanitec Organization ID. | `string` | `null` | no |
4345
| humanitec\_prefix | A prefix that will be attached to all IDs created in Humanitec. | `string` | `""` | no |
4446
| vpc\_description | VPC Description | `string` | `"VPC for Humanitec Reference Architecture Implementation for GCP. https://github.com/humanitec-architecture/reference-archietcture-gcp"` | no |
4547
| vpc\_name | VPC Name | `string` | `"htc-ref-arch-vpc"` | no |

‎modules/base/main.tf

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -44,17 +44,28 @@ module "k8s" {
4444
gar_repository_location = var.gar_repository_location
4545
}
4646

47+
# ######################################################################
48+
# # DYNAMIC CREDENTIALS
49+
# ######################################################################
50+
module "credentials" {
51+
source = "../dynamic_creds"
52+
humanitec_org = var.humanitec_org_id
53+
gcp_project_id = var.project_id
54+
55+
}
56+
57+
4758
# ######################################################################
4859
# # HUMANITEC MODULE
4960
# ######################################################################
5061
module "res_defs" {
51-
source = "../htc_res_defs"
52-
k8s_cluster_name = module.k8s.cluster_name
53-
k8s_loadbalancer = module.k8s.loadbalancer
54-
k8s_region = var.region
55-
k8s_project_id = var.project_id
56-
k8s_credentials = module.k8s.credentials
57-
environment = var.environment
58-
environment_type = var.environment_type
59-
prefix = var.humanitec_prefix
62+
source = "../htc_res_defs"
63+
k8s_cluster_name = module.k8s.cluster_name
64+
k8s_loadbalancer = module.k8s.loadbalancer
65+
k8s_region = var.region
66+
k8s_project_id = var.project_id
67+
environment = var.environment
68+
environment_type = var.environment_type
69+
prefix = var.humanitec_prefix
70+
humanitec_cloud_account = module.credentials.humanitec_cloud_account
6071
}

‎modules/base/terraform.tfvars.example

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ gke_cluster_name = "htc-ref-arch-cluster"
2020
# The name of the subnet to allocate IPs for the GKE Cluster from. If vpc_subnet is set, this must be updated.
2121
gke_subnet_name = "htc-ref-arch-subnet"
2222

23+
# Humanitec Organization ID.
24+
humanitec_org_id = ""
25+
2326
# A prefix that will be attached to all IDs created in Humanitec.
2427
humanitec_prefix = ""
2528

‎modules/base/variables.tf

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,17 @@ variable "project_id" {
77
description = "GCP Project ID to provision resources in."
88
}
99

10-
1110
variable "region" {
1211
type = string
1312
description = "GCP Region to provision resources in."
1413
}
1514

15+
variable "humanitec_org_id" {
16+
description = "Humanitec Organization ID."
17+
type = string
18+
default = null
19+
}
20+
1621
##########################################
1722
# OPTIONAL INPUTS
1823
##########################################

‎modules/dynamic_creds/README.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
### Requirements
3+
4+
| Name | Version |
5+
|------|---------|
6+
| terraform | >= 1.3.0 |
7+
| google | ~> 5.1 |
8+
| humanitec | ~> 1.0 |
9+
10+
### Providers
11+
12+
| Name | Version |
13+
|------|---------|
14+
| google | ~> 5.1 |
15+
| humanitec | ~> 1.0 |
16+
17+
### Resources
18+
19+
| Name | Type |
20+
|------|------|
21+
| [google_iam_workload_identity_pool.pool](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool) | resource |
22+
| [google_iam_workload_identity_pool_provider.pool_provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider) | resource |
23+
| [google_project_iam_member.cloud_account_container_role](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
24+
| [google_service_account.service_account](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
25+
| [google_service_account_iam_binding.iam-binding](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_iam_binding) | resource |
26+
| [humanitec_resource_account.cloud_account](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_account) | resource |
27+
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
28+
29+
### Inputs
30+
31+
| Name | Description | Type | Default | Required |
32+
|------|-------------|------|---------|:--------:|
33+
| gcp\_project\_id | The ID of the GCP project to which resources will be deployed. | `string` | n/a | yes |
34+
| humanitec\_org | The identifier of the Humanitec organization used for managing deployments and resources. | `string` | n/a | yes |
35+
| gcp\_service\_account\_id | The ID of the service account used for authenticating and managing GCP resources. | `string` | `"humanitec-cloud-account"` | no |
36+
| gcp\_workload\_identity\_pool\_id | The ID of the Workload Identity Pool in GCP, which allows you to manage resources within the GCP project. | `string` | `"humanitec-wif-pool"` | no |
37+
| gcp\_workload\_identity\_pool\_provider\_id | The ID of the Workload Identity Pool Provider within the specified Workload Identity Pool in GCP, enabling integration with Humanitec. | `string` | `"humanitec-wif"` | no |
38+
39+
### Outputs
40+
41+
| Name | Description |
42+
|------|-------------|
43+
| humanitec\_cloud\_account | The ID of the Humanitec Cloud Account. |
44+
<!-- END_TF_DOCS -->

‎modules/dynamic_creds/main.tf

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
data "google_project" "project" {
2+
project_id = var.gcp_project_id
3+
}
4+
5+
resource "google_iam_workload_identity_pool" "pool" {
6+
workload_identity_pool_id = var.gcp_workload_identity_pool_id
7+
display_name = "Humanitec Identity Pool"
8+
description = "Identity pool for platform orchiestration"
9+
}
10+
11+
resource "google_iam_workload_identity_pool_provider" "pool_provider" {
12+
workload_identity_pool_id = google_iam_workload_identity_pool.pool.workload_identity_pool_id
13+
workload_identity_pool_provider_id = var.gcp_workload_identity_pool_provider_id
14+
attribute_mapping = {
15+
"google.subject" = "assertion.sub"
16+
}
17+
oidc {
18+
issuer_uri = "https://idtoken.humanitec.io"
19+
}
20+
}
21+
22+
resource "google_service_account" "service_account" {
23+
account_id = var.gcp_service_account_id
24+
display_name = "Humanitec GCP dynamic cloud account"
25+
description = "Used by Humanitec Platform Orchestrator Cloud Account"
26+
}
27+
28+
resource "humanitec_resource_account" "cloud_account" {
29+
id = "humanitec-gcp-dynamic-cloud-account"
30+
name = "Humanitec GCP dynamic cloud account"
31+
type = "gcp-identity"
32+
credentials = jsonencode({
33+
"gcp_service_account" = "${google_service_account.service_account.account_id}@${var.gcp_project_id}.iam.gserviceaccount.com"
34+
"gcp_audience" = "//iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.pool.workload_identity_pool_id}/providers/${google_iam_workload_identity_pool_provider.pool_provider.workload_identity_pool_provider_id}"
35+
})
36+
}
37+
38+
resource "google_service_account_iam_binding" "iam-binding" {
39+
service_account_id = google_service_account.service_account.name
40+
role = "roles/iam.workloadIdentityUser"
41+
42+
members = [
43+
"principal://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/humanitec-wif-pool/subject/${var.humanitec_org}/${humanitec_resource_account.cloud_account.id}",
44+
]
45+
}
46+
47+
resource "google_project_iam_member" "cloud_account_container_role" {
48+
project = var.gcp_project_id
49+
role = "roles/container.admin"
50+
member = "serviceAccount:${google_service_account.service_account.email}"
51+
}

‎modules/dynamic_creds/outputs.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "humanitec_cloud_account" {
2+
value = humanitec_resource_account.cloud_account.id
3+
description = "The ID of the Humanitec Cloud Account."
4+
}

‎modules/dynamic_creds/providers.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
terraform {
2+
required_providers {
3+
humanitec = {
4+
source = "humanitec/humanitec"
5+
version = "~> 1.0"
6+
}
7+
google = {
8+
source = "hashicorp/google"
9+
version = "~> 5.1"
10+
}
11+
}
12+
required_version = ">= 1.3.0"
13+
}

‎modules/dynamic_creds/terraform.tfvars.example

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
2+
# The ID of the GCP project to which resources will be deployed.
3+
gcp_project_id = ""
4+
5+
# The ID of the service account used for authenticating and managing GCP resources.
6+
gcp_service_account_id = "humanitec-cloud-account"
7+
8+
# The ID of the Workload Identity Pool in GCP, which allows you to manage resources within the GCP project.
9+
gcp_workload_identity_pool_id = "humanitec-wif-pool"
10+
11+
# The ID of the Workload Identity Pool Provider within the specified Workload Identity Pool in GCP, enabling integration with Humanitec.
12+
gcp_workload_identity_pool_provider_id = "humanitec-wif"
13+
14+
# The identifier of the Humanitec organization used for managing deployments and resources.
15+
humanitec_org = ""

‎modules/dynamic_creds/variables.tf

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
variable "gcp_project_id" {
2+
type = string
3+
description = "The ID of the GCP project to which resources will be deployed."
4+
}
5+
6+
variable "gcp_workload_identity_pool_id" {
7+
type = string
8+
default = "humanitec-wif-pool"
9+
description = "The ID of the Workload Identity Pool in GCP, which allows you to manage resources within the GCP project."
10+
}
11+
12+
variable "gcp_workload_identity_pool_provider_id" {
13+
type = string
14+
default = "humanitec-wif"
15+
description = "The ID of the Workload Identity Pool Provider within the specified Workload Identity Pool in GCP, enabling integration with Humanitec."
16+
}
17+
18+
variable "gcp_service_account_id" {
19+
type = string
20+
default = "humanitec-cloud-account"
21+
description = "The ID of the service account used for authenticating and managing GCP resources."
22+
}
23+
24+
variable "humanitec_org" {
25+
type = string
26+
description = "The identifier of the Humanitec organization used for managing deployments and resources."
27+
}

‎modules/github/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,6 @@
4545
| gar\_repository\_location | Location of the Google Artifact Registry repository. | `string` | n/a | yes |
4646
| github\_org\_id | GitHub org id | `string` | n/a | yes |
4747
| humanitec\_ci\_service\_user\_token | Humanitec CI Service User Token | `string` | n/a | yes |
48-
| humanitec\_org\_id | Humanitec Organization ID | `string` | n/a | yes |
48+
| humanitec\_org\_id | Humanitec Organization ID. | `string` | n/a | yes |
4949
| project\_id | GCP Project ID to provision resources in. | `string` | n/a | yes |
5050
<!-- END_TF_DOCS -->

‎modules/github/terraform.tfvars.example

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ github_org_id = ""
1111
# Humanitec CI Service User Token
1212
humanitec_ci_service_user_token = ""
1313

14-
# Humanitec Organization ID
14+
# Humanitec Organization ID.
1515
humanitec_org_id = ""
1616

1717
# GCP Project ID to provision resources in.

‎modules/github/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ variable "gar_repository_location" {
1414
}
1515

1616
variable "humanitec_org_id" {
17-
description = "Humanitec Organization ID"
17+
description = "Humanitec Organization ID."
1818
type = string
1919

2020
validation {

‎modules/htc_res_defs/README.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323

2424
| Name | Type |
2525
|------|------|
26-
| [humanitec_resource_account.cluster_account](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_account) | resource |
2726
| [humanitec_resource_definition.k8s_cluster](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition) | resource |
2827
| [humanitec_resource_definition.k8s_namespace](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition) | resource |
2928
| [humanitec_resource_definition_criteria.default_mysql](https://registry.terraform.io/providers/humanitec/humanitec/latest/docs/resources/resource_definition_criteria) | resource |
@@ -37,8 +36,8 @@
3736
|------|-------------|------|---------|:--------:|
3837
| environment | The environment to use for matching criteria. | `string` | n/a | yes |
3938
| environment\_type | The environment type to use for matching criteria. | `string` | n/a | yes |
39+
| humanitec\_cloud\_account | The ID of the Humanitec Cloud Account. | `string` | n/a | yes |
4040
| k8s\_cluster\_name | The name of the cluster. | `string` | n/a | yes |
41-
| k8s\_credentials | The credentials used to establish a connection to the cluster. | `string` | n/a | yes |
4241
| k8s\_loadbalancer | IP address or Host of the load balancer used by the ingress controller. | `string` | n/a | yes |
4342
| k8s\_project\_id | The GCP Project the cluster is in. | `string` | n/a | yes |
4443
| k8s\_region | The region the cluster is in. | `string` | n/a | yes |

‎modules/htc_res_defs/main.tf

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,10 @@
1-
resource "humanitec_resource_account" "cluster_account" {
2-
id = "${var.prefix}cluster"
3-
name = "${var.prefix}cluster"
4-
type = "gcp"
5-
6-
credentials = var.k8s_credentials
7-
}
8-
91
resource "humanitec_resource_definition" "k8s_cluster" {
102
driver_type = "humanitec/k8s-cluster-gke"
113
id = "${var.prefix}cluster"
124
name = "${var.prefix}cluster"
135
type = "k8s-cluster"
146

15-
driver_account = humanitec_resource_account.cluster_account.id
7+
driver_account = var.humanitec_cloud_account
168
driver_inputs = {
179
values_string = jsonencode({
1810
"name" = var.k8s_cluster_name

‎modules/htc_res_defs/terraform.tfvars.example

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ environment = ""
55
# The environment type to use for matching criteria.
66
environment_type = ""
77

8+
# The ID of the Humanitec Cloud Account.
9+
humanitec_cloud_account = ""
10+
811
# The name of the cluster.
912
k8s_cluster_name = ""
1013

11-
# The credentials used to establish a connection to the cluster.
12-
k8s_credentials = ""
13-
1414
# IP address or Host of the load balancer used by the ingress controller.
1515
k8s_loadbalancer = ""
1616

‎modules/htc_res_defs/variables.tf

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
variable "k8s_cluster_name" {
32
type = string
43
description = "The name of the cluster."
@@ -15,10 +14,7 @@ variable "k8s_region" {
1514
type = string
1615
description = "The region the cluster is in."
1716
}
18-
variable "k8s_credentials" {
19-
type = string
20-
description = "The credentials used to establish a connection to the cluster."
21-
}
17+
2218
variable "environment" {
2319
type = string
2420
description = "The environment to use for matching criteria."
@@ -32,3 +28,8 @@ variable "prefix" {
3228
description = "A prefix that will be attached to all IDs created in Humanitec."
3329
default = ""
3430
}
31+
32+
variable "humanitec_cloud_account" {
33+
type = string
34+
description = "The ID of the Humanitec Cloud Account."
35+
}

‎modules/network/output.tf renamed to ‎modules/network/outputs.tf

File renamed without changes.

‎terraform.tfvars.example

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ gar_repository_location = ""
1414
# GitHub org id (required for Backstage)
1515
github_org_id = ""
1616

17-
# Humanitec Organization ID (required for Backstage)
17+
# Humanitec Organization ID.
1818
humanitec_org_id = ""
1919

2020
# A prefix that will be attached to all IDs created in Humanitec.

‎variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ variable "github_org_id" {
5959
}
6060

6161
variable "humanitec_org_id" {
62-
description = "Humanitec Organization ID (required for Backstage)"
62+
description = "Humanitec Organization ID."
6363
type = string
6464
default = null
6565
}

0 commit comments

Comments
 (0)