Skip to content

Commit e2f396d

Browse files
authored
Feat: Support GitHub workflow Identities (#4)
* added feature for github workflow identities Signed-off-by: ishuar <ishansharma887@gmail.com> * Modify simple example with github workflow usage Signed-off-by: ishuar <ishansharma887@gmail.com> * updated multiple identities example with service account and gh workflow usage Signed-off-by: ishuar <ishansharma887@gmail.com> * docs: Update readme Signed-off-by: ishuar <ishansharma887@gmail.com> * Added changelog for release `0.4.0` Signed-off-by: ishuar <ishansharma887@gmail.com> * multiple-identities-eg: put commented code at bottom Signed-off-by: ishuar <ishansharma887@gmail.com> * modify test to use new module Signed-off-by: ishuar <ishansharma887@gmail.com> * removed unwanted code and switch to old output names Signed-off-by: ishuar <ishansharma887@gmail.com> * use locals for combining Signed-off-by: ishuar <ishansharma887@gmail.com> * docs: update docs Signed-off-by: ishuar <ishansharma887@gmail.com> * docs: update variable description for `service_account_name` and `namespace` Signed-off-by: ishuar <ishansharma887@gmail.com> * added test for user assigned identity creation Signed-off-by: ishuar <ishansharma887@gmail.com> * added `github` prefix to github variables Signed-off-by: ishuar <ishansharma887@gmail.com> --------- Signed-off-by: ishuar <ishansharma887@gmail.com>
1 parent 68f5510 commit e2f396d

File tree

15 files changed

+302
-56
lines changed

15 files changed

+302
-56
lines changed

.config/header.md

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ managed within the footer file
3434
| Azure Account | `N/A` | [Create Azure account](https://azure.microsoft.com/en-us/free) | Yes |
3535
<!-- | azure-cli | `>=2.50.0` | [Install azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) | Yes | -->
3636

37-
**⭐️ Don't forget to give the project a star! Thanks again! ⭐️**
37+
**⭐️ Please consider following me on GitHub 👉 and giving a star ⭐ to the repository for future updates. ⭐️**
3838

3939
## Introduction
4040

@@ -47,6 +47,7 @@ managed within the footer file
4747
- Combination of Azure built-in and custom roles on the same identity.
4848
- Optional Kubernetes Service Account and Namespace creation when using with Azure Kubernetes Service.
4949
- Examples to use the module.
50+
- Support for GitHub Workflows federated user assigned identities.
5051

5152
## Usage
5253

@@ -62,17 +63,20 @@ resource "azurerm_resource_group" "this" {
6263
6364
module "simple" {
6465
source = "ishuar/workload-identity/azure"
65-
version = "~> 0.1"
66+
version = "0.4.0"
67+
68+
resource_group_name = azurerm_resource_group.this.name
69+
location = azurerm_resource_group.this.location
70+
oidc_issuer_url = "https://token.actions.githubusercontent.com"
71+
create_github_workflow_credentials = true
72+
github_owner = "ishuar"
73+
github_repository_name = "terraform-azure-workload-identity"
74+
github_entity_type = "pull_request" ## DEFAULT VALUE
6675
67-
resource_group_name = azurerm_resource_group.this.name
68-
location = azurerm_resource_group.this.location
69-
oidc_issuer_url = "https://token.actions.githubusercontent.com"
70-
service_account_name = "${local.prefix}-service-account"
71-
namespace = "default"
7276
role_assignments = [
7377
############## Azure built-in role ###############
7478
{
75-
role_definition_name = "Reader"
79+
role_definition_name = "Contributor"
7680
scope = azurerm_resource_group.this.id
7781
},
7882
############## Azure custom role ###############
@@ -86,6 +90,7 @@ module "simple" {
8690
}
8791
]
8892
}
93+
8994
```
9095

9196
## Examples
@@ -96,4 +101,4 @@ Examples are availabe in `examples` directory.
96101
- [multiple-identities](/examples/multiple-identities/)
97102
- [complete-with-aks](/examples/complete-with-aks/)
98103

99-
**⭐️ Don't forget to give the project a star! Thanks again! ⭐️**
104+
**⭐️ Please consider following me on GitHub 👉 and giving a star ⭐ to the repository for future updates. ⭐️**

.github/release-version.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Update this file for a new release version.
22

3-
module_version: "0.3.0"
3+
module_version: "0.4.0"
44

55
## Example for manual release notes.
66
# release_notes: |

CHANGELOG.md

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
2323
2424
-->
2525

26+
## v0.4.0
27+
28+
### Added
29+
- Feature to support for `GitHub Workflows` as the federated credential's subject in previous versions was only compatible with kubernetes service accounts.
30+
- Reference Docs:
31+
- [MS: Use GitHub Actions to connect to Azure](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-portal%2Clinux)
32+
- [GitHub: Configuring OpenID Connect in Azure ](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure)
33+
- Precondtions checks
34+
- To support multiple github_entity_type.
35+
- `namespace` and `service_account_name` are still required if `create_github_workflow_credentials` is set to false.
36+
- Disable `github_workflow_credentials` by default
37+
38+
### Others
39+
40+
- Adjusted terraform resource `azurerm_role_assignment` key with respect to `github_workflow` feature. Using `gh-repo-REPO_NAME`.
41+
- `simple` example is referring to only `github_workflow_credentials` usage, Use `multiple-identities` example for both features (kubernetes service account and github workflows).
42+
2643
## v0.3.0
2744

2845
### Added
@@ -54,4 +71,3 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
5471

5572
- Considerations
5673
- Please read the variable descriptions in the [variables.tf](./variables.tf) to be aware about the usage of the inputs.
57-

README.md

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ managed within the footer file
3333
| Azure Account | `N/A` | [Create Azure account](https://azure.microsoft.com/en-us/free) | Yes |
3434
<!-- | azure-cli | `>=2.50.0` | [Install azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) | Yes | -->
3535

36-
**⭐️ Don't forget to give the project a star! Thanks again! ⭐️**
36+
**⭐️ Please consider following me on GitHub 👉 and giving a star ⭐ to the repository for future updates. ⭐️**
3737

3838
## Introduction
3939

@@ -46,6 +46,7 @@ managed within the footer file
4646
- Combination of Azure built-in and custom roles on the same identity.
4747
- Optional Kubernetes Service Account and Namespace creation when using with Azure Kubernetes Service.
4848
- Examples to use the module.
49+
- Support for GitHub Workflows federated user assigned identities.
4950

5051
## Usage
5152

@@ -61,17 +62,20 @@ resource "azurerm_resource_group" "this" {
6162
6263
module "simple" {
6364
source = "ishuar/workload-identity/azure"
64-
version = "~> 0.1"
65+
version = "0.4.0"
66+
67+
resource_group_name = azurerm_resource_group.this.name
68+
location = azurerm_resource_group.this.location
69+
oidc_issuer_url = "https://token.actions.githubusercontent.com"
70+
create_github_workflow_credentials = true
71+
github_owner = "ishuar"
72+
github_repository_name = "terraform-azure-workload-identity"
73+
github_entity_type = "pull_request" ## DEFAULT VALUE
6574
66-
resource_group_name = azurerm_resource_group.this.name
67-
location = azurerm_resource_group.this.location
68-
oidc_issuer_url = "https://token.actions.githubusercontent.com"
69-
service_account_name = "${local.prefix}-service-account"
70-
namespace = "default"
7175
role_assignments = [
7276
############## Azure built-in role ###############
7377
{
74-
role_definition_name = "Reader"
78+
role_definition_name = "Contributor"
7579
scope = azurerm_resource_group.this.id
7680
},
7781
############## Azure custom role ###############
@@ -85,6 +89,7 @@ module "simple" {
8589
}
8690
]
8791
}
92+
8893
```
8994

9095
## Examples
@@ -95,7 +100,7 @@ Examples are availabe in `examples` directory.
95100
- [multiple-identities](/examples/multiple-identities/)
96101
- [complete-with-aks](/examples/complete-with-aks/)
97102

98-
**⭐️ Don't forget to give the project a star! Thanks again! ⭐️**
103+
**⭐️ Please consider following me on GitHub 👉 and giving a star ⭐ to the repository for future updates. ⭐️**
99104

100105
## Requirements
101106

@@ -134,17 +139,24 @@ No modules.
134139
| Name | Description | Type | Default | Required |
135140
|------|-------------|------|---------|:--------:|
136141
| <a name="input_location"></a> [location](#input\_location) | (optional) The Azure Region where the User Assigned Identity exists. | `string` | n/a | yes |
137-
| <a name="input_namespace"></a> [namespace](#input\_namespace) | (Required) The namespace where service account will be created. New will be created if value is not equeal to kube-sytem and default | `string` | n/a | yes |
138142
| <a name="input_oidc_issuer_url"></a> [oidc\_issuer\_url](#input\_oidc\_issuer\_url) | (Required)The URL of the OIDC issuer for the cluster | `string` | n/a | yes |
139143
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | (optional) Resource group name. If not set, the default resource group will be used. | `string` | n/a | yes |
140-
| <a name="input_service_account_name"></a> [service\_account\_name](#input\_service\_account\_name) | (Required) The name of the service account which is using the workload identity. | `string` | n/a | yes |
141144
| <a name="input_additional_service_account_annotations"></a> [additional\_service\_account\_annotations](#input\_additional\_service\_account\_annotations) | (optional) Additional Annotations for the new service account created. | `map(string)` | `{}` | no |
142145
| <a name="input_automount_service_account_token"></a> [automount\_service\_account\_token](#input\_automount\_service\_account\_token) | (Optional) To enable automatic mounting of the service account token. Defaults to true | `bool` | `false` | no |
146+
| <a name="input_create_github_workflow_credentials"></a> [create\_github\_workflow\_credentials](#input\_create\_github\_workflow\_credentials) | (optional) Whether to create federated credentials for GitHub workflow or not?. Default is to to create credentials for Azure kubernetes service accounts. If set to `true`, then `github_owner`, 'github\_entity\_type' and `github_repository_name` must be set. | `bool` | `false` | no |
143147
| <a name="input_create_kubernetes_namespace"></a> [create\_kubernetes\_namespace](#input\_create\_kubernetes\_namespace) | (optional) Whether or not to create kubernetes namespace via terraform-kubernetes-provider resource? Set to true if need to create a new namespace and helm release attribute 'create\_namespace' is set to false | `bool` | `false` | no |
144148
| <a name="input_create_service_account"></a> [create\_service\_account](#input\_create\_service\_account) | (optional) Whether or not to create kubernetes service account via terraform-kubernetes-provider? Use this if helm chart supports existing service account name. | `bool` | `false` | no |
149+
| <a name="input_github_branch_name"></a> [github\_branch\_name](#input\_github\_branch\_name) | (optional) GitHub branch name which uses the github workflow with federated credentials. Required when `github_entity_type` is set to `branch`. | `string` | `""` | no |
150+
| <a name="input_github_entity_type"></a> [github\_entity\_type](#input\_github\_entity\_type) | (optional) The filter used to scope the OIDC requests from GitHub workflows. This field is used to generate the subject claim. Accepted values are 'environment', 'branch', 'tag' or 'pull\_request'. Required when `create_github_actions_credential` is set to `true`. | `string` | `"pull_request"` | no |
151+
| <a name="input_github_environment_name"></a> [github\_environment\_name](#input\_github\_environment\_name) | (optional) GitHub environment name which uses the github workflow with federated credentials. Required when `github_entity_type` is set to `environment`. | `string` | `""` | no |
152+
| <a name="input_github_owner"></a> [github\_owner](#input\_github\_owner) | (optional) GitHub organization name or GitHub username that owns the repository where github workflow will use federated credentials. Required when `create_github_actions_credential` is set to `true`. | `string` | `""` | no |
153+
| <a name="input_github_repository_name"></a> [github\_repository\_name](#input\_github\_repository\_name) | (optional)GitHub Repository name where github workflow will use federated credentials. Required when `create_github_actions_credential` is set to `true`. | `string` | `""` | no |
154+
| <a name="input_github_tag_name"></a> [github\_tag\_name](#input\_github\_tag\_name) | (optional) GitHub tag name which uses the github workflow with federated credentials. Required when `github_entity_type` is set to `tag`. | `string` | `""` | no |
155+
| <a name="input_namespace"></a> [namespace](#input\_namespace) | (optional) The namespace where service account will be created. New will be created if value is not equeal to kube-sytem and default.Required when `create_github_actions_credential` is set to `false`. | `string` | `""` | no |
145156
| <a name="input_namespace_annotations"></a> [namespace\_annotations](#input\_namespace\_annotations) | (optional) Annotations for namespace created via terraform-kubernetes-provider resource. | `map(string)` | `{}` | no |
146-
| <a name="input_namespace_labels"></a> [namespace\_labels](#input\_namespace\_labels) | (optional)Labels for namespace created via terraform-kubernetes-provider resource. | `map(string)` | `{}` | no |
157+
| <a name="input_namespace_labels"></a> [namespace\_labels](#input\_namespace\_labels) | (optional) Labels for namespace created via terraform-kubernetes-provider resource. | `map(string)` | `{}` | no |
147158
| <a name="input_role_assignments"></a> [role\_assignments](#input\_role\_assignments) | (optional) The role assignments for the service account.<br><br>`role_definition_name`: The name of a role which either needs to be used (azure built-in) or new one you want to create.<br>`name` : A unique UUID/GUID for this Role Assignment - one will be generated if not specified. Changing this forces a new resource to be created.<br>`condition`: The condition that limits the resources that the role can be assigned to. Changing this forces a new resource to be created.<br>`condition_version`: (Optional) The version of the condition. Possible values are 1.0 or 2.0. Changing this forces a new resource to be created.<br>`create_custom_role` : Whether or not to create a custom role. If set to true, then any of the custom\_role\_actions,custom\_role\_data\_actions, custom\_role\_not\_actions, custom\_role\_not\_data\_actions, custom\_role\_assignable\_scopes are required.<br>`scope` : The scope at which the role assignment or custom role will be created.<br>`custom_role_definition_id`: (Optional) A unique UUID/GUID which identifies this role - one will be generated if not specified. Changing this forces a new resource to be created.Only valid for custom role.<br>`custom_role_actions`: One or more Allowed Actions, such as *, Microsoft.Resources/subscriptions/resourceGroups/read. See [Azure Resource Manager resource provider operations](https://learn.microsoft.com/en-gb/azure/role-based-access-control/resource-provider-operations) for details. Only valid for custom role.<br>`custom_role_data_actions` : One or more Allowed Data Actions, such as *, Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read. See [Azure Resource Manager resource provider operations](https://learn.microsoft.com/en-gb/azure/role-based-access-control/resource-provider-operations) for details. Only valid for custom role.<br>`custom_role_not_actions` : One or more Denied Actions, such as Microsoft.Compute/virtualMachines/write.See [Azure Resource Manager resource provider operations](https://learn.microsoft.com/en-gb/azure/role-based-access-control/resource-provider-operations) for details. Only valid for custom role.<br>`custom_role_not_data_actions` : One or more Disallowed Data Actions, such as *, Microsoft.Resources/subscriptions/resourceGroups/read<br>`custom_role_assignable_scopes` : One or more assignable scopes for this Role Definition. The value for scope is automatically included in this list if no other values supplied<br>`custom_role_description` : A description of the role. Only valid for custom role definition. | <pre>set(object({<br> role_definition_name = optional(string)<br> name = optional(string, null)<br> create_custom_role = optional(bool, false)<br> condition = optional(string, null)<br> condition_version = optional(string, null)<br> scope = optional(string)<br> custom_role_description = optional(string)<br> custom_role_definition_id = optional(string, null)<br> custom_role_actions = optional(set(string), [])<br> custom_role_data_actions = optional(set(string), [])<br> custom_role_not_actions = optional(set(string), [])<br> custom_role_not_data_actions = optional(set(string), [])<br> custom_role_assignable_scopes = optional(set(string), null)<br> }))</pre> | `[]` | no |
159+
| <a name="input_service_account_name"></a> [service\_account\_name](#input\_service\_account\_name) | (optional) The name of the service account which is using the workload identity. Required when `create_github_actions_credential` is set to `false`. | `string` | `""` | no |
148160
| <a name="input_service_account_token_expiration_seconds"></a> [service\_account\_token\_expiration\_seconds](#input\_service\_account\_token\_expiration\_seconds) | (optional) Represents the expirationSeconds field for the projected service account token | `number` | `86400` | no |
149161
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) A mapping of tags which should be assigned to the User Assigned Identity. | `map(string)` | `{}` | no |
150162
| <a name="input_use_existing_resource_group"></a> [use\_existing\_resource\_group](#input\_use\_existing\_resource\_group) | (optional) Whether to use existing resource group or create a new one? | `string` | `true` | no |

0 commit comments

Comments
 (0)