Skip to content

Instantly share code, notes, and snippets.

@lox
Last active September 5, 2023 23:45
Show Gist options
  • Save lox/929f71a5706c4125d26ed14cc30b3a63 to your computer and use it in GitHub Desktop.
Save lox/929f71a5706c4125d26ed14cc30b3a63 to your computer and use it in GitHub Desktop.
Terraform for setting up Identity Federation with GCP for Namespace workloads
// See https://cloud.namespace.so/docs/federation/gcp
locals {
roles = [
"roles/resourcemanager.projectIamAdmin", # allow managing identity
"roles/editor", # allow to manage all resources
"roles/iam.serviceAccountAdmin", # allow to manage service accounts
]
}
resource "google_service_account" "namespace" {
project = google_project.default.project_id
account_id = "namespace"
display_name = "namespace"
description = "Link to Workload Identity Pool used by Namespace"
}
# Allow to access all resources and key projects
resource "google_project_iam_member" "roles" {
project = google_project.default.project_id
for_each = {
for role in local.roles : role => role
}
role = each.value
member = "serviceAccount:${google_service_account.namespace.email}"
}
resource "google_project_iam_member" "project_owner" {
project = google_project.default.project_id
role = "roles/owner"
member = "serviceAccount:${google_service_account.namespace.email}"
}
resource "google_iam_workload_identity_pool" "namespace" {
provider = google-beta
project = google_project.default.project_id
workload_identity_pool_id = "namespace"
display_name = "namespace"
description = "for Namespace"
}
resource "google_iam_workload_identity_pool_provider" "namespace" {
provider = google-beta
project = google_project.default.project_id
workload_identity_pool_id = google_iam_workload_identity_pool.namespace.workload_identity_pool_id
workload_identity_pool_provider_id = "namespace-provider"
display_name = "namespace provider"
description = "OIDC identity pool provider for Namespace"
# See https://cloud.namespace.so/docs/federation/gcp#creating-workload-identity-pool-and-provider
attribute_mapping = {
"google.subject" = "assertion.tenant_id"
}
oidc {
issuer_uri = "https://federation.namespaceapis.com"
}
}
resource "google_service_account_iam_member" "namespace" {
service_account_id = google_service_account.namespace.name
role = "roles/iam.workloadIdentityUser"
member = "principal://iam.googleapis.com/${google_iam_workload_identity_pool.namespace.name}/subject/${var.namespace_tenant_id}"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment