Commit 335a0745 authored by Pierre Smeyers's avatar Pierre Smeyers
Browse files

Merge branch 'feat/deprecated-jwt-variables' into 'master' 

feat(oidc): OIDC authentication support now requires explicit configuration(see doc)

Closes #55

See merge request to-be-continuous/terraform!85
parents bf221837 89dfcb50

README.md

+3 −0
Original line number Diff line number Diff line
@@ -581,6 +581,7 @@ In order to be able to communicate with the Vault server, the variant requires t 
| ----------------- | -------------------------------------- | ----------------- |

| `TBC_VAULT_IMAGE` | The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use (can be overridden) | `$CI_REGISTRY/to-be-continuous/tools/vault-secrets-provider:master` |

| `VAULT_BASE_URL`  | The Vault server base API url          | _none_ |

| `VAULT_OIDC_AUD`  | The `aud` claim for the JWT | `$CI_SERVER_URL` |

| :lock: `VAULT_ROLE_ID`   | The [AppRole](https://www.vaultproject.io/docs/auth/approle) RoleID | **must be defined** |

| :lock: `VAULT_SECRET_ID` | The [AppRole](https://www.vaultproject.io/docs/auth/approle) SecretID | **must be defined** |
@@ -613,6 +614,8 @@ include: 
    file: '/templates/gitlab-ci-terraform-vault.yml'



variables:

    # audience claim for JWT

    VAULT_OIDC_AUD: "https://vault.acme.host"

    # Secrets managed by Vault

    AWS_ACCESS_KEY_ID: "@url@http://vault-secrets-provider/api/secrets/b7ecb6ebabc231/aws/prod/account?field=access_key_id"

    AWS_SECRET_ACCESS_KEY: "@url@http://vault-secrets-provider/api/secrets/b7ecb6ebabc231/aws/prod/account?field=secret_access_key"

templates/gitlab-ci-terraform-gcp.yml

+5 −1
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ 
variables:

  # variabilized gcp-auth-provider image

  TBC_GCP_PROVIDER_IMAGE: $CI_REGISTRY/to-be-continuous/tools/gcp-auth-provider:main

  GCP_OIDC_AUD: "$CI_SERVER_URL"



.tf-base:

  services:
@@ -13,5 +14,8 @@ variables: 
      alias: "gcp-auth-provider"

  variables:

    #  have to be explicitly declared in the YAML to be exported to the service

    CI_JOB_JWT_V2: $CI_JOB_JWT_V2

    GCP_JWT: $GCP_JWT

    GOOGLE_OAUTH_ACCESS_TOKEN: "@url@http://gcp-auth-provider/token"

  id_tokens:

    GCP_JWT:

      aud: "$GCP_OIDC_AUD"

templates/gitlab-ci-terraform-vault.yml

+6 −0
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ variables: 
  # variables have to be explicitly declared in the YAML to be exported to the service

  VAULT_ROLE_ID: "$VAULT_ROLE_ID"

  VAULT_SECRET_ID: "$VAULT_SECRET_ID"

  VAULT_OIDC_AUD: "$CI_SERVER_URL"



.tf-base:

  services:
@@ -14,3 +15,8 @@ variables: 
      command: ["--service", "terraform", "3.12.3" ]

    - name: "$TBC_VAULT_IMAGE"

      alias: "vault-secrets-provider"

  variables:

    VAULT_JWT_TOKEN: "$VAULT_JWT_TOKEN"

  id_tokens:

    VAULT_JWT_TOKEN:

      aud: "$VAULT_OIDC_AUD"