Merge branch 'initial-release' into 'main'

# Created by https://www.toptal.com/developers/gitignore/api/venv,python,VisualStudioCode

# Edit at https://www.toptal.com/developers/gitignore?templates=venv,python,VisualStudioCode

### Python ###

# Byte-compiled / optimized / DLL files

__pycache__/

*.py[cod]

*$py.class

# C extensions

*.so

# Distribution / packaging

.Python

build/

develop-eggs/

dist/

downloads/

eggs/

.eggs/

lib/

lib64/

parts/

sdist/

var/

wheels/

share/python-wheels/

*.egg-info/

.installed.cfg

*.egg

MANIFEST

# PyInstaller

#  Usually these files are written by a python script from a template

#  before PyInstaller builds the exe, so as to inject date/other infos into it.

*.manifest

*.spec

# Installer logs

pip-log.txt

pip-delete-this-directory.txt

# Unit test / coverage reports

htmlcov/

.tox/

.nox/

.coverage

.coverage.*

.cache

nosetests.xml

coverage.xml

*.cover

*.py,cover

.hypothesis/

.pytest_cache/

cover/

# Translations

*.mo

*.pot

# Django stuff:

*.log

local_settings.py

db.sqlite3

db.sqlite3-journal

# Flask stuff:

instance/

.webassets-cache

# Scrapy stuff:

.scrapy

# Sphinx documentation

docs/_build/

# PyBuilder

.pybuilder/

target/

# Jupyter Notebook

.ipynb_checkpoints

# IPython

profile_default/

ipython_config.py

# pyenv

#   For a library or package, you might want to ignore these files since the code is

#   intended to run in multiple environments; otherwise, check them in:

# .python-version

# pipenv

#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.

#   However, in case of collaboration, if having platform-specific dependencies or dependencies

#   having no cross-platform support, pipenv may install dependencies that don't work, or not

#   install all needed dependencies.

#Pipfile.lock

# poetry

#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.

#   This is especially recommended for binary packages to ensure reproducibility, and is more

#   commonly ignored for libraries.

#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control

#poetry.lock

# pdm

#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.

#pdm.lock

#   pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it

#   in version control.

#   https://pdm.fming.dev/#use-with-ide

.pdm.toml

# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm

__pypackages__/

# Celery stuff

celerybeat-schedule

celerybeat.pid

# SageMath parsed files

*.sage.py

# Environments

.env

.venv

env/

venv/

ENV/

env.bak/

venv.bak/

# Spyder project settings

.spyderproject

.spyproject

# Rope project settings

.ropeproject

# mkdocs documentation

/site

# mypy

.mypy_cache/

.dmypy.json

dmypy.json

# Pyre type checker

.pyre/

# pytype static type analyzer

.pytype/

# Cython debug symbols

cython_debug/

# PyCharm

#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can

#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore

#  and can be added to the global gitignore or merged into this file.  For a more nuclear

#  option (not recommended) you can uncomment the following to ignore the entire idea folder.

#.idea/

### Python Patch ###

# Poetry local configuration file - https://python-poetry.org/docs/configuration/#local-configuration

poetry.toml

### venv ###

# Virtualenv

# http://iamzed.com/2009/05/07/a-primer-on-virtualenv/

[Bb]in

[Ii]nclude

[Ll]ib

[Ll]ib64

[Ll]ocal

[Ss]cripts

pyvenv.cfg

pip-selfcheck.json

### VisualStudioCode ###

.vscode/*

!.vscode/settings.json

!.vscode/tasks.json

!.vscode/launch.json

!.vscode/extensions.json

!.vscode/*.code-snippets

# Local History for Visual Studio Code

.history/

# Built Visual Studio Code Extensions

*.vsix

### VisualStudioCode Patch ###

# Ignore all local history of files

.history

.ionide

# End of https://www.toptal.com/developers/gitignore/api/venv,python,VisualStudioCode

include:

  - project: "to-be-continuous/docker"

    ref: "3.1.0"

    file: "templates/gitlab-ci-docker.yml"

  - project: 'to-be-continuous/python'

    ref: '6.1.0'

    file: '/templates/gitlab-ci-python.yml'

stages:

  - build

  - test

  - package-build

  - package-test

  - infra

  - deploy

  - acceptance

  - publish

  - infra-prod

  - production

variables:

  PYTHON_IMAGE: "python:3.8"

  PYTHON_SBOM_DISABLED: "true"

.test-scripts: &test-scripts |

  # BEGSCRIPT

  set -e

  function log_info() {

      echo -e "[\\e[1;94mINFO\\e[0m] $*"

  }

  function log_warn() {

      echo -e "[\\e[1;93mWARN\\e[0m] $*"

  }

  function log_error() {

      echo -e "[\\e[1;91mERROR\\e[0m] $*"

  }

  function fail() {

    log_error "$*"

    exit 1

  }

  function assert_eq() {

    local expected="$1"

    local actual="$2"

    if [ "$expected" == "$actual" ]; then

      log_info "$expected == $actual"

      return 0

    else

      fail "$expected == $actual"

      return 1

    fi

  }

  # ENDSCRIPT

.test-base:

  image: "dwdraju/alpine-curl-jq"

  stage: acceptance

  variables:

    GCP_PROJECT: sandbox-287709

    GCP_OIDC_ACCOUNT: sa-for-cicd@${GCP_PROJECT}.iam.gserviceaccount.com

    GCP_OIDC_PROVIDER: projects/993931605663/locations/global/workloadIdentityPools/to-be-continuous-pool/providers/gitlab-com

  services:

    - name: "$DOCKER_SNAPSHOT_IMAGE"

      alias: "gcp-auth-provider"

  before_script:

    - *test-scripts

test-ping:

  extends: .test-base

  script:

    # test: ping responds pong

    - |

      response_status=`curl -s -o "resp.txt" -w "%{http_code}" http://gcp-auth-provider/ping`

      assert_eq "200" $response_status

      assert_eq "pong" $(cat resp.txt)

test-token-assert-200:

  extends: .test-base

  variables:

    CI_JOB_JWT_V2: $CI_JOB_JWT_V2

  script:

    # test: get token with valid oidc account and provider shall succeed 

    - |

      response_status=$(curl -s -o "resp.txt" -w "%{http_code}" "http://gcp-auth-provider/token?serviceAccount=${GCP_OIDC_ACCOUNT}&workloadIdentityProvider=${GCP_OIDC_PROVIDER}")

      assert_eq "200" $response_status

      token=`cat resp.txt`

      response_status=$(curl -s -o resp.txt -w "%{http_code}" -H "Authorization: Bearer $token" "https://cloudresourcemanager.googleapis.com/v1/projects/sandbox-287709")

      assert_eq "200" $response_status

      project_id_result=$(cat resp.txt | jq .projectId | tr -d '"')

      assert_eq "sandbox-287709" $project_id_result

test-token-assert-500:

  extends: .test-base

  variables:

    CI_JOB_JWT_V2: $CI_JOB_JWT_V2

  # test: get token with missing oidc account fail with 500

  script:

    - |

      response_status=$(curl -s -o "resp.txt" -w "%{http_code}" "http://gcp-auth-provider/token?serviceAccount=invalid&workloadIdentityProvider=invalid")

      assert_eq "500" $response_status

test-token-assert-401:

  extends: .test-base

  # test: get token with missing CI_JOB_JWT_2 fail with 401

  script:

    - |

      response_status=$(curl -s -o "resp.txt" -w "%{http_code}" "http://gcp-auth-provider/token?serviceAccount=${GCP_OIDC_ACCOUNT}&workloadIdentityProvider=${GCP_OIDC_PROVIDER}")

      assert_eq "401" $response_status

 No newline at end of file

FROM python:3.8 as requirements-stage

WORKDIR /tmp

# hadolint ignore=DL3013

RUN pip install --no-cache-dir poetry

COPY ./pyproject.toml ./poetry.lock* /tmp/

RUN poetry export -f requirements.txt --output requirements.txt --without-hashes

###########

FROM python:3.8-slim-buster

ENV PORT=80

WORKDIR /code

COPY --from=requirements-stage /tmp/requirements.txt /code/requirements.txt

RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt

COPY ./app /code/app

EXPOSE ${PORT}

# hadolint ignore=DL3025

CMD uvicorn app.main:app --host=0.0.0.0 --port=${PORT}

# gcp-auth-provider

# GCP Auth Provider

This project builds a Docker image with an API able to retrieve an access token for a given project using google apis.

## Getting started

It is aimed at being used in GitLab CI as a service container

in order to decouple the image of your jobs and the way of retrieving a gpc oauth access token.

To make it easy for you to get started with GitLab, here's a list of recommended next steps.

Already a pro? Just edit this README.md and make it your own. Want to make it easy? [Use the template at the bottom](#editing-this-readme)!

## How to use

## Add your files

### API Overview

- [ ] [Create](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#create-a-file) or [upload](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#upload-a-file) files

- [ ] [Add files using the command line](https://docs.gitlab.com/ee/gitlab-basics/add-file.html#add-a-file-using-the-command-line) or push an existing Git repository with the following command:

The service exposes one single API to retrieve a google oauth access token.

```

cd existing_repo

git remote add origin https://gitlab.com/to-be-continuous/tools/gcp-auth-provider.git

git branch -M main

git push -uf origin main

```

## Integrate with your tools

- [ ] [Set up project integrations](https://gitlab.com/to-be-continuous/tools/gcp-auth-provider/-/settings/integrations)

## Collaborate with your team

- [ ] [Invite team members and collaborators](https://docs.gitlab.com/ee/user/project/members/)

- [ ] [Create a new merge request](https://docs.gitlab.com/ee/user/project/merge_requests/creating_merge_requests.html)

- [ ] [Automatically close issues from merge requests](https://docs.gitlab.com/ee/user/project/issues/managing_issues.html#closing-issues-automatically)

- [ ] [Enable merge request approvals](https://docs.gitlab.com/ee/user/project/merge_requests/approvals/)

- [ ] [Automatically merge when pipeline succeeds](https://docs.gitlab.com/ee/user/project/merge_requests/merge_when_pipeline_succeeds.html)

## Test and Deploy

### GET token endpoint

Use the built-in continuous integration in GitLab.

Retrieve authentication token using API.

- [ ] [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/index.html)

- [ ] [Analyze your code for known vulnerabilities with Static Application Security Testing(SAST)](https://docs.gitlab.com/ee/user/application_security/sast/)

- [ ] [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html)

- [ ] [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/)

- [ ] [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)

***

# Editing this README

```

GET /token?serviceAccount={serviceAccount}&workloadIdentityProvider={workloadIdentityProvider}

```

When you're ready to make this README your own, just edit this file and use the handy template below (or feel free to structure it however you want - this is just a starting point!). Thank you to [makeareadme.com](https://www.makeareadme.com/) for this template.

#### Query Parameters

## Suggestions for a good README

Every project is different, so consider which of these sections apply to yours. The sections used in the template are suggestions for most open source projects. Also keep in mind that while a README can be too long and detailed, too long is better than too short. If you think your README is too long, consider utilizing another form of documentation rather than cutting out information.

## Name

Choose a self-explaining name for your project.

| Name                       | description                                                                               | required              | 

|----------------------------|-------------------------------------------------------------------------------------------|-----------------------|

| `serviceAccount`           | Default Service Account to which impersonate with OpenID Connect authentication           | true                  |

| `workloadIdentityProvider` | Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) | true |

## Description

Let people know what your project can do specifically. Provide context and add a link to any reference visitors might be unfamiliar with. A list of Features or a Background subsection can also be added here. If there are alternatives to your project, this is a good place to list differentiating factors.

## Badges

On some READMEs, you may see small images that convey metadata, such as whether or not all the tests are passing for the project. You can use Shields to add some to your README. Many services also have instructions for adding a badge.

## Visuals

Depending on what you are making, it can be a good idea to include screenshots or even a video (you'll frequently see GIFs rather than actual videos). Tools like ttygif can help, but check out Asciinema for a more sophisticated method.

#### Example

## Installation

Within a particular ecosystem, there may be a common way of installing things, such as using Yarn, NuGet, or Homebrew. However, consider the possibility that whoever is reading your README is a novice and would like more guidance. Listing specific steps helps remove ambiguity and gets people to using your project as quickly as possible. If it only runs in a specific context like a particular programming language version or operating system or has dependencies that have to be installed manually, also add a Requirements subsection.

Let's suppose that you already have a service account and a workload identity provider configured on a gcp project

## Usage

Use examples liberally, and show the expected output if you can. It's helpful to have inline the smallest example of usage that you can demonstrate, while providing links to more sophisticated examples if they are too long to reasonably include in the README.

```bash

service_account={account_name}@{gcp_project_id}.iam.gserviceaccount.com

workload_identity_provider=projects/{gcp_project_number}/locations/global/workloadIdentityPools/{pool_id}/providers/{provider_id}

```

## Support

Tell people where they can go to for help. It can be any combination of an issue tracker, a chat room, an email address, etc.

Then you may retrieve:

## Roadmap

If you have ideas for releases in the future, it is a good idea to list them in the README.

the token calling GET http://gcp-auth-provider/token?serviceAccount={service_account}&workloadIdentityProvider={workload_identity_provider}

## Contributing

State if you are open to contributions and what your requirements are for accepting them.

For people who want to make changes to your project, it's helpful to have some documentation on how to get started. Perhaps there is a script that they should run or some environment variables that they need to set. Make these steps explicit. These instructions could also be useful to your future self.

## Use in Gitlab CI

You can also document commands to lint the code or run tests. These steps help to ensure high code quality and reduce the likelihood that the changes inadvertently break something. Having instructions for running tests is especially helpful if it requires external setup, such as starting a Selenium server for testing in a browser.

Finally, the Docker image can be used in your GitLab CI files as follows:

## Authors and acknowledgment

Show your appreciation to those who have contributed to the project.

## License

For open source projects, say how it is licensed.

```yaml

variables:

  GCP_OIDC_PROVIDER: "foo"

  GCP_OIDC_ACCOUNT: "bar"

## Project status

If you have run out of energy or time for your project, put a note at the top of the README saying that development has slowed down or stopped completely. Someone may choose to fork your project or volunteer to step in as a maintainer or owner, allowing your project to keep going. You can also make an explicit request for maintainers.

deploy-job:

  image: my-deploy-tool:latest

  services:

    # add GCP Auth Provider as a service

    - name: $CI_REGISTRY/to-be-continuous/tools/gcp-auth-provider:master

      alias: gcp-auth-provider

  before-script:

    # retrieve some token from Vault server

    - my_token=$(curl -s -S -f "http://gcp-auth-provider/token?serviceAccount={GCP_OIDC_ACCOUNT}&workloadIdentityProvider={GCP_OIDC_PROVIDER}

    # then login

    - my-deploy-tool login --token $my_token

  script:

    # deploy (pseudo code)

    - my-deploy-tool deploy --other --args

```

 No newline at end of file