Manage workload identity

custom-workload.yaml (view on GitHub ) :

# This Resource Definition uses the Template Driver to assign a custom Kubernetes service account to a workload
# to facilitate workload identity
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-gcp-custom-workload
entity:
  name: wi-gcp-custom-workload
  type: workload
  driver_type: humanitec/template
  driver_inputs:
    values:
      templates:
        # Request a resource of type 'k8s-service-account' in the Resource Graph
        # and add its name to the workload spec
        outputs: |
          update:
            - op: add
              path: /spec/serviceAccountName
              value: ${resources.k8s-service-account.outputs.name}
  # Adjust matching criteria as required
  criteria:
  - app_id: workload-identity-test-gcp

custom-service-account.yaml (view on GitHub ) :

# This Resource Definition uses the Template Driver to create a Kubernetes service account.
# It pulls central configuration parameters from `config` Resources.
# It returns the "principal" string for the ServiceAccount to configure GKE workload identity.
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-gcp-custom-service-account
entity:
  driver_type: humanitec/template
  name: wi-gcp-custom-service-account
  type: k8s-service-account
  driver_inputs:
    values:
      res_id: ${context.res.id}
      gke_project_id: ${resources['config.default#gke-config'].outputs.gke_project_id}
      gke_project_number: ${resources['config.default#gke-config'].outputs.gke_project_number}
      # Using the id `k8s-namespace`, this reference targets the existing, implicitly created namespace resource
      k8s_namespace: "${resources['k8s-namespace.default#k8s-namespace'].outputs.namespace}"
      templates:
        init: |
          res_id: {{ .driver.values.res_id }}
          {{- $res_name := index (splitList "." .driver.values.res_id) 1 }}
          name: {{ $res_name | toRawJson }}
          principal: principal://iam.googleapis.com/projects/{{ .driver.values.gke_project_number }}/locations/global/workloadIdentityPools/{{ .driver.values.gke_project_id }}.svc.id.goog/subject/ns/{{ .driver.values.k8s_namespace }}/sa/{{ $res_name }}
        manifests: |
          service-account.yaml:
            location: namespace
            data:
              apiVersion: v1
              kind: ServiceAccount
              metadata:
                name: {{ .init.name }}
                annotations:
                  hum-res: {{ .init.res_id }}
        outputs: |
          name: {{ .init.name }}
          principal: {{ .init.principal }}
  # Adjust matching criteria as required
  criteria:
  - app_id: workload-identity-test-gcp

gke-config.yaml (view on GitHub ) :

# This Resource Definition of type "config" uses the Template Driver to provide configuration values
# to other Resource Definitions for accessing the GKE cluster
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-gcp-gke-config
entity:
  name: wi-gcp-gke-config
  type: config
  driver_type: humanitec/template
  # The identity configured in this Cloud Account needs permission
  # to deploy Workloads to your GKE cluster
  driver_account: YOURACCOUNT
  driver_inputs:
    values:
      templates:
        outputs: |
          gke_project_id: YOURVALUE
          # Keep the "" around the value of gke_project_number
          gke_project_number: "YOURVALUE"
  criteria:
    - class: default
      res_id: gke-config
      env_type: development
      app_id: workload-identity-test-gcp

s3.yaml (view on GitHub ) :

# This Resource Definition of type `s3` uses the Terraform Runner Driver to provision an Amazon S3 bucket
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-aws-s3
entity:
  driver_type: humanitec/terraform-runner
  name: wi-aws-s3
  type: s3
  # The identity used in this Cloud Account is the one executing the Terraform code
  # It needs permissions to manage S3 buckets
  driver_account: ${resources['config.default#app-config'].account}
  driver_inputs:
    values:
      append_logs_to_error: true
      variables:
        app_id: "${context.app.id}"
        env_id: "${context.env.id}"
        res_id: "${context.res.id}"
        region: ${resources['config.default#app-config'].outputs.region}
      credentials_config:
        environment:
          AWS_ACCESS_KEY_ID: AccessKeyId
          AWS_SECRET_ACCESS_KEY: SecretAccessKey
          AWS_SESSION_TOKEN: SessionToken
      files:
        providers.tf: |
          terraform {
            required_providers {
              aws = {
                source  = "hashicorp/aws"
              }
              random = {
                source  = "hashicorp/random"
              }
            }
          }
        variables.tf: |
          locals {
            workload_id = split(".", var.res_id)[1]
          }
          variable "app_id" {}
          variable "env_id" {}
          variable "res_id" {}
          variable "region" {}
        main.tf: |
          # Provider credentials are being injected through environment variables
          provider "aws" {
            region = var.region
            default_tags {
              tags = {
                humanitec  = "true"
                hum-app    = var.app_id
                hum-env    = var.env_id
                hum-res    = replace(var.res_id, ".", "-")
                managed-by = "terraform"
              }
            }
          }
          resource "random_string" "bucket_name" {
            length  = 10
            special = false
            lower   = true
            upper   = false
          }
          resource "aws_s3_bucket" "bucket" {
            bucket        = random_string.bucket_name.result
            force_destroy = true
          }
        outputs.tf: |
          output "arn" {
            value = aws_s3_bucket.bucket.arn
          }
          output "bucket" {
            value = aws_s3_bucket.bucket.bucket
          }
          output "region" {
            value = aws_s3_bucket.bucket.region
          }
  provision:
    # Co-provision an IAM Policy resource of class "s3-bucket-policy"
    # By not specifying an ID, the co-provisioned aws-policy will have the same ID as the present resource
    aws-policy.s3-bucket-policy:
      is_dependent: true
  # Adjust matching criteria as required
  criteria:
  - app_id: workload-identity-test-aws

gcs.yaml (view on GitHub ) :

# This Resource Definition of type `gcs` uses the Terraform Driver to provision a gcs bucket
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-gcp-gcs
entity:
  driver_type: humanitec/terraform-runner
  name: wi-gcp-gcs
  type: gcs
  # The identity used in this Cloud Account is the one executing the Terraform code
  # It needs permissions to manage Cloud Storage buckets
  driver_account: ${resources['config.default#app-config'].account}
  driver_inputs:
    values:
      append_logs_to_error: true
      variables:
        app_id: "${context.app.id}"
        env_id: "${context.env.id}"
        res_id: "${context.res.id}"
        project_id: ${resources['config.default#app-config'].outputs.project_id}
        region: ${resources['config.default#app-config'].outputs.region}
      credentials_config:
        variables:
          access_token: access_token
      files:
        providers.tf: |
          terraform {
            required_providers {
              google = {
                source  = "hashicorp/google"
              }
              random = {
                source  = "hashicorp/random"
              }
            }
          }
        variables.tf: |
          locals {
            workload_id = split(".", var.res_id)[1]
          }
          variable "access_token" {
            type      = string
            sensitive = true
          }
          variable "app_id" {}
          variable "env_id" {}
          variable "res_id" {}
          variable "project_id" {}
          variable "region" {}
        main.tf: |
          provider "google" {
            access_token = var.access_token
            default_labels = {
              "humanitec"  = "true"
              "hum-app"    = var.app_id
              "hum-env"    = var.env_id
              "hum-res"    = replace(var.res_id, ".", "-")
              "managed-by" = "terraform"
            }
          }
          resource "random_string" "bucket_name" {
            length  = 10
            special = false
            lower   = true
            upper   = false
          }
          resource "google_storage_bucket" "bucket" {
            project                     = var.project_id
            name                        = random_string.bucket_name.result
            location                    = var.region
            uniform_bucket_level_access = true
            force_destroy               = true
          }
        outputs.tf: |
          output "name" {
            value = google_storage_bucket.bucket.name
          }
  provision:
    # Co-provision an IAM Policy resource of class "gcs-default" for this default gcs
    # By not specifying an ID, the co-provisioned gcp-iam-policy-binding will have the same ID as the present resource
    gcp-iam-policy-binding.gcs-default:
      is_dependent: true
  # Adjust matching criteria as required
  criteria:
  - app_id: workload-identity-test-gcp

s3-bucket-policy.yaml (view on GitHub ) :

# This Resource Definition of type "aws-policy" uses the Terraform Runner Driver to provision
# a bucket policy for a S3 bucket it depends on
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-aws-s3-bucket-policy
entity:
  driver_type: humanitec/terraform-runner
  name: wi-aws-s3-bucket-policy
  type: aws-policy
  driver_account: ${resources['config.default#app-config'].account}
  driver_inputs:
    values:
      append_logs_to_error: true
      variables:
        app_id: ${context.app.id}
        env_id: ${context.env.id}
        res_id: ${context.res.id}
        region: ${resources['config.default#app-config'].outputs.region}
        # Reference the bucket for which to provision the bucket policy
        s3_bucket_name: ${resources['s3.default'].outputs.bucket}
        s3_bucket_arn: ${resources['s3.default'].outputs.arn}
        # This Resource selector traverses the Graph to get the "arn" output
        # from all aws-role resources that require access
        # 1. Start with the s3 resource of class "default" and the same ID as the present resource
        #    This effectively matches the s3 that co-provisioned the present resource
        # 2. Find all the workloads that depend on that s3 (direct and indirect)
        # 3. Find all the aws-roles that these workloads depend on
        # 4. For each aws-role, read its "arn" output
        # Notes:
        # - The workload depends on the aws-role because the k8s-service-account co-provisions the aws-role with match_dependents: true
        # - The selector may return more than one element because more than one workload may depend on the s3
        #   if the s3 is a Shared Resource
        role_arns: ${resources['s3.default<workload>aws-role'].outputs.arn}
      credentials_config:
        environment:
          AWS_ACCESS_KEY_ID: AccessKeyId
          AWS_SECRET_ACCESS_KEY: SecretAccessKey
          AWS_SESSION_TOKEN: SessionToken
      files:
        providers.tf: | 
          terraform {
            required_providers {
              aws = {
                source  = "hashicorp/aws"
              }
            }
          }
        variables.tf: |
          variable "app_id" {}
          variable "env_id" {}
          variable "res_id" {}
          variable "region" {}
          variable "s3_bucket_arn" {}
          variable "s3_bucket_name" {}
          variable "role_arns" {
            type = set(string)
          }
        main.tf: |
          # Provider credentials are being injected through environment variables
          provider "aws" {
            region = var.region
            default_tags {
              tags = {
                humanitec  = "true"
                hum-app    = var.app_id
                hum-env    = var.env_id
                hum-res    = replace(var.res_id, ".", "-")
                managed-by = "terraform"
              }
            }
          }
          # Prepare the policy document. Adjust the policy to your scenario
          data "aws_iam_policy_document" "bucket_access" {
            statement {
              sid = "Admin"
              dynamic "principals" {
                for_each = var.role_arns
                content {
                  type        = "AWS"
                  identifiers = ["$\{principals.value}"]
                }
              }
              actions = [
                "s3:*"
              ]
              resources = [
                var.s3_bucket_arn,
                "$\{var.s3_bucket_arn}/*",
              ]
            }
          }
          # Create the bucket policy
          resource "aws_s3_bucket_policy" "bucket_policy" {
            bucket = var.s3_bucket_name
            policy = data.aws_iam_policy_document.bucket_access.json
          }
        outputs.tf: |
          # This output is for debugging and illustration purposes only
          output "role_arns" {
            value = join(",", var.role_arns)
          }
  # Match the class that is used in the "provision" statement in the s3 Resource Definition
  criteria:
  - class: s3-bucket-policy

gcs-iam-member.yaml (view on GitHub ) :

# This Resource Definition uses the Terraform Driver to create IAM policies for gcs resources
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-gcp-gcs-iam-member
entity:
  driver_type: humanitec/terraform-runner
  name: wi-gcp-gcs-iam-member
  type: gcp-iam-policy-binding
  # The identity used in this Cloud Account is the one executing the Terraform code
  # It needs permissions to manage IAM members
  driver_account: ${resources['config.default#app-config'].account}
  driver_inputs:
    values:
      variables:
        res_class: ${context.res.class}
        # Obtain the bucket name from the bucket resource this resource depends on
        gcs_bucket_name: ${resources['gcs.default'].outputs.name}
        # This Resource selector traverses the Graph to get the "principal" output
        # from all k8s-service-account resources that require access
        # 1. Start with the gcs resource of class "default" and the same ID as the present resource
        #    This effectively matches the gcs that co-provisioned the present resource
        # 2. Find all the workloads that depend on that gcs
        # 3. Find all the k8s-service-accounts that these workloads depend on
        # 4. For each k8s-service-account, read its "principal" output
        # Notes:
        # - The present gcp-iam-policy-binding depends on the gcs because the gcs co-provisions it with is_dependent = true
        # - The selector may return more than one element because more than one workload may depend on the gcs
        #   if the gcs is a Shared Resource
        principals: ${resources['gcs.default<workload>k8s-service-account'].outputs.principal}
      credentials_config:
        variables:
          access_token: access_token
      files:
        providers.tf: |
          terraform {
            required_providers {
              google = {
                source  = "hashicorp/google"
              }
            }
          }
        variables.tf: |
          variable "res_class" {}
          variable "access_token" {
            type      = string
            sensitive = true
          }
          variable "gcs_bucket_name" {}
          # This variable is a set because a resource selector, which is used to retrieve it, always returns an array
          variable "principals" {
            type = set(string)
          }
        main.tf: |
          provider "google" {
            access_token = var.access_token
          }
          # Create one IAM member for each principal using a role of your choice
          resource "google_storage_bucket_iam_member" "iam_member" {
            for_each = var.principals
            bucket  = var.gcs_bucket_name
            role    = "roles/storage.objectAdmin"
            member  = each.key
          }
        outputs.tf: |
          # This output is for debugging and illustration purposes only
          output "principals" {
            value = join(",", var.principals)
          }   
  # Match the class that is used in the "provision" statement in the gcs Resource Definition
  criteria:
  - class: gcs-default

app-config.yaml (view on GitHub ) :

# This Resource Definition of type "config" uses the Template Driver to provide configuration values
# to other Resource Definitions for accessing the Google Cloud Project
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-gcp-app-config
entity:
  name: wi-gcp-app-config
  type: config
  driver_type: humanitec/template
  # The identity used in this Cloud Account needs permission to manage
  # the kinds of cloud resources used in the example
  driver_account: YOURACCOUNT
  driver_inputs:
    values:
      templates:
        outputs: |
          project_id: YOURVALUE
          region: YOURVALUE
  criteria:
    - class: default
      res_id: app-config
      env_type: development
      app_id: workload-identity-test-gcp

s3-delegator.yaml (view on GitHub ) :

# This Resource Definition of type `s3` implements a "Delegator" resource 
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-aws-s3-delegator
entity:
  driver_type: humanitec/echo
  name: wi-aws-s3-delegator
  type: s3
  driver_inputs:
    values:
      # Referencing the "concrete" Resource and passing through all of its outputs
      arn: ${resources['s3.default'].outputs.arn}
      name: ${resources['s3.default'].outputs.bucket}
      region: ${resources['s3.default'].outputs.region}
  # Adjust matching criteria as required, but must match all classes
  criteria:
  - class: s3-admin
    app_id: workload-identity-test-aws
  - class: s3-read-only
    app_id: workload-identity-test-aws

gcs-delegator.yaml (view on GitHub ) :

# This Resource Definition of type `gcs` implements a "Delegator" resource
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-gcp-gcs-delegator
entity:
  driver_type: humanitec/echo
  name: wi-gcp-gcs-delegator
  type: gcs
  driver_inputs:
    values:
      # Referencing the "concrete" Resource and passing through all of its outputs
      name: ${resources['gcs.default'].outputs.name}
  provision:
    # Co-provision an IAM Policy resource for this class of gcs
    # The gcp-iam-policy-binding resource will have the same class and ID as the present resource
    gcp-iam-policy-binding:
      is_dependent: true
  # Adjust matching criteria as required, but must match all access classes
  criteria:
  - class: gcs-admin
    app_id: workload-identity-test-gcp
  - class: gcs-read-only
    app_id: workload-identity-test-gcp

s3-bucket-policy.yaml (view on GitHub ) :

# This Resource Definition of type "aws-role" uses the Terraform Driver to provision a bucket policy
# for an S3 bucket it depends on
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-aws-s3-bucket-policy
entity:
  driver_type: humanitec/terraform-runner
  name: wi-aws-s3-bucket-policy
  type: aws-policy
  driver_account: ${resources['config.default#app-config'].account}
  driver_inputs:
    values:
      append_logs_to_error: true
      variables:
        app_id: ${context.app.id}
        env_id: ${context.env.id}
        res_id: ${context.res.id}
        region: ${resources['config.default#app-config'].outputs.region}
        # Reference the "concrete" bucket for which to provision the bucket policy
        s3_bucket_name: ${resources['s3.default'].outputs.bucket}
        s3_bucket_arn: ${resources['s3.default'].outputs.arn}
        # This Resource selector traverses the Graph to get the "arn" output
        # from all aws-role resources that require "read-only" access to an s3
        # 1. Start with the s3 resource of class "default" and the same ID as the present resource
        #    This effectively matches the "concrete" s3 resource
        # 2. Find all the s3 resources of class "s3-read-only" that depend on that s3
        #    This effectively matches the s3 Delegator resource for this access class
        # 3. Find all the workloads that depend on that s3 Delegator
        # 4. Find all the aws-roles that these workloads depend on
        # 5. For each aws-role, read its "arn" output
        # Notes:
        # - The workload depends on the aws-role because the k8s-service-account co-provisions the aws-role with match_dependents: true
        # - The selector may return more than one element because more than one workload may depend on the s3 Delegator
        #   if the s3 is a Shared Resource
        role_arns_readonly: ${resources['s3.default<s3.s3-read-only<workload>aws-role'].outputs.arn}
        # Same as the previous selector, but for access class "s3-admin"
        role_arns_admin: ${resources['s3.default<s3.s3-admin<workload>aws-role'].outputs.arn}
      credentials_config:
        environment:
          AWS_ACCESS_KEY_ID: AccessKeyId
          AWS_SECRET_ACCESS_KEY: SecretAccessKey
          AWS_SESSION_TOKEN: SessionToken
      files:
        providers.tf: | 
          terraform {
            required_providers {
              aws = {
                source  = "hashicorp/aws"
              }
            }
          }
        variables.tf: |
          variable "app_id" {}
          variable "env_id" {}
          variable "res_id" {}
          variable "region" {}
          variable "s3_bucket_arn" {}
          variable "s3_bucket_name" {}
          variable "role_arns_readonly" {
            type = set(string)
          }
          variable "role_arns_admin" {
            type = set(string)
          }
        main.tf: |
          # Provider credentials are being injected through environment variables
          provider "aws" {
            region = var.region
            default_tags {
              tags = {
                humanitec  = "true"
                hum-app    = var.app_id
                hum-env    = var.env_id
                hum-res    = replace(var.res_id, ".", "-")
                managed-by = "terraform"
              }
            }
          }
          # Prepare the policy document for read-only access
          data "aws_iam_policy_document" "bucket_readonly_access" {
            count = length(var.role_arns_readonly) > 0 ? 1 : 0
            statement {
              sid = "ReadOnly"
              dynamic "principals" {
                for_each = var.role_arns_readonly
                content {
                  type        = "AWS"
                  identifiers = ["$\{principals.value}"]
                }
              }
              actions = [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:ListBucket",
              ]
              resources = [
                var.s3_bucket_arn,
                "$\{var.s3_bucket_arn}/*",
              ]
            }
          }
          # Prepare the policy document for admin access
          data "aws_iam_policy_document" "bucket_admin_access" {
            count = length(var.role_arns_admin) > 0 ? 1 : 0
            statement {
              sid = "Admin"
              dynamic "principals" {
                for_each = var.role_arns_admin
                content {
                  type        = "AWS"
                  identifiers = ["$\{principals.value}"]
                }
              }
              actions = [
                "s3:*"
              ]
              resources = [
                var.s3_bucket_arn,
                "$\{var.s3_bucket_arn}/*",
              ]
            }
          }
          # Merge policy documents into one
          data "aws_iam_policy_document" "combined" {
            source_policy_documents = [
              length(data.aws_iam_policy_document.bucket_readonly_access) > 0 ? data.aws_iam_policy_document.bucket_readonly_access[0].json : "",
              length(data.aws_iam_policy_document.bucket_admin_access) > 0 ? data.aws_iam_policy_document.bucket_admin_access[0].json : "",
              ""]
          }
          # Create the bucket policy
          resource "aws_s3_bucket_policy" "bucket_policy" {
            bucket = var.s3_bucket_name
            policy = data.aws_iam_policy_document.combined.json
          }
        outputs.tf: |
          # This output is for debugging and illustration purposes only
          output "role_arns_readonly" {
            value = join(",", var.role_arns_readonly)
          }
          output "role_arns_admin" {
            value = join(",", var.role_arns_admin)
          }
  # Match the class that is used in the "provision" statement in the Delegator s3 Resource Definition
  criteria:
  - class: s3-bucket-policy

gcs-iam-member.yaml (view on GitHub ) :

# This Resource Definition uses the Terraform Driver to create IAM policies for gcs resources
apiVersion: entity.humanitec.io/v1b1
kind: Definition
metadata:
  id: wi-gcp-gcs-iam-member
entity:
  driver_type: humanitec/terraform-runner
  name: wi-gcp-gcs-iam-member
  type: gcp-iam-policy-binding
  # The identity used in this Cloud Account is the one executing the Terraform code
  # It needs permissions to manage IAM members
  driver_account: ${resources['config.default#app-config'].account}
  driver_inputs:
    values:
      variables:
        res_class: ${context.res.class}
        # Obtain the bucket name from the bucket resource this resource depends on (same class and ID)
        gcs_bucket_name: ${resources.gcs.outputs.name}
        # This Resource selector traverses the Graph to get the "principal" output
        # from all k8s-service-account resources that require access
        # 1. Start with the gcs resource of the same class and ID as the present resource
        #    This effectively matches the gcs Delegator that co-provisioned the present resource
        # 2. Find all the workloads that depend on that gcs Delegator
        # 3. Find all the k8s-service-accounts that these workloads depend on
        # 4. For each k8s-service-account, read its "principal" output
        # Notes:
        # - The present gcp-iam-policy-binding depends on the gcs Delegator because the gcs Delegator co-provisions it with is_dependent = true
        # - The selector may return more than one element because more than one workload may depend on the gcs Delegator
        #   if the gcs Delegator is a Shared Resource
        principals: ${resources['gcs<workload>k8s-service-account'].outputs.principal}
      credentials_config:
        variables:
          access_token: access_token
      files:
        providers.tf: |
          terraform {
            required_providers {
              google = {
                source  = "hashicorp/google"
              }
            }
          }
        variables.tf: |
          variable "res_class" {}
          variable "access_token" {
            type      = string
            sensitive = true
          }
          variable "gcs_bucket_name" {}
          # This variable is a set because a resource selector, which is used to retrieve it, always returns an array
          variable "principals" {
            type = set(string)
          }
          # Define the roles for each access class
          locals {
            roles = {
              "gcs-read-only" = "roles/storage.objectViewer"
              "gcs-admin"     = "roles/storage.objectAdmin"
            }
          }
        main.tf: |
          provider "google" {
            access_token = var.access_token
          }
          # Create one IAM member for each principal using the role for the current access class
          resource "google_storage_bucket_iam_member" "iam_member" {
            for_each = var.principals
            bucket  = var.gcs_bucket_name
            role    = local.roles[var.res_class]
            member  = each.key
          }
        outputs.tf: |
          # This output is for debugging and illustration purposes only
          output "principals" {
            value = join(",", var.principals)
          }   
  # Match the class that is used in the "provision" statement in the gcs Delegator Resource Definition
  criteria:
  - class: gcs-read-only
  - class: gcs-admin