GCP OIDC simplification

[Halama]

• Use centralized Github Action Workload Identity pool
• Use direct resource access for Workload Identity instead of Service Account impersonation
• Docs updated- https://keboola.atlassian.net/wiki/spaces/ENGG/pages/2623209501/OIDC+authorization+in+GitHub+Actions#GCP

Terraform plan for CI update:

Terraform will perform the following actions:

  # azuread_application.go_cloud_encrypt will be updated in-place
  ~ resource "azuread_application" "go_cloud_encrypt" {
        id                             = "/applications/416e7640-356a-4c51-a43b-1d7c854810bf"
      ~ owners                         = [
          - "a2e33a9f-bef5-4a23-9f38-1e91f859be4b",
          + "5a5fbaf1-8467-4341-bc4e-d5a9e2c1262a",
        ]
        tags                           = []
        # (24 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # azuread_service_principal.go_cloud_encrypt will be updated in-place
  ~ resource "azuread_service_principal" "go_cloud_encrypt" {
        id                            = "/servicePrincipals/0aa7be8e-a269-47e0-89c0-c3c5a7318a39"
      ~ owners                        = [
          - "a2e33a9f-bef5-4a23-9f38-1e91f859be4b",
          + "5a5fbaf1-8467-4341-bc4e-d5a9e2c1262a",
        ]
        tags                          = []
        # (23 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # google_iam_workload_identity_pool.go_cloud_encrypt will be destroyed
  # (because google_iam_workload_identity_pool.go_cloud_encrypt is not in configuration)
  - resource "google_iam_workload_identity_pool" "go_cloud_encrypt" {
      - disabled                  = false -> null
      - id                        = "projects/go-team-ci/locations/global/workloadIdentityPools/ci-go-cloud-encrypt" -> null
      - name                      = "projects/592579407407/locations/global/workloadIdentityPools/ci-go-cloud-encrypt" -> null
      - project                   = "go-team-ci" -> null
      - state                     = "ACTIVE" -> null
      - workload_identity_pool_id = "ci-go-cloud-encrypt" -> null
        # (2 unchanged attributes hidden)
    }

  # google_iam_workload_identity_pool_provider.go_cloud_encrypt will be destroyed
  # (because google_iam_workload_identity_pool_provider.go_cloud_encrypt is not in configuration)
  - resource "google_iam_workload_identity_pool_provider" "go_cloud_encrypt" {
      - attribute_condition                = <<-EOT
            attribute.repository == "keboola/go-cloud-encrypt"
        EOT -> null
      - attribute_mapping                  = {
          - "attribute.actor"      = "assertion.actor"
          - "attribute.aud"        = "assertion.aud"
          - "attribute.repository" = "assertion.repository"
          - "google.subject"       = "assertion.sub"
        } -> null
      - disabled                           = false -> null
      - id                                 = "projects/go-team-ci/locations/global/workloadIdentityPools/ci-go-cloud-encrypt/providers/go-cloud-encrypt" -> null
      - name                               = "projects/592579407407/locations/global/workloadIdentityPools/ci-go-cloud-encrypt/providers/go-cloud-encrypt" -> null
      - project                            = "go-team-ci" -> null
      - state                              = "ACTIVE" -> null
      - workload_identity_pool_id          = "ci-go-cloud-encrypt" -> null
      - workload_identity_pool_provider_id = "go-cloud-encrypt" -> null
        # (2 unchanged attributes hidden)

      - oidc {
          - allowed_audiences = [] -> null
          - issuer_uri        = "https://token.actions.githubusercontent.com" -> null
            # (1 unchanged attribute hidden)
        }
    }

  # google_kms_crypto_key_iam_binding.go_cloud_encrypt_iam will be updated in-place
  ~ resource "google_kms_crypto_key_iam_binding" "go_cloud_encrypt_iam" {
        id            = "projects/go-team-ci/locations/global/keyRings/ci-go-cloud-encrypt/cryptoKeys/ci-go-cloud-encrypt/roles/cloudkms.cryptoKeyEncrypterDecrypter"
      ~ members       = [
          - "serviceAccount:[email protected]",
          + "principalSet://iam.googleapis.com/projects/594833180351/locations/global/workloadIdentityPools/github/providers/keboola/attribute.repository/keboola/go-cloud-encrypt",
        ]
        # (3 unchanged attributes hidden)
    }

  # google_service_account.go_cloud_encrypt_service_account will be destroyed
  # (because google_service_account.go_cloud_encrypt_service_account is not in configuration)
  - resource "google_service_account" "go_cloud_encrypt_service_account" {
      - account_id   = "ci-go-cloud-encrypt" -> null
      - disabled     = false -> null
      - display_name = "ci Go Cloud Encrypt DEV" -> null
      - email        = "[email protected]" -> null
      - id           = "projects/go-team-ci/serviceAccounts/[email protected]" -> null
      - member       = "serviceAccount:[email protected]" -> null
      - name         = "projects/go-team-ci/serviceAccounts/[email protected]" -> null
      - project      = "go-team-ci" -> null
      - unique_id    = "102524001773285695130" -> null
        # (1 unchanged attribute hidden)
    }

  # google_service_account_iam_member.go_cloud_encrypt will be destroyed
  # (because google_service_account_iam_member.go_cloud_encrypt is not in configuration)
  - resource "google_service_account_iam_member" "go_cloud_encrypt" {
      - etag               = "BwYnRDPzDbg=" -> null
      - id                 = "projects/go-team-ci/serviceAccounts/[email protected]/roles/iam.serviceAccountTokenCreator/principalSet://iam.googleapis.com/projects/592579407407/locations/global/workloadIdentityPools/ci-go-cloud-encrypt/attribute.repository/keboola/go-cloud-encrypt" -> null
      - member             = "principalSet://iam.googleapis.com/projects/592579407407/locations/global/workloadIdentityPools/ci-go-cloud-encrypt/attribute.repository/keboola/go-cloud-encrypt" -> null
      - role               = "roles/iam.serviceAccountTokenCreator" -> null
      - service_account_id = "projects/go-team-ci/serviceAccounts/[email protected]" -> null
    }

  # google_service_account_key.go_cloud_encrypt_key will be destroyed
  # (because google_service_account_key.go_cloud_encrypt_key is not in configuration)
  - resource "google_service_account_key" "go_cloud_encrypt_key" {
      - id                 = "projects/go-team-ci/serviceAccounts/[email protected]/keys/af7a21d8b8c9ad63157bbce5a1ccbf2c68539a00" -> null
      - key_algorithm      = "KEY_ALG_RSA_2048" -> null
      - name               = "projects/go-team-ci/serviceAccounts/[email protected]/keys/af7a21d8b8c9ad63157bbce5a1ccbf2c68539a00" -> null
      - private_key        = (sensitive value) -> null
      - private_key_type   = "TYPE_GOOGLE_CREDENTIALS_FILE" -> null
      - public_key         = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvRENDQWVTZ0F3SUJBZ0lJRFExZkZJclNyY0l3RFFZSktvWklodmNOQVFFRkJRQXdJREVlTUJ3R0ExVUUKQXd3Vk1UQXlOVEkwTURBeE56Y3pNamcxTmprMU1UTXdNQ0FYRFRJME1URXdPREV3TkRNek0xb1lEems1T1RreApNak14TWpNMU9UVTVXakFnTVI0d0hBWURWUVFEREJVeE1ESTFNalF3TURFM056TXlPRFUyT1RVeE16QXdnZ0VpCk1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRREtVQ2xrNFZwdnUwd1JzWVU0Y21jbDhrbEYKQy9iUFhaTWhzaU8wTEVINGdkYXFpelV5L1JMSjJmc2pkNTduR1BkWDFoYWJsSXc3dG5zQnQxSURDVGlHWHNpcQp5S1BaajJGb3Z6MDZGUHluUElYKzZHS2lNU2wvM3JHK0lIaWlsVVdJQlZXOStlOGJlUjZnbDJkaGljQjMxRDVGCnExSlN5ZXIrUTlFblNRMFlFUWtPOWZHbVdSVm5KMUdaL2czWkcya0p6THlkM2xPQnpUS1NiWU9XeHlycS9GS00KWjdGbWR5NjNNR0oxOElqYVpIcWUwL0xMSUhXbHJNSUFWVVlFbUoyVWJFamxvVnZUVFJhMUYzTzVncVFqNTZ1OApKOU1FRitzWlVEOCt4NGpYV2VlYWdDNWZaMTNuL3ptMkdGZkNVSlpKT1c5enQzZ2g5eU1BM1V3b25iOWJBZ01CCkFBR2pPREEyTUF3R0ExVWRFd0VCL3dRQ01BQXdEZ1lEVlIwUEFRSC9CQVFEQWdlQU1CWUdBMVVkSlFFQi93UU0KTUFvR0NDc0dBUVVGQndNQ01BMEdDU3FHU0liM0RRRUJCUVVBQTRJQkFRQjZ3SXl6TlZrV2dGK2ZCbjNzMHRILwpTUkw2c05JNmFtQjZXTmZKME14VzRuMThhTU4vZS9MWlFPa2E2Qmp3TDVGd1lUYzU3akxPTUxETGFQTGQ3VlhXCnNXWE1Ea1JZU24yK2dHeFhuMXRqVXVZZS9DWVdianJVUmNpT0lPV2liWjVQVHFQdm9DZUdQOVJrS1VCVXN6bUcKU1NWR2JDQ0dSaFY3TWwyMkV5ZUdWek01dGcwMzk5WThVSkRwL3pnak5Cakt5a0hJc2FXdUpuMjUzVVpIY2ZPVwpnSWZLaGdLcmJLWHZueVhUeTQ5anY2UmhBVkxOdHd2T0dYOGNnRjZpWFBqVHJBNlpoYlhTTkNNTCs4MXhGTDhuCkZSdmJGb2hjbTR1R1IybTFoZ3ByUTNjZzZpcU1Wa2svZnNwbTJaRmxxQktFZHB4blF1QnIwWCtON1ZkWDBWa2UKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=" -> null
      - public_key_type    = "TYPE_X509_PEM_FILE" -> null
      - service_account_id = "projects/go-team-ci/serviceAccounts/[email protected]" -> null
      - valid_after        = "2024-11-08T10:43:33Z" -> null
      - valid_before       = "9999-12-31T23:59:59Z" -> null
    }

Plan: 0 to add, 3 to change, 5 to destroy.

Changes to Outputs:
  - gcp_private_key       = (sensitive value) -> null

─────────────────────────────────────────

[wokoman]

Za me gut, krasa.