forked from pumasecurity/nymeria
-
Notifications
You must be signed in to change notification settings - Fork 0
101 lines (87 loc) · 4.72 KB
/
federated-identity.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: Federated Identity
on:
workflow_dispatch:
permissions:
actions: read # read gh actions
contents: read # read access to the repo
id-token: write # write jwt token
jobs:
terraform:
name: Apply Terraform
runs-on: ubuntu-latest
steps:
- name: Initialize
shell: bash
run: |
jq --version
az --version
aws --version
gcloud --version
- shell: bash
env:
AZURE_BOOTSTRAP: ${{ secrets.AZURE_BOOTSTRAP }}
AWS_BOOTSTRAP: ${{ secrets.AWS_BOOTSTRAP }}
GCP_BOOTSTRAP: ${{ secrets.GCP_BOOTSTRAP }}
run: |
ARM_SUBSCRIPTION_ID=$(jq -r '.azure_subscription_id.value' <<< $AZURE_BOOTSTRAP)
ARM_TENANT_ID=$(jq -r '.azure_tenant_id.value' <<< $AZURE_BOOTSTRAP)
ARM_CLIENT_ID=$(jq -r '.github_federation_client_id.value' <<< $AZURE_BOOTSTRAP)
ARM_RESOURCE_GROUP_NAME=$(jq -r '.resource_group_name.value' <<< $AZURE_BOOTSTRAP)
ARM_STORAGE_ACCOUNT_NAME=$(jq -r '.terraform_state_storage_account_name.value' <<< $AZURE_BOOTSTRAP)
AZURE_VIRTUAL_MACHINE_USER_IDENTITY_ID=$(jq -r '.azure_virtual_machine_user_identity_id.value' <<< $AZURE_BOOTSTRAP)
AZURE_VIRTUAL_MACHINE_USER_IDENTITY_PRINCIPAL_ID=$(jq -r '.azure_virtual_machine_user_identity_principal_id.value' <<< $AZURE_BOOTSTRAP)
AZURE_VM_AWS_ROLE_ARN=$(jq -r '.azure_vm_aws_role_arn.value' <<< $AWS_BOOTSTRAP)
AZURE_VM_AWS_ACCESS_KEY_ID=$(jq -r '.azure_vm_aws_access_key_id.value' <<< $AWS_BOOTSTRAP)
AZURE_VM_AWS_SECRET_ACCESS_KEY=$(jq -r '.azure_vm_aws_secret_access_key.value' <<< $AWS_BOOTSTRAP)
AWS_S3_BUCKET=$(jq -r '.aws_s3_bucket.value' <<< $AWS_BOOTSTRAP)
AWS_DEFAULT_REGION=$(jq -r '.aws_default_region.value' <<< $AWS_BOOTSTRAP)
GCP_PROJECT_ID=$(jq -r '.gcp_project_id.value' <<< $GCP_BOOTSTRAP)
GCS_BUCKET=$(jq -r '.gcs_bucket.value' <<< $GCP_BOOTSTRAP)
GCP_WORKLOAD_IDENTITY_CLIENT_CONFIGURATION=$(jq -r '.workload_identity_client_configuration.value' <<< $GCP_BOOTSTRAP)
AZURE_VM_GOOGLE_SERVICE_ACCOUNT_KEY=$(jq -r '.azure_vm_google_service_account_key.value' <<< $GCP_BOOTSTRAP)
echo "::add-mask::$ARM_SUBSCRIPTION_ID"
echo "::add-mask::$ARM_TENANT_ID"
echo "::add-mask::$ARM_CLIENT_ID"
echo "::add-mask::$AZURE_VIRTUAL_MACHINE_USER_IDENTITY_ID"
echo "::add-mask::$AZURE_VIRTUAL_MACHINE_USER_IDENTITY_PRINCIPAL_ID"
echo "::add-mask::$AZURE_VM_AWS_ACCESS_KEY_ID"
echo "::add-mask::$AZURE_VM_AWS_SECRET_ACCESS_KEY"
echo "::add-mask::$AZURE_VM_AWS_ROLE_ARN"
echo "::add-mask::$AWS_S3_BUCKET"
echo "::add-mask::$GCP_PROJECT_ID"
echo "::add-mask::$GCP_WORKLOAD_IDENTITY_CLIENT_CONFIGURATION"
echo "::add-mask::$AZURE_VM_GOOGLE_SERVICE_ACCOUNT_KEY"
echo "::add-mask::$GCS_BUCKET"
echo ARM_SUBSCRIPTION_ID=$ARM_SUBSCRIPTION_ID >> $GITHUB_ENV
echo ARM_TENANT_ID=$ARM_TENANT_ID >> $GITHUB_ENV
echo ARM_CLIENT_ID=$ARM_CLIENT_ID >> $GITHUB_ENV
echo ARM_RESOURCE_GROUP_NAME=$ARM_RESOURCE_GROUP_NAME >> $GITHUB_ENV
echo ARM_STORAGE_ACCOUNT_NAME=$ARM_STORAGE_ACCOUNT_NAME >> $GITHUB_ENV
echo AZURE_VIRTUAL_MACHINE_USER_IDENTITY_ID=$AZURE_VIRTUAL_MACHINE_USER_IDENTITY_ID >> $GITHUB_ENV
echo AZURE_VIRTUAL_MACHINE_USER_IDENTITY_PRINCIPAL_ID=$AZURE_VIRTUAL_MACHINE_USER_IDENTITY_PRINCIPAL_ID >> $GITHUB_ENV
echo AZURE_VM_AWS_ROLE_ARN=$AZURE_VM_AWS_ROLE_ARN >> $GITHUB_ENV
echo AZURE_VM_AWS_ACCESS_KEY_ID=$AZURE_VM_AWS_ACCESS_KEY_ID >> $GITHUB_ENV
echo AZURE_VM_AWS_SECRET_ACCESS_KEY=$AZURE_VM_AWS_SECRET_ACCESS_KEY >> $GITHUB_ENV
echo AWS_S3_BUCKET=$AWS_S3_BUCKET >> $GITHUB_ENV
echo AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION >> $GITHUB_ENV
echo GCP_PROJECT_ID=$GCP_PROJECT_ID >> $GITHUB_ENV
echo GCS_BUCKET=$GCS_BUCKET >> $GITHUB_ENV
echo GCP_WORKLOAD_IDENTITY_CLIENT_CONFIGURATION=$GCP_WORKLOAD_IDENTITY_CLIENT_CONFIGURATION >> $GITHUB_ENV
echo AZURE_VM_GOOGLE_SERVICE_ACCOUNT_KEY=$AZURE_VM_GOOGLE_SERVICE_ACCOUNT_KEY >> $GITHUB_ENV
# Check out the repository
- name: Checkout
uses: actions/[email protected]
- name: Azure Login
uses: azure/[email protected]
with:
client-id: ${{ env.ARM_CLIENT_ID }}
tenant-id: ${{ env.ARM_TENANT_ID }}
subscription-id: ${{ env.ARM_SUBSCRIPTION_ID }}
- name: Setup Terraform
uses: hashicorp/setup-terraform@v2
with:
terraform_version: 1.4.5
terraform_wrapper: false
- name: Run Terraform
shell: bash
run: /bin/bash ./build/deploy-terraform.sh