Skip to content

Commit 89ee70a

Browse files
motatoesmotatoes
authored
better support for project level oidc role assumption (#906)
* better support for project level oidc role assumption Former-commit-id: 24f59bd
1 parent e06892a commit 89ee70a

File tree

15 files changed

+465
-346
lines changed

15 files changed

+465
-346
lines changed

‎cli/go.sum‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -317,8 +317,6 @@ github.com/aws/aws-sdk-go v1.15.78/go.mod h1:E3/ieXAlvM0XWO57iftYVDLLvQ824smPP3A
317317
github.com/aws/aws-sdk-go v1.31.9/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
318318
github.com/aws/aws-sdk-go v1.37.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
319319
github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
320-
github.com/aws/aws-sdk-go v1.48.16 h1:mcj2/9J/MJ55Dov+ocMevhR8Jv6jW/fAxbrn4a1JFc8=
321-
github.com/aws/aws-sdk-go v1.48.16/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
322320
github.com/aws/aws-sdk-go v1.49.1 h1:Dsamcd8d/nNb3A+bZ0ucfGl0vGZsW5wlRW0vhoYGoeQ=
323321
github.com/aws/aws-sdk-go v1.49.1/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
324322
github.com/aws/aws-sdk-go v1.49.2 h1:+4BEcm1nPCoDbVd+gg8cdxpa1qJfrvnddy12vpEVWjw=
@@ -463,8 +461,8 @@ github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66D
463461
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
464462
github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
465463
github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
466-
github.com/go-git/go-git/v5 v5.10.1 h1:tu8/D8i+TWxgKpzQ3Vc43e+kkhXqtsZCKI/egajKnxk=
467-
github.com/go-git/go-git/v5 v5.10.1/go.mod h1:uEuHjxkHap8kAl//V5F/nNWwqIYtP/402ddd05mp0wg=
464+
github.com/go-git/go-git/v5 v5.11.0 h1:XIZc1p+8YzypNr34itUfSvYJcv+eYdTnTvOZ2vD3cA4=
465+
github.com/go-git/go-git/v5 v5.11.0/go.mod h1:6GFcX2P3NM7FPBfpePbpLd21XxsgdAt+lKqXmCUiUCY=
468466
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
469467
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
470468
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -610,8 +608,6 @@ github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
610608
github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
611609
github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
612610
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
613-
github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
614-
github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
615611
github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
616612
github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
617613
github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
@@ -752,8 +748,6 @@ github.com/hashicorp/serf v0.0.0-20160124182025-e4ec8cc423bb/go.mod h1:h/Ru6tmZa
752748
github.com/hashicorp/terraform v0.15.3 h1:2QWbTj2xJ/8W1gCyIrd0WAqVF4weKPMYjx8nKjbkQjA=
753749
github.com/hashicorp/terraform v0.15.3/go.mod h1:w4eBEsluZfYumXUTLe834eqHh969AabcLqbj2WAYlM8=
754750
github.com/hashicorp/terraform-config-inspect v0.0.0-20210209133302-4fd17a0faac2/go.mod h1:Z0Nnk4+3Cy89smEbrq+sl1bxc9198gIP4I7wcQF6Kqs=
755-
github.com/hashicorp/terraform-config-inspect v0.0.0-20230925220900-5a6f8d18746d h1:g6kHlvZrFPFKeWRj5q/zyJA5gu7rlJGPf17h8hX7LHY=
756-
github.com/hashicorp/terraform-config-inspect v0.0.0-20230925220900-5a6f8d18746d/go.mod h1:l8HcFPm9cQh6Q0KSWoYPiePqMvRFenybP1CH2MjKdlg=
757751
github.com/hashicorp/terraform-config-inspect v0.0.0-20231204233900-a34142ec2a72 h1:nZ5gGjbe5o7XUu1d7j+Y5Ztcxlp+yaumTKH9i0D3wlg=
758752
github.com/hashicorp/terraform-config-inspect v0.0.0-20231204233900-a34142ec2a72/go.mod h1:l8HcFPm9cQh6Q0KSWoYPiePqMvRFenybP1CH2MjKdlg=
759753
github.com/hashicorp/terraform-registry-address v0.2.0 h1:92LUg03NhfgZv44zpNTLBGIbiyTokQCDcdH5BhVHT3s=
@@ -1067,10 +1061,6 @@ github.com/vmihailenco/msgpack/v5 v5.3.5/go.mod h1:7xyJ9e+0+9SaZT0Wt1RGleJXzli6Q
10671061
github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
10681062
github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
10691063
github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
1070-
github.com/xanzy/go-gitlab v0.95.0 h1:lnYFPDsZuoSWXSC9xPLMcAWlGgndMn+erexGa+jJsS0=
1071-
github.com/xanzy/go-gitlab v0.95.0/go.mod h1:ETg8tcj4OhrB84UEgeE8dSuV/0h4BBL1uOV/qK0vlyI=
1072-
github.com/xanzy/go-gitlab v0.95.1 h1:rQjcmX5Au2Lz9bc3QLTdtSK5ZHdTXLnmhz3CAB/G5So=
1073-
github.com/xanzy/go-gitlab v0.95.1/go.mod h1:ETg8tcj4OhrB84UEgeE8dSuV/0h4BBL1uOV/qK0vlyI=
10741064
github.com/xanzy/go-gitlab v0.95.2 h1:4p0IirHqEp5f0baK/aQqr4TR57IsD+8e4fuyAA1yi88=
10751065
github.com/xanzy/go-gitlab v0.95.2/go.mod h1:ETg8tcj4OhrB84UEgeE8dSuV/0h4BBL1uOV/qK0vlyI=
10761066
github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=

‎cli/pkg/azure/azure.go‎

Lines changed: 68 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -417,22 +417,24 @@ func ConvertAzureEventToCommands(parseAzureContext Azure, impactedProjects []dig
417417

418418
prNumber := parseAzureContext.Event.(AzurePrEvent).Resource.PullRequestId
419419
stateEnvVars, commandEnvVars := digger_config2.CollectTerraformEnvConfig(workflow.EnvVars)
420+
StateEnvProvider, CommandEnvProvider := orchestrator.GetStateAndCommandProviders(project)
420421
jobs = append(jobs, orchestrator.Job{
421-
ProjectName: project.Name,
422-
ProjectDir: project.Dir,
423-
ProjectWorkspace: project.Workspace,
424-
Terragrunt: project.Terragrunt,
425-
OpenTofu: project.OpenTofu,
426-
Commands: workflow.Configuration.OnPullRequestPushed,
427-
ApplyStage: orchestrator.ToConfigStage(workflow.Apply),
428-
PlanStage: orchestrator.ToConfigStage(workflow.Plan),
429-
PullRequestNumber: &prNumber,
430-
EventName: parseAzureContext.EventType,
431-
RequestedBy: parseAzureContext.BaseUrl,
432-
Namespace: parseAzureContext.BaseUrl + "/" + parseAzureContext.ProjectName,
433-
StateEnvVars: stateEnvVars,
434-
CommandEnvVars: commandEnvVars,
435-
AwsRoleToAssume: project.AwsRoleToAssume,
422+
ProjectName: project.Name,
423+
ProjectDir: project.Dir,
424+
ProjectWorkspace: project.Workspace,
425+
Terragrunt: project.Terragrunt,
426+
OpenTofu: project.OpenTofu,
427+
Commands: workflow.Configuration.OnPullRequestPushed,
428+
ApplyStage: orchestrator.ToConfigStage(workflow.Apply),
429+
PlanStage: orchestrator.ToConfigStage(workflow.Plan),
430+
PullRequestNumber: &prNumber,
431+
EventName: parseAzureContext.EventType,
432+
RequestedBy: parseAzureContext.BaseUrl,
433+
Namespace: parseAzureContext.BaseUrl + "/" + parseAzureContext.ProjectName,
434+
StateEnvVars: stateEnvVars,
435+
CommandEnvVars: commandEnvVars,
436+
StateEnvProvider: StateEnvProvider,
437+
CommandEnvProvider: CommandEnvProvider,
436438
})
437439
}
438440
return jobs, true, nil
@@ -445,22 +447,24 @@ func ConvertAzureEventToCommands(parseAzureContext Azure, impactedProjects []dig
445447

446448
prNumber := parseAzureContext.Event.(AzurePrEvent).Resource.PullRequestId
447449
stateEnvVars, commandEnvVars := digger_config2.CollectTerraformEnvConfig(workflow.EnvVars)
450+
StateEnvProvider, CommandEnvProvider := orchestrator.GetStateAndCommandProviders(project)
448451
jobs = append(jobs, orchestrator.Job{
449-
ProjectName: project.Name,
450-
ProjectDir: project.Dir,
451-
ProjectWorkspace: project.Workspace,
452-
Terragrunt: project.Terragrunt,
453-
OpenTofu: project.OpenTofu,
454-
Commands: workflow.Configuration.OnPullRequestClosed,
455-
ApplyStage: orchestrator.ToConfigStage(workflow.Apply),
456-
PlanStage: orchestrator.ToConfigStage(workflow.Plan),
457-
PullRequestNumber: &prNumber,
458-
EventName: parseAzureContext.EventType,
459-
RequestedBy: parseAzureContext.BaseUrl,
460-
Namespace: parseAzureContext.BaseUrl + "/" + parseAzureContext.ProjectName,
461-
StateEnvVars: stateEnvVars,
462-
CommandEnvVars: commandEnvVars,
463-
AwsRoleToAssume: project.AwsRoleToAssume,
452+
ProjectName: project.Name,
453+
ProjectDir: project.Dir,
454+
ProjectWorkspace: project.Workspace,
455+
Terragrunt: project.Terragrunt,
456+
OpenTofu: project.OpenTofu,
457+
Commands: workflow.Configuration.OnPullRequestClosed,
458+
ApplyStage: orchestrator.ToConfigStage(workflow.Apply),
459+
PlanStage: orchestrator.ToConfigStage(workflow.Plan),
460+
PullRequestNumber: &prNumber,
461+
EventName: parseAzureContext.EventType,
462+
RequestedBy: parseAzureContext.BaseUrl,
463+
Namespace: parseAzureContext.BaseUrl + "/" + parseAzureContext.ProjectName,
464+
StateEnvVars: stateEnvVars,
465+
CommandEnvVars: commandEnvVars,
466+
StateEnvProvider: StateEnvProvider,
467+
CommandEnvProvider: CommandEnvProvider,
464468
})
465469
}
466470
return jobs, true, nil
@@ -473,22 +477,24 @@ func ConvertAzureEventToCommands(parseAzureContext Azure, impactedProjects []dig
473477
return nil, false, fmt.Errorf("failed to find workflow digger_config '%s' for project '%s'", project.Workflow, project.Name)
474478
}
475479
stateEnvVars, commandEnvVars := digger_config2.CollectTerraformEnvConfig(workflow.EnvVars)
480+
StateEnvProvider, CommandEnvProvider := orchestrator.GetStateAndCommandProviders(project)
476481
jobs = append(jobs, orchestrator.Job{
477-
ProjectName: project.Name,
478-
ProjectDir: project.Dir,
479-
ProjectWorkspace: project.Workspace,
480-
Terragrunt: project.Terragrunt,
481-
OpenTofu: project.OpenTofu,
482-
Commands: workflow.Configuration.OnCommitToDefault,
483-
ApplyStage: orchestrator.ToConfigStage(workflow.Apply),
484-
PlanStage: orchestrator.ToConfigStage(workflow.Plan),
485-
PullRequestNumber: &prNumber,
486-
EventName: parseAzureContext.EventType,
487-
RequestedBy: parseAzureContext.BaseUrl,
488-
Namespace: parseAzureContext.BaseUrl + "/" + parseAzureContext.ProjectName,
489-
StateEnvVars: stateEnvVars,
490-
CommandEnvVars: commandEnvVars,
491-
AwsRoleToAssume: project.AwsRoleToAssume,
482+
ProjectName: project.Name,
483+
ProjectDir: project.Dir,
484+
ProjectWorkspace: project.Workspace,
485+
Terragrunt: project.Terragrunt,
486+
OpenTofu: project.OpenTofu,
487+
Commands: workflow.Configuration.OnCommitToDefault,
488+
ApplyStage: orchestrator.ToConfigStage(workflow.Apply),
489+
PlanStage: orchestrator.ToConfigStage(workflow.Plan),
490+
PullRequestNumber: &prNumber,
491+
EventName: parseAzureContext.EventType,
492+
RequestedBy: parseAzureContext.BaseUrl,
493+
Namespace: parseAzureContext.BaseUrl + "/" + parseAzureContext.ProjectName,
494+
StateEnvVars: stateEnvVars,
495+
CommandEnvVars: commandEnvVars,
496+
StateEnvProvider: StateEnvProvider,
497+
CommandEnvProvider: CommandEnvProvider,
492498
})
493499
}
494500
return jobs, true, nil
@@ -526,23 +532,24 @@ func ConvertAzureEventToCommands(parseAzureContext Azure, impactedProjects []dig
526532
return nil, false, fmt.Errorf("failed to find workflow digger_config '%s' for project '%s'", project.Workflow, project.Name)
527533
}
528534
stateEnvVars, commandEnvVars := digger_config2.CollectTerraformEnvConfig(workflow.EnvVars)
529-
535+
StateEnvProvider, CommandEnvProvider := orchestrator.GetStateAndCommandProviders(project)
530536
jobs = append(jobs, orchestrator.Job{
531-
ProjectName: project.Name,
532-
ProjectDir: project.Dir,
533-
ProjectWorkspace: workspace,
534-
Terragrunt: project.Terragrunt,
535-
OpenTofu: project.OpenTofu,
536-
Commands: []string{command},
537-
ApplyStage: orchestrator.ToConfigStage(workflow.Apply),
538-
PlanStage: orchestrator.ToConfigStage(workflow.Plan),
539-
PullRequestNumber: &prNumber,
540-
EventName: parseAzureContext.EventType,
541-
RequestedBy: parseAzureContext.BaseUrl,
542-
Namespace: parseAzureContext.BaseUrl + "/" + parseAzureContext.ProjectName,
543-
StateEnvVars: stateEnvVars,
544-
CommandEnvVars: commandEnvVars,
545-
AwsRoleToAssume: project.AwsRoleToAssume,
537+
ProjectName: project.Name,
538+
ProjectDir: project.Dir,
539+
ProjectWorkspace: workspace,
540+
Terragrunt: project.Terragrunt,
541+
OpenTofu: project.OpenTofu,
542+
Commands: []string{command},
543+
ApplyStage: orchestrator.ToConfigStage(workflow.Apply),
544+
PlanStage: orchestrator.ToConfigStage(workflow.Plan),
545+
PullRequestNumber: &prNumber,
546+
EventName: parseAzureContext.EventType,
547+
RequestedBy: parseAzureContext.BaseUrl,
548+
Namespace: parseAzureContext.BaseUrl + "/" + parseAzureContext.ProjectName,
549+
StateEnvVars: stateEnvVars,
550+
CommandEnvVars: commandEnvVars,
551+
StateEnvProvider: StateEnvProvider,
552+
CommandEnvProvider: CommandEnvProvider,
546553
})
547554
}
548555
}

‎cli/pkg/core/terraform/tf.go‎

Lines changed: 9 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,19 @@ func (tf Terraform) Init(params []string, envs map[string]string) (string, strin
2828
params = append(params, "-input=false")
2929
params = append(params, "-no-color")
3030
stdout, stderr, _, err := tf.runTerraformCommand(true, "init", envs, params...)
31+
32+
// switch to workspace for next step
33+
// TODO: make this an individual and isolated step
34+
werr := tf.switchToWorkspace(envs)
35+
if werr != nil {
36+
log.Printf("Fatal: Error terraform switch to workspace %v", err)
37+
return "", "", werr
38+
}
39+
3140
return stdout, stderr, err
3241
}
3342

3443
func (tf Terraform) Apply(params []string, plan *string, envs map[string]string) (string, string, error) {
35-
err := tf.switchToWorkspace(envs)
36-
if err != nil {
37-
log.Printf("Fatal: Error terraform to workspace %v", err)
38-
return "", "", err
39-
}
4044
params = append(append(append(params, "-input=false"), "-no-color"), "-auto-approve")
4145
if plan != nil {
4246
params = append(params, *plan)
@@ -46,11 +50,6 @@ func (tf Terraform) Apply(params []string, plan *string, envs map[string]string)
4650
}
4751

4852
func (tf Terraform) Destroy(params []string, envs map[string]string) (string, string, error) {
49-
err := tf.switchToWorkspace(envs)
50-
if err != nil {
51-
log.Printf("Fatal: Error terraform to workspace %v", err)
52-
return "", "", err
53-
}
5453
params = append(append(append(params, "-input=false"), "-no-color"), "-auto-approve")
5554
stdout, stderr, _, err := tf.runTerraformCommand(true, "destroy", envs, params...)
5655
return stdout, stderr, err
@@ -135,23 +134,6 @@ func (tf Terraform) formatTerraformWorkspaces(list string) string {
135134
}
136135

137136
func (tf Terraform) Plan(params []string, envs map[string]string) (bool, string, string, error) {
138-
139-
workspaces, _, _, err := tf.runTerraformCommand(false, "workspace", envs, "list")
140-
if err != nil {
141-
return false, "", "", err
142-
}
143-
workspaces = tf.formatTerraformWorkspaces(workspaces)
144-
if strings.Contains(workspaces, tf.Workspace) {
145-
_, _, _, err := tf.runTerraformCommand(true, "workspace", envs, "select", tf.Workspace)
146-
if err != nil {
147-
return false, "", "", err
148-
}
149-
} else {
150-
_, _, _, err := tf.runTerraformCommand(true, "workspace", envs, "new", tf.Workspace)
151-
if err != nil {
152-
return false, "", "", err
153-
}
154-
}
155137
params = append(append(append(params, "-input=false"), "-no-color"), "-detailed-exitcode")
156138
stdout, stderr, statusCode, err := tf.runTerraformCommand(true, "plan", envs, params...)
157139
if err != nil && statusCode != 2 {

‎cli/pkg/digger/digger.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ func run(command string, job orchestrator.Job, policyChecker policy.Checker, org
158158
return msg, errors.New(msg)
159159
}
160160

161-
job, err = PopulateAwsCredentialsEnvVarsForJob(&job, nil)
161+
err = job.PopulateAwsCredentialsEnvVarsForJob()
162162
if err != nil {
163163
log.Fatalf("failed to fetch AWS keys, %v", err)
164164
}

‎cli/pkg/digger/jobs.go‎

Lines changed: 0 additions & 37 deletions
This file was deleted.

‎cli/pkg/digger/jobs_test.go‎

Lines changed: 0 additions & 59 deletions
This file was deleted.

0 commit comments

Comments
 (0)