feat: switch to OIDC based auth for Terraform (#382)

liatrio · Jun 26, 2023 · 52a58d7 · 52a58d7
1 parent 6de7b27
commit 52a58d7
Show file tree

Hide file tree

Showing 5 changed files with 20 additions and 17 deletions.
diff --git a/.github/workflows/apply-prod.yml b/.github/workflows/apply-prod.yml
@@ -14,6 +14,11 @@ on:
 env:
   IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/gratibot
 
+permissions:
+  id-token: write
+  contents: read
+  packages: write
+
 jobs:
   build:
     name: Tag image
@@ -39,8 +44,6 @@ jobs:
   plan:
     name: "Terraform Prod plan"
     runs-on: ubuntu-latest
-    environment:
-      name: "prod-plan"
     needs: build
     steps:
       - name: Checkout
@@ -56,10 +59,9 @@ jobs:
           terragrunt plan
         env:
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
           ARM_TENANT_ID: "1b4a4fed-fed8-4823-a8a0-3d5cea83d122"
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_PROD_SUBSCRIPTION_ID }}
-          TF_VAR_acr_subscription_id: ${{ secrets.AZURE_PROD_SUBSCRIPTION_ID }}
+          ARM_USE_OIDC: true
           TF_VAR_gratibot_image: "${{ env.IMAGE_NAME }}:${{ needs.build.outputs.docker_tag }}"
           TF_VAR_app_token: ${{ secrets.PROD_PLAN_APP_TOKEN }}
           TF_VAR_bot_user_token: ${{ secrets.PROD_PLAN_BOT_TOKEN }}
@@ -84,10 +86,9 @@ jobs:
           terragrunt apply --terragrunt-non-interactive -auto-approve
         env:
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
           ARM_TENANT_ID: "1b4a4fed-fed8-4823-a8a0-3d5cea83d122"
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_PROD_SUBSCRIPTION_ID }}
-          TF_VAR_acr_subscription_id: ${{ secrets.AZURE_PROD_SUBSCRIPTION_ID }}
+          ARM_USE_OIDC: true
           TF_VAR_gratibot_image: "${{ env.IMAGE_NAME }}:${{ needs.build.outputs.docker_tag }}"
           TF_VAR_app_token: ${{ secrets.PROD_APP_TOKEN }}
           TF_VAR_bot_user_token: ${{ secrets.PROD_BOT_TOKEN }}

diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
@@ -8,6 +8,12 @@ on:
 env:
   IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/gratibot
 
+permissions:
+  id-token: write
+  pull-requests: write
+  contents: read
+  packages: write
+
 jobs:
   setup:
     name: Pipeline Setup
@@ -57,7 +63,6 @@ jobs:
           terragrunt validate --terragrunt-no-auto-init
         working-directory: infra/terragrunt/nonprod/gratibot/
         env:
-          TF_VAR_acr_subscription_id: ${{ secrets.AZURE_NONPROD_SUBSCRIPTION_ID }}
           TF_VAR_gratibot_image: "${{ env.IMAGE_NAME }}:${{ needs.build.outputs.docker_tag }}"
           TF_VAR_app_token: ${{ secrets.NONPROD_APP_TOKEN }}
           TF_VAR_bot_user_token: ${{ secrets.NONPROD_BOT_TOKEN }}
@@ -82,10 +87,9 @@ jobs:
         continue-on-error: true
         env:
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
           ARM_TENANT_ID: "1b4a4fed-fed8-4823-a8a0-3d5cea83d122"
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_NONPROD_SUBSCRIPTION_ID }}
-          TF_VAR_acr_subscription_id: ${{ secrets.AZURE_NONPROD_SUBSCRIPTION_ID }}
+          ARM_USE_OIDC: true
           TF_VAR_gratibot_image: "${{ env.IMAGE_NAME }}:${{ needs.build.outputs.docker_tag }}"
           TF_VAR_app_token: ${{ secrets.NONPROD_APP_TOKEN }}
           TF_VAR_bot_user_token: ${{ secrets.NONPROD_BOT_TOKEN }}

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -18,6 +18,11 @@ on:
 env:
   IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/gratibot
 
+permissions:
+  id-token: write
+  contents: write
+  packages: write
+
 jobs:
   build:
     name: Build and Publish Image
@@ -60,10 +65,9 @@ jobs:
           terragrunt apply --terragrunt-non-interactive -auto-approve
         env:
           ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
           ARM_TENANT_ID: "1b4a4fed-fed8-4823-a8a0-3d5cea83d122"
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_NONPROD_SUBSCRIPTION_ID }}
-          TF_VAR_acr_subscription_id: ${{ secrets.AZURE_NONPROD_SUBSCRIPTION_ID }}
+          ARM_USE_OIDC: true
           TF_VAR_gratibot_image: "${{ env.IMAGE_NAME }}:${{ needs.build.outputs.docker_tag }}"
           TF_VAR_app_token: ${{ secrets.NONPROD_APP_TOKEN }}
           TF_VAR_bot_user_token: ${{ secrets.NONPROD_BOT_TOKEN }}

diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf
@@ -1,5 +1,4 @@
 provider "azurerm" {
-  subscription_id = var.acr_subscription_id
   features {}
   skip_provider_registration = "true"
 }
diff --git a/infra/terraform/variables.tf b/infra/terraform/variables.tf
@@ -1,8 +1,3 @@
-variable "acr_subscription_id" {
-  description = "Azure subscription to use for Gratibot resources"
-  type        = string
-}
-
 variable "resource_group_name" {
   description = "Azure resource group for Gratibot"
   default     = "gratibot-azure-data"