Add required gcp iam with terraform

.github/workflows/build.yml

@@ -11,13 +11,15 @@ on:
       - CONTRIBUTING.md
       - CODEOWNERS
       - 'docs/**'
+      - 'terraform/**'
   pull_request:
     branches: [ "main" ]
     paths-ignore:
       - README.md
       - CONTRIBUTING.md
       - CODEOWNERS
       - 'docs/**'
+      - 'terraform/**'
 
 env:
   # Use docker.io for Docker Hub if empty

.github/workflows/techdocs.yml

@@ -5,6 +5,7 @@ on:
     paths:
      - "docs/**"
      - "mkdocs.yml"
+     - ".github/workflows/techdocs.yml"
 
 jobs:
   publish-techdocs-site:

.github/workflows/terraform.yml

@@ -0,0 +1,30 @@
+name: "Deploy to GCP"
+
+on:
+  push:
+    paths:
+        - "terraform/**"
+        - ".github/workflows/terraform.yml"
+
+jobs:
+  sandbox:
+    name: Deploy to sandbox
+    permissions:
+      # For logging on to Vault, GCP
+      id-token: write
+      # For writing comments on PR
+      pull-requests: write
+      # For fetching git repo
+      contents: read
+      # For accessing repository
+    uses: kartverket/github-workflows/.github/workflows/run-terraform.yml@v4.1.0
+    with:
+      runner: ubuntu-latest
+      environment: sandbox
+      terraform_workspace: sandbox
+      terraform_option_1: -var-file=sandbox.tfvars
+      terraform_init_option_1: -backend-config=backend-sandbox.hcl
+      working_directory: terraform
+      auth_project_number: "833464919209"
+      service_account: utviklerportal-deploy@utviklerportal-sandbox-5af9.iam.gserviceaccount.com
+      project_id: utviklerportal-sandbox-5af9

.gitignore

@@ -57,3 +57,4 @@ e2e-test-report/
 *.sqlite
 
 github-app-backstage-skip-credentials.yaml
+.terraform/

terraform/backend-sandbox.hcl

@@ -0,0 +1 @@
+bucket="terraform_state_utviklerportal_378a"

terraform/bucket.tf

@@ -0,0 +1,13 @@
+resource "random_string" "bucket_name" {
+  length  = 10
+  special = false
+  upper   = false
+}
+
+resource "google_storage_bucket" "techdocs" {
+  name                        = "techdocs${random_string.bucket_name.result}"
+  location                    = var.location
+  force_destroy               = true
+  project                     = var.gcp_project_id
+  uniform_bucket_level_access = true
+}

terraform/provider.tf

@@ -0,0 +1,14 @@
+terraform {
+  backend "gcs" {}
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "5.15.0"
+    }
+  }
+}
+
+provider "google" {
+  project = var.gcp_project_id
+  region  = var.location
+}

terraform/reader.tf

@@ -0,0 +1,31 @@
+# Creates the service account used by the backstage pod to read the techdocs bucket
+
+resource "google_service_account" "reader" {
+  account_id   = "techdocs-reader"
+  display_name = "TechDocs Reader"
+  project      = var.gcp_project_id
+}
+
+resource "google_storage_bucket_iam_binding" "reader" {
+  bucket = google_storage_bucket.techdocs.name
+  role   = "roles/storage.admin"
+  members = [
+    "serviceAccount:${google_service_account.reader.email}",
+  ]
+}
+
+resource "google_service_account_iam_binding" "kubernetes" {
+  role               = "roles/iam.workloadIdentityUser"
+  service_account_id = google_service_account.reader.name
+  members = [
+    "serviceAccount:${var.kubernetes_gcp_project_id}.svc.id.goog[${var.kubernetes_namespace}/${var.kubernetes_service_account_name}]"
+  ]
+}
+
+resource "google_service_account_iam_binding" "kubernetes_token" {
+  role               = "roles/iam.serviceAccountTokenCreator"
+  service_account_id = google_service_account.reader.name
+  members = [
+    "serviceAccount:${var.kubernetes_gcp_project_id}.svc.id.goog[${var.kubernetes_namespace}/${var.kubernetes_service_account_name}]"
+  ]
+}

terraform/sandbox.tfvars

@@ -0,0 +1,3 @@
+gcp_project_id            = "utviklerportal-sandbox-5af9"
+kubernetes_gcp_project_id = "kubernetes-sandbox-6e24"
+tf_state_bucket           = "terraform_state_utviklerportal_378a"

terraform/variables.tf

@@ -0,0 +1,29 @@
+variable "gcp_project_id" {
+  type        = string
+  description = "The GCP project to deploy into"
+}
+
+variable "kubernetes_gcp_project_id" {
+  type        = string
+  description = "The GCP project where the Kubernetes cluster is managed"
+}
+
+variable "location" {
+  type    = string
+  default = "EUROPE-NORTH1"
+}
+
+variable "kubernetes_namespace" {
+  type    = string
+  default = "backstage"
+}
+
+variable "kubernetes_service_account_name" {
+  type    = string
+  default = "backstage"
+}
+
+variable "tf_state_bucket" {
+  type        = string
+  description = "The GCS bucket to store the terraform state"
+}

terraform/writer.tf

@@ -0,0 +1,41 @@
+#Creates the service account to uploads techdocs to the bucket
+
+resource "google_service_account" "writer" {
+  account_id   = "techdocs-writer"
+  display_name = "TechDocs Writer"
+  project      = var.gcp_project_id
+}
+
+resource "google_storage_bucket_iam_binding" "writer" {
+  bucket = google_storage_bucket.techdocs.name
+  role   = "roles/storage.admin"
+  members = [
+    "serviceAccount:${google_service_account.writer.email}",
+  ]
+}
+
+resource "google_iam_workload_identity_pool" "backstage" {
+  workload_identity_pool_id = "backstage-pool"
+  description               = "pool to handle backstage service accounts"
+}
+
+resource "google_iam_workload_identity_pool_provider" "backstage" {
+  workload_identity_pool_id          = google_iam_workload_identity_pool.backstage.workload_identity_pool_id
+  workload_identity_pool_provider_id = "github-provider"
+  description                        = "Workload Identity Pool Provider managed by Terraform"
+  attribute_mapping = {
+    "google.subject"       = "assertion.sub"
+    "attribute.actor"      = "assertion.actor"
+    "attribute.aud"        = "assertion.aud"
+    "attribute.enterprise" = "assertion.enterprise"
+  }
+  oidc {
+    issuer_uri = "https://token.actions.githubusercontent.com"
+  }
+}
+
+resource "google_service_account_iam_member" "wif_backstage_writer" {
+  service_account_id = google_service_account.writer.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.backstage.name}/attribute.enteprise/kartverket"
+}