mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-02 23:31:08 +08:00
Tim BuckleyandTiago Silva
03dba137cd
* Machine ID: Terraform Cloud joining This adds a new `terraform` join method, which uses Terraform Cloud's Workload Identity OIDC provider to provide delegated joining support for Machine ID bots. As the Terraform provider now embeds tbot, this means - with some light modifications - that the Terraform provider can now join using this join method, and without any secrets. * Address some review feedback, add first batch of tests This addresses a few feedback items, defaulting the audience to the Teleport cluster name and requiring allow rules specify an organization + at least one other parameter. Also, adds a first batch of tests. * Update autogenerated CRD docs * Add tests for RegisterUsingToken and provisioning token init * Fix imports * Fix CRD docs * Update tfschema * Update tf docs * Update docstring to make it clear that `Audience` is optional * Update manifests * Update CRD docs * Code review feedback; docstring fixes * Rename lib/terraform to lib/terraformcloud * Rename terraform -> terraform_cloud Renames the new join method to terraform_cloud to make it clear that it won't work for TF running elsewhere (where other join methods should be used) * Fix tests and docs lints * Update api/proto/teleport/legacy/types/types.proto Co-authored-by: Tiago Silva <tiago.silva@goteleport.com> * Update proto artifacts --------- Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
69 lines
1.9 KiB
Go
69 lines
1.9 KiB
Go
/*
|
|
* Teleport
|
|
* Copyright (C) 2024 Gravitational, Inc.
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Affero General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
package terraformcloud
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/gravitational/trace"
|
|
)
|
|
|
|
type envGetter func(key string) string
|
|
|
|
// IDTokenSource allows a Terraform Workload ID token to be fetched whilst
|
|
// within a Terraform Cloud execution.
|
|
type IDTokenSource struct {
|
|
audienceTag string
|
|
|
|
getEnv envGetter
|
|
}
|
|
|
|
// GetIDToken fetches a Terraform Cloud JWT from the local node's environment
|
|
func (its *IDTokenSource) GetIDToken() (string, error) {
|
|
name := "TFC_WORKLOAD_IDENTITY_TOKEN"
|
|
if its.audienceTag != "" {
|
|
name = fmt.Sprintf("TFC_WORKLOAD_IDENTITY_TOKEN_%s", strings.ToUpper(its.audienceTag))
|
|
}
|
|
|
|
tok := its.getEnv(name)
|
|
if tok == "" {
|
|
audienceName := "TFC_WORKLOAD_IDENTITY_AUDIENCE"
|
|
if its.audienceTag != "" {
|
|
audienceName = fmt.Sprintf("TFC_WORKLOAD_IDENTITY_AUDIENCE_%s", strings.ToUpper(its.audienceTag))
|
|
}
|
|
|
|
return "", trace.BadParameter(
|
|
"%s environment variable missing, ensure the corresponding %s variable is set in the workspace",
|
|
name, audienceName,
|
|
)
|
|
}
|
|
|
|
return tok, nil
|
|
}
|
|
|
|
// NewIDTokenSource creates a new TFC ID token source with the given audience
|
|
// tag.
|
|
func NewIDTokenSource(audienceTag string, getEnv envGetter) *IDTokenSource {
|
|
return &IDTokenSource{
|
|
audienceTag,
|
|
getEnv,
|
|
}
|
|
}
|