From 9f5ffd3b28b583b1386588f5f18c783cd5ca8ae4 Mon Sep 17 00:00:00 2001 From: aminsammara Date: Mon, 6 Jul 2026 09:25:06 +0000 Subject: [PATCH] feat(spartan): WIF + Artifact Registry for treasury-infra CI Adds a GitHub Actions Workload Identity pool/provider restricted to the aztec-labs-eng/treasury-infra repository, a treasury-infra-ci service account it may impersonate, and a treasury-infra Docker repository the account can write to. Lets that repo's CI push its propose-watcher image keylessly; GKE nodes already read Artifact Registry project-wide. The pool/provider names (github / treasury-infra) are referenced by the GCP_WIF_PROVIDER variable already set on the treasury-infra repo. --- .../terraform/gke-cluster/docker-registry.tf | 19 ++++++++++ spartan/terraform/gke-cluster/iam.tf | 37 +++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/spartan/terraform/gke-cluster/docker-registry.tf b/spartan/terraform/gke-cluster/docker-registry.tf index fa1f15a4d3de..09eacbc82038 100644 --- a/spartan/terraform/gke-cluster/docker-registry.tf +++ b/spartan/terraform/gke-cluster/docker-registry.tf @@ -30,3 +30,22 @@ resource "google_artifact_registry_repository_iam_member" "ci_docker_registry_wr role = "roles/artifactregistry.writer" member = "serviceAccount:${google_service_account.ci.email}" } + +# Docker repository for images built by aztec-labs-eng/treasury-infra (e.g. propose-watcher) +resource "google_artifact_registry_repository" "treasury_infra" { + project = var.project + location = var.region + repository_id = "treasury-infra" + description = "Images built by aztec-labs-eng/treasury-infra CI" + format = "DOCKER" + + depends_on = [google_project_service.artifact_registry] +} + +resource "google_artifact_registry_repository_iam_member" "treasury_infra_ci_writer" { + project = google_artifact_registry_repository.treasury_infra.project + location = google_artifact_registry_repository.treasury_infra.location + repository = google_artifact_registry_repository.treasury_infra.name + role = "roles/artifactregistry.writer" + member = "serviceAccount:${google_service_account.treasury_infra_ci.email}" +} diff --git a/spartan/terraform/gke-cluster/iam.tf b/spartan/terraform/gke-cluster/iam.tf index e7bc9cb99843..83e0c9dd9b19 100644 --- a/spartan/terraform/gke-cluster/iam.tf +++ b/spartan/terraform/gke-cluster/iam.tf @@ -108,3 +108,40 @@ data "google_iam_policy" "all_users_storage_read" { ] } } + +# CI service account for the aztec-labs-eng/treasury-infra repo (propose-watcher images) +resource "google_service_account" "treasury_infra_ci" { + account_id = "treasury-infra-ci" + display_name = "treasury-infra GitHub Actions CI" + description = "Pushes images from aztec-labs-eng/treasury-infra GitHub Actions via WIF" +} + +# Workload Identity pool for GitHub Actions OIDC tokens +resource "google_iam_workload_identity_pool" "github" { + workload_identity_pool_id = "github" + display_name = "GitHub Actions" +} + +# Trust GitHub-issued tokens, restricted to the treasury-infra repository +resource "google_iam_workload_identity_pool_provider" "treasury_infra" { + workload_identity_pool_id = google_iam_workload_identity_pool.github.workload_identity_pool_id + workload_identity_pool_provider_id = "treasury-infra" + display_name = "treasury-infra repo" + + attribute_mapping = { + "google.subject" = "assertion.sub" + "attribute.repository" = "assertion.repository" + } + attribute_condition = "assertion.repository == \"aztec-labs-eng/treasury-infra\"" + + oidc { + issuer_uri = "https://token.actions.githubusercontent.com" + } +} + +# Allow workflows from that repository to impersonate the CI service account +resource "google_service_account_iam_member" "treasury_infra_ci_wif" { + service_account_id = google_service_account.treasury_infra_ci.name + role = "roles/iam.workloadIdentityUser" + member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository/aztec-labs-eng/treasury-infra" +}