Skip to content

Commit 73832b9

Browse files
dylanratcliffedylanratcliffe
committed
Fixed env0 gcp auth
1 parent d6e04da commit 73832b9

12 files changed

Lines changed: 90 additions & 52 deletions

File tree

‎env0.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,21 @@
11
version: 2
2+
shell: bash
23

34
deploy:
45
steps:
6+
setupVariables:
7+
after:
8+
- name: Configure GCP OIDC credentials
9+
run: |
10+
CRED_FILE="${ENV0_TEMPLATE_PATH:-$ENV0_ROOT_DIR}/env0_credential_configuration.json"
11+
if [ -f "$CRED_FILE" ]; then
12+
echo "GOOGLE_APPLICATION_CREDENTIALS=$CRED_FILE" >> "$ENV0_ENV"
13+
echo "GOOGLE_APPLICATION_CREDENTIALS set to $CRED_FILE"
14+
else
15+
echo "WARNING: GCP OIDC credential file not found at $CRED_FILE." 1>&2
16+
echo "Attach a 'GCP OIDC' deployment credential in env0 to enable GCP authentication." 1>&2
17+
fi
18+
519
terraformPlan:
620
after:
721
- name: Submit Plan to Overmind

‎modules/agm-talk/main.tf‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@ resource "aws_iam_role" "lambda" {
4747
assume_role_policy = jsonencode({
4848
Version = "2012-10-17"
4949
Statement = [{
50-
Action = "sts:AssumeRole"
51-
Effect = "Allow"
50+
Action = "sts:AssumeRole"
51+
Effect = "Allow"
5252
Principal = { Service = "lambda.amazonaws.com" }
5353
}]
5454
})
@@ -106,10 +106,10 @@ resource "aws_cloudfront_origin_request_policy" "forward_all" {
106106
# CloudFront distribution
107107
# -----------------------------------------------------------------------------
108108
resource "aws_cloudfront_distribution" "app" {
109-
enabled = true
110-
comment = "${var.prefix} — Loom session leak replication"
111-
is_ipv6_enabled = true
112-
wait_for_deployment = true
109+
enabled = true
110+
comment = "${var.prefix} — Loom session leak replication"
111+
is_ipv6_enabled = true
112+
wait_for_deployment = true
113113

114114
origin {
115115
domain_name = replace(replace(aws_lambda_function_url.app.function_url, "https://", ""), "/", "")

‎outputs.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,28 @@ output "gcp_service_account_email" {
1313
value = google_service_account.deploy.email
1414
}
1515

16+
# Paste the value of this output when creating a "GCP OIDC" deployment
17+
# credential in env0 (Organization Settings -> Credentials -> New -> GCP OIDC).
18+
# It mirrors the JSON that GCP's "Configure your application" wizard would
19+
# produce, but built from the Terraform-managed pool/provider/SA above so it
20+
# stays in sync.
21+
output "env0_gcp_oidc_credential_json" {
22+
description = "JSON to paste into the env0 'GCP OIDC' deployment credential."
23+
value = var.example_env == "terraform-example" ? jsonencode({
24+
type = "external_account"
25+
audience = "//iam.googleapis.com/${google_iam_workload_identity_pool_provider.env0[0].name}"
26+
subject_token_type = "urn:ietf:params:oauth:token-type:jwt"
27+
token_url = "https://sts.googleapis.com/v1/token"
28+
service_account_impersonation_url = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${google_service_account.deploy.email}:generateAccessToken"
29+
credential_source = {
30+
file = "env0-oidc-token.txt"
31+
format = {
32+
type = "text"
33+
}
34+
}
35+
}) : null
36+
}
37+
1638
# API Server outputs
1739
output "api_server_url" {
1840
description = "URL to access the API server"

‎scale-test/central_resources.tf‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ resource "aws_sns_topic_subscription" "central_to_us_east_1" {
9292
# us-west-2 SQS -> Central SNS
9393
resource "aws_sns_topic_subscription" "central_to_us_west_2" {
9494
count = local.enable_aws ? length(module.aws_us_west_2[0].sqs_queue_arns) : 0
95-
provider = aws.us_east_1 # Subscription created in SNS region
95+
provider = aws.us_east_1 # Subscription created in SNS region
9696

9797
topic_arn = aws_sns_topic.central[0].arn
9898
protocol = "sqs"
@@ -227,11 +227,11 @@ resource "aws_s3_bucket_policy" "scenario_central_s3" {
227227
]
228228
},
229229
{
230-
Sid = "ScenarioDenyDelete"
231-
Effect = "Deny"
230+
Sid = "ScenarioDenyDelete"
231+
Effect = "Deny"
232232
Principal = "*"
233-
Action = "s3:DeleteObject"
234-
Resource = "${aws_s3_bucket.central[0].arn}/*"
233+
Action = "s3:DeleteObject"
234+
Resource = "${aws_s3_bucket.central[0].arn}/*"
235235
}
236236
]
237237
})

‎scale-test/main.tf‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -155,10 +155,10 @@ module "aws_us_east_1" {
155155

156156
enable_ec2 = var.enable_ec2_instances
157157
enable_lambda = var.enable_lambda_functions
158-
ec2_instance_type = local.scenario_instance_type # Scenario-aware
158+
ec2_instance_type = local.scenario_instance_type # Scenario-aware
159159
ebs_volume_size = var.ebs_volume_size
160160
lambda_memory = var.lambda_memory_size
161-
lambda_timeout = local.scenario_lambda_timeout # Scenario-aware
161+
lambda_timeout = local.scenario_lambda_timeout # Scenario-aware
162162

163163
# Central resources for cross-region connectivity
164164
central_bucket_name = local.enable_aws ? aws_s3_bucket.central[0].id : ""
@@ -186,10 +186,10 @@ module "aws_us_west_2" {
186186

187187
enable_ec2 = var.enable_ec2_instances
188188
enable_lambda = var.enable_lambda_functions
189-
ec2_instance_type = local.scenario_instance_type # Scenario-aware
189+
ec2_instance_type = local.scenario_instance_type # Scenario-aware
190190
ebs_volume_size = var.ebs_volume_size
191191
lambda_memory = var.lambda_memory_size
192-
lambda_timeout = local.scenario_lambda_timeout # Scenario-aware
192+
lambda_timeout = local.scenario_lambda_timeout # Scenario-aware
193193

194194
# Central resources for cross-region connectivity
195195
central_bucket_name = local.enable_aws ? aws_s3_bucket.central[0].id : ""
@@ -217,10 +217,10 @@ module "aws_eu_west_1" {
217217

218218
enable_ec2 = var.enable_ec2_instances
219219
enable_lambda = var.enable_lambda_functions
220-
ec2_instance_type = local.scenario_instance_type # Scenario-aware
220+
ec2_instance_type = local.scenario_instance_type # Scenario-aware
221221
ebs_volume_size = var.ebs_volume_size
222222
lambda_memory = var.lambda_memory_size
223-
lambda_timeout = local.scenario_lambda_timeout # Scenario-aware
223+
lambda_timeout = local.scenario_lambda_timeout # Scenario-aware
224224

225225
# Central resources for cross-region connectivity
226226
central_bucket_name = local.enable_aws ? aws_s3_bucket.central[0].id : ""
@@ -248,10 +248,10 @@ module "aws_ap_southeast_1" {
248248

249249
enable_ec2 = var.enable_ec2_instances
250250
enable_lambda = var.enable_lambda_functions
251-
ec2_instance_type = local.scenario_instance_type # Scenario-aware
251+
ec2_instance_type = local.scenario_instance_type # Scenario-aware
252252
ebs_volume_size = var.ebs_volume_size
253253
lambda_memory = var.lambda_memory_size
254-
lambda_timeout = local.scenario_lambda_timeout # Scenario-aware
254+
lambda_timeout = local.scenario_lambda_timeout # Scenario-aware
255255

256256
# Central resources for cross-region connectivity
257257
central_bucket_name = local.enable_aws ? aws_s3_bucket.central[0].id : ""
@@ -283,8 +283,8 @@ module "gcp_us_central1" {
283283
unique_suffix = local.unique_suffix
284284
common_labels = local.common_tags
285285

286-
enable_gce = var.enable_ec2_instances # Reuse EC2 toggle for GCE
287-
enable_functions = var.enable_lambda_functions # Reuse Lambda toggle for Cloud Functions
286+
enable_gce = var.enable_ec2_instances # Reuse EC2 toggle for GCE
287+
enable_functions = var.enable_lambda_functions # Reuse Lambda toggle for Cloud Functions
288288
machine_type = local.scenario_gce_machine_type
289289
function_timeout = local.scenario_function_timeout
290290

‎scale-test/modules/aws/compute.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ resource "aws_instance" "scale_test" {
2121
# Use shared security groups (creates relationship density)
2222
# HIGH FAN-OUT: All instances attach to the shared high_fanout SG
2323
vpc_security_group_ids = [
24-
aws_security_group.high_fanout.id, # Shared SG for high fan-out testing
24+
aws_security_group.high_fanout.id, # Shared SG for high fan-out testing
2525
aws_security_group.shared[count.index % length(aws_security_group.shared)].id
2626
]
2727

‎scale-test/modules/aws/outputs.tf‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -143,22 +143,22 @@ output "resource_summary" {
143143
counts = {
144144
vpc = 1
145145
subnets = length(aws_subnet.public) + length(aws_subnet.private)
146-
security_groups = length(aws_security_group.shared) + 1 # +1 for high_fanout SG
146+
security_groups = length(aws_security_group.shared) + 1 # +1 for high_fanout SG
147147
ec2_instances = var.enable_ec2 ? length(aws_instance.scale_test) : 0
148148
lambda_functions = var.enable_lambda ? length(aws_lambda_function.scale_test) : 0
149149
sqs_queues = length(aws_sqs_queue.scale_test)
150150
sqs_dlqs = length(aws_sqs_queue.dlq)
151151
sns_topics = length(aws_sns_topic.scale_test)
152152
s3_buckets = length(aws_s3_bucket.scale_test)
153153
ssm_parameters = length(aws_ssm_parameter.scale_test) + length(aws_ssm_parameter.secure)
154-
iam_roles = length(aws_iam_role.lambda_execution) + 2 # +1 EC2 role, +1 high_fanout
154+
iam_roles = length(aws_iam_role.lambda_execution) + 2 # +1 EC2 role, +1 high_fanout
155155
cloudwatch_groups = length(aws_cloudwatch_log_group.scale_test) + (var.enable_lambda ? length(aws_cloudwatch_log_group.lambda) : 0)
156156
}
157157
high_fanout = {
158-
shared_sg_id = aws_security_group.high_fanout.id
159-
shared_lambda_role = aws_iam_role.high_fanout_lambda.name
160-
ec2_attached_to_sg = var.enable_ec2 ? length(aws_instance.scale_test) : 0
161-
lambdas_using_role = var.enable_lambda ? length(aws_lambda_function.scale_test) : 0
158+
shared_sg_id = aws_security_group.high_fanout.id
159+
shared_lambda_role = aws_iam_role.high_fanout_lambda.name
160+
ec2_attached_to_sg = var.enable_ec2 ? length(aws_instance.scale_test) : 0
161+
lambdas_using_role = var.enable_lambda ? length(aws_lambda_function.scale_test) : 0
162162
}
163163
}
164164
}

‎scale-test/modules/gcp/main.tf‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ locals {
2020

2121
# Regional resource counts (distribute across regions)
2222
regional_count = {
23-
gce_instances = ceil(var.resource_counts.ec2_instances / 4)
24-
functions = ceil(var.resource_counts.lambda_functions / 4)
25-
pubsub_topics = ceil(var.resource_counts.sns_topics / 4)
26-
pubsub_subs = ceil(var.resource_counts.sqs_queues / 4)
27-
gcs_buckets = ceil(var.resource_counts.s3_buckets / 4)
28-
secrets = ceil(var.resource_counts.ssm_parameters / 4)
29-
firewall_rules = ceil(var.resource_counts.security_groups / 4)
23+
gce_instances = ceil(var.resource_counts.ec2_instances / 4)
24+
functions = ceil(var.resource_counts.lambda_functions / 4)
25+
pubsub_topics = ceil(var.resource_counts.sns_topics / 4)
26+
pubsub_subs = ceil(var.resource_counts.sqs_queues / 4)
27+
gcs_buckets = ceil(var.resource_counts.s3_buckets / 4)
28+
secrets = ceil(var.resource_counts.ssm_parameters / 4)
29+
firewall_rules = ceil(var.resource_counts.security_groups / 4)
3030
}
3131

3232
# Common labels with region - GCP requires lowercase label keys

‎scale-test/modules/gcp/network.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ resource "google_compute_subnetwork" "private" {
3838
region = var.region
3939
ip_cidr_range = "${local.subnet_prefix}.${100 + count.index * 10}.0/24"
4040

41-
description = "Private subnet ${count.index + 1}"
42-
private_ip_google_access = true
41+
description = "Private subnet ${count.index + 1}"
42+
private_ip_google_access = true
4343
}
4444

4545
# -----------------------------------------------------------------------------

‎scale-test/modules/gcp/outputs.tf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -108,15 +108,15 @@ output "secret_ids" {
108108

109109
output "resource_summary" {
110110
value = {
111-
region = var.region
112-
vpc = google_compute_network.main.name
113-
gce_instances = length(google_compute_instance.scale_test)
114-
cloud_functions = length(google_cloudfunctions2_function.scale_test)
115-
pubsub_topics = length(google_pubsub_topic.scale_test)
116-
pubsub_subs = length(google_pubsub_subscription.scale_test)
117-
gcs_buckets = length(google_storage_bucket.scale_test)
118-
secrets = length(google_secret_manager_secret.scale_test)
119-
firewall_rules = length(google_compute_firewall.per_instance) + 3 # +3 for high_fanout, ssh, egress
111+
region = var.region
112+
vpc = google_compute_network.main.name
113+
gce_instances = length(google_compute_instance.scale_test)
114+
cloud_functions = length(google_cloudfunctions2_function.scale_test)
115+
pubsub_topics = length(google_pubsub_topic.scale_test)
116+
pubsub_subs = length(google_pubsub_subscription.scale_test)
117+
gcs_buckets = length(google_storage_bucket.scale_test)
118+
secrets = length(google_secret_manager_secret.scale_test)
119+
firewall_rules = length(google_compute_firewall.per_instance) + 3 # +3 for high_fanout, ssh, egress
120120
}
121121
description = "Summary of resources created in this region"
122122
}

0 commit comments

Comments
 (0)