Merge pull request #511 from overmindtech/gcp-demo

Gcp demo

Author: dylanratcliffe

.devcontainer/devcontainer.json

@@ -7,14 +7,16 @@
 	// Features to add to the dev container. More info: https://containers.dev/features.
 	"features": {
 		"ghcr.io/devcontainers/features/aws-cli:1": {},
+		"ghcr.io/devcontainers/features/gcloud:1": {},
 		"ghcr.io/devcontainers/features/terraform:1": {}
 	},
 	// Configure tool-specific properties.
 	"customizations": {
 		"vscode": {
 			"extensions": [
 				"github.vscode-github-actions",
-				"hashicorp.terraform"
+				"hashicorp.terraform",
+				"googlecloudplatform.gcp-vscode"
 			]
 		}
 	}
@@ -24,5 +26,6 @@
 	// },
 	// "mounts": [
 	// 	"source=${localEnv:HOME}${localEnv:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
+	// 	"source=${localEnv:HOME}${localEnv:USERPROFILE}/.config/gcloud,target=/home/vscode/.config/gcloud,type=bind"
 	// ]
 }

.github/actions/terraform_init/action.yml

@@ -7,6 +7,12 @@ inputs:
   terraform_workspace:
     description: "The Terraform workspace to use (optional)"
     required: false
+  gcp_workload_identity_provider:
+    description: "GCP Workload Identity Provider resource name for OIDC auth"
+    required: true
+  gcp_service_account:
+    description: "GCP service account email to impersonate via WIF"
+    required: true
 
 runs:
   using: "composite"
@@ -29,6 +35,12 @@ runs:
         aws-region: eu-west-2
         role-to-assume: ${{ inputs.terraform_deploy_role }}
 
+    - name: Configure GCP Credentials
+      uses: google-github-actions/auth@v3
+      with:
+        workload_identity_provider: ${{ inputs.gcp_workload_identity_provider }}
+        service_account: ${{ inputs.gcp_service_account }}
+
     - name: Terraform Init
       id: init
       shell: bash

.github/workflows/automatic.yml

@@ -32,6 +32,8 @@ jobs:
         with:
           terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }}
           terraform_workspace: terraform-example
+          gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
 
       - name: Download terraform plan
         uses: actions/download-artifact@v8
@@ -70,6 +72,8 @@ jobs:
         with:
           terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }}
           terraform_workspace: terraform-example
+          gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
 
       - name: Terraform Validate
         if: github.event.action != 'closed'
@@ -153,6 +157,8 @@ jobs:
         with:
           terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }}
           terraform_workspace: terraform-example
+          gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
 
       - name: Terraform Plan for Cost Analysis
         id: plan-cost

.github/workflows/manual.yml

@@ -20,6 +20,8 @@ jobs:
         with:
           terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }}
           terraform_workspace: terraform-example
+          gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
 
       - name: Terraform Plan
         id: plan

.github/workflows/signals-demo.yml

@@ -113,6 +113,8 @@ jobs:
         with:
           terraform_deploy_role: ${{ vars.TERRAFORM_DEPLOY_ROLE }}
           terraform_workspace: terraform-example
+          gcp_workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          gcp_service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
 
       - name: Terraform Plan
         run: terraform plan -out=tfplan

.terraform.lock.hcl

@@ -250,6 +250,14 @@ module "agm_talk" {
   source = "./modules/agm-talk"
 }
 
+# Simple GCS bucket to validate GCP provider connectivity in CI
+resource "google_storage_bucket" "test" {
+  name                        = "${var.gcp_project_id}-tf-test"
+  location                    = var.gcp_region
+  force_destroy               = true
+  uniform_bucket_level_access = true
+}
+
 module "api_access" {
   count  = var.enable_api_access ? 1 : 0
   source = "./modules/signals-demo"

main.tf

@@ -2,6 +2,17 @@
 #   value = aws_iam_role.deploy_role.arn
 # }
 
+# GCP Workload Identity Federation outputs (needed for CI platform configuration)
+output "gcp_workload_identity_provider" {
+  description = "Full resource name of the GitHub Actions WIF provider (for google-github-actions/auth)"
+  value       = google_iam_workload_identity_pool_provider.github.name
+}
+
+output "gcp_service_account_email" {
+  description = "Email of the GCP deploy service account"
+  value       = google_service_account.deploy.email
+}
+
 # API Server outputs
 output "api_server_url" {
   description = "URL to access the API server"

outputs.tf

@@ -5,6 +5,11 @@ provider "aws" {
   region = "eu-west-2"
 }
 
+provider "google" {
+  project = var.gcp_project_id
+  region  = var.gcp_region
+}
+
 # Disable this temporarily during bootstrapping and use `terraform init
 # -migrate-state` to migrate the local state into S3 after all resources have
 # been deployed
@@ -17,6 +22,10 @@ terraform {
       # we expect this to be fixed over the coming weeks, as of 23/6/2025
       version = "< 6.38"
     }
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 6.0"
+    }
     archive = {
       source  = "hashicorp/archive"
       version = "~> 2.0"
@@ -287,3 +296,146 @@ resource "aws_iam_openid_connect_provider" "env0" {
   client_id_list  = ["hoMiq9PdkRh9LUvVpH4wIErWg50VSG1b"]
   thumbprint_list = [data.tls_certificate.env0.certificates[0].sha1_fingerprint]
 }
+
+# =============================================================================
+# GCP Workload Identity Federation
+# Mirrors the AWS OIDC provider + deploy role pattern above.
+# See https://cloud.google.com/iam/docs/workload-identity-federation
+# =============================================================================
+
+resource "google_iam_workload_identity_pool" "deploy" {
+  workload_identity_pool_id = "${var.example_env}-deploy"
+  display_name              = "Deploy Pool (${var.example_env})"
+  description               = "Workload Identity Pool for CI/CD platforms to deploy infrastructure"
+}
+
+# GitHub Actions OIDC provider
+resource "google_iam_workload_identity_pool_provider" "github" {
+  workload_identity_pool_id          = google_iam_workload_identity_pool.deploy.workload_identity_pool_id
+  workload_identity_pool_provider_id = "github-actions"
+  display_name                       = "GitHub Actions"
+
+  attribute_mapping = {
+    "google.subject"       = "assertion.sub"
+    "attribute.actor"      = "assertion.actor"
+    "attribute.repository" = "assertion.repository"
+  }
+
+  attribute_condition = "assertion.repository == 'overmindtech/terraform-example'"
+
+  oidc {
+    issuer_uri = "https://token.actions.githubusercontent.com"
+  }
+}
+
+# Terraform Cloud OIDC provider
+resource "google_iam_workload_identity_pool_provider" "tfc" {
+  count = var.example_env == "terraform-example" ? 1 : 0
+
+  workload_identity_pool_id          = google_iam_workload_identity_pool.deploy.workload_identity_pool_id
+  workload_identity_pool_provider_id = "terraform-cloud"
+  display_name                       = "Terraform Cloud"
+
+  attribute_mapping = {
+    "google.subject"                   = "assertion.sub"
+    "attribute.terraform_workspace"    = "assertion.terraform_workspace_name"
+    "attribute.terraform_organization" = "assertion.terraform_organization_name"
+  }
+
+  attribute_condition = "assertion.terraform_organization_name == 'Overmind'"
+
+  oidc {
+    issuer_uri        = "https://app.terraform.io"
+    allowed_audiences = ["gcp.workload.identity"]
+  }
+}
+
+# env0 OIDC provider
+resource "google_iam_workload_identity_pool_provider" "env0" {
+  count = var.example_env == "terraform-example" ? 1 : 0
+
+  workload_identity_pool_id          = google_iam_workload_identity_pool.deploy.workload_identity_pool_id
+  workload_identity_pool_provider_id = "env0"
+  display_name                       = "env0"
+
+  attribute_mapping = {
+    "google.subject" = "assertion.sub"
+  }
+
+  oidc {
+    issuer_uri        = "https://login.app.env0.com/"
+    allowed_audiences = ["https://prod.env0.com"]
+  }
+}
+
+# Spacelift OIDC provider
+resource "google_iam_workload_identity_pool_provider" "spacelift" {
+  count = var.example_env == "terraform-example" ? 1 : 0
+
+  workload_identity_pool_id          = google_iam_workload_identity_pool.deploy.workload_identity_pool_id
+  workload_identity_pool_provider_id = "spacelift"
+  display_name                       = "Spacelift"
+
+  attribute_mapping = {
+    "google.subject"        = "assertion.sub"
+    "attribute.space"       = "assertion.spaceId"
+    "attribute.stack"       = "assertion.callerId"
+    "attribute.caller_type" = "assertion.callerType"
+  }
+
+  oidc {
+    issuer_uri = "https://overmindtech.app.spacelift.io"
+  }
+}
+
+# Deploy service account (GCP equivalent of aws_iam_role.deploy_role)
+resource "google_service_account" "deploy" {
+  account_id   = "${var.example_env}-deploy"
+  display_name = "Terraform Deploy (${var.example_env})"
+  description  = "Service account used by CI/CD platforms to deploy infrastructure via Workload Identity Federation"
+}
+
+resource "google_project_iam_member" "deploy_editor" {
+  project = var.gcp_project_id
+  role    = "roles/editor"
+  member  = "serviceAccount:${google_service_account.deploy.email}"
+}
+
+# Allow the Workload Identity Pool to impersonate the deploy service account
+resource "google_service_account_iam_member" "github_wif" {
+  service_account_id = google_service_account.deploy.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.deploy.name}/attribute.repository/overmindtech/terraform-example"
+}
+
+resource "google_service_account_iam_member" "tfc_wif" {
+  count = var.example_env == "terraform-example" ? 1 : 0
+
+  service_account_id = google_service_account.deploy.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.deploy.name}/attribute.terraform_organization/Overmind"
+}
+
+resource "google_service_account_iam_member" "env0_wif" {
+  count = var.example_env == "terraform-example" ? 1 : 0
+
+  service_account_id = google_service_account.deploy.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.deploy.name}/*"
+  condition {
+    title      = "env0-provider-only"
+    expression = "request.auth.claims.iss == 'https://login.app.env0.com/'"
+  }
+}
+
+resource "google_service_account_iam_member" "spacelift_wif" {
+  count = var.example_env == "terraform-example" ? 1 : 0
+
+  service_account_id = google_service_account.deploy.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.deploy.name}/*"
+  condition {
+    title      = "spacelift-provider-only"
+    expression = "request.auth.claims.iss == 'https://overmindtech.app.spacelift.io'"
+  }
+}

terraform.tf

@@ -0,0 +1 @@
+gcp_project_id = "overmind-terraform-example"