Add a datasource for retrieving the client email from OpenID Connect #1422
Conversation
|
Hi! I'm the modular magician, I work on Magic Modules. Pull request statusesNo diff detected in Ansible. New Pull RequestsI built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed. |
|
Hi! I'm the modular magician, I work on Magic Modules. Pull request statusesterraform-provider-google-beta already has an open PR. New Pull RequestsI didn't open any new pull requests because of this PR. |
|
I'm leery of this, but open to being pragmatic about it. I dislike adding non-GCP resources, because people are going to want to expand our scope to include all sorts of things, and our answer has always been it's a GCP-specific provider. The purist answer is a separate provider should be made, maybe an OpenID provider or a Google Identity provider or something. But all my arguments are around precedents, and I'm not sure I want precedents to stand in the way of user benefits. |
… of the provider's Google identity.
Tracked submodules are build/terraform-beta build/terraform build/ansible build/inspec.
modular-magician
force-pushed
the
datasource-openid-userinfo
branch
from
90bb6b2 to
f722077
Compare
|
|
||
| subject { | ||
| kind = "User" | ||
| name = "${data.google_client_openid_useremail.provider_identity.email}" |
Alright, so this one is a bit of a departure from our regularly scheduled programming. This isn't a GCP API, but is a Google API.
We have no way right now to tell what account email is being used to interact with GCP; this is especially important when using Terraform in a CI system and the user hasn't manually defined their service account.
Provided the user has specified the necessary oauth scope, datasource uses a well-known OpenID / Oauth2 endpoint we [Google] publish to retrieve the email tied to the user's credentials.
While getting this normally isn't important for interacting with GCP- GCP is already able to tell your email even w/o the scope- it is important at the crossover point from GKE -> K8S when using OpenID auth; to bootstrap K8S inside a GKE cluster, users using the recommended auth system (OpenID/IAM auth) need to define rolebindings against their GCP email.
So, instead of requiring that to be defined by hand, this datasource lets us figure that out in the Google provider and pass that information on into the rest of our Terraform config.
[all]
[terraform]
[terraform-beta]
[ansible]
[inspec]