From 51f34c9a640a815ba851c3cb8bc75881441f98e3 Mon Sep 17 00:00:00 2001 From: Conrad Kramer Date: Sun, 7 Jun 2026 13:34:53 -0700 Subject: [PATCH] Use client-only WIF runner grants --- infra/identity/README.md | 5 ++--- infra/identity/terraform.tfvars.example | 2 +- infra/identity/variables.tf | 4 ++-- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/infra/identity/README.md b/infra/identity/README.md index ebc1123..e370095 100644 --- a/infra/identity/README.md +++ b/infra/identity/README.md @@ -17,9 +17,8 @@ It may manage: - a non-exportable software KMS signing key for Sparkle Ed25519 appcast signatures (`sparkle-ed25519`) - an Authentik-backed WIF pool/provider for Forgejo runners -- the runner service account and its narrow IAM bindings for the - `burrow-automation` group and the Authentik WIF client ID - `google-wif.burrow.net` +- the runner service account and its narrow IAM binding for the Authentik WIF + client ID `google-wif.burrow.net`; human/group grants are opt-in It must not manage: diff --git a/infra/identity/terraform.tfvars.example b/infra/identity/terraform.tfvars.example index caeb7ca..7411302 100644 --- a/infra/identity/terraform.tfvars.example +++ b/infra/identity/terraform.tfvars.example @@ -11,5 +11,5 @@ manage_google_runner_service_account = false google_wif_issuer_uri = "https://auth.burrow.net/application/o/google-cloud/" google_wif_allowed_audiences = ["google-wif.burrow.net"] -google_wif_runner_group = "burrow-automation" +google_wif_runner_group = "" google_wif_runner_client_id = "google-wif.burrow.net" diff --git a/infra/identity/variables.tf b/infra/identity/variables.tf index 86f4820..c88b52a 100644 --- a/infra/identity/variables.tf +++ b/infra/identity/variables.tf @@ -177,9 +177,9 @@ variable "google_wif_allowed_audiences" { } variable "google_wif_runner_group" { - description = "Mapped Authentik group allowed to assume the runner service account. Empty allows the whole pool." + description = "Mapped Authentik group allowed to assume the runner service account. Leave empty for machine-to-machine client credentials." type = string - default = "burrow-automation" + default = "" } variable "google_wif_runner_client_id" {