Use client-only WIF runner grants

infra/identity/README.md

@@ -17,9 +17,8 @@ It may manage:
 - a non-exportable software KMS signing key for Sparkle Ed25519 appcast
   signatures (`sparkle-ed25519`)
 - an Authentik-backed WIF pool/provider for Forgejo runners
-- the runner service account and its narrow IAM bindings for the
+- the runner service account and its narrow IAM binding for the Authentik WIF
-  `burrow-automation` group and the Authentik WIF client ID
+  client ID `google-wif.burrow.net`; human/group grants are opt-in
-  `google-wif.burrow.net`
 
 It must not manage:
 

infra/identity/terraform.tfvars.example

@@ -11,5 +11,5 @@ manage_google_runner_service_account = false
 
 google_wif_issuer_uri        = "https://auth.burrow.net/application/o/google-cloud/"
 google_wif_allowed_audiences = ["google-wif.burrow.net"]
-google_wif_runner_group      = "burrow-automation"
+google_wif_runner_group      = ""
 google_wif_runner_client_id  = "google-wif.burrow.net"

infra/identity/variables.tf

@@ -177,9 +177,9 @@ variable "google_wif_allowed_audiences" {
 }
 
 variable "google_wif_runner_group" {
-  description = "Mapped Authentik group allowed to assume the runner service account. Empty allows the whole pool."
+  description = "Mapped Authentik group allowed to assume the runner service account. Leave empty for machine-to-machine client credentials."
   type        = string
-  default     = "burrow-automation"
+  default     = ""
 }
 
 variable "google_wif_runner_client_id" {