hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Fix WIF provider groups mapping
Some checks failed
Build Rust / Cargo Test (push) Successful in 4m1s
Details
Build Site / Next.js Build (push) Failing after 5s
Details
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 4s
Details
Lint Governance / BEP Metadata (push) Successful in 1s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 13:54:02 -07:00
parent 51f34c9a64
commit 5276b57c4d
2 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
infra/identity/google.tf
View file

@ -19,7 +19,7 @@ locals {
google_runner_wif_group_members = var.google_wif_runner_group != "" ? ( google_runner_wif_group_members = var.google_wif_runner_group != "" ? (
toset([ toset([
"principalSet://iam.googleapis.com/projects/${var.google_project_number}/locations/global/workloadIdentityPools/${var.google_wif_pool_id}/attribute.burrow_groups/${var.google_wif_runner_group}" "principalSet://iam.googleapis.com/projects/${var.google_project_number}/locations/global/workloadIdentityPools/${var.google_wif_pool_id}/group/${var.google_wif_runner_group}"
]) ])
) : ( ) : (
toset([]) toset([])
@ -142,7 +142,6 @@ resource "google_iam_workload_identity_pool_provider" "forgejo_runners" {
"attribute.burrow_subject" = "assertion.sub" "attribute.burrow_subject" = "assertion.sub"
"attribute.burrow_username" = "assertion.preferred_username" "attribute.burrow_username" = "assertion.preferred_username"
"attribute.burrow_email" = "assertion.email" "attribute.burrow_email" = "assertion.email"
"attribute.burrow_groups" = "assertion.groups"
"attribute.burrow_client_id" = "assertion.azp" "attribute.burrow_client_id" = "assertion.azp"
} }

2
infra/identity/variables.tf
View file

@ -177,7 +177,7 @@ variable "google_wif_allowed_audiences" {
} }
variable "google_wif_runner_group" { variable "google_wif_runner_group" {
description = "Mapped Authentik group allowed to assume the runner service account. Leave empty for machine-to-machine client credentials." description = "Google groups principal allowed to assume the runner service account. Leave empty for machine-to-machine client credentials."
type = string type = string
default = "" default = ""
} }