GCP Dynamic provider credentials support

[alfespa17]

Adding support to use gcp dynami provider credential support:

Inside our GCP project we need to do the following:

Add a new workload identity federation

Add a name to the identity pool.

Select OIDC , add a provider name, use the terrakube api for the issuer URL and leave the default audience

Setup the provider attributes

the attribute mapping should look like the following:

OIDC 1:

assertion.sub

Condition CEL

assertion.sub.startsWith("organization:TERRAKUBE_ORGANIZATION_NAME:workspace:TERRAKUBE_WORKSPACE_NAME")

Once created we can copy the audience and just remove the "https:"

Finally we need to grant access to one particular gcp service account.

We need to define the following env variables inside the workspace configuration:

• ENABLE_DYNAMIC_CREDENTIALS_GCP=true
• WORKLOAD_IDENTITY_SERVICE_ACCOUNT_EMAIL=xxxx@xxxx.iam.gserviceaccount.com
• WORKLOAD_IDENTITY_AUDIENCE_GCP=//iam.googleapis.com/projects/{{PROJECT-NUMBER}}/locations/global/workloadIdentityPools/{{PROJECT_NAME}}/providers/{{PROVIDER}}

Example:

user@pop-os:~/git/dynamic_creds$ terraform init

Initializing Terraform Cloud...

Initializing provider plugins...
- Finding latest version of hashicorp/google...
- Installing hashicorp/google v5.26.0...
- Installed hashicorp/google v5.26.0 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform Cloud has been successfully initialized!

You may now begin working with Terraform Cloud. Try running "terraform plan" to
see any changes that are required for your infrastructure.

If you ever set or change modules or Terraform Settings, run "terraform init"
again to reinitialize your working directory.
user@pop-os:~/git/dynamic_creds$ terraform apply

Running apply in Terraform Cloud. Output will stream here. Pressing Ctrl-C
will cancel the remote apply if it's still pending. If the apply started it
will stop streaming the logs, but will not stop the apply running remotely.

Preparing the remote apply...

To view this run in a browser, visit:
https://8080-azbuilder-terrakube-2vs2w68kc0p.ws-us110.gitpod.io/app/simple/simple/runs/3

Waiting for the plan to start...

***************************************
Running Terraform PLAN
***************************************

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # google_storage_bucket.auto-expire will be created
  + resource "google_storage_bucket" "auto-expire" {
      + effective_labels            = (known after apply)
      + force_destroy               = true
      + id                          = (known after apply)
      + location                    = "US"
      + name                        = "asdfadsfqerqer1fgsdfgt"
      + project                     = (known after apply)
      + project_number              = (known after apply)
      + public_access_prevention    = "enforced"
      + rpo                         = (known after apply)
      + self_link                   = (known after apply)
      + storage_class               = "STANDARD"
      + terraform_labels            = (known after apply)
      + uniform_bucket_level_access = (known after apply)
      + url                         = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.


Do you want to perform these actions in workspace "simple"?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

google_storage_bucket.auto-expire: Creating...
google_storage_bucket.auto-expire: Creation complete after 1s [id=asdfadsfqerqer1fgsdfgt]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

[sonarcloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud