mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-02-02 02:24:56 -05:00
a295ecaffb
* deps: update Terraform azurerm to v4 * Set Azure subscription ID when applying Terraform files * Upgrade azurerm to v4.1.0 * Mark subscriptionID flag as not required * deps: tidy all modules --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Daniel Weiße <dw@edgeless.systems> Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
102 lines
3.0 KiB
YAML
102 lines
3.0 KiB
YAML
name: Constellation IAM create
|
|
description: Create IAM configuration for a Constellation cluster.
|
|
|
|
inputs:
|
|
cloudProvider:
|
|
description: "Either 'aws', 'azure' or 'gcp'."
|
|
required: true
|
|
attestationVariant:
|
|
description: "The attestation variant to use."
|
|
required: true
|
|
kubernetesVersion:
|
|
description: "Kubernetes version to create the cluster from."
|
|
required: false
|
|
namePrefix:
|
|
description: "Name prefix to use for resources."
|
|
required: true
|
|
additionalTags:
|
|
description: "Additional resource tags that will be written into the constellation configuration."
|
|
default: ""
|
|
required: false
|
|
#
|
|
# AWS specific inputs
|
|
#
|
|
awsZone:
|
|
description: "AWS zone to deploy Constellation in."
|
|
required: false
|
|
#
|
|
# Azure specific inputs
|
|
#
|
|
azureSubscriptionID:
|
|
description: "Azure subscription ID to deploy Constellation in."
|
|
required: true
|
|
azureRegion:
|
|
description: "Azure region to deploy Constellation in."
|
|
required: false
|
|
#
|
|
# GCP specific inputs
|
|
#
|
|
gcpProjectID:
|
|
description: "The GCP project ID to deploy Constellation in."
|
|
required: false
|
|
gcpZone:
|
|
description: "The GCP zone to deploy Constellation in."
|
|
required: false
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Generate config
|
|
id: generate-config
|
|
shell: bash
|
|
run: |
|
|
kubernetesFlag=""
|
|
if [[ ! -z "${{ inputs.kubernetesVersion }}" ]]; then
|
|
kubernetesFlag="--kubernetes=${{ inputs.kubernetesVersion }}"
|
|
fi
|
|
|
|
# TODO(v2.17): Remove this fallback and always use --tags flag
|
|
tagsFlag=""
|
|
if constellation config generate --help | grep -q -- --tags; then
|
|
tagsFlag="--tags=\"${{ inputs.additionalTags }}\""
|
|
fi
|
|
|
|
echo "flag=--update-config" | tee -a "$GITHUB_OUTPUT"
|
|
constellation config generate ${{ inputs.cloudProvider }} ${kubernetesFlag} --attestation ${{ inputs.attestationVariant }} ${tagsFlag}
|
|
|
|
- name: Constellation iam create aws
|
|
shell: bash
|
|
if: inputs.cloudProvider == 'aws'
|
|
run: |
|
|
constellation iam create aws \
|
|
--zone="${{ inputs.awsZone }}" \
|
|
--prefix="${{ inputs.namePrefix }}" \
|
|
--update-config \
|
|
--tf-log=DEBUG \
|
|
--yes
|
|
|
|
- name: Constellation iam create azure
|
|
shell: bash
|
|
if: inputs.cloudProvider == 'azure'
|
|
run: |
|
|
constellation iam create azure \
|
|
--subscriptionID="${{ inputs.azureSubscriptionID }}" \
|
|
--region="${{ inputs.azureRegion }}" \
|
|
--resourceGroup="${{ inputs.namePrefix }}-rg" \
|
|
--servicePrincipal="${{ inputs.namePrefix }}-sp" \
|
|
--update-config \
|
|
--tf-log=DEBUG \
|
|
--yes
|
|
|
|
- name: Constellation iam create gcp
|
|
shell: bash
|
|
if: inputs.cloudProvider == 'gcp'
|
|
run: |
|
|
constellation iam create gcp \
|
|
--projectID="${{ inputs.gcpProjectID }}" \
|
|
--zone="${{ inputs.gcpZone }}" \
|
|
--serviceAccountID="${{ inputs.namePrefix }}-sa" \
|
|
--update-config \
|
|
--tf-log=DEBUG \
|
|
--yes
|