feat: add auth with workload identity federation

.github/workflows/deploy-dev.yml

@@ -69,9 +69,15 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Save GCP Credentials
-        run: |
-          echo '${{ secrets.GCP_SA_KEY }}' > ${{ env.CREDENTIALS_FILE }}
+      - name: 🔐 Autenticar com o Google Cloud
+        uses: google-github-actions/auth@v3
+        with:
+          project_id: ${{ vars.GCP_PROJECT_ID }}
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+
+      # - name: Save GCP Credentials
+      #   run: |
+      #     echo '${{ secrets.GCP_SA_KEY }}' > ${{ env.CREDENTIALS_FILE }}
 
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3

.github/workflows/deploy-prod.yml

@@ -69,9 +69,15 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Save GCP Credentials
-        run: |
-          echo '${{ secrets.GCP_SA_KEY }}' > ${{ env.CREDENTIALS_FILE }}
+      - name: 🔐 Autenticar com o Google Cloud
+        uses: google-github-actions/auth@v3
+        with:
+          project_id: ${{ vars.GCP_PROJECT_ID }}
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+
+      # - name: Save GCP Credentials
+      #   run: |
+      #     echo '${{ secrets.GCP_SA_KEY }}' > ${{ env.CREDENTIALS_FILE }}
 
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3

infra/dev/main.tf

@@ -13,6 +13,12 @@ module "cloudrun" {
   environment  = "development"
 }
 
+module "cloudiam" {
+  source = "../modules/cloudiam"
+
+  github_repository_name = var.github_repository_name
+}
+
 output "service_url" {
   value = module.cloudrun.service_url
 }

infra/dev/variables.tf

@@ -13,3 +13,8 @@ variable "image_url" {
   description = "URL da imagem docker"
   type        = string
 }
+
+variable "github_repository_name" {
+  description = "The GitHub repository name in the format <org/repo>"
+  type        = string
+}

infra/modules/cloudiam/main.tf

@@ -0,0 +1,32 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 4.0"
+    }
+  }
+}
+
+resource "google_iam_workload_identity_pool" "github_pool" {
+  display_name              = "GitHub Pool"
+  description               = "Workload Identity Pool for GitHub Actions"
+  workload_identity_pool_id = "github-pool"
+}
+
+resource "google_iam_workload_identity_pool_provider" "github_provider" {
+  attribute_condition                = "attribute.repository == '${var.github_repository_name}'"
+  display_name                       = "GitHub Provider"
+  description                        = "Workload Identity Pool Provider for GitHub Actions"
+  workload_identity_pool_id          = google_iam_workload_identity_pool.github_pool.workload_identity_pool_id
+  workload_identity_pool_provider_id = "github-provider"
+  attribute_mapping = {
+    "attribute.actor"      = "assertion.actor"
+    "attribute.aud"        = "assertion.aud"
+    "attribute.repository" = "assertion.repository"
+    "google.subject"       = "assertion.sub"
+  }
+
+  oidc {
+    issuer_uri = "https://token.actions.githubusercontent.com"
+  }
+}

infra/modules/cloudiam/variables.tf

@@ -0,0 +1,5 @@
+variable "github_repository_name" {
+  description = "The GitHub repository name in the format <org/repo>"
+  type        = string
+  default = "Pos-Grad-Devops/api-restaurant"
+}

infra/prod/main.tf

@@ -13,6 +13,12 @@ module "cloudrun" {
   environment  = "production"
 }
 
+module "cloudiam" {
+  source = "../modules/cloudiam"
+
+  github_repository_name = var.github_repository_name
+}
+
 output "service_url" {
   value = module.cloudrun.service_url
 }

infra/prod/variables.tf

@@ -13,3 +13,8 @@ variable "image_url" {
   description = "URL da imagem docker"
   type        = string
 }
+
+variable "github_repository_name" {
+  description = "The GitHub repository name in the format <org/repo>"
+  type        = string
+}