Skip to content

Commit

Permalink
Adding GCloud federated authentication for analytics teaching-qualifi…
Browse files Browse the repository at this point in the history
…cations workspace
  • Loading branch information
shaheislamdfe committed Dec 4, 2024
1 parent 5ce12ba commit d615088
Show file tree
Hide file tree
Showing 7 changed files with 40 additions and 3 deletions.
5 changes: 5 additions & 0 deletions .github/actions/deploy-environment/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,11 @@ runs:
with:
azure-credentials: ${{ inputs.azure-credentials }}

- uses: google-github-actions/auth@v2
with:
project_id: teaching-qualifications
workload_identity_provider: projects/63681705511/locations/global/workloadIdentityPools/teaching-qualifications/providers/teaching-qualifications

- name: Terraform Apply
shell: bash
run: |
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/build-and-deploy.yml
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,10 @@ on:
options:
- production

permissions:
pull-requests: write
id-token: write

jobs:
build_image:
name: Image build and push
Expand Down
3 changes: 3 additions & 0 deletions config/initializers/dfe_analytics.rb
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@
config.queue = :analytics
config.environment = HostingEnvironment.environment_name
config.entity_table_checks_enabled = true
config.azure_federated_auth = ENV.include? "GOOGLE_CLOUD_CREDENTIALS"

config.bigquery_maintenance_window = "08-09-2024 18:00..08-09-2024 19:00"

config.enable_analytics =
proc do
Expand Down
5 changes: 3 additions & 2 deletions terraform/application/application.tf
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,11 @@ module "application_configuration" {
BIGQUERY_TABLE_NAME = "events"
RAILS_SERVE_STATIC_FILES = "true"
}
secret_variables = {
secret_variables = merge({
DATABASE_URL = module.postgres.url
REDIS_URL = module.redis-cache.url
AZURE_STORAGE_ACCESS_KEY = azurerm_storage_account.evidence.primary_access_key
}
}, local.federated_auth_secrets)
}

module "web_application" {
Expand Down Expand Up @@ -70,4 +70,5 @@ module "worker_application" {
replicas = var.worker_replicas
docker_image = var.docker_image
enable_logit = true
enable_gcp_wif = true
}
3 changes: 2 additions & 1 deletion terraform/application/config/review.tfvars.json
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,6 @@
"namespace": "tra-development",
"deploy_azure_backing_services": false,
"enable_postgres_ssl": false,
"evidence_container_retention_in_days": 1
"evidence_container_retention_in_days": 1,
"enable_dfe_analytics_federated_auth": true
}
14 changes: 14 additions & 0 deletions terraform/application/dfe_analytics.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
provider "google" {
project = "teaching-qualifications"
}

module "dfe_analytics" {
source = "./vendor/modules/dfe-terraform-modules//aks/dfe_analytics"

azure_resource_prefix = var.azure_resource_prefix
cluster = var.cluster
namespace = var.namespace
service_short = var.service_short
environment = var.environment
gcp_dataset = "events_${var.config}"
}
9 changes: 9 additions & 0 deletions terraform/application/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,11 @@ variable "postgres_enable_high_availability" {
default = false
}

variable "enable_dfe_analytics_federated_auth" {
description = "Create the resources in Google cloud for federated authentication and enable in application"
default = false
}

locals {
postgres_ssl_mode = var.enable_postgres_ssl ? "require" : "disable"

Expand All @@ -105,4 +110,8 @@ locals {
# s189paytqevidpdsa vs s189daytqevidpr12345sa
storage_account_environment = var.config == var.environment ? var.config_short : replace(var.environment, "-", "")
evidence_storage_account_name = "${local.azure_resource_prefix_short}aytqevid${local.storage_account_environment}sa"

federated_auth_secrets = {
GOOGLE_CLOUD_CREDENTIALS = var.enable_dfe_analytics_federated_auth ? module.dfe_analytics[0].google_cloud_credentials : null
} : {}
}

0 comments on commit d615088

Please sign in to comment.