Adding GCloud federated authentication for teaching-qualifications

.github/actions/deploy-environment/action.yml

@@ -33,6 +33,11 @@ runs:
       with:
         azure-credentials: ${{ inputs.azure-credentials }}
 
+    - uses: google-github-actions/auth@v2
+      with:
+        project_id: teaching-qualifications
+        workload_identity_provider: projects/708780292301/locations/global/workloadIdentityPools/access-your-teaching-qualificati/providers/access-your-teaching-qualificati
+
     - name: Terraform Apply
       shell: bash
       run: |

.github/workflows/build-and-deploy.yml

@@ -46,6 +46,9 @@ jobs:
     needs: [build_image]
     environment:
       name: review
+    permissions:
+      pull-requests: write
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -99,6 +102,8 @@ jobs:
     environment:
       name: ${{ matrix.environment }}
       url: ${{ steps.deploy.outputs.environment_url }}
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -119,6 +124,8 @@ jobs:
     environment:
       name: production
       url: ${{ steps.deploy.outputs.environment_url }}
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/delete-review-app.yml

@@ -20,6 +20,10 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ contains(github.event.pull_request.labels.*.name, 'deploy') }}
     environment: review
+    permissions:
+      pull-requests: write
+      id-token: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -69,6 +73,11 @@ jobs:
         with:
           azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
 
+      - uses: google-github-actions/auth@v2
+        with:
+          project_id: teaching-qualifications
+          workload_identity_provider: projects/708780292301/locations/global/workloadIdentityPools/access-your-teaching-qualificati/providers/access-your-teaching-qualificati
+
       - name: Terraform Destroy
         run: |
           make ci review terraform-destroy

.gitignore

@@ -34,6 +34,7 @@ fetch_config.rb
 terraform/application/vendor
 terraform/domains/infrastructure/vendor
 terraform/domains/environment_domains/vendor
+bin/terrafile
 
 # Active Storage folder
 storage/

config/initializers/dfe_analytics.rb

@@ -4,6 +4,7 @@
   config.queue = :analytics
   config.environment = HostingEnvironment.environment_name
   config.entity_table_checks_enabled = true
+  config.azure_federated_auth = ENV.include? "GOOGLE_CLOUD_CREDENTIALS"
 
   config.enable_analytics =
     proc do

terraform/app.tf

@@ -1,21 +1,21 @@
 locals {
   aytq_env_vars = merge(try(local.infrastructure_secrets, null),
     {
-      AZURE_STORAGE_ACCOUNT_NAME            = azurerm_storage_account.evidence.name,
-      AZURE_STORAGE_ACCESS_KEY              = azurerm_storage_account.evidence.primary_access_key,
-      AZURE_STORAGE_CONTAINER               = azurerm_storage_container.uploads.name
-      BIGQUERY_DATASET                      = "events_${var.environment_name}",
-      BIGQUERY_PROJECT_ID                   = "teaching-qualifications",
-      BIGQUERY_TABLE_NAME                   = "events",
-      CHECK_RECORDS_DOMAIN                  = var.check_domain != null ? "https://${var.check_domain}" : "https://${local.aytq_web_app_name}.azurewebsites.net"
-      ConnectionStrings__Redis              = azurerm_redis_cache.redis.primary_connection_string
-      DATABASE_PASSWORD                     = local.infrastructure_secrets.POSTGRES_ADMIN_PASSWORD
-      DATABASE_URL                          = "postgres://postgres@${local.postgres_server_name}.postgres.database.azure.com:5432"
-      DOCKER_REGISTRY_SERVER_URL            = "https://ghcr.io",
-      HOSTING_DOMAIN                        = var.domain != null ? "https://${var.domain}" : "https://${local.aytq_web_app_name}.azurewebsites.net"
-      HOSTING_ENVIRONMENT_NAME              = local.hosting_environment
-      RAILS_SERVE_STATIC_FILES              = "true"
-      REDIS_URL                             = "rediss://:${azurerm_redis_cache.redis.primary_access_key}@${azurerm_redis_cache.redis.hostname}:${azurerm_redis_cache.redis.ssl_port}/0"
+      AZURE_STORAGE_ACCOUNT_NAME = azurerm_storage_account.evidence.name,
+      AZURE_STORAGE_ACCESS_KEY   = azurerm_storage_account.evidence.primary_access_key,
+      AZURE_STORAGE_CONTAINER    = azurerm_storage_container.uploads.name
+      BIGQUERY_DATASET           = "events_${var.environment_name}",
+      BIGQUERY_PROJECT_ID        = "teaching-qualifications",
+      BIGQUERY_TABLE_NAME        = "events",
+      CHECK_RECORDS_DOMAIN       = var.check_domain != null ? "https://${var.check_domain}" : "https://${local.aytq_web_app_name}.azurewebsites.net"
+      ConnectionStrings__Redis   = azurerm_redis_cache.redis.primary_connection_string
+      DATABASE_PASSWORD          = local.infrastructure_secrets.POSTGRES_ADMIN_PASSWORD
+      DATABASE_URL               = "postgres://postgres@${local.postgres_server_name}.postgres.database.azure.com:5432"
+      DOCKER_REGISTRY_SERVER_URL = "https://ghcr.io",
+      HOSTING_DOMAIN             = var.domain != null ? "https://${var.domain}" : "https://${local.aytq_web_app_name}.azurewebsites.net"
+      HOSTING_ENVIRONMENT_NAME   = local.hosting_environment
+      RAILS_SERVE_STATIC_FILES   = "true"
+      REDIS_URL                  = "rediss://:${azurerm_redis_cache.redis.primary_access_key}@${azurerm_redis_cache.redis.hostname}:${azurerm_redis_cache.redis.ssl_port}/0"
     }
   )
 }

terraform/application/application.tf

@@ -23,11 +23,11 @@ module "application_configuration" {
     BIGQUERY_TABLE_NAME        = "events"
     RAILS_SERVE_STATIC_FILES   = "true"
   }
-  secret_variables = {
+  secret_variables = merge({
     DATABASE_URL             = module.postgres.url
     REDIS_URL                = module.redis-cache.url
     AZURE_STORAGE_ACCESS_KEY = azurerm_storage_account.evidence.primary_access_key
-  }
+  }, local.federated_auth_secrets)
 }
 
 module "web_application" {
@@ -70,4 +70,5 @@ module "worker_application" {
   replicas                   = var.worker_replicas
   docker_image               = var.docker_image
   enable_logit               = true
+  enable_gcp_wif             = var.enable_dfe_analytics_federated_auth
 }

terraform/application/config/review.tfvars.json

@@ -3,5 +3,6 @@
   "namespace": "tra-development",
   "deploy_azure_backing_services": false,
   "enable_postgres_ssl": false,
-  "evidence_container_retention_in_days": 1
+  "evidence_container_retention_in_days": 1,
+  "enable_dfe_analytics_federated_auth": true
 }

terraform/application/dfe_analytics.tf

@@ -0,0 +1,15 @@
+provider "google" {
+  project = "teaching-qualifications"
+}
+
+module "dfe_analytics" {
+  count  = var.enable_dfe_analytics_federated_auth ? 1 : 0
+  source = "./vendor/modules/aks//aks/dfe_analytics"
+
+  azure_resource_prefix = var.azure_resource_prefix
+  cluster               = var.cluster
+  namespace             = var.namespace
+  service_short         = var.service_short
+  environment           = var.environment
+  gcp_dataset           = "events_${var.config}"
+}

terraform/application/terraform.tf

@@ -10,8 +10,8 @@ terraform {
       version = "2.32.0"
     }
     statuscake = {
-     source  = "StatusCakeDev/statuscake"
-     version = "2.2.2"
+      source  = "StatusCakeDev/statuscake"
+      version = "2.2.2"
     }
   }
   backend "azurerm" {
@@ -42,5 +42,5 @@ provider "kubernetes" {
 }
 
 provider "statuscake" {
- api_token = module.infrastructure_secrets.map.STATUSCAKE-API-TOKEN
+  api_token = module.infrastructure_secrets.map.STATUSCAKE-API-TOKEN
 }

terraform/application/variables.tf

@@ -89,6 +89,11 @@ variable "postgres_enable_high_availability" {
   default = false
 }
 
+variable "enable_dfe_analytics_federated_auth" {
+  description = "Create the resources in Google cloud for federated authentication and enable in application"
+  default     = false
+}
+
 locals {
   postgres_ssl_mode = var.enable_postgres_ssl ? "require" : "disable"
 
@@ -105,4 +110,8 @@ locals {
   # s189paytqevidpdsa vs s189daytqevidpr12345sa
   storage_account_environment   = var.config == var.environment ? var.config_short : replace(var.environment, "-", "")
   evidence_storage_account_name = "${local.azure_resource_prefix_short}aytqevid${local.storage_account_environment}sa"
+
+  federated_auth_secrets = var.enable_dfe_analytics_federated_auth ? {
+    GOOGLE_CLOUD_CREDENTIALS = module.dfe_analytics[0].google_cloud_credentials
+  } : {}
 }