CICD with WIF for bootstrap stage doesn't work for me

[keyshz]

Hello,

I have followed every step in the FAST. I have set up the branch to null in tfvars file. Do you maybe know what might be the issue? I have also tried to give the permissions manually but it seems like it doesn't work

ERROR: (gcloud.alpha.storage.cp) There was a problem refreshing your current auth tokens: ('Unable to acquire impersonated credentials', '{\n "error": {\n "code": 403,\n "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",\n "status": "PERMISSION_DENIED",\n "details": [\n {\n "@type": "type.googleapis.com/google.rpc.ErrorInfo",\n "reason": "IAM_PERMISSION_DENIED",\n "domain": "iam.googleapis.com",\n "metadata": {\n "permission": "iam.serviceAccounts.getAccessToken"\n }\n }\n ]\n }\n}\n')
Please run:
$ gcloud auth login
to obtain new credentials.
If you have already logged in with a different account, run:
$ gcloud config set account ACCOUNT
to select an already authenticated account to use.

[ludoo]

Can you share your identity providers and cicd variables?

[keyshz]

Yes, sure. I have put a star in the name and issuer_uri because I have a private gitlab instance.

federated_identity_providers = {
  
  gitlab-private-sample = {
    issuer              = "gitlab"
    custom_settings     = {
      issuer_uri = "*"
    }
  }

cicd_repositories = {
  bootstrap = {
    branch            =  null
    identity_provider =  "gitlab-private-sample"
    name              =  "*"
    type              =  "gitlab"
  }
  

resman = {
    branch            = "main"
     identity_provider =  "gitlab-private-sample"
    name              =  "*"
    type              = "gitlab"
  }

[ludoo]

I don't think those are correct. :)

Remove the custom_settings block from the identity provider, put the actual repo name in name including its project.

This is an example of my settings

federated_identity_providers = {
  github-ludomagno = {
    attribute_condition = "attribute.repository_owner==\"ludomagno\""
    issuer              = "github"
  }
  gitlab-ludomagno = {
    attribute_condition = "attribute.namespace_path==\"ludomagno\""
    issuer              = "gitlab"
  }
}
cicd_repositories = {
  bootstrap = {
    identity_provider = "gitlab-ludomagno"
    name              = "ludomagno/bootstrap"
    type              = "gitlab"
  }
  resman = {
    identity_provider = "github-ludomagno"
    name              = "ludomagno/resource_management"
    type              = "github"
  }
}