Skip to content

Commit f82f779

Browse files
aliottaaliotta
authored
add workload identity support (#206)
1 parent 79340ae commit f82f779

File tree

12 files changed

+169
-105
lines changed

12 files changed

+169
-105
lines changed

‎.github/workflows/testacc.yml

+17-17
Original file line numberDiff line numberDiff line change
@@ -79,24 +79,24 @@ jobs:
7979
echo "SKIP_CLUSTER_RESOURCE_TESTS=$SKIP_TESTS" >> $GITHUB_ENV
8080
- env:
8181
TF_ACC: "1"
82-
HYBRID_ORGANIZATION_API_TOKEN: ${{ secrets.DEV_HYBRID_ORGANIZATION_API_TOKEN }}
83-
HYBRID_ORGANIZATION_ID: clx44v7op01nf01m5iohqjkk6
84-
HOSTED_ORGANIZATION_API_TOKEN: ${{ secrets.DEV_HOSTED_ORGANIZATION_API_TOKEN }}
85-
HOSTED_ORGANIZATION_ID: clx42kkcm01fo01o06agtmshg
86-
HOSTED_SCIM_ORGANIZATION_API_TOKEN: ${{ secrets.DEV_HOSTED_SCIM_ORGANIZATION_API_TOKEN }}
87-
HOSTED_SCIM_ORGANIZATION_ID: clz3bcmd3003m01qemptnfenp
88-
HYBRID_CLUSTER_ID: clxkqfzvm001d01ncr9rs80si
89-
HYBRID_DRY_RUN_CLUSTER_ID: clxko4djp008601njcuoxt4z5
90-
HYBRID_NODE_POOL_ID: clxkqfzvm001c01nc1eosyxzg
91-
ASTRO_API_HOST: https://api.astronomer-dev.io
82+
HYBRID_ORGANIZATION_API_TOKEN: ${{ secrets.STAGE_HYBRID_ORGANIZATION_API_TOKEN }}
83+
HYBRID_ORGANIZATION_ID: clx46ca4y061z01jleyku7sr6
84+
HOSTED_ORGANIZATION_API_TOKEN: ${{ secrets.STAGE_HOSTED_ORGANIZATION_API_TOKEN }}
85+
HOSTED_ORGANIZATION_ID: clx46acvv060e01ilddqlbsmc
86+
HOSTED_SCIM_ORGANIZATION_API_TOKEN: ${{ secrets.STAGE_HOSTED_SCIM_ORGANIZATION_API_TOKEN }}
87+
HOSTED_SCIM_ORGANIZATION_ID: clz3blqb500lh01mtkwu9zk5z
88+
HYBRID_CLUSTER_ID: clxm3xg9e05bl01ixsrhxje4e
89+
HYBRID_DRY_RUN_CLUSTER_ID: clxm3y54805bs01ix5owqhfff
90+
HYBRID_NODE_POOL_ID: clxm3xg9e05bk01ixrqk52cob
91+
ASTRO_API_HOST: https://api.astronomer-stage.io
92+
HOSTED_TEAM_ID: clx486hno068301il306nuhsm
93+
HOSTED_USER_ID: clz3a95hw00j301jj5jfmcgwd
94+
HOSTED_DUMMY_USER_ID: clzawlsb701vv01ikvsqz5mws
95+
HOSTED_DEPLOYMENT_ID: clx4825jb068z01j9931ib5gb
96+
HOSTED_STANDARD_DEPLOYMENT_ID: cm077ee2807g301kpjkqdoc15
97+
HOSTED_WORKSPACE_ID: clx480rvx068u01j9mp7t7fqh
98+
HOSTED_API_TOKEN_ID: clxm46ged05b301neuucdqwox
9299
SKIP_CLUSTER_RESOURCE_TESTS: ${{ env.SKIP_CLUSTER_RESOURCE_TESTS }}
93-
HOSTED_TEAM_ID: clx44rvzr01nc01o06pze6qb7
94-
HOSTED_USER_ID: clz3a4ymt004x01on8w5ydq8j
95-
HOSTED_DUMMY_USER_ID: clzawipbm00bm01qw98vzzoca
96-
HOSTED_DEPLOYMENT_ID: cm1zkps2a0cv301ph39benet6
97-
HOSTED_STANDARD_DEPLOYMENT_ID: cm070pg0r00wd01qgnskk0dir
98-
HOSTED_WORKSPACE_ID: clx42sxw501gl01o0gjenthnh
99-
HOSTED_API_TOKEN_ID: clxm4836f00ql01me3nigmcr6
100100
TESTARGS: "-failfast"
101101
run: make testacc
102102

‎CONTRIBUTING.md

+11
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,17 @@ Ensure you have the following installed:
6666
export ASTRO_API_TOKEN=<your-api-token>
6767
```
6868

69+
### Setting up the Import script for Local Development
70+
71+
1. Build the import script from the import directory
72+
```
73+
go build import_script.go
74+
```
75+
2. Run the import script
76+
```
77+
./import_script -resources deployment -organizationId <your-org-id> -host dev -token YOU_API_TOKEN
78+
```
79+
6980
## Making Changes
7081

7182
1. Create a new branch for your changes:

‎docs/resources/cluster.md

+38-38
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Cluster resource. If creating multiple clusters, add a delay between each cluste
1515
```terraform
1616
resource "astro_cluster" "aws_example" {
1717
type = "DEDICATED"
18-
name = "my first aws cluster"
18+
name = "LIOTTA"
1919
region = "us-east-1"
2020
cloud_provider = "AWS"
2121
vpc_subnet_range = "172.20.0.0/20"
@@ -27,43 +27,43 @@ resource "astro_cluster" "aws_example" {
2727
}
2828
}
2929
30-
resource "astro_cluster" "azure_example" {
31-
type = "DEDICATED"
32-
name = "my first azure cluster"
33-
region = "westus2"
34-
cloud_provider = "AZURE"
35-
vpc_subnet_range = "172.20.0.0/19"
36-
workspace_ids = ["clv4wcf6f003u01m3zp7gsvzg"]
37-
}
38-
39-
resource "astro_cluster" "gcp_example" {
40-
type = "DEDICATED"
41-
name = "my first gcp cluster"
42-
region = "us-central1"
43-
cloud_provider = "GCP"
44-
pod_subnet_range = "172.21.0.0/19"
45-
service_peering_range = "172.23.0.0/20"
46-
service_subnet_range = "172.22.0.0/22"
47-
vpc_subnet_range = "172.20.0.0/22"
48-
workspace_ids = []
49-
}
50-
51-
// Import an existing cluster
52-
import {
53-
id = "clozc036j01to01jrlgvuf98d" // ID of the existing cluster
54-
to = astro_cluster.imported_cluster
55-
}
56-
resource "astro_cluster" "imported_cluster" {
57-
type = "DEDICATED"
58-
name = "an existing cluster to import"
59-
region = "us-central1"
60-
cloud_provider = "GCP"
61-
pod_subnet_range = "172.21.0.0/19"
62-
service_peering_range = "172.23.0.0/20"
63-
service_subnet_range = "172.22.0.0/22"
64-
vpc_subnet_range = "172.20.0.0/22"
65-
workspace_ids = []
66-
}
30+
# resource "astro_cluster" "azure_example" {
31+
# type = "DEDICATED"
32+
# name = "my first azure cluster"
33+
# region = "westus2"
34+
# cloud_provider = "AZURE"
35+
# vpc_subnet_range = "172.20.0.0/19"
36+
# workspace_ids = ["clv4wcf6f003u01m3zp7gsvzg"]
37+
# }
38+
#
39+
# resource "astro_cluster" "gcp_example" {
40+
# type = "DEDICATED"
41+
# name = "my first gcp cluster"
42+
# region = "us-central1"
43+
# cloud_provider = "GCP"
44+
# pod_subnet_range = "172.21.0.0/19"
45+
# service_peering_range = "172.23.0.0/20"
46+
# service_subnet_range = "172.22.0.0/22"
47+
# vpc_subnet_range = "172.20.0.0/22"
48+
# workspace_ids = []
49+
# }
50+
#
51+
# // Import an existing cluster
52+
# import {
53+
# id = "clozc036j01to01jrlgvuf98d" // ID of the existing cluster
54+
# to = astro_cluster.imported_cluster
55+
# }
56+
# resource "astro_cluster" "imported_cluster" {
57+
# type = "DEDICATED"
58+
# name = "an existing cluster to import"
59+
# region = "us-central1"
60+
# cloud_provider = "GCP"
61+
# pod_subnet_range = "172.21.0.0/19"
62+
# service_peering_range = "172.23.0.0/20"
63+
# service_subnet_range = "172.22.0.0/22"
64+
# vpc_subnet_range = "172.20.0.0/22"
65+
# workspace_ids = []
66+
# }
6767
```
6868

6969
<!-- schema generated by tfplugindocs -->

‎docs/resources/deployment.md

+2
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ resource "astro_deployment" "dedicated" {
3131
resource_quota_memory = "20Gi"
3232
scheduler_size = "SMALL"
3333
workspace_id = "clnp86ly5000401ndaga21g81"
34+
desired_workload_identity = "arn:aws:iam::123456789:role/AirflowS3Logs-clmk2qqia000008mhff3ndjr0"
3435
environment_variables = [{
3536
key = "key1"
3637
value = "value1"
@@ -164,6 +165,7 @@ resource "astro_deployment" "imported_deployment" {
164165
- `cluster_id` (String) Deployment cluster identifier - required for 'HYBRID' and 'DEDICATED' deployments. If changing this value, the deployment will be recreated in the new cluster
165166
- `default_task_pod_cpu` (String) Deployment default task pod CPU - required for 'STANDARD' and 'DEDICATED' deployments
166167
- `default_task_pod_memory` (String) Deployment default task pod memory - required for 'STANDARD' and 'DEDICATED' deployments
168+
- `desired_workload_identity` (String) Deployment's desired workload identity. The Terraform provider will use this provided workload identity to create the Deployment. If it is not provided the workload identity will be assigned automatically.
167169
- `is_development_mode` (Boolean) Deployment development mode - required for 'STANDARD' and 'DEDICATED' deployments. If changing from 'False' to 'True', the deployment will be recreated
168170
- `is_high_availability` (Boolean) Deployment high availability - required for 'STANDARD' and 'DEDICATED' deployments
169171
- `original_astro_runtime_version` (String) Deployment's original Astro Runtime version. The Terraform provider will use this provided Astro runtime version to create the Deployment. The Astro runtime version can be updated with your Astro project Dockerfile, but if this value is changed, the Deployment will be recreated with this new Astro runtime version.

‎examples/resources/astro_cluster/resource.tf

+38-38
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
resource "astro_cluster" "aws_example" {
22
type = "DEDICATED"
3-
name = "my first aws cluster"
3+
name = "LIOTTA"
44
region = "us-east-1"
55
cloud_provider = "AWS"
66
vpc_subnet_range = "172.20.0.0/20"
@@ -12,40 +12,40 @@ resource "astro_cluster" "aws_example" {
1212
}
1313
}
1414

15-
resource "astro_cluster" "azure_example" {
16-
type = "DEDICATED"
17-
name = "my first azure cluster"
18-
region = "westus2"
19-
cloud_provider = "AZURE"
20-
vpc_subnet_range = "172.20.0.0/19"
21-
workspace_ids = ["clv4wcf6f003u01m3zp7gsvzg"]
22-
}
23-
24-
resource "astro_cluster" "gcp_example" {
25-
type = "DEDICATED"
26-
name = "my first gcp cluster"
27-
region = "us-central1"
28-
cloud_provider = "GCP"
29-
pod_subnet_range = "172.21.0.0/19"
30-
service_peering_range = "172.23.0.0/20"
31-
service_subnet_range = "172.22.0.0/22"
32-
vpc_subnet_range = "172.20.0.0/22"
33-
workspace_ids = []
34-
}
35-
36-
// Import an existing cluster
37-
import {
38-
id = "clozc036j01to01jrlgvuf98d" // ID of the existing cluster
39-
to = astro_cluster.imported_cluster
40-
}
41-
resource "astro_cluster" "imported_cluster" {
42-
type = "DEDICATED"
43-
name = "an existing cluster to import"
44-
region = "us-central1"
45-
cloud_provider = "GCP"
46-
pod_subnet_range = "172.21.0.0/19"
47-
service_peering_range = "172.23.0.0/20"
48-
service_subnet_range = "172.22.0.0/22"
49-
vpc_subnet_range = "172.20.0.0/22"
50-
workspace_ids = []
51-
}
15+
# resource "astro_cluster" "azure_example" {
16+
# type = "DEDICATED"
17+
# name = "my first azure cluster"
18+
# region = "westus2"
19+
# cloud_provider = "AZURE"
20+
# vpc_subnet_range = "172.20.0.0/19"
21+
# workspace_ids = ["clv4wcf6f003u01m3zp7gsvzg"]
22+
# }
23+
#
24+
# resource "astro_cluster" "gcp_example" {
25+
# type = "DEDICATED"
26+
# name = "my first gcp cluster"
27+
# region = "us-central1"
28+
# cloud_provider = "GCP"
29+
# pod_subnet_range = "172.21.0.0/19"
30+
# service_peering_range = "172.23.0.0/20"
31+
# service_subnet_range = "172.22.0.0/22"
32+
# vpc_subnet_range = "172.20.0.0/22"
33+
# workspace_ids = []
34+
# }
35+
#
36+
# // Import an existing cluster
37+
# import {
38+
# id = "clozc036j01to01jrlgvuf98d" // ID of the existing cluster
39+
# to = astro_cluster.imported_cluster
40+
# }
41+
# resource "astro_cluster" "imported_cluster" {
42+
# type = "DEDICATED"
43+
# name = "an existing cluster to import"
44+
# region = "us-central1"
45+
# cloud_provider = "GCP"
46+
# pod_subnet_range = "172.21.0.0/19"
47+
# service_peering_range = "172.23.0.0/20"
48+
# service_subnet_range = "172.22.0.0/22"
49+
# vpc_subnet_range = "172.20.0.0/22"
50+
# workspace_ids = []
51+
# }

‎examples/resources/astro_deployment/resource.tf

+1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ resource "astro_deployment" "dedicated" {
1616
resource_quota_memory = "20Gi"
1717
scheduler_size = "SMALL"
1818
workspace_id = "clnp86ly5000401ndaga21g81"
19+
desired_workload_identity = "arn:aws:iam::123456789:role/AirflowS3Logs-clmk2qqia000008mhff3ndjr0"
1920
environment_variables = [{
2021
key = "key1"
2122
value = "value1"

‎import/import_script.go

+10
Original file line numberDiff line numberDiff line change
@@ -824,6 +824,12 @@ func generateDeploymentHCL(ctx context.Context, platformClient *platform.ClientW
824824

825825
deploymentType := deployment.Type
826826

827+
workloadIdentity := deployment.WorkloadIdentity
828+
workloadIdentityString := ""
829+
if workloadIdentity != nil {
830+
workloadIdentityString = fmt.Sprintf(`desired_workload_identity = "%s"`, *workloadIdentity)
831+
}
832+
827833
if *deploymentType == platform.DeploymentTypeDEDICATED {
828834
deploymentHCL = fmt.Sprintf(`
829835
resource "astro_deployment" "deployment_%s" {
@@ -845,6 +851,7 @@ resource "astro_deployment" "deployment_%s" {
845851
type = "%s"
846852
workspace_id = "%s"
847853
%s
854+
%s
848855
}
849856
`,
850857
deployment.Id,
@@ -866,6 +873,7 @@ resource "astro_deployment" "deployment_%s" {
866873
stringValue((*string)(deploymentType)),
867874
deployment.WorkspaceId,
868875
workerQueuesString,
876+
workloadIdentityString,
869877
)
870878
} else if *deploymentType == platform.DeploymentTypeSTANDARD {
871879
deploymentHCL = fmt.Sprintf(`
@@ -889,6 +897,7 @@ resource "astro_deployment" "deployment_%s" {
889897
type = "%s"
890898
workspace_id = "%s"
891899
%s
900+
%s
892901
}
893902
`,
894903
deployment.Id,
@@ -911,6 +920,7 @@ resource "astro_deployment" "deployment_%s" {
911920
stringValue((*string)(deploymentType)),
912921
deployment.WorkspaceId,
913922
workerQueuesString,
923+
workloadIdentityString,
914924
)
915925
} else {
916926
log.Printf("Skipping deployment %s: unsupported deployment type %s", deployment.Id, stringValue((*string)(deploymentType)))

‎internal/provider/datasources/data_source_deployments_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ resource "astro_deployment" "test_deployment_celery" {
150150
name = "%v-2"
151151
description = "%v"
152152
type = "STANDARD"
153-
region = "us-east-1"
153+
region = "us-west-2"
154154
cloud_provider = "AWS"
155155
contact_emails = []
156156
default_task_pod_cpu = "0.25"

‎internal/provider/models/deployment.go

+1
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ type DeploymentResource struct {
4949
DesiredDagTarballVersion types.String `tfsdk:"desired_dag_tarball_version"`
5050
IsCicdEnforced types.Bool `tfsdk:"is_cicd_enforced"`
5151
IsDagDeployEnabled types.Bool `tfsdk:"is_dag_deploy_enabled"`
52+
DesiredWorkloadIdentity types.String `tfsdk:"desired_workload_identity"`
5253
WorkloadIdentity types.String `tfsdk:"workload_identity"`
5354
ExternalIps types.Set `tfsdk:"external_ips"`
5455
OidcIssuerUrl types.String `tfsdk:"oidc_issuer_url"`

0 commit comments

Comments
 (0)