WARNING: THIS SITE IS A MIRROR OF GITHUB.COM / IT CANNOT LOGIN OR REGISTER ACCOUNTS / THE CONTENTS ARE PROVIDED AS-IS / THIS SITE ASSUMES NO RESPONSIBILITY FOR ANY DISPLAYED CONTENT OR LINKS / IF YOU FOUND SOMETHING MAY NOT GOOD FOR EVERYONE, CONTACT ADMIN AT ilovescratch@foxmail.com
Skip to content

Commit a00b0b5

Browse files
malhussanmalhussan
committed
feat: s3 bucket wif - support multiple subjects with partial matching
1 parent 0b2d15c commit a00b0b5

File tree

4 files changed

+20
-17
lines changed

4 files changed

+20
-17
lines changed

‎modules/aks/starterkit/buildingblock/README.md‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ This documentation is intended as a reference documentation for cloud foundation
1515

1616
| Name | Version |
1717
|------|---------|
18-
| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | 0.9.0 |
18+
| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | 0.15.0 |
1919

2020
## Modules
2121

@@ -25,15 +25,15 @@ No modules.
2525

2626
| Name | Type |
2727
|------|------|
28-
| [meshstack_building_block_v2.github_actions_dev](https://registry.terraform.io/providers/meshcloud/meshstack/0.9.0/docs/resources/building_block_v2) | resource |
29-
| [meshstack_building_block_v2.github_actions_prod](https://registry.terraform.io/providers/meshcloud/meshstack/0.9.0/docs/resources/building_block_v2) | resource |
30-
| [meshstack_building_block_v2.repo](https://registry.terraform.io/providers/meshcloud/meshstack/0.9.0/docs/resources/building_block_v2) | resource |
31-
| [meshstack_project.dev](https://registry.terraform.io/providers/meshcloud/meshstack/0.9.0/docs/resources/project) | resource |
32-
| [meshstack_project.prod](https://registry.terraform.io/providers/meshcloud/meshstack/0.9.0/docs/resources/project) | resource |
33-
| [meshstack_project_user_binding.creator_dev_admin](https://registry.terraform.io/providers/meshcloud/meshstack/0.9.0/docs/resources/project_user_binding) | resource |
34-
| [meshstack_project_user_binding.creator_prod_admin](https://registry.terraform.io/providers/meshcloud/meshstack/0.9.0/docs/resources/project_user_binding) | resource |
35-
| [meshstack_tenant_v4.dev](https://registry.terraform.io/providers/meshcloud/meshstack/0.9.0/docs/resources/tenant_v4) | resource |
36-
| [meshstack_tenant_v4.prod](https://registry.terraform.io/providers/meshcloud/meshstack/0.9.0/docs/resources/tenant_v4) | resource |
28+
| [meshstack_building_block_v2.github_actions_dev](https://registry.terraform.io/providers/meshcloud/meshstack/0.15.0/docs/resources/building_block_v2) | resource |
29+
| [meshstack_building_block_v2.github_actions_prod](https://registry.terraform.io/providers/meshcloud/meshstack/0.15.0/docs/resources/building_block_v2) | resource |
30+
| [meshstack_building_block_v2.repo](https://registry.terraform.io/providers/meshcloud/meshstack/0.15.0/docs/resources/building_block_v2) | resource |
31+
| [meshstack_project.dev](https://registry.terraform.io/providers/meshcloud/meshstack/0.15.0/docs/resources/project) | resource |
32+
| [meshstack_project.prod](https://registry.terraform.io/providers/meshcloud/meshstack/0.15.0/docs/resources/project) | resource |
33+
| [meshstack_project_user_binding.creator_dev_admin](https://registry.terraform.io/providers/meshcloud/meshstack/0.15.0/docs/resources/project_user_binding) | resource |
34+
| [meshstack_project_user_binding.creator_prod_admin](https://registry.terraform.io/providers/meshcloud/meshstack/0.15.0/docs/resources/project_user_binding) | resource |
35+
| [meshstack_tenant_v4.dev](https://registry.terraform.io/providers/meshcloud/meshstack/0.15.0/docs/resources/tenant_v4) | resource |
36+
| [meshstack_tenant_v4.prod](https://registry.terraform.io/providers/meshcloud/meshstack/0.15.0/docs/resources/tenant_v4) | resource |
3737

3838
## Inputs
3939

‎modules/aws/s3_bucket/backplane/README.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,11 @@ module "aws_s3_bucket_backplane" {
2222
workload_identity_federation = {
2323
issuer = "https://your-oidc-issuer"
2424
audience = "your-audience"
25-
subject = "system:serviceaccount:your-namespace:your-service-account-name"
26-
} # Optional, if not provided, workload identity federation will not be set up and IAM access keys will be created
25+
subjects = [
26+
"system:serviceaccount:your-namespace:your-service-account-name", # Exact match
27+
"system:serviceaccount:your-namespace:*", # Wildcard match
28+
]
29+
} # Optional, if not provided, IAM access keys will be created instead
2730
}
2831
2932
output "aws_s3_bucket_backplane" {
@@ -62,7 +65,7 @@ No modules.
6265

6366
| Name | Description | Type | Default | Required |
6467
|------|-------------|------|---------|:--------:|
65-
| <a name="input_workload_identity_federation"></a> [workload\_identity\_federation](#input\_workload\_identity\_federation) | Set these options to add a trusted identity provider from meshStack to allow workload identity federation for authentication which can be used instead of access keys. | <pre>object({<br> issuer = string,<br> audience = string,<br> subject = string,<br> })</pre> | `null` | no |
68+
| <a name="input_workload_identity_federation"></a> [workload\_identity\_federation](#input\_workload\_identity\_federation) | Set these options to add a trusted identity provider from meshStack to allow workload identity federation for authentication which can be used instead of access keys. Supports multiple subjects for migration paths and wildcard patterns (e.g., 'system:serviceaccount:namespace:*'). | <pre>object({<br> issuer = string,<br> audience = string,<br> subjects = list(string)<br> })</pre> | `null` | no |
6669

6770
## Outputs
6871

‎modules/aws/s3_bucket/backplane/iam.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,10 @@ data "aws_iam_policy_document" "workload_identity_federation" {
6666
}
6767

6868
condition {
69-
test = "StringEquals"
69+
test = "StringLike"
7070
variable = "${trimprefix(var.workload_identity_federation.issuer, "https://")}:sub"
7171

72-
values = [var.workload_identity_federation.subject]
72+
values = var.workload_identity_federation.subjects
7373
}
7474
}
7575
}

‎modules/aws/s3_bucket/backplane/variables.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ variable "workload_identity_federation" {
22
type = object({
33
issuer = string,
44
audience = string,
5-
subject = string,
5+
subjects = list(string)
66
})
77
default = null
8-
description = "Set these options to add a trusted identity provider from meshStack to allow workload identity federation for authentication which can be used instead of access keys."
8+
description = "Set these options to add a trusted identity provider from meshStack to allow workload identity federation for authentication which can be used instead of access keys. Supports multiple subjects for migration paths and wildcard patterns (e.g., 'system:serviceaccount:namespace:*')."
99
}

0 commit comments

Comments
 (0)