Cicd sa for automation resources manager in project

[rafero12]

Hello,

After creating a project with Project Factory, is it possible to use WIF for automating resource management in this project?

In Project Factory, two service accounts are quickly created: 0 and 0r. So, where are the other two service accounts (1 and 1r) for CI/CD GitHub or GitLab?

Best regards,

[ludoo]

There's no CI/CD support out of the box for project factory projects, like for FAST stages. It's something that would make sense to implement TBH.

As a stopgap, if the WIF providers you define in stage 0 also work for project factory created projects, you can add the few pieces yourself by

• creating the CI/CD SAs via the project factory
• assigning the WIF impersonation role on them using the WIF provider defined in stage 0
• assigning the service account token creator role on the automation service accounts for them
• cloning one of the FAST CI/CD workflows and modifying it to fit

[rafero12]

Thanks for this idea! However, the Project Factory account created on 2-resman needs the ability to create buckets in the automation project. The role defined in stage-2-project-factory.tf under iam_project_roles:

iam_project_roles = {
(var.automation.project_id) = ["roles/serviceusage.serviceUsageConsumer"]
}
is not sufficient. The service account for the Project Factory also requires bucket administration privileges. To address this, the following update is necessary:

iam_project_roles = {
(var.automation.project_id) = [
"roles/serviceusage.serviceUsageConsumer",
"roles/storage.admin"
]
}
This ensures the Project Factory service account has the appropriate permissions to manage buckets within the automation project. it's true ?

[ludoo]

The project factory should not create buckets in the automation project. It should create its own automation project in the hierarchy it manages, and use that for application-level IaC resources.

[ludoo]

well I'm pretty sure since I wrote that :) automation project refers to automation.project_id which if you notice equals xxx-iac-prod-teams-0, so not the org-level automation project.

[rafero12]

thanks, so where in this stage should create automation project in the hierarchy level automation, but for use this automation, it must to create wif configuration.

[wolfie82]

I created a PR to support this functionality as it's something I also needed.

#3166