Mirrors/flux2
1
0
Fork 0
mirror of synced 2026-02-06 19:05:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

instructions for test user in Azure DevOps and GCP source repo

Browse Source 
Signed-off-by: Somtochi Onyekwere <somtochionyekwere@gmail.com>
This commit is contained in:
Somtochi Onyekwere
2023-08-16 22:14:13 +01:00
committed by Sunny
parent 3b637a5125
commit 7141271bae
2 changed files with 42 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
tests/integration/README.md
View File

@@ -36,6 +36,17 @@ The [azure](./terraform/azure) Terraform creates the AKS cluster and related res
- Azure DevOps only supports RSA keys. Please see
[documentation](https://learn.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops#set-up-ssh-key-authentication)
for how to set up SSH key authentication.
- When using in CI, create a test user and use the test user's PAT and SSH key
for all Azure DevOps interactions. To grant the test user access in Azure
DevOps:
- Go to `Organization Settings` on the sidebar of the organization page.
- Under `General` > `Users`, click on `Add User` and input the user's email,
select `Access Level` of `Basic`.
- Go to `Security` > `Permissions`, click on the `User` tab.
- For the invited user, set the following permissions to `Allow`:
- `General: Create new project`.
- The user will get an email invitation and would need to create a Microsoft
account if they don't have one yet.
**NOTE:** To use Service Principal (for example in CI environment), set the
`ARM-*` variables in `.env`, source it and authenticate Azure CLI with:
@@ -171,10 +182,18 @@ for the terraform variables
[aggressive replacement in logs](https://github.com/google-github-actions/auth/blob/v1.1.0/docs/TROUBLESHOOTING.md#aggressive--replacement-in-logs)
for more details.
- Register [SSH Keys with Google Cloud](https://cloud.google.com/source-repositories/docs/authentication#ssh)
- Google Cloud supports these three SSH key types: RSA (only for keys with more than 2048 bits), ECDSA and ED25519
- **Note:** Google doesn't allow an SSH key to be associated with a service account email address. Therefore, there has to be an actual
user that the SSH keys are registered to, and the email of this user will be passed to terraform through the `TF_VAR_gcp_email`
variable.
- Google Cloud supports these three SSH key types: RSA (only for keys with
more than 2048 bits), ECDSA and ED25519.
- The SSH user doesn't have to be a member of the GCP project. The terraform
setup will grant the user permissions to the repository. Visit
https://source.cloud.google.com, login or create a GCP account with the SSH
user's email address and add SSH keys in the account. Set this email as the
value for the environment variable `TF_VAR_gcp_email` in `.env` file to be
used as a terraform variable.
**Note:** Google doesn't allow a SSH key to be associated with a service
account email address. Therefore, there has to be an actual user that the SSH
key is registered to.
### Permissions

19
tests/integration/terraform/gcp/sourcerepo.tf
View File

@@ -5,3 +5,22 @@ resource "google_sourcerepo_repository" "fleet-infra" {
resource "google_sourcerepo_repository" "application" {
name = "application-${random_pet.suffix.id}"
}
resource "google_sourcerepo_repository_iam_binding" "application_binding" {
project = google_sourcerepo_repository.application.project
repository = google_sourcerepo_repository.application.name
role = "roles/source.admin"
members = [
"user:${var.gcp_email}",
]
}
resource "google_sourcerepo_repository_iam_binding" "fleet-infra_binding" {
project = google_sourcerepo_repository.fleet-infra.project
repository = google_sourcerepo_repository.fleet-infra.name
role = "roles/source.admin"
members = [
"user:${var.gcp_email}",
]
}