67 lines
2.3 KiB
HCL
67 lines
2.3 KiB
HCL
locals {
|
|
quay_oidc_redirect_uri = "${trim(var.quay_base_url, "/")}/oauth2/zitadel/callback"
|
|
quay_oidc_redirect_uris = [
|
|
local.quay_oidc_redirect_uri,
|
|
"${local.quay_oidc_redirect_uri}/attach",
|
|
"${local.quay_oidc_redirect_uri}/cli",
|
|
]
|
|
|
|
quay_zitadel_roles = {
|
|
quay_user = {
|
|
display_name = "Quay user"
|
|
group = "Quay"
|
|
}
|
|
quay_admin = {
|
|
display_name = "Quay administrator"
|
|
group = "Quay"
|
|
}
|
|
}
|
|
|
|
quay_zitadel_role_keys = keys(local.quay_zitadel_roles)
|
|
}
|
|
|
|
resource "zitadel_project_role" "quay" {
|
|
for_each = local.quay_zitadel_roles
|
|
|
|
org_id = zitadel_org.primary.id
|
|
project_id = zitadel_project.services.id
|
|
role_key = each.key
|
|
display_name = each.value.display_name
|
|
group = each.value.group
|
|
}
|
|
|
|
resource "zitadel_application_oidc" "quay" {
|
|
org_id = zitadel_org.primary.id
|
|
project_id = zitadel_project.services.id
|
|
name = "Quay"
|
|
redirect_uris = local.quay_oidc_redirect_uris
|
|
response_types = ["OIDC_RESPONSE_TYPE_CODE"]
|
|
grant_types = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"]
|
|
post_logout_redirect_uris = [trim(var.quay_base_url, "/")]
|
|
app_type = "OIDC_APP_TYPE_WEB"
|
|
auth_method_type = "OIDC_AUTH_METHOD_TYPE_BASIC"
|
|
version = "OIDC_VERSION_1_0"
|
|
clock_skew = "0s"
|
|
dev_mode = false
|
|
access_token_type = "OIDC_TOKEN_TYPE_BEARER"
|
|
access_token_role_assertion = false
|
|
id_token_role_assertion = true
|
|
id_token_userinfo_assertion = true
|
|
additional_origins = []
|
|
skip_native_app_success_page = false
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "quay_oidc" {
|
|
mount = var.vault_kv_mount
|
|
name = var.quay_oidc_vault_path
|
|
|
|
data_json = jsonencode({
|
|
client_id = zitadel_application_oidc.quay.client_id
|
|
client_secret = zitadel_application_oidc.quay.client_secret
|
|
discovery_url = "https://${var.zitadel_domain}/.well-known/openid-configuration"
|
|
redirect_uri = local.quay_oidc_redirect_uri
|
|
})
|
|
|
|
# Vault is source of truth after first write. OIDC credential rotation is explicit.
|
|
lifecycle { ignore_changes = [data_json] }
|
|
}
|