Skip to content

Commit 27b7726

Browse files
thphamthpham
committed
[iam] introduce iam_compartmen_id which define the top parent compartment for IAM resources when not at tenancy level
 - + describe usage of a Custom Identity Domain within an OCI subcompartment Signed-off-by: Thomas Pham <[email protected]>
1 parent 4c272ec commit 27b7726

File tree

12 files changed

+154
-28
lines changed

12 files changed

+154
-28
lines changed

‎docs/src/SUMMARY.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
- [Identity](./guide/identity.md)
99
- [Policies](./guide/identity_policies.md)
1010
- [Tags](./guide/identity_tags.md)
11+
- [Identity Domain](./guide/identity_domain.md)
1112
- [Network](./guide/network.md)
1213
- [Subnets](./guide/network_subnets.md)
1314
- [Network Security Groups](./guide/network_nsgs.md)

‎docs/src/guide/identity.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
# Identity
22

3-
Optional creation of Identity Dynamic Groups, Policies, and Tags.
3+
## IAM without Identity Domains
4+
5+
Optional creation of Identity [Dynamic Groups](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingdynamicgroups.htm), [Policies](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingpolicies.htm), and Tags.

‎docs/src/guide/identity_domain.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# IAM with Identity Domains
2+
3+
Creation of Identity [Dynamic Groups](https://docs.oracle.com/en-us/iaas/Content/Identity/dynamicgroups/managingdynamicgroups.htm), [Policies](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingpolicies.htm), and Tags.
4+
5+
6+
## Context
7+
8+
While you might not have the necessary policy permissions to provision OKE clusters directly at Tenancy level (ROOT compartment) and you have full control only under a sub-compartment, the following parameters will allow you to reference an existing and custom `identity domain` at this sub-compartment level. The `Dynamic Groups` will be then created in this Identity Domain while the policies will be created at the sub-compartment level and their statements using the `dynamic group` in your `identity domain`
9+
10+
Moreover, You can use this Identity Domain, to create service account users for your Kubernetes/OKE controllers or operators.
11+
12+
## Usage
13+
14+
```javascript
15+
{{#include ../../../examples/iam/vars-subcompartment-iam-identitydomain.auto.tfvars:4:}}
16+
```

‎module-iam.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,8 @@ module "iam" {
5555
source = "./modules/iam"
5656
compartment_id = local.compartment_id
5757
state_id = local.state_id
58-
tenancy_id = local.tenancy_id
58+
tenancy_id = local.iam_compartment_id
59+
identity_domain_name = local.identity_domain_name
5960
cluster_id = local.cluster_id
6061
create_iam_resources = var.create_iam_resources
6162
create_iam_autoscaler_policy = local.create_iam_autoscaler_policy

‎modules/iam/data-common.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Copyright (c) 2022, 2023 Oracle Corporation and/or its affiliates.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
3+
4+
locals {
5+
identity_domain_name = coalesce(var.identity_domain_name, "Default" )
6+
isDefaultIdentityDomain = local.identity_domain_name == "Default" ? true : false
7+
}
8+
9+
data "oci_identity_domains" "domains" {
10+
count = local.isDefaultIdentityDomain ? 0 : 1
11+
12+
#Required
13+
compartment_id = var.tenancy_id # dynamic groups exist in the parent compartment.
14+
15+
#Optional
16+
display_name = var.identity_domain_name
17+
#home_region_url = var.domain_home_region_url ## TODO: provide the home region
18+
#is_hidden_on_login = var.domain_is_hidden_on_login
19+
#license_type = var.domain_license_type
20+
#name = var.domain_name
21+
#state = var.domain_state
22+
#type = var.domain_type
23+
#url = var.domain_url
24+
25+
provider = oci.home
26+
}

‎modules/iam/group-autoscaling.tf‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,26 +15,26 @@ locals {
1515
])) : local.autoscaler_compartment_rule
1616

1717
autoscaler_templates = [
18-
"Allow dynamic-group %v to manage cluster-node-pools in compartment id %v",
19-
"Allow dynamic-group %v to manage compute-management-family in compartment id %v",
20-
"Allow dynamic-group %v to manage instance-family in compartment id %v",
21-
"Allow dynamic-group %v to manage volume-family in compartment id %v",
22-
"Allow dynamic-group %v to use subnets in compartment id %v",
23-
"Allow dynamic-group %v to read virtual-network-family in compartment id %v",
24-
"Allow dynamic-group %v to use vnics in compartment id %v",
25-
"Allow dynamic-group %v to inspect compartments in compartment id %v",
18+
"Allow dynamic-group '%v'/'%v' to manage cluster-node-pools in compartment id %v",
19+
"Allow dynamic-group '%v'/'%v' to manage compute-management-family in compartment id %v",
20+
"Allow dynamic-group '%v'/'%v' to manage instance-family in compartment id %v",
21+
"Allow dynamic-group '%v'/'%v' to manage volume-family in compartment id %v",
22+
"Allow dynamic-group '%v'/'%v' to use subnets in compartment id %v",
23+
"Allow dynamic-group '%v'/'%v' to read virtual-network-family in compartment id %v",
24+
"Allow dynamic-group '%v'/'%v' to use vnics in compartment id %v",
25+
"Allow dynamic-group '%v'/'%v' to inspect compartments in compartment id %v",
2626
]
2727

2828
autoscaler_policy_statements = var.create_iam_autoscaler_policy ? tolist([
2929
for statement in local.autoscaler_templates : formatlist(statement,
30-
local.autoscaler_group_name, local.worker_compartments,
30+
local.identity_domain_name, local.autoscaler_group_name, local.worker_compartments,
3131
)
3232
]) : []
3333
}
3434

3535
resource "oci_identity_dynamic_group" "autoscaling" {
3636
provider = oci.home
37-
count = var.create_iam_resources && var.create_iam_autoscaler_policy ? 1 : 0
37+
count = var.create_iam_resources && var.create_iam_autoscaler_policy && local.isDefaultIdentityDomain ? 1 : 0
3838
compartment_id = var.tenancy_id # dynamic groups exist in root compartment (tenancy)
3939
description = format("Dynamic group of cluster autoscaler-capable worker nodes for OKE Terraform state %v", var.state_id)
4040
matching_rule = local.autoscaler_group_rules
@@ -45,3 +45,18 @@ resource "oci_identity_dynamic_group" "autoscaling" {
4545
ignore_changes = [defined_tags, freeform_tags]
4646
}
4747
}
48+
49+
resource "oci_identity_domains_dynamic_resource_group" "autoscaling" {
50+
provider = oci.home
51+
count = var.create_iam_resources && var.create_iam_autoscaler_policy && !local.isDefaultIdentityDomain ? 1 : 0
52+
#Optional
53+
description = format("Dynamic group of cluster autoscaler-capable worker nodes for OKE Terraform state %v", var.state_id)
54+
#Required
55+
matching_rule = local.autoscaler_group_rules
56+
display_name = local.autoscaler_group_name
57+
idcs_endpoint = data.oci_identity_domains.domains[0].domains[0]["url"]
58+
schemas = [
59+
"urn:ietf:params:scim:schemas:oracle:idcs:DynamicResourceGroup",
60+
"urn:ietf:params:scim:schemas:oracle:idcs:extension:OCITags"
61+
]
62+
}

‎modules/iam/group-cluster.tf‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,14 @@ locals {
1212

1313
# Cluster secrets encryption using OCI Key Management System (KMS)
1414
cluster_policy_statements = coalesce(var.cluster_kms_key_id, "none") != "none" ? tolist([format(
15-
"Allow dynamic-group %v to use keys in compartment id %v where target.key.id = '%v'",
16-
local.cluster_group_name, var.compartment_id, var.cluster_kms_key_id,
15+
"Allow dynamic-group '%v'/'%v' to use keys in compartment id %v where target.key.id = '%v'",
16+
local.identity_domain_name, local.cluster_group_name, var.compartment_id, var.cluster_kms_key_id,
1717
)]) : []
1818
}
1919

2020
resource "oci_identity_dynamic_group" "cluster" {
2121
provider = oci.home
22-
count = var.create_iam_resources && var.create_iam_kms_policy ? 1 : 0
22+
count = var.create_iam_resources && var.create_iam_kms_policy && local.isDefaultIdentityDomain ? 1 : 0
2323
compartment_id = var.tenancy_id # dynamic groups exist in root compartment (tenancy)
2424
description = format("Dynamic group with cluster for OKE Terraform state %v", var.state_id)
2525
matching_rule = local.cluster_rule
@@ -30,3 +30,18 @@ resource "oci_identity_dynamic_group" "cluster" {
3030
ignore_changes = [defined_tags, freeform_tags]
3131
}
3232
}
33+
34+
resource "oci_identity_domains_dynamic_resource_group" "cluster" {
35+
provider = oci.home
36+
count = var.create_iam_resources && var.create_iam_kms_policy && !local.isDefaultIdentityDomain ? 1 : 0
37+
#Optional
38+
description = format("Dynamic group with cluster for OKE Terraform state %v", var.state_id)
39+
#Required
40+
matching_rule = local.cluster_rule
41+
display_name = local.cluster_group_name
42+
idcs_endpoint = data.oci_identity_domains.domains[0].domains[0]["url"]
43+
schemas = [
44+
"urn:ietf:params:scim:schemas:oracle:idcs:DynamicResourceGroup",
45+
"urn:ietf:params:scim:schemas:oracle:idcs:extension:OCITags"
46+
]
47+
}

‎modules/iam/group-operator.tf‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ locals {
99
])) : "ALL {instance.compartment.id = '${var.compartment_id}'}"
1010

1111
cluster_manage_statement = format(
12-
"Allow dynamic-group %v to MANAGE clusters in compartment id %v",
13-
local.operator_group_name, var.compartment_id,
12+
"Allow dynamic-group '%v'/'%v' to MANAGE clusters in compartment id %v",
13+
local.identity_domain_name ,local.operator_group_name, var.compartment_id,
1414
)
1515

1616
# TODO support keys defined at worker group level
@@ -33,7 +33,7 @@ locals {
3333

3434
resource "oci_identity_dynamic_group" "operator" {
3535
provider = oci.home
36-
count = var.create_iam_resources && var.create_iam_operator_policy ? 1 : 0
36+
count = var.create_iam_resources && var.create_iam_operator_policy && local.isDefaultIdentityDomain ? 1 : 0
3737
compartment_id = var.tenancy_id # dynamic groups exist in root compartment (tenancy)
3838
description = format("Dynamic group of operator instance(s) for OKE Terraform state %v", var.state_id)
3939
matching_rule = local.operator_group_rules
@@ -44,3 +44,18 @@ resource "oci_identity_dynamic_group" "operator" {
4444
ignore_changes = [defined_tags, freeform_tags]
4545
}
4646
}
47+
48+
resource "oci_identity_domains_dynamic_resource_group" "operator" {
49+
provider = oci.home
50+
count = var.create_iam_resources && var.create_iam_operator_policy && !local.isDefaultIdentityDomain ? 1 : 0
51+
#Optional
52+
description = format("Dynamic group of operator instance(s) for OKE Terraform state %v", var.state_id)
53+
#Required
54+
matching_rule = local.operator_group_rules
55+
display_name = local.operator_group_name
56+
idcs_endpoint = data.oci_identity_domains.domains[0].domains[0]["url"]
57+
schemas = [
58+
"urn:ietf:params:scim:schemas:oracle:idcs:DynamicResourceGroup",
59+
"urn:ietf:params:scim:schemas:oracle:idcs:extension:OCITags"
60+
]
61+
}

‎modules/iam/group-workers.tf‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,15 @@ locals {
1818
])))
1919

2020
cluster_join_statements = formatlist(
21-
"Allow dynamic-group %v to {CLUSTER_JOIN} in compartment id %v where %v",
22-
local.worker_group_name, local.worker_compartments, local.cluster_join_where_clause
21+
"Allow dynamic-group '%v'/'%v' to {CLUSTER_JOIN} in compartment id %v where %v",
22+
local.identity_domain_name, local.worker_group_name, local.worker_compartments, local.cluster_join_where_clause
2323
)
2424

2525
# TODO support keys defined at worker group level
2626
worker_kms_volume_templates = tolist([
2727
"Allow service oke to USE key-delegates in compartment id %v where target.key.id = '%v'",
2828
"Allow service blockstorage to USE keys in compartment id %v where target.key.id = '%v'",
29-
"Allow dynamic-group ${local.worker_group_name} to USE key-delegates in compartment id %v where target.key.id = '%v'"
29+
"Allow dynamic-group '${local.identity_domain_name}'/'${local.worker_group_name}' to USE key-delegates in compartment id %v where target.key.id = '%v'"
3030
])
3131

3232
# Block volume encryption using OCI Key Management System (KMS)
@@ -43,7 +43,7 @@ locals {
4343

4444
resource "oci_identity_dynamic_group" "workers" {
4545
provider = oci.home
46-
count = var.create_iam_resources && var.create_iam_worker_policy ? 1 : 0
46+
count = var.create_iam_resources && var.create_iam_worker_policy && local.isDefaultIdentityDomain ? 1 : 0
4747
compartment_id = var.tenancy_id # dynamic groups exist in root compartment (tenancy)
4848
description = format("Dynamic group of self-managed worker nodes for OKE Terraform state %v", var.state_id)
4949
matching_rule = local.worker_group_rules
@@ -54,3 +54,18 @@ resource "oci_identity_dynamic_group" "workers" {
5454
ignore_changes = [defined_tags, freeform_tags]
5555
}
5656
}
57+
58+
resource "oci_identity_domains_dynamic_resource_group" "workers" {
59+
provider = oci.home
60+
count = var.create_iam_resources && var.create_iam_worker_policy && !local.isDefaultIdentityDomain ? 1 : 0
61+
#Optional
62+
description = format("Dynamic group of self-managed worker nodes for OKE Terraform state %v", var.state_id)
63+
#Required
64+
matching_rule = local.worker_group_rules
65+
display_name = local.worker_group_name
66+
idcs_endpoint = data.oci_identity_domains.domains[0].domains[0]["url"]
67+
schemas = [
68+
"urn:ietf:params:scim:schemas:oracle:idcs:DynamicResourceGroup",
69+
"urn:ietf:params:scim:schemas:oracle:idcs:extension:OCITags"
70+
]
71+
}

‎modules/iam/outputs.tf‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,17 @@
33

44
output "dynamic_group_ids" {
55
description = "Cluster IAM dynamic group IDs"
6-
value = local.has_policy_statements ? compact([
7-
one(oci_identity_dynamic_group.cluster[*].id),
8-
one(oci_identity_dynamic_group.workers[*].id),
9-
one(oci_identity_dynamic_group.autoscaling[*].id),
10-
one(oci_identity_dynamic_group.operator[*].id),
11-
]) : null
6+
value = local.has_policy_statements && local.isDefaultIdentityDomain ? compact([
7+
one(oci_identity_dynamic_group.cluster[*].id),
8+
one(oci_identity_dynamic_group.workers[*].id),
9+
one(oci_identity_dynamic_group.autoscaling[*].id),
10+
one(oci_identity_dynamic_group.operator[*].id),
11+
]) : local.has_policy_statements && !local.isDefaultIdentityDomain ? compact([
12+
one(oci_identity_domains_dynamic_resource_group.cluster[*].id),
13+
one(oci_identity_domains_dynamic_resource_group.workers[*].id),
14+
one(oci_identity_domains_dynamic_resource_group.autoscaling[*].id),
15+
one(oci_identity_domains_dynamic_resource_group.operator[*].id),
16+
]) : null
1217
}
1318

1419
output "policy_statements" {

0 commit comments

Comments
 (0)