63 lines
2.6 KiB
Terraform
63 lines
2.6 KiB
Terraform
|
# Project, roles and default-org lookup.
|
||
|
|
#
|
||
|
|
# ZITADEL has no group object. The plan §1.3 maps every Authentik group to a
|
||
|
|
# project role, and the groups-claim action (actions.tf) reconstructs the
|
||
|
|
# `groups` claim from those role keys. Role keys therefore EQUAL the existing
|
||
|
|
# Authentik group names, including the hyphens, so that the resulting claim is
|
||
|
|
# byte-identical and no consumer or RBAC file changes. The v4.19.2 API allows
|
||
|
|
# role keys of 1-200 characters with no character-set restriction (proto
|
||
|
|
# zitadel/project/v2/project_service.proto, AddProjectRole.role_key).
|
||
|
|
|
||
|
|
data "zitadel_org" "default" {
|
||
|
|
id = var.org_id
|
||
|
|
}
|
||
|
|
|
||
|
|
locals {
|
||
|
|
# Single source: the 19 groups of scripts/iam/provision-rbac.py GROUPS.
|
||
|
|
# Descriptions are carried over so the console reads the same as before.
|
||
|
|
roles = {
|
||
|
|
"homelab-admins" = "Cluster administrators with full access"
|
||
|
|
"minio-admins" = "MinIO administrators"
|
||
|
|
"minio-photos" = "Photos bucket (Immich) access"
|
||
|
|
"minio-documents" = "Documents bucket (Paperless) access"
|
||
|
|
"minio-backups" = "Backups bucket read-only access"
|
||
|
|
"poimen-admins" = "Poimen memory administrators"
|
||
|
|
"poimen-devs" = "Dev and staging projects access"
|
||
|
|
"poimen-prod-readonly" = "Production projects read-only access"
|
||
|
|
"paperless-admins" = "Paperless administrators"
|
||
|
|
"paperless-finance" = "Finance documents"
|
||
|
|
"paperless-legal" = "Legal documents"
|
||
|
|
"paperless-hr" = "HR documents"
|
||
|
|
"grafana-admins" = "Grafana administrators"
|
||
|
|
"grafana-editors" = "Grafana dashboard editors"
|
||
|
|
"grafana-viewers" = "Grafana dashboard viewers"
|
||
|
|
"sqs-users" = "SQS/Temporal queue read access"
|
||
|
|
"sqs-writers" = "SQS/Temporal queue read/write access"
|
||
|
|
"s3-users" = "S3 read access"
|
||
|
|
"s3-writers" = "S3 read/write access"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "zitadel_project_v2" "homelab" {
|
||
|
|
org_id = data.zitadel_org.default.id
|
||
|
|
name = var.project_name
|
||
|
|
project_id = var.project_id
|
||
|
|
project_role_check = false
|
||
|
|
|
||
|
|
# Roles must reach the tokens. Every consumer authorizes on them:
|
||
|
|
# kube-apiserver RBAC reads `groups`, MinIO reads bucket policies, Grafana
|
||
|
|
# reads grafana_org_role. Role assertion on the ID token is what most OIDC
|
||
|
|
# clients inspect.
|
||
|
|
project_role_assertion = true
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "zitadel_project_role" "groups" {
|
||
|
|
for_each = local.roles
|
||
|
|
|
||
|
|
org_id = data.zitadel_org.default.id
|
||
|
|
project_id = zitadel_project_v2.homelab.id
|
||
|
|
role_key = each.key
|
||
|
|
display_name = each.key
|
||
|
|
group = "homelab"
|
||
|
|
}
|