Skip to content
References
tcloud
tcloud iam
tcloud iam workload-identity-federation bootstrap

iam workload-identity-federation bootstrap

tcloud iam workload-identity-federation bootstrap

Provision workload identity for GitHub, GitLab, or Kubernetes

Synopsis

Creates (when missing) a federated OIDC identity provider, a Thalassa service account, bindings to organisation role(s) and/or IAM policy(ies), and a federated identity for the workload JWT subject.

Provide at least one –role or –policy (both may be repeated and combined).

Resources are labelled thalassa.cloud/managed-by=workload-identity-bootstrap and thalassa.cloud/wif-vcs=<github|gitlab|kubernetes>.

Subcommands: github — GitHub Actions (issuer https://token.actions.githubusercontent.com) gitlab — GitLab CI id_token kubernetes — in-cluster service account JWTs

Options 

      --dry-run                       Print planned changes without calling the API
  -h, --help                          help for bootstrap
      --name string                   Base name for the Thalassa service account and federated identity (federated identity becomes <name>-fi; default: wif-<platform>-<key>)
      --no-hints                      Do not print platform hints after bootstrap
      --policy strings                IAM policy identity, slug, or name (repeatable; at least one --role or --policy required)
      --provider-description string   Optional description when creating the federated identity provider
      --provider-name string          Optional display name when creating the federated identity provider
      --role strings                  Organisation role identity, slug, or name (repeatable; at least one --role or --policy required)
      --scope strings                 Federated identity allowed scopes: api:read, api:write, kubernetes, objectStorage (default: api:read,api:write)
      --trusted-audience strings      JWT aud values to trust (repeatable; default: current context API URL, e.g. https://api.thalassa.cloud)

Options inherited from parent commands 

      --access-token string    Access Token authentication (overrides context)
      --api string             API endpoint (overrides context)
      --client-id string       OIDC client ID for OIDC authentication (overrides context)
      --client-secret string   OIDC client secret for OIDC authentication (overrides context)
  -c, --context string         Context name
      --debug                  Debug mode
      --ignore-dir-config      Ignore directory-local .thalassa defaults
  -O, --organisation string    Organisation slug or identity (overrides context)
  -P, --project string         Project identity (overrides context; slug is resolved to identity; use "root" for organisation scope)
      --token string           Personal access token (overrides context)

SEE ALSO