Skip to content
References
tcloud
tcloud iam
tcloud iam workload-identity-federation bootstrap github

iam workload-identity-federation bootstrap github

tcloud iam workload-identity-federation bootstrap github

Bootstrap workload identity for GitHub Actions

Synopsis

Creates or reuses a federated identity provider for GitHub’s OIDC issuer, then binds your repository and ref to a Thalassa service account via a federated identity.

The JWT issuer is https://token.actions.githubusercontent.com. Match subjects with –repository (owner/name), –ref-kind, and –ref (omit –ref only when –ref-kind is pull_request).

tcloud iam workload-identity-federation bootstrap github [flags]

Examples 

  # Main branch (JWT aud defaults to context API URL)
  tcloud iam workload-identity-federation bootstrap github --repository acme/api --ref main --role deployer

  # Bind IAM policies instead of (or in addition to) organisation roles
  tcloud iam workload-identity-federation bootstrap github --repository acme/api --ref main --policy ci-deploy --policy ci-read

  # Multiple organisation roles
  tcloud iam workload-identity-federation bootstrap github --repository acme/api --ref main --role deployer --role reader

  # Specific ref kind
  tcloud iam workload-identity-federation bootstrap github --repository acme/api --ref-kind branch --ref main --role deployer

  # Pull request workflows (subject repo:owner/repo:pull_request)
  tcloud iam workload-identity-federation bootstrap github --repository acme/api --ref-kind pull_request --role deployer

  # Custom Thalassa service account / federated identity names (federated identity: platform-ci-fi)
  tcloud iam workload-identity-federation bootstrap github --repository acme/api --ref main --name platform-ci --role deployer

Options 

  -h, --help                help for github
      --ref string          Branch, tag, or environment name (omit when --ref-kind pull_request)
      --ref-kind string     branch, tag, environment, or pull_request (default "branch")
      --repository string   GitHub repository as owner/name (required)

Options inherited from parent commands 

      --access-token string           Access Token authentication (overrides context)
      --api string                    API endpoint (overrides context)
      --client-id string              OIDC client ID for OIDC authentication (overrides context)
      --client-secret string          OIDC client secret for OIDC authentication (overrides context)
  -c, --context string                Context name
      --debug                         Debug mode
      --dry-run                       Print planned changes without calling the API
      --ignore-dir-config             Ignore directory-local .thalassa defaults
      --name string                   Base name for the Thalassa service account and federated identity (federated identity becomes <name>-fi; default: wif-<platform>-<key>)
      --no-hints                      Do not print platform hints after bootstrap
  -O, --organisation string           Organisation slug or identity (overrides context)
      --policy strings                IAM policy identity, slug, or name (repeatable; at least one --role or --policy required)
  -P, --project string                Project identity (overrides context; slug is resolved to identity; use "root" for organisation scope)
      --provider-description string   Optional description when creating the federated identity provider
      --provider-name string          Optional display name when creating the federated identity provider
      --role strings                  Organisation role identity, slug, or name (repeatable; at least one --role or --policy required)
      --scope strings                 Federated identity allowed scopes: api:read, api:write, kubernetes, objectStorage (default: api:read,api:write)
      --token string                  Personal access token (overrides context)
      --trusted-audience strings      JWT aud values to trust (repeatable; default: current context API URL, e.g. https://api.thalassa.cloud)

SEE ALSO