-
Notifications
You must be signed in to change notification settings - Fork 13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[CC-30333] auth: use JWT for authentication #249
Conversation
db96756
to
2d18ab4
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
2d18ab4
to
4079e87
Compare
@kathancox, requesting another round of review, as there have been further changes to the docs. Thank you! |
This one seems a bit off, but lets fix the message in another round. We can fix later. It's talking about both JWT Issuer and Invalid API key.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this looks great. Thank you. I mentioned one nit but we can wait to the next version to fix.
@pritesh-lahoti i just noticed the commit message needs to be updated with the new env var names. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Two nits, but LGTM!
docs/index.md
Outdated
@@ -20,8 +20,9 @@ provider "cockroach" { | |||
# Instructions for getting an API Key | |||
# https://www.cockroachlabs.com/docs/cockroachcloud/console-access-management.html#api-access | |||
# | |||
# The Terraform provider requires an environment variable COCKROACH_API_KEY | |||
# The Terraform provider requires either COCKROACH_API_KEY or COCKROACH_API_JWT environment variable for performing authentication. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
# The Terraform provider requires either COCKROACH_API_KEY or COCKROACH_API_JWT environment variable for performing authentication. | |
# The Terraform provider requires either the COCKROACH_API_KEY or COCKROACH_API_JWT environment variable for performing authentication. |
examples/provider/provider.tf
Outdated
@@ -5,6 +5,7 @@ provider "cockroach" { | |||
# Instructions for getting an API Key | |||
# https://www.cockroachlabs.com/docs/cockroachcloud/console-access-management.html#api-access | |||
# | |||
# The Terraform provider requires an environment variable COCKROACH_API_KEY | |||
# The Terraform provider requires either COCKROACH_API_KEY or COCKROACH_API_JWT environment variable for performing authentication. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
# The Terraform provider requires either COCKROACH_API_KEY or COCKROACH_API_JWT environment variable for performing authentication. | |
# The Terraform provider requires either the COCKROACH_API_KEY or COCKROACH_API_JWT environment variable for performing authentication. |
This PR allows using the Terraform Provider via JWT authentication, in addition to API Keys. The JWT auth mechanism requires a COCKROACH_VANITY_NAME env var capturing the vanity name of the org with the corresponding JWT Issuer. In case the JWT is issued against multiple identities, it also requires a COCKROACH_USERNAME env var capturing the user / service account to impersonate. Eventually, we will add a CI stage for running acceptance tests via this auth mechanism.
I'm going to go ahead and make these small nit changes and land the PR. There is still time to get the release out. |
This PR allows using the Terraform Provider via JWT authentication, in addition to API Keys. The JWT auth mechanism requires a CC_VANITY_NAME env capturing the vanity name of the org with the corresponding JWT Issuer. In case the JWT is issued against multiple identities, it also requires a CC_USERNAME env capturing the user / service account to impersonate. Eventually, we will add a CI stage for running acceptance tests via this auth mechanism.
Commit checklist
make generate
)