From 292ee662b5fbb057206f3f190da5b2cd5b902db0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Wei=C3=9Fe?= <dw@edgeless.systems>
Date: Wed, 22 Nov 2023 10:17:43 +0100
Subject: [PATCH] Update CI to use different GCP project
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
---
 .github/actions/e2e_test/action.yml      |  3 ---
 .github/workflows/e2e-test-daily.yml     |  9 ++++-----
 .github/workflows/e2e-test-release.yml   |  9 ++++-----
 .github/workflows/e2e-test-tf-module.yml |  5 +++--
 .github/workflows/e2e-test-weekly.yml    |  9 ++++-----
 .github/workflows/e2e-test.yml           | 11 +++++------
 .github/workflows/e2e-upgrade.yml        | 13 ++++++-------
 dev-docs/workflows/github-actions.md     | 22 +++++-----------------
 8 files changed, 31 insertions(+), 50 deletions(-)

diff --git a/.github/actions/e2e_test/action.yml b/.github/actions/e2e_test/action.yml
index a157b2b925..cd47d1f1cf 100644
--- a/.github/actions/e2e_test/action.yml
+++ b/.github/actions/e2e_test/action.yml
@@ -37,9 +37,6 @@ inputs:
   gcpClusterCreateServiceAccount:
     description: "Service account with permissions to create a Constellation cluster on GCP."
     required: true
-  gcpInClusterServiceAccountKey:
-    description: "Service account to use inside the created Constellation cluster on GCP."
-    required: true
   awsOpenSearchDomain:
     description: "AWS OpenSearch Endpoint Domain to upload the benchmark results."
   awsOpenSearchUsers:
diff --git a/.github/workflows/e2e-test-daily.yml b/.github/workflows/e2e-test-daily.yml
index a9f77c31fd..bdb1e076a0 100644
--- a/.github/workflows/e2e-test-daily.yml
+++ b/.github/workflows/e2e-test-daily.yml
@@ -74,10 +74,9 @@ jobs:
           isDebugImage: ${{ matrix.refStream == 'ref/main/stream/debug/?' }}
           cliVersion: ${{ matrix.refStream == 'ref/release/stream/stable/?' && needs.find-latest-image.outputs.image-release-stable || '' }}
           refStream: ${{ matrix.refStream }}
-          gcpProject: ${{ secrets.GCP_E2E_PROJECT }}
-          gcpClusterCreateServiceAccount: "constellation-e2e-cluster@constellation-331613.iam.gserviceaccount.com"
-          gcpIAMCreateServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
-          gcpInClusterServiceAccountKey: ${{ secrets.GCP_CLUSTER_SERVICE_ACCOUNT }}
+          gcpProject: constellation-e2e # ${{ secrets.GCP_E2E_PROJECT }}
+          gcpClusterCreateServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com"
+          gcpIAMCreateServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
           kubernetesVersion: ${{ matrix.kubernetesVersion }}
           test: ${{ matrix.test }}
           buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }}
@@ -106,7 +105,7 @@ jobs:
         with:
           cloudProvider: ${{ matrix.provider }}
           azureCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }}
-          gcpServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
+          gcpServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
 
       - name: Notify about failure
         if: |
diff --git a/.github/workflows/e2e-test-release.yml b/.github/workflows/e2e-test-release.yml
index 681a340d2b..cb4af633a6 100644
--- a/.github/workflows/e2e-test-release.yml
+++ b/.github/workflows/e2e-test-release.yml
@@ -226,10 +226,9 @@ jobs:
           awsOpenSearchDomain: ${{ secrets.AWS_OPENSEARCH_DOMAIN }}
           awsOpenSearchUsers: ${{ secrets.AWS_OPENSEARCH_USER }}
           awsOpenSearchPwd: ${{ secrets.AWS_OPENSEARCH_PWD }}
-          gcpProject: ${{ secrets.GCP_E2E_PROJECT }}
-          gcpClusterCreateServiceAccount: "constellation-e2e-cluster@constellation-331613.iam.gserviceaccount.com"
-          gcpIAMCreateServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
-          gcpInClusterServiceAccountKey: ${{ secrets.GCP_CLUSTER_SERVICE_ACCOUNT }}
+          gcpProject: constellation-e2e # ${{ secrets.GCP_E2E_PROJECT }}
+          gcpClusterCreateServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com"
+          gcpIAMCreateServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
           test: ${{ matrix.test }}
           buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }}
           azureClusterCreateCredentials: ${{ secrets.AZURE_E2E_CLUSTER_CREDENTIALS }}
@@ -255,7 +254,7 @@ jobs:
         with:
           cloudProvider: ${{ matrix.provider }}
           azureCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }}
-          gcpServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
+          gcpServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
 
   e2e-upgrade:
     strategy:
diff --git a/.github/workflows/e2e-test-tf-module.yml b/.github/workflows/e2e-test-tf-module.yml
index 0ea8f91b7c..c55a9dbf71 100644
--- a/.github/workflows/e2e-test-tf-module.yml
+++ b/.github/workflows/e2e-test-tf-module.yml
@@ -159,7 +159,8 @@ jobs:
         run: |
           cat > terraform.tfvars <<EOF
           name = "${{ steps.create-prefix.outputs.prefix }}"
-          project = "${{ secrets.GCP_E2E_PROJECT }}"
+          # project = "${{ secrets.GCP_E2E_PROJECT }}"
+          project = "constellation-e2e"
           service_account_id = "${{ steps.create-prefix.outputs.prefix }}-sa"
           image = "${{ steps.find-latest-image.outputs.image }}"
           zone = "${{ inputs.regionZone || 'europe-west3-b' }}"
@@ -245,7 +246,7 @@ jobs:
         if: inputs.cloudProvider == 'gcp'
         uses: ./.github/actions/login_gcp
         with:
-          service_account: "constellation-e2e-tf@constellation-331613.iam.gserviceaccount.com"
+          service_account: "terraform-e2e@constellation-e2e.iam.gserviceaccount.com"
 
       - name: Apply Terraform Cluster
         id: apply_terraform
diff --git a/.github/workflows/e2e-test-weekly.yml b/.github/workflows/e2e-test-weekly.yml
index 02661cfc42..48f6fac983 100644
--- a/.github/workflows/e2e-test-weekly.yml
+++ b/.github/workflows/e2e-test-weekly.yml
@@ -243,10 +243,9 @@ jobs:
           awsOpenSearchDomain: ${{ secrets.AWS_OPENSEARCH_DOMAIN }}
           awsOpenSearchUsers: ${{ secrets.AWS_OPENSEARCH_USER }}
           awsOpenSearchPwd: ${{ secrets.AWS_OPENSEARCH_PWD }}
-          gcpProject: ${{ secrets.GCP_E2E_PROJECT }}
-          gcpClusterCreateServiceAccount: "constellation-e2e-cluster@constellation-331613.iam.gserviceaccount.com"
-          gcpIAMCreateServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
-          gcpInClusterServiceAccountKey: ${{ secrets.GCP_CLUSTER_SERVICE_ACCOUNT }}
+          gcpProject: constellation-e2e # ${{ secrets.GCP_E2E_PROJECT }}
+          gcpClusterCreateServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com"
+          gcpIAMCreateServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
           test: ${{ matrix.test }}
           buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }}
           azureClusterCreateCredentials: ${{ secrets.AZURE_E2E_CLUSTER_CREDENTIALS }}
@@ -274,7 +273,7 @@ jobs:
         with:
           cloudProvider: ${{ matrix.provider }}
           azureCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }}
-          gcpServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
+          gcpServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
 
       - name: Notify about failure
         if: |
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 99dda6b18d..99c80531a1 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -165,7 +165,7 @@ jobs:
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           ref: ${{ inputs.git-ref }}
-          
+
       - name: Get Latest Image
         id: find-latest-image
         uses: ./.github/actions/find_latest_image
@@ -215,10 +215,9 @@ jobs:
           cloudProvider: ${{ inputs.cloudProvider }}
           machineType: ${{ inputs.machineType }}
           regionZone: ${{ inputs.regionZone }}
-          gcpProject: ${{ secrets.GCP_E2E_PROJECT }}
-          gcpClusterCreateServiceAccount: "constellation-e2e-cluster@constellation-331613.iam.gserviceaccount.com"
-          gcpIAMCreateServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
-          gcpInClusterServiceAccountKey: ${{ secrets.GCP_CLUSTER_SERVICE_ACCOUNT }}
+          gcpProject: constellation-e2e # ${{ secrets.GCP_E2E_PROJECT }}
+          gcpClusterCreateServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com"
+          gcpIAMCreateServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
           test: ${{ inputs.test }}
           kubernetesVersion: ${{ inputs.kubernetesVersion }}
           awsOpenSearchDomain: ${{ secrets.AWS_OPENSEARCH_DOMAIN }}
@@ -253,4 +252,4 @@ jobs:
         with:
           cloudProvider: ${{ inputs.cloudProvider }}
           azureCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }}
-          gcpServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
+          gcpServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
diff --git a/.github/workflows/e2e-upgrade.yml b/.github/workflows/e2e-upgrade.yml
index 70d10f9d81..fa3e38bc10 100644
--- a/.github/workflows/e2e-upgrade.yml
+++ b/.github/workflows/e2e-upgrade.yml
@@ -170,10 +170,9 @@ jobs:
           isDebugImage: "false"
           cliVersion: ${{ inputs.fromVersion }}
           regionZone: ${{ inputs.regionZone }}
-          gcpProject: ${{ secrets.GCP_E2E_PROJECT }}
-          gcpClusterCreateServiceAccount: "constellation-e2e-cluster@constellation-331613.iam.gserviceaccount.com"
-          gcpIAMCreateServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
-          gcpInClusterServiceAccountKey: ${{ secrets.GCP_CLUSTER_SERVICE_ACCOUNT }}
+          gcpProject: constellation-e2e # ${{ secrets.GCP_E2E_PROJECT }}
+          gcpClusterCreateServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com"
+          gcpIAMCreateServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
           test: "upgrade"
           buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }}
           azureClusterCreateCredentials: ${{ secrets.AZURE_E2E_CLUSTER_CREDENTIALS }}
@@ -196,7 +195,7 @@ jobs:
         if: inputs.cloudProvider == 'gcp'
         uses: ./.github/actions/login_gcp
         with:
-          service_account: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
+          service_account: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
 
       - name: Login to AWS (IAM role)
         if: inputs.cloudProvider == 'aws'
@@ -226,7 +225,7 @@ jobs:
         if: always() && inputs.cloudProvider == 'gcp'
         uses: ./.github/actions/login_gcp
         with:
-          service_account: "constellation-e2e-cluster@constellation-331613.iam.gserviceaccount.com"
+          service_account: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com"
 
       - name: Login to AWS (Cluster role)
         if: always() && inputs.cloudProvider == 'aws'
@@ -297,7 +296,7 @@ jobs:
         with:
           cloudProvider: ${{ inputs.cloudProvider }}
           azureCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }}
-          gcpServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com"
+          gcpServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
 
       - name: Notify about failure
         if: |
diff --git a/dev-docs/workflows/github-actions.md b/dev-docs/workflows/github-actions.md
index 40accbdfd5..ef97ed3326 100644
--- a/dev-docs/workflows/github-actions.md
+++ b/dev-docs/workflows/github-actions.md
@@ -30,11 +30,11 @@ When using `--mode` be aware that `--e2e-focus` and `e2e-skip` will be overwritt
 
 ## Local Development
 
-Using [***act***](https://github.com/nektos/act) you can run GitHub actions locally.
+Using [`act`](https://github.com/nektos/act) you can run GitHub actions locally.
 
 **These instructions are for internal use.**
 In case you want to use the E2E actions externally, you need to adjust other configuration parameters.
-Check the assignments made in the [/.github/actions/e2e_test/action.yml](E2E action) and adjust any hard-coded values.
+Check the assignments made in the [E2E action](/.github/actions/e2e_test/action.yml) and adjust any hard-coded values.
 
 ### Specific Jobs
 
@@ -59,7 +59,7 @@ Create a new JSON file to describe the event ([relevant issue](https://github.co
 }
 ```
 
-Then run *act* with the event as input:
+Then run `act` with the event as input:
 
 ```bash
 act -j e2e-test-manual --eventpath event.json
@@ -67,20 +67,8 @@ act -j e2e-test-manual --eventpath event.json
 
 ### Authorizing GCP
 
-For creating Kubernetes clusters in GCP a local copy of the service account secret is required.
-
-1. [Create a new service account key](https://console.cloud.google.com/iam-admin/serviceaccounts/details/112741463528383500960/keys?authuser=0&project=constellation-331613&supportedpurview=project)
-2. Create a compact (one line) JSON representation of the file `jq -c`
-3. Store in a GitHub Action Secret called `GCP_SERVICE_ACCOUNT` or create a local secret file for *act* to consume:
-
-```bash
-$ cat secrets.env
-GCP_SERVICE_ACCOUNT={"type":"service_account", ... }
-
-$ act --secret-file secrets.env
-```
-
-In addition, you need to create a Service Account which Constellation itself is supposed to use. Refer to [First steps](https://docs.edgeless.systems/constellation/getting-started/first-steps#create-a-cluster) in the documentation on how to create it. What you need here specifically is the `gcpServiceAccountKey`, which needs to be stored in a secret called `GCP_CLUSTER_SERVICE_ACCOUNT`.
+For GCP, OIDC is used to authenticate the CI runner.
+This means the workflow cannot be run locally, as the runner created by `act` is not authenticated.
 
 ### Authorizing Azure