From 9052e2e4e7fa0da56576a1a6a96f3bec56853af1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Tue, 17 Mar 2026 10:29:35 +0000 Subject: [PATCH] Add information about CI/CD seup for other stages --- fast/stages/0-org-setup/README.md | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/fast/stages/0-org-setup/README.md b/fast/stages/0-org-setup/README.md index 564f19857..a30fbb9b4 100644 --- a/fast/stages/0-org-setup/README.md +++ b/fast/stages/0-org-setup/README.md @@ -681,7 +681,7 @@ CI/CD support is implemented via two different sets of configurations: The default approach is to define a Workload Identity provider in the `iac-0` project, or in an additional project dedicated to this task. This is achieved by adding a `workload_identity_pools` block to the project configuration, like in the following example. ```yaml -# projects/iac-0.yaml +# projects/core/iac-0.yaml workload_identity_pools: default: @@ -703,6 +703,34 @@ workload_identity_pools: The above configuration can be easily extended to support multiple pools and providers, and is not limited to OpenId Connect but can also leverage other provider types. Check the project module or project schema for the full interface. +In the `iac-0` project you can find a sample configuration for 0-org-setup stage service accounts dedicated for CI/CD operations: + +```yaml +# projects/core/iac-0.yaml + +service_accounts: + # IaC service accounts for this stage + iac-org-ro: + display_name: IaC service account for org setup (read-only). + iac-org-rw: + display_name: IaC service account for org setup (read-write). + # CI/CD service accounts for this stage + iac-org-cicd-ro: + display_name: IaC service account for org setup CI/CD (read-only). + iam_sa_roles: + $service_account_ids:iac-0/iac-org-ro: + - roles/iam.workloadIdentityUser + - roles/iam.serviceAccountTokenCreator + iac-org-cicd-rw: + display_name: IaC service account for org setup CI/CD (read-write). + iam_sa_roles: + $service_account_ids:iac-0/iac-org-rw: + - roles/iam.workloadIdentityUser + - roles/iam.serviceAccountTokenCreator +``` + +You need to extend this configuration to all other stages that you plan to use in your deployment and add permissions to IaC service account dedicated for specific stage. + Once one or more providers have been defined they can be referenced in the CI/CD configuration file. The following example defines a workflow configuration for this stage. ```yaml