This is an automated email from the ASF dual-hosted git repository. shahar1 pushed a commit to branch runs-on-default-oidc-subject in repository https://gitbox.apache.org/repos/asf/airflow-ci-infra.git
commit 4a23cab07531b6d9eaa1316e82ccb6e30d89cb66 Author: Shahar Epstein <[email protected]> AuthorDate: Sun Oct 25 11:09:09 2026 +0200 Trust the default OIDC subject until INFRA-28572 lands GitHub has not opted apache/airflow-ci-infra into immutable OIDC subjects yet, so its tokens carry the default subject and both Terraform roles refuse the workflow with "Not authorized to perform sts:AssumeRoleWithWebIdentity". Accept the default subject next to the immutable one, and document in the README what to remove once INFRA enables the setting. --- terraform/runs-on-access/README.rst | 28 +++++++++++++++++++++++----- terraform/runs-on-access/main.tf | 16 +++++++++++++--- 2 files changed, 36 insertions(+), 8 deletions(-) diff --git a/terraform/runs-on-access/README.rst b/terraform/runs-on-access/README.rst index 5b6a428..4f3f4e1 100644 --- a/terraform/runs-on-access/README.rst +++ b/terraform/runs-on-access/README.rst @@ -55,16 +55,20 @@ Roles with a new logical-ID prefix fails its update with ``AccessDenied`` until the list in ``main.tf`` is extended. -All trust policies use GitHub's immutable OIDC subject, +All trust policies are meant to use GitHub's immutable OIDC subject, ``repo:apache@47359/airflow-ci-infra@321691041:...``, so a renamed or re-created repository -cannot match them. The GitHub OIDC provider already exists in the account (it is shared with -``apache/airflow``) and is only read here. +cannot match them. **Temporarily** (`INFRA-28572 <https://issues.apache.org/jira/browse/INFRA-28572>`_) +they also accept the default subject ``repo:apache/airflow-ci-infra:...``, because the repository +is not opted into immutable subjects yet and its tokens carry the default form; see +`Switching to the immutable subject`_. The GitHub OIDC provider already exists in the account (it +is shared with ``apache/airflow``) and is only read here. Bootstrap order --------------- -1. A repository admin opts ``apache/airflow-ci-infra`` into immutable OIDC subjects (until then - both roles refuse the workflow): +1. (Pending, INFRA-28572_.) A repository + admin opts ``apache/airflow-ci-infra`` into immutable OIDC subjects; until that happens the + roles trust the default subject as well, see `Switching to the immutable subject`_: .. code-block:: bash @@ -98,3 +102,17 @@ Bootstrap order stack (the workflow would only do it on the next push that changes ``terraform/runs-on``'s ``.tf`` files). From then on the workflow plans and applies. + +Switching to the immutable subject +---------------------------------- + +Once INFRA has enabled ``use_immutable_subject`` (check with +``gh api repos/apache/airflow-ci-infra/actions/oidc/customization/sub``), the tokens change to +the immutable form at once; the roles keep working because they trust both. Then: + +1. Remove ``"repo:apache/airflow-ci-infra"`` from ``github_subject_prefixes`` in ``main.tf`` and + delete the ``TEMPORARY`` comment above it, so only the immutable subject remains. +2. Drop this section and the "Temporarily" sentence above, and restore step 1 of the bootstrap + order to its original wording. +3. An account admin applies this module by hand (``terraform plan`` shows only the two trust + policies changing in place). diff --git a/terraform/runs-on-access/main.tf b/terraform/runs-on-access/main.tf index dc84c75..f39f32e 100644 --- a/terraform/runs-on-access/main.tf +++ b/terraform/runs-on-access/main.tf @@ -27,10 +27,20 @@ locals { # Immutable OIDC subject (owner and repository IDs next to their names), so a renamed or # re-created repository cannot match. Fork pull requests get no OIDC token at all, and the # runs-on-prod environment deploys only from main after a required reviewer approves (.asf.yaml). - github_subject = "repo:apache@47359/airflow-ci-infra@321691041" + # + # TEMPORARY (INFRA-28572): the repository is not opted into immutable subjects yet, so its tokens + # carry the default subject and the roles trust both forms. Once INFRA enables the setting, drop + # "repo:apache/airflow-ci-infra" from github_subject_prefixes and apply this module by hand + # (README, "Switching to the immutable subject"). + github_subject_prefixes = [ + "repo:apache/airflow-ci-infra", + "repo:apache@47359/airflow-ci-infra@321691041", + ] github_subjects = { - plan = ["${local.github_subject}:pull_request", "${local.github_subject}:ref:refs/heads/main"] - apply = ["${local.github_subject}:environment:runs-on-prod"] + plan = flatten([ + for s in local.github_subject_prefixes : ["${s}:pull_request", "${s}:ref:refs/heads/main"] + ]) + apply = [for s in local.github_subject_prefixes : "${s}:environment:runs-on-prod"] } # IAM names the RunsOn template generates for the runs-on stack: <stack>-<logical id>-<suffix>.
