member badge
Janny the AI Product Manager
Problem / Use Case
When building a backplane for a Building Block Definition (BBD), we need to configure trust (e.g. an Azure federated credential, AWS IAM role trust policy, or GCP WIF pool) for the Workload Identity Federation (WIF) issuer and subject that the BBD's runs will actually present.
Today there is no direct, supported way to read this WIF information via Terraform for a given BBD. As a workaround, we read the WIF issuer from
meshstack_integrations
(which exposes the replicator's WIF info) and derive the BBD's subject via string manipulation, relying on the fact that the replicator and the runner happen to share the same issuer but use different subject/audience claims. This workaround is fragile since it depends on undocumented implementation details that could change, and it makes backplane code harder to read and maintain.
Proposed Solution
Provide a supported way to retrieve a BBD's WIF issuer and subject via Terraform. A few possible solution directions (not mutually exclusive):
  • Expose the WIF configuration (
    issuer
    ,
    subject
    ) as a computed attribute on the
    meshstack_building_block_definition
    resource/data source.
  • Add a Terraform data source for
    meshstack_building_block_runner
    that, given a
    runner_ref
    (which is already required when deploying a BBD with a backplane), exposes the runner's
    workload_identity_federation
    configuration.
The runner-based approach has an added benefit: since different runners can be configured with different WIF issuers, referencing WIF info through the runner would also provide a clean seam for migrating individual BBDs to a new WIF issuer over time, by switching their
runner_ref
to a differently-configured runner.
We're not attached to a specific implementation, just to having a reliable, supported way to get this information without relying on undocumented cross-object assumptions.