WIP

Jberlinsky · Jberlinsky · commit 093b22928e95 · 2019-02-13T09:47:26.000-05:00
diff --git a/autogen/cluster_regional.tf b/autogen/cluster_regional.tf
@@ -81,7 +81,7 @@ resource "google_container_cluster" "primary" {
     name = "default-pool"
 
     node_config {
-      service_account = "${lookup(var.node_pools[0], "service_account", var.service_account)}"
+      service_account = "${lookup(var.node_pools[0], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"
     }
   }
 {% if private_cluster %}
@@ -127,7 +127,7 @@ resource "google_container_node_pool" "pools" {
 
     disk_size_gb    = "${lookup(var.node_pools[count.index], "disk_size_gb", 100)}"
     disk_type       = "${lookup(var.node_pools[count.index], "disk_type", "pd-standard")}"
-    service_account = "${lookup(var.node_pools[count.index], "service_account", var.service_account)}"
+    service_account = "${lookup(var.node_pools[count.index], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"
     preemptible     = "${lookup(var.node_pools[count.index], "preemptible", false)}"
 
     oauth_scopes = [
diff --git a/autogen/cluster_zonal.tf b/autogen/cluster_zonal.tf
@@ -81,7 +81,7 @@ resource "google_container_cluster" "zonal_primary" {
     name = "default-pool"
 
     node_config {
-      service_account = "${lookup(var.node_pools[0], "service_account", var.service_account)}"
+      service_account = "${lookup(var.node_pools[0], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"
     }
   }
 {% if private_cluster %}
@@ -127,7 +127,7 @@ resource "google_container_node_pool" "zonal_pools" {
 
     disk_size_gb    = "${lookup(var.node_pools[count.index], "disk_size_gb", 100)}"
     disk_type       = "${lookup(var.node_pools[count.index], "disk_type", "pd-standard")}"
-    service_account = "${lookup(var.node_pools[count.index], "service_account", var.service_account)}"
+    service_account = "${lookup(var.node_pools[count.index], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"
     preemptible     = "${lookup(var.node_pools[count.index], "preemptible", false)}"
 
     oauth_scopes = [
diff --git a/autogen/sa.tf b/autogen/sa.tf
@@ -0,0 +1,23 @@
+/**
+ * Copyright 2018 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+{{ autogeneration_note }}
+
+resource "google_service_account" "cluster_service_account" {
+  count = "${(var.service_account == "create") ? 1 : 0}"
+  account_id = "tf-gke-${var.name}"
+  display_name = "Terraform-managed service account for cluster ${var.name}"
+}
diff --git a/autogen/variables.tf b/autogen/variables.tf
@@ -208,7 +208,7 @@ variable "monitoring_service" {
 }
 
 variable "service_account" {
-  description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account"
+  description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account. May also specify `create` to automatically create a cluster-specific service account"
   default     = ""
 }
 {% if private_cluster %}
diff --git a/cluster_regional.tf b/cluster_regional.tf
@@ -81,7 +81,7 @@ resource "google_container_cluster" "primary" {
     name = "default-pool"
 
     node_config {
-      service_account = "${lookup(var.node_pools[0], "service_account", var.service_account)}"
+      service_account = "${lookup(var.node_pools[0], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"
     }
   }
 
@@ -121,7 +121,7 @@ resource "google_container_node_pool" "pools" {
 
     disk_size_gb    = "${lookup(var.node_pools[count.index], "disk_size_gb", 100)}"
     disk_type       = "${lookup(var.node_pools[count.index], "disk_type", "pd-standard")}"
-    service_account = "${lookup(var.node_pools[count.index], "service_account", var.service_account)}"
+    service_account = "${lookup(var.node_pools[count.index], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"
     preemptible     = "${lookup(var.node_pools[count.index], "preemptible", false)}"
 
     oauth_scopes = [
diff --git a/cluster_zonal.tf b/cluster_zonal.tf
@@ -81,7 +81,7 @@ resource "google_container_cluster" "zonal_primary" {
     name = "default-pool"
 
     node_config {
-      service_account = "${lookup(var.node_pools[0], "service_account", var.service_account)}"
+      service_account = "${lookup(var.node_pools[0], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"
     }
   }
 
@@ -121,7 +121,7 @@ resource "google_container_node_pool" "zonal_pools" {
 
     disk_size_gb    = "${lookup(var.node_pools[count.index], "disk_size_gb", 100)}"
     disk_type       = "${lookup(var.node_pools[count.index], "disk_type", "pd-standard")}"
-    service_account = "${lookup(var.node_pools[count.index], "service_account", var.service_account)}"
+    service_account = "${lookup(var.node_pools[count.index], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"
     preemptible     = "${lookup(var.node_pools[count.index], "preemptible", false)}"
 
     oauth_scopes = [
diff --git a/examples/simple_zonal/main.tf b/examples/simple_zonal/main.tf
@@ -34,7 +34,7 @@ module "gke" {
   subnetwork        = "${var.subnetwork}"
   ip_range_pods     = "${var.ip_range_pods}"
   ip_range_services = "${var.ip_range_services}"
-  service_account   = "${var.compute_engine_service_account}"
+  service_account   = "create"
 }
 
 data "google_client_config" "default" {}
diff --git a/examples/simple_zonal/variables.tf b/examples/simple_zonal/variables.tf
@@ -51,7 +51,3 @@ variable "ip_range_pods" {
 variable "ip_range_services" {
   description = "The secondary ip range to use for pods"
 }
-
-variable "compute_engine_service_account" {
-  description = "Service account to associate to the nodes in the cluster"
-}
diff --git a/sa.tf b/sa.tf
@@ -0,0 +1,23 @@
+/**
+ * Copyright 2018 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// This file was automatically generated from a template in ./autogen
+
+resource "google_service_account" "cluster_service_account" {
+  count = "${(var.service_account == "create") ? 1 : 0}"
+  account_id = "tf-gke-${var.name}"
+  display_name = "Terraform-managed service account for cluster ${var.name}"
+}
diff --git a/test/fixtures/simple_zonal/example.tf b/test/fixtures/simple_zonal/example.tf
@@ -26,5 +26,4 @@ module "example" {
   subnetwork                     = "${google_compute_subnetwork.main.name}"
   ip_range_pods                  = "${google_compute_subnetwork.main.secondary_ip_range.0.range_name}"
   ip_range_services              = "${google_compute_subnetwork.main.secondary_ip_range.1.range_name}"
-  compute_engine_service_account = "${var.compute_engine_service_account}"
 }
diff --git a/test/integration/simple_zonal/controls/gcloud.rb b/test/integration/simple_zonal/controls/gcloud.rb
@@ -79,6 +79,10 @@
     describe "node pool" do
       let(:node_pools) { data['nodePools'].reject { |p| p['name'] == "default-pool" } }
 
+      it "uses an automatically created service account" do
+        raise node_pools.to_json.inspect
+      end
+
       it "has autoscaling enabled" do
         expect(node_pools).to include(
           including(
diff --git a/variables.tf b/variables.tf
@@ -208,6 +208,6 @@ variable "monitoring_service" {
 }
 
 variable "service_account" {
-  description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account"
+  description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account. May also specify `create` to automatically create a cluster-specific service account"
   default     = ""
 }

Original file line number	Diff line number	Diff line change
`@@ -81,7 +81,7 @@ resource "google_container_cluster" "primary" {`
`81`	`81`	`name = "default-pool"`
`82`	`82`
`83`	`83`	`node_config {`
`84`		`- service_account = "${lookup(var.node_pools[0], "service_account", var.service_account)}"`
	`84`	`+ service_account = "${lookup(var.node_pools[0], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"`
`85`	`85`	`}`
`86`	`86`	`}`
`87`	`87`	`{% if private_cluster %}`
`@@ -127,7 +127,7 @@ resource "google_container_node_pool" "pools" {`
`127`	`127`
`128`	`128`	`disk_size_gb = "${lookup(var.node_pools[count.index], "disk_size_gb", 100)}"`
`129`	`129`	`disk_type = "${lookup(var.node_pools[count.index], "disk_type", "pd-standard")}"`
`130`		`- service_account = "${lookup(var.node_pools[count.index], "service_account", var.service_account)}"`
	`130`	`+ service_account = "${lookup(var.node_pools[count.index], "service_account", (var.service_account == "create") ? element(concat(google_service_account.cluster_service_account.*.email, list("")), 0) : var.service_account)}"`
`131`	`131`	`preemptible = "${lookup(var.node_pools[count.index], "preemptible", false)}"`
`132`	`132`
`133`	`133`	`oauth_scopes = [`
Original file line number	Diff line number	Diff line change
`@@ -208,7 +208,7 @@ variable "monitoring_service" {`
`208`	`208`	`}`
`209`	`209`
`210`	`210`	`variable "service_account" {`
`211`		- description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account"
	`211`	+ description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account. May also specify `create` to automatically create a cluster-specific service account"
`212`	`212`	`default = ""`
`213`	`213`	`}`
`214`	`214`	`{% if private_cluster %}`
Original file line number	Diff line number	Diff line change
`@@ -34,7 +34,7 @@ module "gke" {`
`34`	`34`	`subnetwork = "${var.subnetwork}"`
`35`	`35`	`ip_range_pods = "${var.ip_range_pods}"`
`36`	`36`	`ip_range_services = "${var.ip_range_services}"`
`37`		`- service_account = "${var.compute_engine_service_account}"`
	`37`	`+ service_account = "create"`
`38`	`38`	`}`
`39`	`39`
`40`	`40`	`data "google_client_config" "default" {}`
Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,3 @@ variable "ip_range_pods" {`
`51`	`51`	`variable "ip_range_services" {`
`52`	`52`	`description = "The secondary ip range to use for pods"`
`53`	`53`	`}`
`54`		`-`
`55`		`-variable "compute_engine_service_account" {`
`56`		`- description = "Service account to associate to the nodes in the cluster"`
`57`		`-}`
Original file line number	Diff line number	Diff line change
`@@ -26,5 +26,4 @@ module "example" {`
`26`	`26`	`subnetwork = "${google_compute_subnetwork.main.name}"`
`27`	`27`	`ip_range_pods = "${google_compute_subnetwork.main.secondary_ip_range.0.range_name}"`
`28`	`28`	`ip_range_services = "${google_compute_subnetwork.main.secondary_ip_range.1.range_name}"`
`29`		`- compute_engine_service_account = "${var.compute_engine_service_account}"`
`30`	`29`	`}`
Original file line number	Diff line number	Diff line change
`@@ -208,6 +208,6 @@ variable "monitoring_service" {`
`208`	`208`	`}`
`209`	`209`
`210`	`210`	`variable "service_account" {`
`211`		- description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account"
	`211`	+ description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account. May also specify `create` to automatically create a cluster-specific service account"
`212`	`212`	`default = ""`
`213`	`213`	`}`