Skip to content

Commit 2c6c0db

Browse files
bharathkkbbharathkkb
committed
add gke hub registration
1 parent d778958 commit 2c6c0db

File tree

11 files changed

+140
-31
lines changed

11 files changed

+140
-31
lines changed

‎examples/simple_regional_with_asm/main.tf

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,19 @@ data "google_project" "project" {
2828
}
2929

3030
module "gke" {
31-
source = "../../modules/beta-public-cluster/"
32-
project_id = var.project_id
33-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
34-
regional = true
35-
region = var.region
36-
network = var.network
37-
subnetwork = var.subnetwork
38-
ip_range_pods = var.ip_range_pods
39-
ip_range_services = var.ip_range_services
40-
network_policy = false
41-
cluster_resource_labels={"mesh_id":"proj-${data.google_project.project.number}"}
31+
source = "../../modules/beta-public-cluster/"
32+
project_id = var.project_id
33+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
34+
regional = true
35+
#TESTING
36+
kubernetes_version = "1.15.11-gke.12"
37+
region = var.region
38+
network = var.network
39+
subnetwork = var.subnetwork
40+
ip_range_pods = var.ip_range_pods
41+
ip_range_services = var.ip_range_services
42+
network_policy = false
43+
cluster_resource_labels = { "mesh_id" : "proj-${data.google_project.project.number}" }
4244
node_pools = [
4345
{
4446
name = "asm-node-pool"

‎modules/asm/main.tf

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,33 @@ module "asm_install" {
3232
}
3333

3434
resource "google_service_account" "gke_hub_sa" {
35-
account_id = "gke-hub-sa"
36-
display_name = "Service Account"
35+
account_id = var.gke_hub_sa_name
36+
display_name = "Service Account for GKE Hub Registration"
3737
}
3838

3939
resource "google_project_iam_member" "gke_hub_member" {
4040
project = var.project_id
4141
role = "roles/gkehub.connect"
4242
member = "serviceAccount:${google_service_account.gke_hub_sa.email}"
4343
}
44+
45+
resource "google_service_account_key" "gke_hub_key" {
46+
service_account_id = google_service_account.gke_hub_sa.name
47+
}
48+
49+
module "gke_hub_registration" {
50+
source = "terraform-google-modules/gcloud/google"
51+
version = "~> 1.0"
52+
53+
platform = "linux"
54+
gcloud_sdk_version = "292.0.0"
55+
skip_download = var.skip_gcloud_download
56+
upgrade = false
57+
use_tf_google_credentials_env_var = true
58+
module_depends_on = [module.asm_install.wait]
59+
60+
create_cmd_entrypoint = "${path.module}/scripts/gke_hub_registration.sh"
61+
create_cmd_body = "${var.gke_hub_membership_name} ${var.location} ${var.cluster_name} ${google_service_account_key.gke_hub_key.private_key}"
62+
destroy_cmd_entrypoint = "gcloud"
63+
destroy_cmd_body = "container hub memberships unregister ${var.gke_hub_membership_name} --gke-cluster=${var.location}/${var.cluster_name}"
64+
}

‎modules/asm/scripts/gke_hub_registration.sh

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash
2+
# Copyright 2018 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
set -e
17+
18+
if [ "$#" -lt 4 ]; then
19+
>&2 echo "Not all expected arguments set."
20+
exit 1
21+
fi
22+
23+
MEMBERSHIP_NAME=$1
24+
CLUSTER_LOCATION=$2
25+
CLUSTER_NAME=$3
26+
SERVICE_ACCOUNT_KEY=$4
27+
28+
#write temp key, cleanup at exit
29+
tmp_file=$(mktemp)
30+
trap "rm -rf $tmp_file" EXIT
31+
echo ${SERVICE_ACCOUNT_KEY} | base64 --decode > $tmp_file
32+
33+
gcloud container hub memberships register ${MEMBERSHIP_NAME} --gke-cluster=${CLUSTER_LOCATION}/${CLUSTER_NAME} --service-account-key-file=${tmp_file} --quiet

‎modules/asm/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,4 +39,22 @@ variable "asm_release_channel" {
3939
description = "ASM Release Channel (REGULAR/RAPID/STABLE)"
4040
type = string
4141
default = "REGULAR"
42+
}
43+
44+
variable "enable_gke_hub_registration" {
45+
description = "Enables GKE Hub Registration when set to true"
46+
type = bool
47+
default = true
48+
}
49+
50+
variable "gke_hub_sa_name" {
51+
description = "Name for the GKE Hub SA stored as a secret `creds-gcp` in the `gke-connect` namespace."
52+
type = string
53+
default = "gke-hub-sa"
54+
}
55+
56+
variable "gke_hub_membership_name" {
57+
description = "Memebership name that uniquely represents the cluster being registered on the Hub"
58+
type = string
59+
default = "gke-asm-membership"
4260
}

‎test/fixtures/simple_regional_with_asm/example.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
module "example" {
1818
source = "../../../examples/simple_regional_with_asm"
1919

20-
project_id = var.project_ids[0]
20+
project_id = var.project_ids[2]
2121
cluster_name_suffix = "-${random_string.suffix.result}"
2222
region = var.region
2323
network = google_compute_network.main.name

‎test/fixtures/simple_regional_with_asm/network.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ resource "random_string" "suffix" {
2222

2323
provider "google" {
2424
version = "~> 3.16.0"
25-
project = var.project_ids[0]
25+
project = var.project_ids[2]
2626
}
2727

2828
resource "google_compute_network" "main" {

‎test/fixtures/simple_regional_with_asm/outputs.tf

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,3 @@ output "service_account" {
7878
description = "The service account to default running nodes as if not overridden in `node_pools`."
7979
value = module.example.service_account
8080
}
81-
82-
output "registry_project_id" {
83-
value = var.registry_project_id
84-
}

‎test/fixtures/simple_regional_with_asm/variables.tf

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,3 @@ variable "zones" {
2929
description = "The GCP zones to create and test resources in, for applicable tests"
3030
default = ["us-central1-a", "us-central1-b", "us-central1-c"]
3131
}
32-
33-
variable "compute_engine_service_accounts" {
34-
type = list(string)
35-
description = "The email addresses of the service account to associate with the GKE cluster"
36-
}

‎test/setup/iam.tf

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,15 +27,18 @@ locals {
2727
"roles/iam.serviceAccountUser",
2828
"roles/compute.viewer",
2929
"roles/resourcemanager.projectIamAdmin",
30-
"roles/composer.worker",
31-
"roles/gkehub.admin",
32-
"roles/iam.serviceAccountKeyAdmin",
33-
"roles/serviceusage.serviceUsageAdmin",
30+
]
31+
# roles as documented https://cloud.google.com/service-mesh/docs/gke-install-new-cluster#setting_up_your_project
32+
int_asm_required_roles = [
3433
"roles/editor",
34+
"roles/container.admin",
35+
"roles/resourcemanager.projectIamAdmin",
36+
"roles/iam.serviceAccountAdmin",
37+
"roles/iam.serviceAccountKeyAdmin",
38+
"roles/gkehub.admin",
3539
]
3640
}
3741

38-
3942
resource "random_id" "random_suffix" {
4043
byte_length = 2
4144
}
@@ -58,6 +61,12 @@ resource "google_service_account" "gke_sa_2" {
5861
display_name = "gke-sa-int-test-p2"
5962
}
6063

64+
resource "google_service_account" "gke_sa_asm" {
65+
project = module.gke-project-asm.project_id
66+
account_id = "gke-sa-int-test-asm-${random_id.random_suffix.hex}"
67+
display_name = "gke-sa-int-test-asm"
68+
}
69+
6170
resource "google_project_iam_member" "int_test_1" {
6271
count = length(local.int_required_roles)
6372

@@ -74,6 +83,14 @@ resource "google_project_iam_member" "int_test_2" {
7483
member = "serviceAccount:${google_service_account.int_test.email}"
7584
}
7685

86+
resource "google_project_iam_member" "int_test_asm" {
87+
for_each = toset(concat(local.int_required_roles, local.int_asm_required_roles))
88+
89+
project = module.gke-project-asm.project_id
90+
role = each.value
91+
member = "serviceAccount:${google_service_account.int_test.email}"
92+
}
93+
7794
resource "google_service_account_key" "int_test" {
7895
service_account_id = google_service_account.int_test.id
7996
}

‎test/setup/main.tf

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,30 @@ module "gke-project-2" {
6767
"storage-api.googleapis.com",
6868
]
6969
}
70+
71+
# apis as documented https://cloud.google.com/service-mesh/docs/gke-install-new-cluster#setting_up_your_project
72+
module "gke-project-asm" {
73+
source = "terraform-google-modules/project-factory/google"
74+
version = "~> 3.0"
75+
76+
name = "ci-gke-asm"
77+
random_project_id = true
78+
org_id = var.org_id
79+
folder_id = var.folder_id
80+
billing_account = var.billing_account
81+
82+
activate_apis = [
83+
"container.googleapis.com",
84+
"compute.googleapis.com",
85+
"monitoring.googleapis.com",
86+
"logging.googleapis.com",
87+
"meshca.googleapis.com",
88+
"meshtelemetry.googleapis.com",
89+
"meshconfig.googleapis.com",
90+
"iamcredentials.googleapis.com",
91+
"anthos.googleapis.com",
92+
"gkeconnect.googleapis.com",
93+
"gkehub.googleapis.com",
94+
"cloudresourcemanager.googleapis.com",
95+
]
96+
}

‎test/setup/outputs.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
*/
1616

1717
output "project_ids" {
18-
value = [module.gke-project-1.project_id, module.gke-project-2.project_id]
18+
value = [module.gke-project-1.project_id, module.gke-project-2.project_id, module.gke-project-asm.project_id]
1919
}
2020

2121
output "sa_key" {
@@ -24,7 +24,7 @@ output "sa_key" {
2424
}
2525

2626
output "compute_engine_service_accounts" {
27-
value = [google_service_account.gke_sa_1.email, google_service_account.gke_sa_2.email]
27+
value = [google_service_account.gke_sa_1.email, google_service_account.gke_sa_2.email, google_service_account.gke_sa_asm.email]
2828
}
2929

3030
output "registry_project_id" {

0 commit comments

Comments
 (0)