Skip to content

Commit 4fab404

Browse files
jullianowjullianow
authored
feat: Adding extra permissions to the cluster's default service account (#1943)
Signed-off-by: Julliano Goncalves <[email protected]>
1 parent 7290ee0 commit 4fab404

File tree

10 files changed

+140
-0
lines changed
  • autogen/main
  • modules
    • beta-autopilot-private-cluster
    • beta-autopilot-public-cluster
    • beta-private-cluster
    • beta-private-cluster-update-variant
    • beta-public-cluster
    • beta-public-cluster-update-variant
    • private-cluster
    • private-cluster-update-variant
  • sa.tf

10 files changed

+140
-0
lines changed

‎autogen/main/sa.tf.tmpl

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

‎modules/beta-autopilot-private-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

‎modules/beta-autopilot-public-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

‎modules/beta-private-cluster-update-variant/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

‎modules/beta-private-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

‎modules/beta-public-cluster-update-variant/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

‎modules/beta-public-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

‎modules/private-cluster-update-variant/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

‎modules/private-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

‎sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,20 @@ resource "google_project_iam_member" "cluster_service_account-nodeService_accoun
5252
member = google_service_account.cluster_service_account[0].member
5353
}
5454

55+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
56+
count = var.create_service_account ? 1 : 0
57+
project = google_service_account.cluster_service_account[0].project
58+
role = "roles/monitoring.metricWriter"
59+
member = google_service_account.cluster_service_account[0].member
60+
}
61+
62+
resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" {
63+
count = var.create_service_account ? 1 : 0
64+
project = google_service_account.cluster_service_account[0].project
65+
role = "roles/stackdriver.resourceMetadata.writer"
66+
member = google_service_account.cluster_service_account[0].member
67+
}
68+
5569
resource "google_project_iam_member" "cluster_service_account-gcr" {
5670
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
5771
project = each.key

0 commit comments

Comments
 (0)