Skip to content

Commit 594178c

Browse files
apeabodyapeabody
committed
feat: add cross project fleet service agent for beta clusters
1 parent 79a8d68 commit 594178c

File tree

27 files changed

+193
-0
lines changed

27 files changed

+193
-0
lines changed

‎autogen/main/outputs.tf.tmpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,3 +239,10 @@ output "fleet_membership" {
239239
description = "Fleet membership (if registered)"
240240
value = local.fleet_membership
241241
}
242+
{% if beta_cluster %}
243+
244+
output "fleet_project_service_agent_email" {
245+
description = "Fleet project service agent email (if granted)"
246+
value = try(google_project_service_identity.fleet_project[0].email, null)
247+
}
248+
{% endif %}

‎autogen/main/sa.tf.tmpl

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,19 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
{% if beta_cluster %}
69+
70+
resource "google_project_service_identity" "fleet_project" {
71+
count = var.fleet_project_grant_service_agent ? 1 : 0
72+
provider = google-beta
73+
project = var.fleet_project
74+
service = "gkehub.googleapis.com"
75+
}
76+
77+
resource "google_project_iam_member" "service_agent" {
78+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
79+
project = var.fleet_project
80+
role = each.value
81+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
82+
}
83+
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -863,3 +863,11 @@ variable "fleet_project" {
863863
type = string
864864
default = null
865865
}
866+
{% if beta_cluster %}
867+
868+
variable "fleet_project_grant_service_agent" {
869+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
870+
type = bool
871+
default = false
872+
}
873+
{% endif %}

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ Then perform the following commands on the root folder:
9999
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
100100
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
101101
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
102+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
102103
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
103104
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
104105
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
@@ -155,6 +156,7 @@ Then perform the following commands on the root folder:
155156
| dns\_cache\_enabled | Whether DNS Cache enabled |
156157
| endpoint | Cluster endpoint |
157158
| fleet\_membership | Fleet membership (if registered) |
159+
| fleet\_project\_service\_agent\_email | Fleet project service agent email (if granted) |
158160
| gateway\_api\_channel | The gateway api channel of this cluster. |
159161
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
160162
| http\_load\_balancing\_enabled | Whether http load balancing enabled |

‎modules/beta-autopilot-private-cluster/outputs.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,3 +193,8 @@ output "fleet_membership" {
193193
description = "Fleet membership (if registered)"
194194
value = local.fleet_membership
195195
}
196+
197+
output "fleet_project_service_agent_email" {
198+
description = "Fleet project service agent email (if granted)"
199+
value = try(google_project_service_identity.fleet_project[0].email, null)
200+
}

‎modules/beta-autopilot-private-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.fleet_project
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,3 +466,9 @@ variable "fleet_project" {
466466
type = string
467467
default = null
468468
}
469+
470+
variable "fleet_project_grant_service_agent" {
471+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
472+
type = bool
473+
default = false
474+
}

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ Then perform the following commands on the root folder:
9090
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
9191
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
9292
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
93+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
9394
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
9495
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
9596
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
@@ -144,6 +145,7 @@ Then perform the following commands on the root folder:
144145
| dns\_cache\_enabled | Whether DNS Cache enabled |
145146
| endpoint | Cluster endpoint |
146147
| fleet\_membership | Fleet membership (if registered) |
148+
| fleet\_project\_service\_agent\_email | Fleet project service agent email (if granted) |
147149
| gateway\_api\_channel | The gateway api channel of this cluster. |
148150
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
149151
| http\_load\_balancing\_enabled | Whether http load balancing enabled |

‎modules/beta-autopilot-public-cluster/outputs.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,3 +183,8 @@ output "fleet_membership" {
183183
description = "Fleet membership (if registered)"
184184
value = local.fleet_membership
185185
}
186+
187+
output "fleet_project_service_agent_email" {
188+
description = "Fleet project service agent email (if granted)"
189+
value = try(google_project_service_identity.fleet_project[0].email, null)
190+
}

‎modules/beta-autopilot-public-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.fleet_project
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -436,3 +436,9 @@ variable "fleet_project" {
436436
type = string
437437
default = null
438438
}
439+
440+
variable "fleet_project_grant_service_agent" {
441+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
442+
type = bool
443+
default = false
444+
}

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ Then perform the following commands on the root folder:
212212
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
213213
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
214214
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
215+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
215216
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
216217
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
217218
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
@@ -295,6 +296,7 @@ Then perform the following commands on the root folder:
295296
| dns\_cache\_enabled | Whether DNS Cache enabled |
296297
| endpoint | Cluster endpoint |
297298
| fleet\_membership | Fleet membership (if registered) |
299+
| fleet\_project\_service\_agent\_email | Fleet project service agent email (if granted) |
298300
| gateway\_api\_channel | The gateway api channel of this cluster. |
299301
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
300302
| http\_load\_balancing\_enabled | Whether http load balancing enabled |

‎modules/beta-private-cluster-update-variant/outputs.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,3 +219,8 @@ output "fleet_membership" {
219219
description = "Fleet membership (if registered)"
220220
value = local.fleet_membership
221221
}
222+
223+
output "fleet_project_service_agent_email" {
224+
description = "Fleet project service agent email (if granted)"
225+
value = try(google_project_service_identity.fleet_project[0].email, null)
226+
}

‎modules/beta-private-cluster-update-variant/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.fleet_project
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -817,3 +817,9 @@ variable "fleet_project" {
817817
type = string
818818
default = null
819819
}
820+
821+
variable "fleet_project_grant_service_agent" {
822+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
823+
type = bool
824+
default = false
825+
}

‎modules/beta-private-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ Then perform the following commands on the root folder:
190190
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
191191
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
192192
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
193+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
193194
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
194195
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
195196
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
@@ -273,6 +274,7 @@ Then perform the following commands on the root folder:
273274
| dns\_cache\_enabled | Whether DNS Cache enabled |
274275
| endpoint | Cluster endpoint |
275276
| fleet\_membership | Fleet membership (if registered) |
277+
| fleet\_project\_service\_agent\_email | Fleet project service agent email (if granted) |
276278
| gateway\_api\_channel | The gateway api channel of this cluster. |
277279
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
278280
| http\_load\_balancing\_enabled | Whether http load balancing enabled |

‎modules/beta-private-cluster/outputs.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,3 +219,8 @@ output "fleet_membership" {
219219
description = "Fleet membership (if registered)"
220220
value = local.fleet_membership
221221
}
222+
223+
output "fleet_project_service_agent_email" {
224+
description = "Fleet project service agent email (if granted)"
225+
value = try(google_project_service_identity.fleet_project[0].email, null)
226+
}

‎modules/beta-private-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.fleet_project
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -817,3 +817,9 @@ variable "fleet_project" {
817817
type = string
818818
default = null
819819
}
820+
821+
variable "fleet_project_grant_service_agent" {
822+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
823+
type = bool
824+
default = false
825+
}

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,7 @@ Then perform the following commands on the root folder:
203203
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
204204
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
205205
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
206+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
206207
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
207208
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
208209
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
@@ -284,6 +285,7 @@ Then perform the following commands on the root folder:
284285
| dns\_cache\_enabled | Whether DNS Cache enabled |
285286
| endpoint | Cluster endpoint |
286287
| fleet\_membership | Fleet membership (if registered) |
288+
| fleet\_project\_service\_agent\_email | Fleet project service agent email (if granted) |
287289
| gateway\_api\_channel | The gateway api channel of this cluster. |
288290
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
289291
| http\_load\_balancing\_enabled | Whether http load balancing enabled |

‎modules/beta-public-cluster-update-variant/outputs.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,3 +209,8 @@ output "fleet_membership" {
209209
description = "Fleet membership (if registered)"
210210
value = local.fleet_membership
211211
}
212+
213+
output "fleet_project_service_agent_email" {
214+
description = "Fleet project service agent email (if granted)"
215+
value = try(google_project_service_identity.fleet_project[0].email, null)
216+
}

‎modules/beta-public-cluster-update-variant/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.fleet_project
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -787,3 +787,9 @@ variable "fleet_project" {
787787
type = string
788788
default = null
789789
}
790+
791+
variable "fleet_project_grant_service_agent" {
792+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
793+
type = bool
794+
default = false
795+
}

‎modules/beta-public-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,7 @@ Then perform the following commands on the root folder:
181181
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
182182
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
183183
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
184+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
184185
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
185186
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
186187
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
@@ -262,6 +263,7 @@ Then perform the following commands on the root folder:
262263
| dns\_cache\_enabled | Whether DNS Cache enabled |
263264
| endpoint | Cluster endpoint |
264265
| fleet\_membership | Fleet membership (if registered) |
266+
| fleet\_project\_service\_agent\_email | Fleet project service agent email (if granted) |
265267
| gateway\_api\_channel | The gateway api channel of this cluster. |
266268
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
267269
| http\_load\_balancing\_enabled | Whether http load balancing enabled |

‎modules/beta-public-cluster/outputs.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,3 +209,8 @@ output "fleet_membership" {
209209
description = "Fleet membership (if registered)"
210210
value = local.fleet_membership
211211
}
212+
213+
output "fleet_project_service_agent_email" {
214+
description = "Fleet project service agent email (if granted)"
215+
value = try(google_project_service_identity.fleet_project[0].email, null)
216+
}

0 commit comments

Comments
 (0)