Skip to content

Commit 59d36b9

Browse files
apeabodyapeabody
authored
feat: add cross project fleet service agent (#1896)
1 parent 79a8d68 commit 59d36b9

File tree

27 files changed

+166
-0
lines changed

27 files changed

+166
-0
lines changed

‎autogen/main/cluster.tf.tmpl

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -584,6 +584,10 @@ resource "google_container_cluster" "primary" {
584584
}
585585
}
586586
{% endif %}
587+
{% if beta_cluster %}
588+
589+
depends_on = [google_project_iam_member.service_agent]
590+
{% endif %}
587591
}
588592
{% if autopilot_cluster != true %}
589593
/******************************************

‎autogen/main/sa.tf.tmpl

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,19 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
{% if beta_cluster %}
69+
70+
resource "google_project_service_identity" "fleet_project" {
71+
count = var.fleet_project_grant_service_agent ? 1 : 0
72+
provider = google-beta
73+
project = var.fleet_project
74+
service = "gkehub.googleapis.com"
75+
}
76+
77+
resource "google_project_iam_member" "service_agent" {
78+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
79+
project = var.project_id
80+
role = each.value
81+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
82+
}
83+
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -863,3 +863,11 @@ variable "fleet_project" {
863863
type = string
864864
default = null
865865
}
866+
{% if beta_cluster %}
867+
868+
variable "fleet_project_grant_service_agent" {
869+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
870+
type = bool
871+
default = false
872+
}
873+
{% endif %}

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ Then perform the following commands on the root folder:
9999
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
100100
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
101101
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
102+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
102103
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
103104
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
104105
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -268,4 +268,6 @@ resource "google_container_cluster" "primary" {
268268
topic = var.notification_config_topic
269269
}
270270
}
271+
272+
depends_on = [google_project_iam_member.service_agent]
271273
}

‎modules/beta-autopilot-private-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.project_id
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,3 +466,9 @@ variable "fleet_project" {
466466
type = string
467467
default = null
468468
}
469+
470+
variable "fleet_project_grant_service_agent" {
471+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
472+
type = bool
473+
default = false
474+
}

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ Then perform the following commands on the root folder:
9090
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
9191
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
9292
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
93+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
9394
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
9495
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
9596
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,4 +249,6 @@ resource "google_container_cluster" "primary" {
249249
topic = var.notification_config_topic
250250
}
251251
}
252+
253+
depends_on = [google_project_iam_member.service_agent]
252254
}

‎modules/beta-autopilot-public-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.project_id
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -436,3 +436,9 @@ variable "fleet_project" {
436436
type = string
437437
default = null
438438
}
439+
440+
variable "fleet_project_grant_service_agent" {
441+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
442+
type = bool
443+
default = false
444+
}

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ Then perform the following commands on the root folder:
212212
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
213213
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
214214
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
215+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
215216
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
216217
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
217218
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,8 @@ resource "google_container_cluster" "primary" {
500500
}
501501
}
502502
}
503+
504+
depends_on = [google_project_iam_member.service_agent]
503505
}
504506
/******************************************
505507
Create Container Cluster node pools

‎modules/beta-private-cluster-update-variant/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.project_id
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -817,3 +817,9 @@ variable "fleet_project" {
817817
type = string
818818
default = null
819819
}
820+
821+
variable "fleet_project_grant_service_agent" {
822+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
823+
type = bool
824+
default = false
825+
}

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ Then perform the following commands on the root folder:
190190
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
191191
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
192192
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
193+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
193194
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
194195
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
195196
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,8 @@ resource "google_container_cluster" "primary" {
500500
}
501501
}
502502
}
503+
504+
depends_on = [google_project_iam_member.service_agent]
503505
}
504506
/******************************************
505507
Create Container Cluster node pools

‎modules/beta-private-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.project_id
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -817,3 +817,9 @@ variable "fleet_project" {
817817
type = string
818818
default = null
819819
}
820+
821+
variable "fleet_project_grant_service_agent" {
822+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
823+
type = bool
824+
default = false
825+
}

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,7 @@ Then perform the following commands on the root folder:
203203
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
204204
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
205205
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
206+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
206207
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
207208
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
208209
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -481,6 +481,8 @@ resource "google_container_cluster" "primary" {
481481
}
482482
}
483483
}
484+
485+
depends_on = [google_project_iam_member.service_agent]
484486
}
485487
/******************************************
486488
Create Container Cluster node pools

‎modules/beta-public-cluster-update-variant/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.project_id
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -787,3 +787,9 @@ variable "fleet_project" {
787787
type = string
788788
default = null
789789
}
790+
791+
variable "fleet_project_grant_service_agent" {
792+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
793+
type = bool
794+
default = false
795+
}

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,7 @@ Then perform the following commands on the root folder:
181181
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
182182
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
183183
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
184+
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
184185
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
185186
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
186187
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -481,6 +481,8 @@ resource "google_container_cluster" "primary" {
481481
}
482482
}
483483
}
484+
485+
depends_on = [google_project_iam_member.service_agent]
484486
}
485487
/******************************************
486488
Create Container Cluster node pools

‎modules/beta-public-cluster/sa.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
6565
role = "roles/artifactregistry.reader"
6666
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6767
}
68+
69+
resource "google_project_service_identity" "fleet_project" {
70+
count = var.fleet_project_grant_service_agent ? 1 : 0
71+
provider = google-beta
72+
project = var.fleet_project
73+
service = "gkehub.googleapis.com"
74+
}
75+
76+
resource "google_project_iam_member" "service_agent" {
77+
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
78+
project = var.project_id
79+
role = each.value
80+
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
81+
}

‎modules/beta-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -787,3 +787,9 @@ variable "fleet_project" {
787787
type = string
788788
default = null
789789
}
790+
791+
variable "fleet_project_grant_service_agent" {
792+
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
793+
type = bool
794+
default = false
795+
}

0 commit comments

Comments
 (0)