Skip to content

Commit a42ed88

Browse files
griseaugriseau
authored
fix: use provided service_account_name if available (#1610)
1 parent db51271 commit a42ed88

File tree

29 files changed

+118
-29
lines changed

29 files changed

+118
-29
lines changed

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,8 @@ Then perform the following commands on the root folder:
203203
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
204204
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
205205
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
206-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
206+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
207+
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
207208
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
208209
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
209210
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |

‎autogen/main/sa.tf.tmpl

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ locals {
2323
["dummy"],
2424
),
2525
)
26+
service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
27+
2628
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
2729
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
2830

@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
3941
resource "google_service_account" "cluster_service_account" {
4042
count = var.create_service_account ? 1 : 0
4143
project = var.project_id
42-
account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
44+
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4345
display_name = "Terraform-managed service account for cluster ${var.name}"
4446
}
4547

‎autogen/main/variables.tf.tmpl

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -379,7 +379,13 @@ variable "registry_project_ids" {
379379

380380
variable "service_account" {
381381
type = string
382-
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
382+
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
383+
default = ""
384+
}
385+
386+
variable "service_account_name" {
387+
type = string
388+
description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
383389
default = ""
384390
}
385391

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,8 @@ Then perform the following commands on the root folder:
120120
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
121121
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
122122
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
123-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
123+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
124+
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
124125
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
125126
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
126127
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |

‎modules/beta-autopilot-private-cluster/sa.tf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ locals {
2323
["dummy"],
2424
),
2525
)
26+
service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
27+
2628
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
2729
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
2830

@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
3941
resource "google_service_account" "cluster_service_account" {
4042
count = var.create_service_account ? 1 : 0
4143
project = var.project_id
42-
account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
44+
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4345
display_name = "Terraform-managed service account for cluster ${var.name}"
4446
}
4547

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,13 @@ variable "registry_project_ids" {
222222

223223
variable "service_account" {
224224
type = string
225-
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
225+
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
226+
default = ""
227+
}
228+
229+
variable "service_account_name" {
230+
type = string
231+
description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
226232
default = ""
227233
}
228234

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,8 @@ Then perform the following commands on the root folder:
109109
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
110110
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
111111
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
112-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
112+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
113+
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
113114
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
114115
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
115116
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |

‎modules/beta-autopilot-public-cluster/sa.tf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ locals {
2323
["dummy"],
2424
),
2525
)
26+
service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
27+
2628
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
2729
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
2830

@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
3941
resource "google_service_account" "cluster_service_account" {
4042
count = var.create_service_account ? 1 : 0
4143
project = var.project_id
42-
account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
44+
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4345
display_name = "Terraform-managed service account for cluster ${var.name}"
4446
}
4547

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,13 @@ variable "registry_project_ids" {
222222

223223
variable "service_account" {
224224
type = string
225-
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
225+
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
226+
default = ""
227+
}
228+
229+
variable "service_account_name" {
230+
type = string
231+
description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
226232
default = ""
227233
}
228234

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,8 @@ Then perform the following commands on the root folder:
254254
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
255255
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
256256
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
257-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
257+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
258+
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
258259
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
259260
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
260261
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |

‎modules/beta-private-cluster-update-variant/sa.tf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ locals {
2323
["dummy"],
2424
),
2525
)
26+
service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
27+
2628
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
2729
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
2830

@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
3941
resource "google_service_account" "cluster_service_account" {
4042
count = var.create_service_account ? 1 : 0
4143
project = var.project_id
42-
account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
44+
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4345
display_name = "Terraform-managed service account for cluster ${var.name}"
4446
}
4547

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,13 @@ variable "registry_project_ids" {
358358

359359
variable "service_account" {
360360
type = string
361-
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
361+
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
362+
default = ""
363+
}
364+
365+
variable "service_account_name" {
366+
type = string
367+
description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
362368
default = ""
363369
}
364370

‎modules/beta-private-cluster/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,8 @@ Then perform the following commands on the root folder:
232232
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
233233
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
234234
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
235-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
235+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
236+
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
236237
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
237238
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
238239
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |

‎modules/beta-private-cluster/sa.tf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ locals {
2323
["dummy"],
2424
),
2525
)
26+
service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
27+
2628
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
2729
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
2830

@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
3941
resource "google_service_account" "cluster_service_account" {
4042
count = var.create_service_account ? 1 : 0
4143
project = var.project_id
42-
account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
44+
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4345
display_name = "Terraform-managed service account for cluster ${var.name}"
4446
}
4547

0 commit comments

Comments
 (0)