Skip to content

Commit ed58124

Browse files
morgantemorgante
authored
Merge pull request #225 from kopachevsky/fix/27/dynamic-sa
Bugfix: Can not use dynamic Service Account #27
2 parents 1ce3e62 + 7a4f7e6 commit ed58124

File tree

34 files changed

+165
-113
lines changed

34 files changed

+165
-113
lines changed

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ SHELL := /usr/bin/env bash
1818
# Docker build config variables
1919
CREDENTIALS_PATH ?= /cft/workdir/credentials.json
2020
DOCKER_ORG := gcr.io/cloud-foundation-cicd
21-
DOCKER_TAG_BASE_KITCHEN_TERRAFORM ?= 2.1.0
21+
DOCKER_TAG_BASE_KITCHEN_TERRAFORM ?= 2.3.0
2222
DOCKER_REPO_BASE_KITCHEN_TERRAFORM := ${DOCKER_ORG}/cft/kitchen-terraform:${DOCKER_TAG_BASE_KITCHEN_TERRAFORM}
2323

2424
# All is the first target in the file so it will get picked up when you just run 'make' on its own

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
134134
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | string | `""` | no |
135135
| cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | map(string) | `<map>` | no |
136136
| configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | string | `"false"` | no |
137+
| create\_service\_account | Defines if service account specified to run nodes should be created. | bool | `"true"` | no |
137138
| description | The description of the cluster | string | `""` | no |
138139
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | bool | `"true"` | no |
139140
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |
@@ -167,7 +168,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
167168
| region | The region to host the cluster in (required) | string | n/a | yes |
168169
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
169170
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
170-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The default value will cause a cluster-specific service account to be created. | string | `"create"` | no |
171+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
171172
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map(list(string)) | `<map>` | no |
172173
| subnetwork | The subnetwork to host the cluster in (required) | string | n/a | yes |
173174
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | list | `<list>` | no |

‎autogen/outputs.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ output "endpoint" {
4545
sensitive = true
4646
description = "Cluster endpoint"
4747
value = local.cluster_endpoint
48-
depends_on = [
48+
depends_on = [
4949
/* Nominally, the endpoint is populated as soon as it is known to Terraform.
5050
* However, the cluster may not be in a usable state yet. Therefore any
5151
* resources dependent on the cluster being up will fail to deploy. With

‎autogen/sa.tf

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ locals {
2323
["dummy"],
2424
),
2525
)
26-
service_account = var.service_account == "create" ? element(local.service_account_list, 0) : var.service_account
26+
// if user set var.service_accont it will be used even if var.create_service_account==true, so service account will be created but not used
27+
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? element(local.service_account_list, 0) : var.service_account
2728
}
2829

2930
resource "random_string" "cluster_service_account_suffix" {
@@ -34,28 +35,28 @@ resource "random_string" "cluster_service_account_suffix" {
3435
}
3536

3637
resource "google_service_account" "cluster_service_account" {
37-
count = var.service_account == "create" ? 1 : 0
38+
count = var.create_service_account ? 1 : 0
3839
project = var.project_id
3940
account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
4041
display_name = "Terraform-managed service account for cluster ${var.name}"
4142
}
4243

4344
resource "google_project_iam_member" "cluster_service_account-log_writer" {
44-
count = var.service_account == "create" ? 1 : 0
45+
count = var.create_service_account ? 1 : 0
4546
project = google_service_account.cluster_service_account[0].project
4647
role = "roles/logging.logWriter"
4748
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
4849
}
4950

5051
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
51-
count = var.service_account == "create" ? 1 : 0
52+
count = var.create_service_account ? 1 : 0
5253
project = google_project_iam_member.cluster_service_account-log_writer[0].project
5354
role = "roles/monitoring.metricWriter"
5455
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
5556
}
5657

5758
resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" {
58-
count = var.service_account == "create" ? 1 : 0
59+
count = var.create_service_account ? 1 : 0
5960
project = google_project_iam_member.cluster_service_account-metric_writer[0].project
6061
role = "roles/monitoring.viewer"
6162
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"

‎autogen/variables.tf

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -255,10 +255,16 @@ variable "monitoring_service" {
255255
default = "monitoring.googleapis.com"
256256
}
257257

258+
variable "create_service_account" {
259+
type = bool
260+
description = "Defines if service account specified to run nodes should be created."
261+
default = true
262+
}
263+
258264
variable "service_account" {
259265
type = string
260-
description = "The service account to run nodes as if not overridden in `node_pools`. The default value will cause a cluster-specific service account to be created."
261-
default = "create"
266+
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
267+
default = ""
262268
}
263269

264270
variable "basic_auth_username" {

‎examples/deploy_service/main.tf

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,10 @@ module "gke" {
4646
network = var.network
4747
subnetwork = var.subnetwork
4848

49-
ip_range_pods = var.ip_range_pods
50-
ip_range_services = var.ip_range_services
51-
service_account = var.compute_engine_service_account
49+
ip_range_pods = var.ip_range_pods
50+
ip_range_services = var.ip_range_services
51+
create_service_account = false
52+
service_account = var.compute_engine_service_account
5253
}
5354

5455
resource "kubernetes_pod" "nginx-example" {

‎examples/disable_client_cert/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ module "gke" {
3939
subnetwork = var.subnetwork
4040
ip_range_pods = var.ip_range_pods
4141
ip_range_services = var.ip_range_services
42+
create_service_account = false
4243
service_account = var.compute_engine_service_account
4344
issue_client_certificate = false
4445
}

‎examples/node_pool/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ module "gke" {
3939
subnetwork = var.subnetwork
4040
ip_range_pods = var.ip_range_pods
4141
ip_range_services = var.ip_range_services
42+
create_service_account = false
4243
remove_default_node_pool = true
4344
disable_legacy_metadata_endpoints = false
4445

‎examples/shared_vpc/main.tf

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,17 @@ provider "google-beta" {
2929
}
3030

3131
module "gke" {
32-
source = "../../"
33-
project_id = var.project_id
34-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35-
region = var.region
36-
network = var.network
37-
network_project_id = var.network_project_id
38-
subnetwork = var.subnetwork
39-
ip_range_pods = var.ip_range_pods
40-
ip_range_services = var.ip_range_services
41-
service_account = var.compute_engine_service_account
32+
source = "../../"
33+
project_id = var.project_id
34+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35+
region = var.region
36+
network = var.network
37+
network_project_id = var.network_project_id
38+
subnetwork = var.subnetwork
39+
ip_range_pods = var.ip_range_pods
40+
ip_range_services = var.ip_range_services
41+
create_service_account = false
42+
service_account = var.compute_engine_service_account
4243
}
4344

4445
data "google_client_config" "default" {

‎examples/simple_regional/main.tf

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,17 @@ provider "google-beta" {
2929
}
3030

3131
module "gke" {
32-
source = "../../"
33-
project_id = var.project_id
34-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35-
regional = true
36-
region = var.region
37-
network = var.network
38-
subnetwork = var.subnetwork
39-
ip_range_pods = var.ip_range_pods
40-
ip_range_services = var.ip_range_services
41-
service_account = var.compute_engine_service_account
32+
source = "../../"
33+
project_id = var.project_id
34+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35+
regional = true
36+
region = var.region
37+
network = var.network
38+
subnetwork = var.subnetwork
39+
ip_range_pods = var.ip_range_pods
40+
ip_range_services = var.ip_range_services
41+
create_service_account = false
42+
service_account = var.compute_engine_service_account
4243
}
4344

4445
data "google_client_config" "default" {

‎examples/simple_regional_beta/main.tf

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -31,18 +31,19 @@ provider "google-beta" {
3131
}
3232

3333
module "gke" {
34-
source = "../../modules/beta-public-cluster/"
35-
project_id = var.project_id
36-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
37-
regional = true
38-
region = var.region
39-
network = var.network
40-
subnetwork = var.subnetwork
41-
ip_range_pods = var.ip_range_pods
42-
ip_range_services = var.ip_range_services
43-
service_account = var.compute_engine_service_account
44-
istio = var.istio
45-
cloudrun = var.cloudrun
34+
source = "../../modules/beta-public-cluster/"
35+
project_id = var.project_id
36+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
37+
regional = true
38+
region = var.region
39+
network = var.network
40+
subnetwork = var.subnetwork
41+
ip_range_pods = var.ip_range_pods
42+
ip_range_services = var.ip_range_services
43+
create_service_account = false
44+
service_account = var.compute_engine_service_account
45+
istio = var.istio
46+
cloudrun = var.cloudrun
4647
}
4748

4849
data "google_client_config" "default" {

‎examples/simple_regional_private/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ module "gke" {
3939
subnetwork = var.subnetwork
4040
ip_range_pods = var.ip_range_pods
4141
ip_range_services = var.ip_range_services
42+
create_service_account = false
4243
service_account = var.compute_engine_service_account
4344
enable_private_endpoint = true
4445
enable_private_nodes = true

‎examples/simple_zonal_private/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ module "gke" {
4040
subnetwork = var.subnetwork
4141
ip_range_pods = var.ip_range_pods
4242
ip_range_services = var.ip_range_services
43+
create_service_account = false
4344
service_account = var.compute_engine_service_account
4445
enable_private_endpoint = true
4546
enable_private_nodes = true

‎examples/stub_domains/main.tf

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,17 @@ provider "google-beta" {
2929
}
3030

3131
module "gke" {
32-
source = "../../"
33-
project_id = var.project_id
34-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35-
region = var.region
36-
network = var.network
37-
subnetwork = var.subnetwork
38-
ip_range_pods = var.ip_range_pods
39-
ip_range_services = var.ip_range_services
40-
network_policy = true
41-
service_account = var.compute_engine_service_account
32+
source = "../../"
33+
project_id = var.project_id
34+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35+
region = var.region
36+
network = var.network
37+
subnetwork = var.subnetwork
38+
ip_range_pods = var.ip_range_pods
39+
ip_range_services = var.ip_range_services
40+
network_policy = true
41+
service_account = var.compute_engine_service_account
42+
create_service_account = false
4243

4344
configure_ip_masq = true
4445

‎examples/stub_domains_private/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,9 @@ module "gke" {
5757

5858
master_ipv4_cidr_block = "172.16.0.0/28"
5959

60-
network_policy = true
61-
service_account = var.compute_engine_service_account
60+
network_policy = true
61+
create_service_account = false
62+
service_account = var.compute_engine_service_account
6263

6364
stub_domains = {
6465
"example.com" = [

‎examples/stub_domains_upstream_nameservers/main.tf

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,17 @@ provider "google-beta" {
2929
}
3030

3131
module "gke" {
32-
source = "../../"
33-
project_id = var.project_id
34-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35-
region = var.region
36-
network = var.network
37-
subnetwork = var.subnetwork
38-
ip_range_pods = var.ip_range_pods
39-
ip_range_services = var.ip_range_services
40-
network_policy = true
41-
service_account = var.compute_engine_service_account
32+
source = "../../"
33+
project_id = var.project_id
34+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35+
region = var.region
36+
network = var.network
37+
subnetwork = var.subnetwork
38+
ip_range_pods = var.ip_range_pods
39+
ip_range_services = var.ip_range_services
40+
network_policy = true
41+
create_service_account = false
42+
service_account = var.compute_engine_service_account
4243

4344
configure_ip_masq = true
4445

‎examples/upstream_nameservers/main.tf

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,17 @@ provider "google-beta" {
2929
}
3030

3131
module "gke" {
32-
source = "../../"
33-
project_id = var.project_id
34-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35-
region = var.region
36-
network = var.network
37-
subnetwork = var.subnetwork
38-
ip_range_pods = var.ip_range_pods
39-
ip_range_services = var.ip_range_services
40-
network_policy = true
41-
service_account = var.compute_engine_service_account
32+
source = "../../"
33+
project_id = var.project_id
34+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
35+
region = var.region
36+
network = var.network
37+
subnetwork = var.subnetwork
38+
ip_range_pods = var.ip_range_pods
39+
ip_range_services = var.ip_range_services
40+
network_policy = true
41+
create_service_account = false
42+
service_account = var.compute_engine_service_account
4243

4344
configure_ip_masq = true
4445
upstream_nameservers = ["8.8.8.8", "8.8.4.4"]

‎examples/workload_metadata_config/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ module "gke" {
4040
subnetwork = var.subnetwork
4141
ip_range_pods = var.ip_range_pods
4242
ip_range_services = var.ip_range_services
43+
create_service_account = false
4344
service_account = var.compute_engine_service_account
4445
enable_private_endpoint = true
4546
enable_private_nodes = true

‎modules/beta-private-cluster/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
142142
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | string | `""` | no |
143143
| cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | map(string) | `<map>` | no |
144144
| configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | string | `"false"` | no |
145+
| create\_service\_account | Defines if service account specified to run nodes should be created. | bool | `"true"` | no |
145146
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key. | object | `<list>` | no |
146147
| default\_max\_pods\_per\_node | The maximum number of pods to schedule per node | string | `"110"` | no |
147148
| deploy\_using\_private\_endpoint | (Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | bool | `"false"` | no |
@@ -187,7 +188,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
187188
| region | The region to host the cluster in (required) | string | n/a | yes |
188189
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
189190
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
190-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The default value will cause a cluster-specific service account to be created. | string | `"create"` | no |
191+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
191192
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map(list(string)) | `<map>` | no |
192193
| subnetwork | The subnetwork to host the cluster in (required) | string | n/a | yes |
193194
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | list | `<list>` | no |

‎modules/beta-private-cluster/outputs.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ output "endpoint" {
4545
sensitive = true
4646
description = "Cluster endpoint"
4747
value = local.cluster_endpoint
48-
depends_on = [
48+
depends_on = [
4949
/* Nominally, the endpoint is populated as soon as it is known to Terraform.
5050
* However, the cluster may not be in a usable state yet. Therefore any
5151
* resources dependent on the cluster being up will fail to deploy. With

0 commit comments

Comments
 (0)