Skip to content

Commit fc43485

Browse files
yashbhutwalayashbhutwala
authored
fix: Add ability to impersonate service accounts in kubectl for all submodules (terraform-google-modules#903)
1 parent e2ba8d2 commit fc43485

File tree

17 files changed

+151
-124
lines changed

17 files changed

+151
-124
lines changed

‎autogen/main/dns.tf.tmpl

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
module "gcloud_delete_default_kube_dns_configmap" {
23-
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24-
version = "~> 2.0.2"
25-
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26-
cluster_name = google_container_cluster.primary.name
27-
cluster_location = google_container_cluster.primary.location
28-
project_id = var.project_id
29-
upgrade = var.gcloud_upgrade
30-
23+
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24+
version = "~> 2.1.0"
25+
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26+
cluster_name = google_container_cluster.primary.name
27+
cluster_location = google_container_cluster.primary.location
28+
project_id = var.project_id
29+
upgrade = var.gcloud_upgrade
30+
impersonate_service_account = var.impersonate_service_account
3131

3232
kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
3333
kubectl_destroy_command = ""

‎dns.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
module "gcloud_delete_default_kube_dns_configmap" {
23-
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24-
version = "~> 2.0.2"
25-
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26-
cluster_name = google_container_cluster.primary.name
27-
cluster_location = google_container_cluster.primary.location
28-
project_id = var.project_id
29-
upgrade = var.gcloud_upgrade
30-
23+
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24+
version = "~> 2.1.0"
25+
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26+
cluster_name = google_container_cluster.primary.name
27+
cluster_location = google_container_cluster.primary.location
28+
project_id = var.project_id
29+
upgrade = var.gcloud_upgrade
30+
impersonate_service_account = var.impersonate_service_account
3131

3232
kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
3333
kubectl_destroy_command = ""

‎modules/asm/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ To deploy this config:
6464
| enable\_gcp\_iam\_roles | Sets `--enable_gcp_iam_roles` option if true. | `bool` | `false` | no |
6565
| enable\_registration | Sets `--enable_registration` option if true. | `bool` | `false` | no |
6666
| gcloud\_sdk\_version | The gcloud sdk version to use. Minimum required version is 293.0.0 | `string` | `"296.0.1"` | no |
67+
| impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | `string` | `""` | no |
6768
| key\_file | The GCP Service Account credentials file path used to deploy ASM. | `string` | `""` | no |
6869
| location | The location (zone or region) this cluster has been created in. | `string` | n/a | yes |
6970
| managed\_control\_plane | ASM managed control plane boolean. Determines whether to install ASM managed control plane. Installing ASM managed control plane does not install gateways. Documentation on how to install gateways with ASM MCP can be found at https://cloud.google.com/service-mesh/docs/managed-control-plane#install_istio_gateways_optional. | `bool` | `false` | no |

‎modules/asm/main.tf

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,16 +32,17 @@ locals {
3232

3333
module "asm_install" {
3434
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
35-
version = "~> 2.0.2"
35+
version = "~> 2.1.0"
3636
module_depends_on = [var.cluster_endpoint]
3737

38-
gcloud_sdk_version = var.gcloud_sdk_version
39-
upgrade = true
40-
additional_components = ["kubectl", "kpt", "beta", "kustomize"]
41-
cluster_name = var.cluster_name
42-
cluster_location = var.location
43-
project_id = var.project_id
44-
service_account_key_file = var.service_account_key_file
38+
gcloud_sdk_version = var.gcloud_sdk_version
39+
upgrade = true
40+
additional_components = ["kubectl", "kpt", "beta", "kustomize"]
41+
cluster_name = var.cluster_name
42+
cluster_location = var.location
43+
project_id = var.project_id
44+
service_account_key_file = var.service_account_key_file
45+
impersonate_service_account = var.impersonate_service_account
4546

4647
kubectl_create_command = "${path.module}/scripts/install_asm.sh ${var.project_id} ${var.cluster_name} ${var.location} ${var.asm_version} ${var.mode} ${var.managed_control_plane} ${var.skip_validation} ${local.options_string} ${local.custom_overlays_string} ${var.enable_all} ${var.enable_cluster_roles} ${var.enable_cluster_labels} ${var.enable_gcp_apis} ${var.enable_gcp_iam_roles} ${var.enable_gcp_components} ${var.enable_registration} ${var.outdir} ${var.ca} ${local.ca_cert} ${local.ca_key} ${local.root_cert} ${local.cert_chain} ${local.service_account_string} ${local.key_file_string} ${local.asm_git_tag_string}"
4748
kubectl_destroy_command = "kubectl delete ns istio-system"

‎modules/asm/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,12 @@ variable "managed_control_plane" {
8787
default = false
8888
}
8989

90+
variable "impersonate_service_account" {
91+
type = string
92+
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
93+
default = ""
94+
}
95+
9096
variable "options" {
9197
description = "Comma separated list of options. Works with in-cluster control plane only. Supported options are documented in https://cloud.google.com/service-mesh/docs/enable-optional-features."
9298
type = list

‎modules/beta-private-cluster-update-variant/dns.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
module "gcloud_delete_default_kube_dns_configmap" {
23-
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24-
version = "~> 2.0.2"
25-
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26-
cluster_name = google_container_cluster.primary.name
27-
cluster_location = google_container_cluster.primary.location
28-
project_id = var.project_id
29-
upgrade = var.gcloud_upgrade
30-
23+
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24+
version = "~> 2.1.0"
25+
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26+
cluster_name = google_container_cluster.primary.name
27+
cluster_location = google_container_cluster.primary.location
28+
project_id = var.project_id
29+
upgrade = var.gcloud_upgrade
30+
impersonate_service_account = var.impersonate_service_account
3131

3232
kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
3333
kubectl_destroy_command = ""

‎modules/beta-private-cluster/dns.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
module "gcloud_delete_default_kube_dns_configmap" {
23-
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24-
version = "~> 2.0.2"
25-
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26-
cluster_name = google_container_cluster.primary.name
27-
cluster_location = google_container_cluster.primary.location
28-
project_id = var.project_id
29-
upgrade = var.gcloud_upgrade
30-
23+
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24+
version = "~> 2.1.0"
25+
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26+
cluster_name = google_container_cluster.primary.name
27+
cluster_location = google_container_cluster.primary.location
28+
project_id = var.project_id
29+
upgrade = var.gcloud_upgrade
30+
impersonate_service_account = var.impersonate_service_account
3131

3232
kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
3333
kubectl_destroy_command = ""

‎modules/beta-public-cluster-update-variant/dns.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
module "gcloud_delete_default_kube_dns_configmap" {
23-
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24-
version = "~> 2.0.2"
25-
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26-
cluster_name = google_container_cluster.primary.name
27-
cluster_location = google_container_cluster.primary.location
28-
project_id = var.project_id
29-
upgrade = var.gcloud_upgrade
30-
23+
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24+
version = "~> 2.1.0"
25+
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26+
cluster_name = google_container_cluster.primary.name
27+
cluster_location = google_container_cluster.primary.location
28+
project_id = var.project_id
29+
upgrade = var.gcloud_upgrade
30+
impersonate_service_account = var.impersonate_service_account
3131

3232
kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
3333
kubectl_destroy_command = ""

‎modules/beta-public-cluster/dns.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
module "gcloud_delete_default_kube_dns_configmap" {
23-
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24-
version = "~> 2.0.2"
25-
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26-
cluster_name = google_container_cluster.primary.name
27-
cluster_location = google_container_cluster.primary.location
28-
project_id = var.project_id
29-
upgrade = var.gcloud_upgrade
30-
23+
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
24+
version = "~> 2.1.0"
25+
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
26+
cluster_name = google_container_cluster.primary.name
27+
cluster_location = google_container_cluster.primary.location
28+
project_id = var.project_id
29+
upgrade = var.gcloud_upgrade
30+
impersonate_service_account = var.impersonate_service_account
3131

3232
kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
3333
kubectl_destroy_command = ""

‎modules/hub/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ resource "google_service_account_key" "gke_hub_key" {
7272

7373
module "gke_hub_registration" {
7474
source = "terraform-google-modules/gcloud/google"
75-
version = "~> 2.0.2"
75+
version = "~> 2.1.0"
7676

7777
platform = "linux"
7878
gcloud_sdk_version = var.gcloud_sdk_version

‎modules/k8s-operator-crd-support/main.tf

Lines changed: 50 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ locals {
3434

3535
module "k8sop_manifest" {
3636
source = "terraform-google-modules/gcloud/google"
37-
version = "~> 2.0.2"
37+
version = "~> 2.1.0"
3838
enabled = local.should_download_manifest
3939

4040
create_cmd_entrypoint = "gsutil"
@@ -45,14 +45,15 @@ module "k8sop_manifest" {
4545

4646

4747
module "k8s_operator" {
48-
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
49-
version = "~> 2.0.2"
50-
module_depends_on = [module.k8sop_manifest.wait, var.cluster_endpoint]
51-
cluster_name = var.cluster_name
52-
cluster_location = var.location
53-
project_id = var.project_id
54-
service_account_key_file = var.service_account_key_file
55-
use_existing_context = var.use_existing_context
48+
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
49+
version = "~> 2.1.0"
50+
module_depends_on = [module.k8sop_manifest.wait, var.cluster_endpoint]
51+
cluster_name = var.cluster_name
52+
cluster_location = var.location
53+
project_id = var.project_id
54+
service_account_key_file = var.service_account_key_file
55+
use_existing_context = var.use_existing_context
56+
impersonate_service_account = var.impersonate_service_account
5657

5758
kubectl_create_command = "kubectl apply -f ${local.manifest_path}"
5859
kubectl_destroy_command = "kubectl delete -f ${local.manifest_path}"
@@ -67,15 +68,16 @@ resource "tls_private_key" "k8sop_creds" {
6768

6869
module "k8sop_creds_secret" {
6970
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
70-
version = "~> 2.0.2"
71+
version = "~> 2.1.0"
7172

72-
enabled = var.create_ssh_key == true || var.ssh_auth_key != null ? "true" : "false"
73-
module_depends_on = [module.k8s_operator.wait]
74-
cluster_name = var.cluster_name
75-
cluster_location = var.location
76-
project_id = var.project_id
77-
service_account_key_file = var.service_account_key_file
78-
use_existing_context = var.use_existing_context
73+
enabled = var.create_ssh_key == true || var.ssh_auth_key != null ? "true" : "false"
74+
module_depends_on = [module.k8s_operator.wait]
75+
cluster_name = var.cluster_name
76+
cluster_location = var.location
77+
project_id = var.project_id
78+
service_account_key_file = var.service_account_key_file
79+
use_existing_context = var.use_existing_context
80+
impersonate_service_account = var.impersonate_service_account
7981

8082
kubectl_create_command = local.private_key != null ? "kubectl create secret generic ${var.operator_credential_name} -n=${var.operator_credential_namespace} --from-literal=${local.k8sop_creds_secret_key}='${local.private_key}'" : ""
8183
kubectl_destroy_command = "kubectl delete secret ${var.operator_credential_name} -n=${var.operator_credential_namespace}"
@@ -102,15 +104,16 @@ data "template_file" "k8sop_config" {
102104
}
103105

104106
module "k8sop_config" {
105-
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
106-
version = "~> 2.0.2"
107-
module_depends_on = [module.k8s_operator.wait, module.k8sop_creds_secret.wait]
108-
cluster_name = var.cluster_name
109-
cluster_location = var.location
110-
project_id = var.project_id
111-
create_cmd_triggers = { configmanagement = data.template_file.k8sop_config.rendered }
112-
service_account_key_file = var.service_account_key_file
113-
use_existing_context = var.use_existing_context
107+
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
108+
version = "~> 2.1.0"
109+
module_depends_on = [module.k8s_operator.wait, module.k8sop_creds_secret.wait]
110+
cluster_name = var.cluster_name
111+
cluster_location = var.location
112+
project_id = var.project_id
113+
create_cmd_triggers = { configmanagement = data.template_file.k8sop_config.rendered }
114+
service_account_key_file = var.service_account_key_file
115+
use_existing_context = var.use_existing_context
116+
impersonate_service_account = var.impersonate_service_account
114117

115118
kubectl_create_command = "kubectl apply -f - <<EOF\n${data.template_file.k8sop_config.rendered}EOF"
116119
kubectl_destroy_command = "kubectl delete -f - <<EOF\n${data.template_file.k8sop_config.rendered}EOF"
@@ -133,7 +136,7 @@ data "template_file" "rootsync_config" {
133136

134137
module "wait_for_configsync_api" {
135138
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
136-
version = "~> 2.0.2"
139+
version = "~> 2.1.0"
137140
enabled = var.enable_multi_repo
138141

139142
module_depends_on = [module.k8sop_config.wait]
@@ -153,32 +156,34 @@ module "wait_for_configsync_api" {
153156

154157
module "rootsync_config" {
155158
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
156-
version = "~> 2.0.2"
159+
version = "~> 2.1.0"
157160
enabled = var.enable_multi_repo
158161

159-
module_depends_on = [module.wait_for_configsync_api.wait]
160-
cluster_name = var.cluster_name
161-
project_id = var.project_id
162-
cluster_location = var.location
163-
create_cmd_triggers = { rootsync = data.template_file.rootsync_config.rendered }
164-
service_account_key_file = var.service_account_key_file
165-
use_existing_context = var.use_existing_context
162+
module_depends_on = [module.wait_for_configsync_api.wait]
163+
cluster_name = var.cluster_name
164+
project_id = var.project_id
165+
cluster_location = var.location
166+
create_cmd_triggers = { rootsync = data.template_file.rootsync_config.rendered }
167+
service_account_key_file = var.service_account_key_file
168+
use_existing_context = var.use_existing_context
169+
impersonate_service_account = var.impersonate_service_account
166170

167171
kubectl_create_command = "kubectl apply -f - <<EOF\n${data.template_file.rootsync_config.rendered}EOF"
168172
kubectl_destroy_command = "kubectl delete -f - <<EOF\n${data.template_file.rootsync_config.rendered}EOF"
169173
}
170174

171175
module "wait_for_gatekeeper" {
172-
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
173-
version = "~> 2.0.2"
174-
enabled = var.enable_policy_controller ? true : false
175-
module_depends_on = [module.k8sop_config.wait]
176-
cluster_name = var.cluster_name
177-
cluster_location = var.location
178-
project_id = var.project_id
179-
create_cmd_triggers = { script_sha1 = sha1(file("${path.module}/scripts/wait_for_gatekeeper.sh")) }
180-
service_account_key_file = var.service_account_key_file
181-
use_existing_context = var.use_existing_context
176+
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
177+
version = "~> 2.1.0"
178+
enabled = var.enable_policy_controller ? true : false
179+
module_depends_on = [module.k8sop_config.wait]
180+
cluster_name = var.cluster_name
181+
cluster_location = var.location
182+
project_id = var.project_id
183+
create_cmd_triggers = { script_sha1 = sha1(file("${path.module}/scripts/wait_for_gatekeeper.sh")) }
184+
service_account_key_file = var.service_account_key_file
185+
use_existing_context = var.use_existing_context
186+
impersonate_service_account = var.impersonate_service_account
182187

183188
kubectl_create_command = "${path.module}/scripts/wait_for_gatekeeper.sh ${var.project_id} ${var.cluster_name} ${var.location} ${local.append_arg_use_existing_context}"
184189
kubectl_destroy_command = ""

‎modules/k8s-operator-crd-support/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,3 +162,9 @@ variable "use_existing_context" {
162162
type = bool
163163
default = false
164164
}
165+
166+
variable "impersonate_service_account" {
167+
type = string
168+
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
169+
default = ""
170+
}

0 commit comments

Comments
 (0)