added service account extension

oracle-terraform-modules · Mar 27, 2024 · 459d237 · 459d237
1 parent c0d8158
commit 459d237
Show file tree

Hide file tree

Showing 5 changed files with 185 additions and 1 deletion.
diff --git a/examples/extensions/vars-extensions-service-account.auto.tfvars b/examples/extensions/vars-extensions-service-account.auto.tfvars
@@ -0,0 +1,27 @@
+# Copyright (c) 2024 Oracle Corporation and/or its affiliates.
+# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
+
+create_service_account = true
+service_accounts       = {
+  # Example to create a cluster role binding using a cluster role.
+  example_cluster_role_binding = {
+    sa_name = "sa1"
+    sa_namespace = "kube-system"
+    sa_cluster_role = "cluster-admin"
+    sa_cluster_role_binding = "sa1-crb"
+  }
+  # Example to create a role binding using a cluster role.
+  example_role_binding = {
+    sa_name = "sa2"
+    sa_namespace = "default"
+    sa_cluster_role = "cluster-admin"
+    sa_role_binding = "sa1-rb"
+  }
+  # Example to create a role binding using a role, the role needs to exist within the namespace.
+  example_role_binding = {
+    sa_name = "sa3"
+    sa_namespace = "kube-system"
+    sa_role = "system:controller:token-cleaner"
+    sa_role_binding = "sa3-rb"
+  }
+}
diff --git a/module-extensions.tf b/module-extensions.tf
@@ -3,7 +3,8 @@
 
 module "extensions" {
   source   = "./modules/extensions"
-  count    = alltrue([var.create_cluster,local.operator_enabled]) ? 1 : 0
+  depends_on = [ module.network ]
+  count    = alltrue([var.create_cluster, local.operator_enabled]) ? 1 : 0
   region   = var.region
   state_id = local.state_id
 
@@ -106,4 +107,8 @@ module "extensions" {
   mpi_operator_namespace      = var.mpi_operator_namespace
   mpi_operator_deployment_url = var.mpi_operator_deployment_url
   mpi_operator_version        = var.mpi_operator_version
+
+  # Service Account
+  create_service_account               = var.create_service_account
+  service_accounts                     = var.service_accounts
 }
diff --git a/modules/extensions/service_account.tf b/modules/extensions/service_account.tf
@@ -0,0 +1,128 @@
+# Copyright (c) 2024 Oracle Corporation and/or its affiliates.
+# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
+
+locals {
+  sa_with_cluster_role_bindings = {
+    for k, v in var.service_accounts: k => v
+    if lookup(v, "sa_cluster_role_binding", null) != null
+  }
+  sa_with_role_bindings = {
+    for k, v in var.service_accounts: k => v
+    if lookup(v, "sa_role_binding", null) != null
+  } 
+}
+
+resource "null_resource" "service_account_crb" {
+  for_each = var.create_service_account ? local.sa_with_cluster_role_bindings : {}
+
+  triggers = {
+    service_account_name                 = each.value.sa_name
+    service_account_namespace            = each.value.sa_namespace
+    service_account_cluster_role         = each.value.sa_cluster_role
+    service_account_cluster_role_binding = each.value.sa_cluster_role_binding
+
+    # Parameters ignored as triggers in the life_cycle block. Required to establish connections.
+    bastion_host    = var.bastion_host
+    bastion_user    = var.bastion_user
+    ssh_private_key = var.ssh_private_key
+    operator_host   = var.operator_host
+    operator_user   = var.operator_user
+  }
+
+  connection {
+    bastion_host        = self.triggers.bastion_host
+    bastion_user        = self.triggers.bastion_user
+    bastion_private_key = self.triggers.ssh_private_key
+    host                = self.triggers.operator_host
+    user                = self.triggers.operator_user
+    private_key         = self.triggers.ssh_private_key
+    timeout             = "10m"
+    type                = "ssh"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "kubectl get ns ${self.triggers.service_account_namespace} || kubectl create ns ${self.triggers.service_account_namespace}",
+      "kubectl create sa -n ${self.triggers.service_account_namespace} ${self.triggers.service_account_name}",
+      "kubectl create clusterrolebinding ${self.triggers.service_account_cluster_role_binding} --clusterrole=${self.triggers.service_account_cluster_role} --serviceaccount=${self.triggers.service_account_namespace}:${self.triggers.service_account_name}"
+    ]
+  }
+
+  provisioner "remote-exec" {
+    when = destroy
+    on_failure = continue
+    inline = [
+      "kubectl delete clusterrolebinding ${self.triggers.service_account_cluster_role_binding}",
+      "kubectl delete sa -n ${self.triggers.service_account_namespace} ${self.triggers.service_account_name}"
+    ]
+  }
+
+  lifecycle {
+    ignore_changes = [
+      triggers["bastion_host"],
+      triggers["bastion_user"],
+      triggers["ssh_private_key"],
+      triggers["operator_host"],
+      triggers["operator_user"]
+    ]
+  }
+}
+
+resource "null_resource" "service_account_rb" {
+  for_each = var.create_service_account ? local.sa_with_role_bindings : {}
+
+  triggers = {
+    service_account_name                 = each.value.sa_name
+    service_account_namespace            = each.value.sa_namespace
+    service_account_cluster_role         = each.value.sa_cluster_role
+    service_account_role                 = lookup(each.value, "sa_role", "") 
+    service_account_role_binding         = each.value.sa_role_binding
+
+    # Parameters ignored as triggers in the life_cycle block. Required to establish connections.
+    bastion_host    = var.bastion_host
+    bastion_user    = var.bastion_user
+    ssh_private_key = var.ssh_private_key
+    operator_host   = var.operator_host
+    operator_user   = var.operator_user
+  }
+
+  connection {
+    bastion_host        = self.triggers.bastion_host
+    bastion_user        = self.triggers.bastion_user
+    bastion_private_key = self.triggers.ssh_private_key
+    host                = self.triggers.operator_host
+    user                = self.triggers.operator_user
+    private_key         = self.triggers.ssh_private_key
+    timeout             = "10m"
+    type                = "ssh"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "kubectl get ns ${self.triggers.service_account_namespace} || kubectl create ns ${self.triggers.service_account_namespace}",
+      "kubectl create sa -n ${self.triggers.service_account_namespace} ${self.triggers.service_account_name}",
+      self.triggers.service_account_role != "" ?
+        "kubectl create rolebinding -n ${self.triggers.service_account_namespace} ${self.triggers.service_account_role_binding} --role=${self.triggers.service_account_role} --serviceaccount=${self.triggers.service_account_namespace}:${self.triggers.service_account_name}" :
+        "kubectl create rolebinding -n ${self.triggers.service_account_namespace} ${self.triggers.service_account_role_binding} --clusterrole=${self.triggers.service_account_cluster_role} --serviceaccount=${self.triggers.service_account_namespace}:${self.triggers.service_account_name}"
+    ]
+  }
+
+  provisioner "remote-exec" {
+    when = destroy
+    on_failure = continue
+    inline = [
+      "kubectl delete rolebinding -n ${self.triggers.service_account_namespace} ${self.triggers.service_account_role_binding}",
+      "kubectl delete sa -n ${self.triggers.service_account_namespace} ${self.triggers.service_account_name}"
+    ]
+  }
+
+  lifecycle {
+    ignore_changes = [
+      triggers["bastion_host"],
+      triggers["bastion_user"],
+      triggers["ssh_private_key"],
+      triggers["operator_host"],
+      triggers["operator_user"]
+    ]
+  }
+}
diff --git a/modules/extensions/variables.tf b/modules/extensions/variables.tf
@@ -101,3 +101,7 @@ variable "gatekeeper_namespace" { type = string }
 variable "gatekeeper_helm_version" { type = string }
 variable "gatekeeper_helm_values" { type = map(string) }
 variable "gatekeeper_helm_values_files" { type = list(string) }
+
+# Service Account
+variable "create_service_account" { type = bool }
+variable "service_accounts" { type = map(any) }
diff --git a/variables-extensions.tf b/variables-extensions.tf
@@ -367,3 +367,23 @@ variable "gatekeeper_helm_values_files" {
   type        = list(string)
 }
 
+# Service Account
+
+variable "create_service_account" {
+  default     = false
+  description = "Wether to create a service account or not."
+  type        = bool
+}
+
+variable "service_accounts" {
+  default     = {
+    kubeconfigsa = {
+      sa_name = "kubeconfigsa"
+      sa_namespace = "kube-system"
+      sa_cluster_role = "cluster-admin"
+      sa_cluster_role_binding = "kubeconfigsa-crb"
+    }
+  }
+  description = "Map of service accounts and associated parameters."
+  type        = map(any)
+}