Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add ability to impersonate for kubectl-wrapper module #91

Merged
merged 8 commits into from
May 8, 2021
Merged

add ability to impersonate for kubectl-wrapper module #91

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
676eefd
add ability to impersonate for kubectl-wrapper module
yashbhutwala Apr 24, 2021
d31912b
use make generate_docs
yashbhutwala Apr 24, 2021
12c820c
make it backwards compatible
yashbhutwala Apr 25, 2021
d02b918
fix conditional and ci
yashbhutwala Apr 30, 2021
f6dd8f3
flip the ternary
yashbhutwala Apr 30, 2021
a3a3d16
terraform fmt
yashbhutwala Apr 30, 2021
6bb2bf3
try with a true flag
yashbhutwala May 7, 2021
fbfe837
shift additional 2 in case of service impersonation
yashbhutwala May 7, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions modules/kubectl-wrapper/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ module "kubectl" {
| create\_cmd\_triggers | List of any additional triggers for the create command execution. | map | `<map>` | no |
| enabled | Flag to optionally disable usage of this module. | bool | `"true"` | no |
| gcloud\_sdk\_version | The gcloud sdk version to download. | string | `"281.0.0"` | no |
| impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | string | `""` | no |
| internal\_ip | Use internal ip for the cluster endpoint. | bool | `"false"` | no |
| kubectl\_create\_command | The kubectl command to create resources. | string | n/a | yes |
| kubectl\_destroy\_command | The kubectl command to destroy resources. | string | n/a | yes |
Expand Down
4 changes: 2 additions & 2 deletions modules/kubectl-wrapper/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,8 @@ module "gcloud_kubectl" {
service_account_key_file = var.service_account_key_file

create_cmd_entrypoint = "${path.module}/scripts/kubectl_wrapper.sh"
create_cmd_body = "${local.base_cmd} ${var.kubectl_create_command}"
create_cmd_body = var.impersonate_service_account == "" ? "${local.base_cmd} ${var.kubectl_create_command}" : "${local.base_cmd} true ${var.impersonate_service_account} ${var.kubectl_create_command}"
create_cmd_triggers = var.create_cmd_triggers
destroy_cmd_entrypoint = "${path.module}/scripts/kubectl_wrapper.sh"
destroy_cmd_body = "${local.base_cmd} ${var.kubectl_destroy_command}"
destroy_cmd_body = var.impersonate_service_account == "" ? "${local.base_cmd} ${var.kubectl_destroy_command}" : "${local.base_cmd} true ${var.impersonate_service_account} ${var.kubectl_destroy_command}"
}
5 changes: 5 additions & 0 deletions modules/kubectl-wrapper/scripts/kubectl_wrapper.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ LOCATION=$2
PROJECT_ID=$3
INTERNAL=$4
USE_EXISTING_CONTEXT=$5
ENABLE_IMPERSONATE_SERVICE_ACCOUNT=$6
IMPERSONATE_SERVICE_ACCOUNT=$7

shift 5

Expand All @@ -50,6 +52,9 @@ else
LOCATION_TYPE=$(grep -o "-" <<< "${LOCATION}" | wc -l)

CMD="gcloud container clusters get-credentials ${CLUSTER_NAME} --project ${PROJECT_ID}"
if [[ "${ENABLE_IMPERSONATE_SERVICE_ACCOUNT}" == true ]]; then
CMD+=" --impersonate-service-account ${IMPERSONATE_SERVICE_ACCOUNT}"
yashbhutwala marked this conversation as resolved.
Show resolved Hide resolved
fi

if [[ $LOCATION_TYPE -eq 2 ]] ;then
CMD+=" --zone ${LOCATION}"
Expand Down
6 changes: 6 additions & 0 deletions modules/kubectl-wrapper/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,3 +98,9 @@ variable "service_account_key_file" {
description = "Path to service account key file to auth as for running `gcloud container clusters get-credentials`."
default = ""
}

variable "impersonate_service_account" {
type = string
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
default = ""
}