From 0d7f63858d283ffb6c66d9f3a162ee0845db57f0 Mon Sep 17 00:00:00 2001 From: Andrew Peabody Date: Tue, 26 Dec 2023 08:21:18 -0800 Subject: [PATCH] fix!: Revert create least privilege default service account (#1757) (#1827) --- autogen/main/sa.tf.tmpl | 25 +++++++++++++++++-- docs/upgrading_to_v30.0.md | 7 ++++++ modules/beta-autopilot-private-cluster/sa.tf | 25 +++++++++++++++++-- modules/beta-autopilot-public-cluster/sa.tf | 25 +++++++++++++++++-- .../beta-private-cluster-update-variant/sa.tf | 25 +++++++++++++++++-- modules/beta-private-cluster/sa.tf | 25 +++++++++++++++++-- .../beta-public-cluster-update-variant/sa.tf | 25 +++++++++++++++++-- modules/beta-public-cluster/sa.tf | 25 +++++++++++++++++-- modules/private-cluster-update-variant/sa.tf | 25 +++++++++++++++++-- modules/private-cluster/sa.tf | 25 +++++++++++++++++-- sa.tf | 25 +++++++++++++++++-- 11 files changed, 237 insertions(+), 20 deletions(-) create mode 100644 docs/upgrading_to_v30.0.md diff --git a/autogen/main/sa.tf.tmpl b/autogen/main/sa.tf.tmpl index dbc17213a..cae74cd59 100644 --- a/autogen/main/sa.tf.tmpl +++ b/autogen/main/sa.tf.tmpl @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member } diff --git a/docs/upgrading_to_v30.0.md b/docs/upgrading_to_v30.0.md new file mode 100644 index 000000000..74f8047e9 --- /dev/null +++ b/docs/upgrading_to_v30.0.md @@ -0,0 +1,7 @@ +# Upgrading to v30.0 +The v30.0 release of *kubernetes-engine* is a backwards incompatible +release. + +### Default cluster service account permissions modified + +When `create_service_account` is `true`, the service account will now be created with the `Logs Writer`, `Monitoring Metric Writer`, `Monitoring Viewer` and `Stackdriver Resource Metadata Writer` roles instead of the deprecated `Kubernetes Engine Node Service Account` role. diff --git a/modules/beta-autopilot-private-cluster/sa.tf b/modules/beta-autopilot-private-cluster/sa.tf index a19843e0f..9a13a2490 100644 --- a/modules/beta-autopilot-private-cluster/sa.tf +++ b/modules/beta-autopilot-private-cluster/sa.tf @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member } diff --git a/modules/beta-autopilot-public-cluster/sa.tf b/modules/beta-autopilot-public-cluster/sa.tf index a19843e0f..9a13a2490 100644 --- a/modules/beta-autopilot-public-cluster/sa.tf +++ b/modules/beta-autopilot-public-cluster/sa.tf @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member } diff --git a/modules/beta-private-cluster-update-variant/sa.tf b/modules/beta-private-cluster-update-variant/sa.tf index a19843e0f..9a13a2490 100644 --- a/modules/beta-private-cluster-update-variant/sa.tf +++ b/modules/beta-private-cluster-update-variant/sa.tf @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member } diff --git a/modules/beta-private-cluster/sa.tf b/modules/beta-private-cluster/sa.tf index a19843e0f..9a13a2490 100644 --- a/modules/beta-private-cluster/sa.tf +++ b/modules/beta-private-cluster/sa.tf @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member } diff --git a/modules/beta-public-cluster-update-variant/sa.tf b/modules/beta-public-cluster-update-variant/sa.tf index a19843e0f..9a13a2490 100644 --- a/modules/beta-public-cluster-update-variant/sa.tf +++ b/modules/beta-public-cluster-update-variant/sa.tf @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member } diff --git a/modules/beta-public-cluster/sa.tf b/modules/beta-public-cluster/sa.tf index a19843e0f..9a13a2490 100644 --- a/modules/beta-public-cluster/sa.tf +++ b/modules/beta-public-cluster/sa.tf @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member } diff --git a/modules/private-cluster-update-variant/sa.tf b/modules/private-cluster-update-variant/sa.tf index a19843e0f..9a13a2490 100644 --- a/modules/private-cluster-update-variant/sa.tf +++ b/modules/private-cluster-update-variant/sa.tf @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member } diff --git a/modules/private-cluster/sa.tf b/modules/private-cluster/sa.tf index a19843e0f..9a13a2490 100644 --- a/modules/private-cluster/sa.tf +++ b/modules/private-cluster/sa.tf @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member } diff --git a/sa.tf b/sa.tf index a19843e0f..9a13a2490 100644 --- a/sa.tf +++ b/sa.tf @@ -45,10 +45,31 @@ resource "google_service_account" "cluster_service_account" { display_name = "Terraform-managed service account for cluster ${var.name}" } -resource "google_project_iam_member" "cluster_service_account-nodeService_account" { +resource "google_project_iam_member" "cluster_service_account-log_writer" { count = var.create_service_account ? 1 : 0 project = google_service_account.cluster_service_account[0].project - role = "roles/container.nodeServiceAccount" + role = "roles/logging.logWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-metric_writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-log_writer[0].project + role = "roles/monitoring.metricWriter" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-metric_writer[0].project + role = "roles/monitoring.viewer" + member = google_service_account.cluster_service_account[0].member +} + +resource "google_project_iam_member" "cluster_service_account-resourceMetadata-writer" { + count = var.create_service_account ? 1 : 0 + project = google_project_iam_member.cluster_service_account-monitoring_viewer[0].project + role = "roles/stackdriver.resourceMetadata.writer" member = google_service_account.cluster_service_account[0].member }