Skip to content

Commit

Permalink
fix: Add ability to impersonate service accounts in kubectl for all s…
Browse files Browse the repository at this point in the history 
…ubmodules (#903)
  • Loading branch information
@yashbhutwala
yashbhutwala committed May 20, 2021
1 parent e2ba8d2 commit fc43485
Show file tree
Hide file tree
Showing 17 changed files with 151 additions and 124 deletions.
16 changes: 8 additions & 8 deletions autogen/main/dns.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
16 changes: 8 additions & 8 deletions dns.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
1 change: 1 addition & 0 deletions modules/asm/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ To deploy this config:
| enable\_gcp\_iam\_roles | Sets `--enable_gcp_iam_roles` option if true. | `bool` | `false` | no |
| enable\_registration | Sets `--enable_registration` option if true. | `bool` | `false` | no |
| gcloud\_sdk\_version | The gcloud sdk version to use. Minimum required version is 293.0.0 | `string` | `"296.0.1"` | no |
| impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | `string` | `""` | no |
| key\_file | The GCP Service Account credentials file path used to deploy ASM. | `string` | `""` | no |
| location | The location (zone or region) this cluster has been created in. | `string` | n/a | yes |
| managed\_control\_plane | ASM managed control plane boolean. Determines whether to install ASM managed control plane. Installing ASM managed control plane does not install gateways. Documentation on how to install gateways with ASM MCP can be found at https://cloud.google.com/service-mesh/docs/managed-control-plane#install_istio_gateways_optional. | `bool` | `false` | no |
Expand Down
17 changes: 9 additions & 8 deletions modules/asm/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,16 +32,17 @@ locals {

module "asm_install" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
version = "~> 2.1.0"
module_depends_on = [var.cluster_endpoint]

gcloud_sdk_version = var.gcloud_sdk_version
upgrade = true
additional_components = ["kubectl", "kpt", "beta", "kustomize"]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
gcloud_sdk_version = var.gcloud_sdk_version
upgrade = true
additional_components = ["kubectl", "kpt", "beta", "kustomize"]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/install_asm.sh ${var.project_id} ${var.cluster_name} ${var.location} ${var.asm_version} ${var.mode} ${var.managed_control_plane} ${var.skip_validation} ${local.options_string} ${local.custom_overlays_string} ${var.enable_all} ${var.enable_cluster_roles} ${var.enable_cluster_labels} ${var.enable_gcp_apis} ${var.enable_gcp_iam_roles} ${var.enable_gcp_components} ${var.enable_registration} ${var.outdir} ${var.ca} ${local.ca_cert} ${local.ca_key} ${local.root_cert} ${local.cert_chain} ${local.service_account_string} ${local.key_file_string} ${local.asm_git_tag_string}"
kubectl_destroy_command = "kubectl delete ns istio-system"
Expand Down
6 changes: 6 additions & 0 deletions modules/asm/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,12 @@ variable "managed_control_plane" {
default = false
}

variable "impersonate_service_account" {
type = string
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
default = ""
}

variable "options" {
description = "Comma separated list of options. Works with in-cluster control plane only. Supported options are documented in https://cloud.google.com/service-mesh/docs/enable-optional-features."
type = list
Expand Down
16 changes: 8 additions & 8 deletions modules/beta-private-cluster-update-variant/dns.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
16 changes: 8 additions & 8 deletions modules/beta-private-cluster/dns.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
16 changes: 8 additions & 8 deletions modules/beta-public-cluster-update-variant/dns.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
16 changes: 8 additions & 8 deletions modules/beta-public-cluster/dns.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
2 changes: 1 addition & 1 deletion modules/hub/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ resource "google_service_account_key" "gke_hub_key" {

module "gke_hub_registration" {
source = "terraform-google-modules/gcloud/google"
version = "~> 2.0.2"
version = "~> 2.1.0"

platform = "linux"
gcloud_sdk_version = var.gcloud_sdk_version
Expand Down
95 changes: 50 additions & 45 deletions modules/k8s-operator-crd-support/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ locals {

module "k8sop_manifest" {
source = "terraform-google-modules/gcloud/google"
version = "~> 2.0.2"
version = "~> 2.1.0"
enabled = local.should_download_manifest

create_cmd_entrypoint = "gsutil"
Expand All @@ -45,14 +45,15 @@ module "k8sop_manifest" {


module "k8s_operator" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
module_depends_on = [module.k8sop_manifest.wait, var.cluster_endpoint]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
module_depends_on = [module.k8sop_manifest.wait, var.cluster_endpoint]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "kubectl apply -f ${local.manifest_path}"
kubectl_destroy_command = "kubectl delete -f ${local.manifest_path}"
Expand All @@ -67,15 +68,16 @@ resource "tls_private_key" "k8sop_creds" {

module "k8sop_creds_secret" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
version = "~> 2.1.0"

enabled = var.create_ssh_key == true || var.ssh_auth_key != null ? "true" : "false"
module_depends_on = [module.k8s_operator.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
enabled = var.create_ssh_key == true || var.ssh_auth_key != null ? "true" : "false"
module_depends_on = [module.k8s_operator.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = local.private_key != null ? "kubectl create secret generic ${var.operator_credential_name} -n=${var.operator_credential_namespace} --from-literal=${local.k8sop_creds_secret_key}='${local.private_key}'" : ""
kubectl_destroy_command = "kubectl delete secret ${var.operator_credential_name} -n=${var.operator_credential_namespace}"
Expand All @@ -102,15 +104,16 @@ data "template_file" "k8sop_config" {
}

module "k8sop_config" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
module_depends_on = [module.k8s_operator.wait, module.k8sop_creds_secret.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
create_cmd_triggers = { configmanagement = data.template_file.k8sop_config.rendered }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
module_depends_on = [module.k8s_operator.wait, module.k8sop_creds_secret.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
create_cmd_triggers = { configmanagement = data.template_file.k8sop_config.rendered }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "kubectl apply -f - <<EOF\n${data.template_file.k8sop_config.rendered}EOF"
kubectl_destroy_command = "kubectl delete -f - <<EOF\n${data.template_file.k8sop_config.rendered}EOF"
Expand All @@ -133,7 +136,7 @@ data "template_file" "rootsync_config" {

module "wait_for_configsync_api" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
version = "~> 2.1.0"
enabled = var.enable_multi_repo

module_depends_on = [module.k8sop_config.wait]
Expand All @@ -153,32 +156,34 @@ module "wait_for_configsync_api" {

module "rootsync_config" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
version = "~> 2.1.0"
enabled = var.enable_multi_repo

module_depends_on = [module.wait_for_configsync_api.wait]
cluster_name = var.cluster_name
project_id = var.project_id
cluster_location = var.location
create_cmd_triggers = { rootsync = data.template_file.rootsync_config.rendered }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
module_depends_on = [module.wait_for_configsync_api.wait]
cluster_name = var.cluster_name
project_id = var.project_id
cluster_location = var.location
create_cmd_triggers = { rootsync = data.template_file.rootsync_config.rendered }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "kubectl apply -f - <<EOF\n${data.template_file.rootsync_config.rendered}EOF"
kubectl_destroy_command = "kubectl delete -f - <<EOF\n${data.template_file.rootsync_config.rendered}EOF"
}

module "wait_for_gatekeeper" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = var.enable_policy_controller ? true : false
module_depends_on = [module.k8sop_config.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
create_cmd_triggers = { script_sha1 = sha1(file("${path.module}/scripts/wait_for_gatekeeper.sh")) }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = var.enable_policy_controller ? true : false
module_depends_on = [module.k8sop_config.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
create_cmd_triggers = { script_sha1 = sha1(file("${path.module}/scripts/wait_for_gatekeeper.sh")) }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/wait_for_gatekeeper.sh ${var.project_id} ${var.cluster_name} ${var.location} ${local.append_arg_use_existing_context}"
kubectl_destroy_command = ""
Expand Down
6 changes: 6 additions & 0 deletions modules/k8s-operator-crd-support/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -162,3 +162,9 @@ variable "use_existing_context" {
type = bool
default = false
}

variable "impersonate_service_account" {
type = string
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
default = ""
}
Loading

0 comments on commit fc43485

Please sign in to comment.