-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Using service account impersonation for terraform invoking this module #874
Comments
Hi @yashbhutwala If you want a quick workaround if you are not interested in stub_domains and upstream_nameservers is to set |
Yes @bharathkkb you're right! A --impersonate-service-account=${var.impersonate_sa} flag in kubectl-wrapper module is what I need. Unfortunately, I cannot use skip_provisioner because we do use the stub_domain functionality currently. |
I have a use-case where I'm using shared Terraform Cloud Agents, and my TF Cloud workspace is isolated by using service account impersonation, i.e.: the GSA that terraform agent runs terraform by default does not have GKE Admin IAM. Problem is since this module uses the kubectl-wrapper module like this, which uses this gcloud command here, it uses the agent terraform IAM instead of the impersonating ones, hence not being able to create GKE. Is there any potential workarounds/idea for such setup?
The text was updated successfully, but these errors were encountered: