Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump up kubectl-wrapper and gcloud module version to add ability to impersonate service account #903

Merged
merged 7 commits into from
May 20, 2021
Merged

Bump up kubectl-wrapper and gcloud module version to add ability to impersonate service account #903

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
19868a6
update via autogen
yashbhutwala May 20, 2021
8710f59
add impersonate_service_account var for workload identity module
yashbhutwala May 20, 2021
2faac85
add impersonate_service_account variable for asm module
yashbhutwala May 20, 2021
24211fe
add impersonate_service_account variable for k8s-operator-crd-support…
yashbhutwala May 20, 2021
440892d
bump up gcloud module version in other places
yashbhutwala May 20, 2021
2d8e0ee
run make docker_generate_docs
yashbhutwala May 20, 2021
ce399a4
Merge branch 'master' into fix-874
morgante May 20, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
16 changes: 8 additions & 8 deletions autogen/main/dns.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
16 changes: 8 additions & 8 deletions dns.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
1 change: 1 addition & 0 deletions modules/asm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ To deploy this config:
| cluster\_endpoint | The GKE cluster endpoint. | `string` | n/a | yes |
| cluster\_name | The unique name to identify the cluster in ASM. | `string` | n/a | yes |
| gcloud\_sdk\_version | The gcloud sdk version to use. Minimum required version is 293.0.0 | `string` | `"296.0.1"` | no |
| impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | `string` | `""` | no |
| location | The location (zone or region) this cluster has been created in. | `string` | n/a | yes |
| managed | Whether the control plane should be managed. | `bool` | `false` | no |
| project\_id | The project in which the resource belongs. | `string` | n/a | yes |
Expand Down
17 changes: 9 additions & 8 deletions modules/asm/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,16 +24,17 @@ locals {

module "asm_install" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
version = "~> 2.1.0"
module_depends_on = [var.cluster_endpoint]

gcloud_sdk_version = var.gcloud_sdk_version
upgrade = true
additional_components = ["kubectl", "kpt", "beta", "kustomize"]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
gcloud_sdk_version = var.gcloud_sdk_version
upgrade = true
additional_components = ["kubectl", "kpt", "beta", "kustomize"]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = var.managed ? "${local.kubectl_create_command_base} ${var.managed}" : local.kubectl_create_command_base
kubectl_destroy_command = "kubectl delete ns istio-system"
Expand Down
6 changes: 6 additions & 0 deletions modules/asm/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,3 +62,9 @@ variable "managed" {
type = bool
default = false
}

variable "impersonate_service_account" {
type = string
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
default = ""
}
16 changes: 8 additions & 8 deletions modules/beta-private-cluster-update-variant/dns.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
16 changes: 8 additions & 8 deletions modules/beta-private-cluster/dns.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
16 changes: 8 additions & 8 deletions modules/beta-public-cluster-update-variant/dns.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
16 changes: 8 additions & 8 deletions modules/beta-public-cluster/dns.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down
2 changes: 1 addition & 1 deletion modules/hub/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ resource "google_service_account_key" "gke_hub_key" {

module "gke_hub_registration" {
source = "terraform-google-modules/gcloud/google"
version = "~> 2.0.2"
version = "~> 2.1.0"

platform = "linux"
gcloud_sdk_version = var.gcloud_sdk_version
Expand Down
95 changes: 50 additions & 45 deletions modules/k8s-operator-crd-support/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ locals {

module "k8sop_manifest" {
source = "terraform-google-modules/gcloud/google"
version = "~> 2.0.2"
version = "~> 2.1.0"
enabled = local.should_download_manifest

create_cmd_entrypoint = "gsutil"
Expand All @@ -45,14 +45,15 @@ module "k8sop_manifest" {


module "k8s_operator" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
module_depends_on = [module.k8sop_manifest.wait, var.cluster_endpoint]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
module_depends_on = [module.k8sop_manifest.wait, var.cluster_endpoint]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "kubectl apply -f ${local.manifest_path}"
kubectl_destroy_command = "kubectl delete -f ${local.manifest_path}"
Expand All @@ -67,15 +68,16 @@ resource "tls_private_key" "k8sop_creds" {

module "k8sop_creds_secret" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
version = "~> 2.1.0"

enabled = var.create_ssh_key == true || var.ssh_auth_key != null ? "true" : "false"
module_depends_on = [module.k8s_operator.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
enabled = var.create_ssh_key == true || var.ssh_auth_key != null ? "true" : "false"
module_depends_on = [module.k8s_operator.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = local.private_key != null ? "kubectl create secret generic ${var.operator_credential_name} -n=${var.operator_credential_namespace} --from-literal=${local.k8sop_creds_secret_key}='${local.private_key}'" : ""
kubectl_destroy_command = "kubectl delete secret ${var.operator_credential_name} -n=${var.operator_credential_namespace}"
Expand All @@ -102,15 +104,16 @@ data "template_file" "k8sop_config" {
}

module "k8sop_config" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
module_depends_on = [module.k8s_operator.wait, module.k8sop_creds_secret.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
create_cmd_triggers = { configmanagement = data.template_file.k8sop_config.rendered }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
module_depends_on = [module.k8s_operator.wait, module.k8sop_creds_secret.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
create_cmd_triggers = { configmanagement = data.template_file.k8sop_config.rendered }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "kubectl apply -f - <<EOF\n${data.template_file.k8sop_config.rendered}EOF"
kubectl_destroy_command = "kubectl delete -f - <<EOF\n${data.template_file.k8sop_config.rendered}EOF"
Expand All @@ -133,7 +136,7 @@ data "template_file" "rootsync_config" {

module "wait_for_configsync_api" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
version = "~> 2.1.0"
enabled = var.enable_multi_repo

module_depends_on = [module.k8sop_config.wait]
Expand All @@ -153,32 +156,34 @@ module "wait_for_configsync_api" {

module "rootsync_config" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
version = "~> 2.1.0"
enabled = var.enable_multi_repo

module_depends_on = [module.wait_for_configsync_api.wait]
cluster_name = var.cluster_name
project_id = var.project_id
cluster_location = var.location
create_cmd_triggers = { rootsync = data.template_file.rootsync_config.rendered }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
module_depends_on = [module.wait_for_configsync_api.wait]
cluster_name = var.cluster_name
project_id = var.project_id
cluster_location = var.location
create_cmd_triggers = { rootsync = data.template_file.rootsync_config.rendered }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "kubectl apply -f - <<EOF\n${data.template_file.rootsync_config.rendered}EOF"
kubectl_destroy_command = "kubectl delete -f - <<EOF\n${data.template_file.rootsync_config.rendered}EOF"
}

module "wait_for_gatekeeper" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = var.enable_policy_controller ? true : false
module_depends_on = [module.k8sop_config.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
create_cmd_triggers = { script_sha1 = sha1(file("${path.module}/scripts/wait_for_gatekeeper.sh")) }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = var.enable_policy_controller ? true : false
module_depends_on = [module.k8sop_config.wait]
cluster_name = var.cluster_name
cluster_location = var.location
project_id = var.project_id
create_cmd_triggers = { script_sha1 = sha1(file("${path.module}/scripts/wait_for_gatekeeper.sh")) }
service_account_key_file = var.service_account_key_file
use_existing_context = var.use_existing_context
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/wait_for_gatekeeper.sh ${var.project_id} ${var.cluster_name} ${var.location} ${local.append_arg_use_existing_context}"
kubectl_destroy_command = ""
Expand Down
6 changes: 6 additions & 0 deletions modules/k8s-operator-crd-support/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,3 +162,9 @@ variable "use_existing_context" {
type = bool
default = false
}

variable "impersonate_service_account" {
type = string
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
default = ""
}
16 changes: 8 additions & 8 deletions modules/private-cluster-update-variant/dns.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,14 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.0.2"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade

source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
project_id = var.project_id
upgrade = var.gcloud_upgrade
impersonate_service_account = var.impersonate_service_account

kubectl_create_command = "${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"
kubectl_destroy_command = ""
Expand Down