[#77] Argo: Fix SA permissions

odahu · Apr 6, 2021 · 87d0bdc · 87d0bdc
1 parent 147bc4c
commit 87d0bdc
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/terraform/modules/k8s/argo/prereqs/gke/main.tf b/terraform/modules/k8s/argo/prereqs/gke/main.tf
@@ -1,5 +1,6 @@
 locals {
   gsa_argo_name = "${var.cluster_name}-argo"
+  workflows_namespace = var.configuration.workflows_namespace == "" ? var.configuration.namespace : var.configuration.workflows_namespace
 }
 
 resource "google_service_account" "argo" {
@@ -45,7 +46,7 @@ resource "google_service_account_iam_binding" "argo_web_identity" {
   service_account_id = google_service_account.argo.name
   role               = "roles/iam.workloadIdentityUser"
 
-  members = ["serviceAccount:${var.project_id}.svc.id.goog[argo]", "serviceAccount:${var.project_id}.svc.id.goog[argo-workflow]"]
+  members = ["serviceAccount:${var.project_id}.svc.id.goog[${var.configuration.namespace}|argo]", "serviceAccount:${var.project_id}.svc.id.goog[${local.workflows_namespace}|argo-workflow]"]
 }
 
 resource "google_service_account_key" "argo_sa_key" {