Skip to content

Commit

Permalink
feat: add cross project fleet service agent (#1896)
Browse files Browse the repository at this point in the history
  • Loading branch information
apeabody authored Mar 8, 2024
1 parent 79a8d68 commit 59d36b9
Show file tree
Hide file tree
Showing 27 changed files with 166 additions and 0 deletions.
4 changes: 4 additions & 0 deletions autogen/main/cluster.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -584,6 +584,10 @@ resource "google_container_cluster" "primary" {
}
}
{% endif %}
{% if beta_cluster %}

depends_on = [google_project_iam_member.service_agent]
{% endif %}
}
{% if autopilot_cluster != true %}
/******************************************
Expand Down
16 changes: 16 additions & 0 deletions autogen/main/sa.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,19 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
role = "roles/artifactregistry.reader"
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
}
{% if beta_cluster %}

resource "google_project_service_identity" "fleet_project" {
count = var.fleet_project_grant_service_agent ? 1 : 0
provider = google-beta
project = var.fleet_project
service = "gkehub.googleapis.com"
}

resource "google_project_iam_member" "service_agent" {
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
project = var.project_id
role = each.value
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
}
{% endif %}
8 changes: 8 additions & 0 deletions autogen/main/variables.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -863,3 +863,11 @@ variable "fleet_project" {
type = string
default = null
}
{% if beta_cluster %}

variable "fleet_project_grant_service_agent" {
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
type = bool
default = false
}
{% endif %}
1 change: 1 addition & 0 deletions modules/beta-autopilot-private-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,7 @@ Then perform the following commands on the root folder:
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-autopilot-private-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -268,4 +268,6 @@ resource "google_container_cluster" "primary" {
topic = var.notification_config_topic
}
}

depends_on = [google_project_iam_member.service_agent]
}
14 changes: 14 additions & 0 deletions modules/beta-autopilot-private-cluster/sa.tf
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
role = "roles/artifactregistry.reader"
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
}

resource "google_project_service_identity" "fleet_project" {
count = var.fleet_project_grant_service_agent ? 1 : 0
provider = google-beta
project = var.fleet_project
service = "gkehub.googleapis.com"
}

resource "google_project_iam_member" "service_agent" {
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
project = var.project_id
role = each.value
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
}
6 changes: 6 additions & 0 deletions modules/beta-autopilot-private-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -466,3 +466,9 @@ variable "fleet_project" {
type = string
default = null
}

variable "fleet_project_grant_service_agent" {
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
type = bool
default = false
}
1 change: 1 addition & 0 deletions modules/beta-autopilot-public-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@ Then perform the following commands on the root folder:
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-autopilot-public-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -249,4 +249,6 @@ resource "google_container_cluster" "primary" {
topic = var.notification_config_topic
}
}

depends_on = [google_project_iam_member.service_agent]
}
14 changes: 14 additions & 0 deletions modules/beta-autopilot-public-cluster/sa.tf
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
role = "roles/artifactregistry.reader"
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
}

resource "google_project_service_identity" "fleet_project" {
count = var.fleet_project_grant_service_agent ? 1 : 0
provider = google-beta
project = var.fleet_project
service = "gkehub.googleapis.com"
}

resource "google_project_iam_member" "service_agent" {
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
project = var.project_id
role = each.value
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
}
6 changes: 6 additions & 0 deletions modules/beta-autopilot-public-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -436,3 +436,9 @@ variable "fleet_project" {
type = string
default = null
}

variable "fleet_project_grant_service_agent" {
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
type = bool
default = false
}
1 change: 1 addition & 0 deletions modules/beta-private-cluster-update-variant/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,7 @@ Then perform the following commands on the root folder:
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster-update-variant/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -500,6 +500,8 @@ resource "google_container_cluster" "primary" {
}
}
}

depends_on = [google_project_iam_member.service_agent]
}
/******************************************
Create Container Cluster node pools
Expand Down
14 changes: 14 additions & 0 deletions modules/beta-private-cluster-update-variant/sa.tf
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
role = "roles/artifactregistry.reader"
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
}

resource "google_project_service_identity" "fleet_project" {
count = var.fleet_project_grant_service_agent ? 1 : 0
provider = google-beta
project = var.fleet_project
service = "gkehub.googleapis.com"
}

resource "google_project_iam_member" "service_agent" {
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
project = var.project_id
role = each.value
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
}
6 changes: 6 additions & 0 deletions modules/beta-private-cluster-update-variant/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -817,3 +817,9 @@ variable "fleet_project" {
type = string
default = null
}

variable "fleet_project_grant_service_agent" {
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
type = bool
default = false
}
1 change: 1 addition & 0 deletions modules/beta-private-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,7 @@ Then perform the following commands on the root folder:
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -500,6 +500,8 @@ resource "google_container_cluster" "primary" {
}
}
}

depends_on = [google_project_iam_member.service_agent]
}
/******************************************
Create Container Cluster node pools
Expand Down
14 changes: 14 additions & 0 deletions modules/beta-private-cluster/sa.tf
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
role = "roles/artifactregistry.reader"
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
}

resource "google_project_service_identity" "fleet_project" {
count = var.fleet_project_grant_service_agent ? 1 : 0
provider = google-beta
project = var.fleet_project
service = "gkehub.googleapis.com"
}

resource "google_project_iam_member" "service_agent" {
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
project = var.project_id
role = each.value
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
}
6 changes: 6 additions & 0 deletions modules/beta-private-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -817,3 +817,9 @@ variable "fleet_project" {
type = string
default = null
}

variable "fleet_project_grant_service_agent" {
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
type = bool
default = false
}
1 change: 1 addition & 0 deletions modules/beta-public-cluster-update-variant/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,7 @@ Then perform the following commands on the root folder:
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-public-cluster-update-variant/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -481,6 +481,8 @@ resource "google_container_cluster" "primary" {
}
}
}

depends_on = [google_project_iam_member.service_agent]
}
/******************************************
Create Container Cluster node pools
Expand Down
14 changes: 14 additions & 0 deletions modules/beta-public-cluster-update-variant/sa.tf
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
role = "roles/artifactregistry.reader"
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
}

resource "google_project_service_identity" "fleet_project" {
count = var.fleet_project_grant_service_agent ? 1 : 0
provider = google-beta
project = var.fleet_project
service = "gkehub.googleapis.com"
}

resource "google_project_iam_member" "service_agent" {
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
project = var.project_id
role = each.value
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
}
6 changes: 6 additions & 0 deletions modules/beta-public-cluster-update-variant/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -787,3 +787,9 @@ variable "fleet_project" {
type = string
default = null
}

variable "fleet_project_grant_service_agent" {
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
type = bool
default = false
}
1 change: 1 addition & 0 deletions modules/beta-public-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,7 @@ Then perform the following commands on the root folder:
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-public-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -481,6 +481,8 @@ resource "google_container_cluster" "primary" {
}
}
}

depends_on = [google_project_iam_member.service_agent]
}
/******************************************
Create Container Cluster node pools
Expand Down
14 changes: 14 additions & 0 deletions modules/beta-public-cluster/sa.tf
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,17 @@ resource "google_project_iam_member" "cluster_service_account-artifact-registry"
role = "roles/artifactregistry.reader"
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
}

resource "google_project_service_identity" "fleet_project" {
count = var.fleet_project_grant_service_agent ? 1 : 0
provider = google-beta
project = var.fleet_project
service = "gkehub.googleapis.com"
}

resource "google_project_iam_member" "service_agent" {
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
project = var.project_id
role = each.value
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
}
6 changes: 6 additions & 0 deletions modules/beta-public-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -787,3 +787,9 @@ variable "fleet_project" {
type = string
default = null
}

variable "fleet_project_grant_service_agent" {
description = "(Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles."
type = bool
default = false
}

0 comments on commit 59d36b9

Please sign in to comment.