bug: fix svpc regression

[bharathkkb]

• fix svpc regression to grant roles/compute.networkUser at project level if subnets empty
• additional tests to cover all cases
  • if list of subnets empty, expect GKE/dataproc bindings at project level (service project b)
  • if list of subnets not empty, expect GKE/dataproc bindings at subnet level (service project)
  • Either case, if GKE, roles/container.hostServiceAgentUser granted at project level
• use common resources for each service

[bharathkkb]

compact was giving me the count cannot determine number of resources error. Weirdly enough this approach does not. I think it has to do something with this hashicorp/terraform#25152

[morgante]

I think looping on the actual accounts is actually dangerous. I think something like this would be better:

locals {
  apis = {
    "container.googleapis.com": format("service-%s@container-engine-robot.iam.gserviceaccount.com", data.google_project.service_project.number
 }
  active_apis = setintersection(keys(local.apis), var.active_apis
  subnetwork_api = setproduct(local.active_apis, var.shared_vpc_subnets)
}

[bharathkkb]

I ended up having to do tolist(setproduct(local.active_apis, var.shared_vpc_subnets)) as it was otherwise a set and throwing error This value does not have any indices. In this case I dont think element ordering matters as it becomes a list of elements of type [api,subnet].

[morgante]

I think looping on the actual accounts is actually dangerous. I think something like this would be better:

locals {
  apis = {
    "container.googleapis.com": format("service-%s@container-engine-robot.iam.gserviceaccount.com", data.google_project.service_project.number
 }
  active_apis = setintersection(keys(local.apis), var.active_apis
  subnetwork_api = setproduct(local.active_apis, var.shared_vpc_subnets)
}