Skip to content

Commit 81bc3ad

Browse files
gtoonstragtoonstra
committed
feat: Workload identity for GKE
1 parent a806477 commit 81bc3ad

File tree

8 files changed

+149
-40
lines changed

8 files changed

+149
-40
lines changed

‎examples/deployment/application/versions.tf‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,15 @@ terraform {
88
source = "hashicorp/kubernetes"
99
version = "~> 2.25.2"
1010
}
11+
helm = {
12+
source = "hashicorp/helm"
13+
version = "~> 2.17.0"
14+
}
1115
}
1216
}
1317

1418
locals {
1519
operator_version = "1.2.8"
16-
helm_version = "0.6.83"
20+
helm_version = "0.7.1"
1721
crd_version = "0.1.1"
1822
}

‎examples/deployment/infra/config.tf‎

Lines changed: 56 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,62 @@ resource "local_file" "infra_config" {
33
content = templatefile(
44
"${path.module}/../templates/datafold/infra_settings.tpl",
55
{
6-
aws_target_group_arn = "",
7-
cluster_scaler_role_arn = "",
8-
clickhouse_access_key = "",
9-
clickhouse_backup_sa = module.gcp[0].clickhouse_backup_sa,
10-
clickhouse_data_size = module.gcp[0].clickhouse_data_size,
11-
clickhouse_data_volume_id = module.gcp[0].clickhouse_data_volume_id,
12-
clickhouse_gcs_bucket = module.gcp[0].clickhouse_gcs_bucket,
13-
clickhouse_logs_size = module.gcp[0].clickhouse_logs_size,
14-
clickhouse_log_volume_id = module.gcp[0].clickhouse_logs_volume_id,
15-
clickhouse_s3_bucket = "",
16-
clickhouse_s3_region = "",
17-
clickhouse_secret_key = "",
18-
cloud_provider = module.gcp[0].cloud_provider,
19-
cluster_name = module.gcp[0].cluster_name,
20-
gcp_neg_name = module.gcp[0].neg_name,
21-
load_balancer_ips = module.gcp[0].lb_external_ip,
22-
load_balancer_controller_arn = "",
23-
postgres_database = module.gcp[0].postgres_database_name,
24-
postgres_password = module.gcp[0].postgres_password,
25-
postgres_port = module.gcp[0].postgres_port,
26-
postgres_server = module.gcp[0].postgres_host,
27-
postgres_user = module.gcp[0].postgres_username,
28-
redis_password = module.gcp[0].redis_password,
29-
redis_data_size = module.gcp[0].redis_data_size,
30-
redis_data_volume_id = module.gcp[0].redis_data_volume_id,
31-
server_name = module.gcp[0].domain_name,
32-
vpc_cidr = module.gcp[0].vpc_cidr,
6+
aws_target_group_arn = "",
7+
cluster_scaler_role_arn = "",
8+
clickhouse_s3_backup_role = "",
9+
clickhouse_data_size = module.gcp[0].clickhouse_data_size,
10+
clickhouse_data_volume_id = module.gcp[0].clickhouse_data_volume_id,
11+
clickhouse_gcs_bucket = module.gcp[0].clickhouse_gcs_bucket,
12+
gcp_backup_account = module.gcp[0].clickhouse_backup_sa,
13+
clickhouse_logs_size = module.gcp[0].clickhouse_logs_size,
14+
clickhouse_log_volume_id = module.gcp[0].clickhouse_logs_volume_id,
15+
clickhouse_s3_bucket = "",
16+
clickhouse_s3_region = "",
17+
clickhouse_azblob_account_name = "",
18+
clickhouse_azblob_container = "",
19+
clickhouse_azblob_account_key = "",
20+
cloud_provider = module.gcp[0].cloud_provider,
21+
cluster_name = module.gcp[0].cluster_name,
22+
gcp_neg_name = module.gcp[0].neg_name,
23+
load_balancer_ips = jsondecode(module.gcp[0].lb_external_ip),
24+
load_balancer_controller_arn = "",
25+
postgres_database = module.gcp[0].postgres_database_name,
26+
postgres_password = module.gcp[0].postgres_password,
27+
postgres_port = module.gcp[0].postgres_port,
28+
postgres_server = module.gcp[0].postgres_host,
29+
postgres_user = module.gcp[0].postgres_username,
30+
redis_password = module.gcp[0].redis_password,
31+
redis_data_size = module.gcp[0].redis_data_size,
32+
redis_data_volume_id = module.gcp[0].redis_data_volume_id,
33+
server_name = module.gcp[0].domain_name,
34+
vpc_cidr = module.gcp[0].vpc_cidr,
35+
36+
# service accounts vars
37+
dfshell_role_arn = try(module.gcp[0].dfshell_role_arn, "")
38+
dfshell_service_account_name = try(module.gcp[0].dfshell_service_account_name, "datafold-dfshell")
39+
worker_portal_role_arn = try(module.gcp[0].worker_portal_role_arn, "")
40+
worker_portal_service_account_name = try(module.gcp[0].worker_portal_service_account_name, "datafold-worker-portal")
41+
operator_role_arn = try(module.gcp[0].operator_role_arn, "")
42+
operator_service_account_name = try(module.gcp[0].operator_service_account_name, "datafold-operator")
43+
server_role_arn = try(module.gcp[0].server_role_arn, "")
44+
server_service_account_name = try(module.gcp[0].server_service_account_name, "datafold-server")
45+
scheduler_role_arn = try(module.gcp[0].scheduler_role_arn, "")
46+
scheduler_service_account_name = try(module.gcp[0].scheduler_service_account_name, "datafold-scheduler")
47+
worker_role_arn = try(module.gcp[0].worker_role_arn, "")
48+
worker_service_account_name = try(module.gcp[0].worker_service_account_name, "datafold-worker")
49+
worker_catalog_role_arn = try(module.gcp[0].worker_catalog_role_arn, "")
50+
worker_catalog_service_account_name = try(module.gcp[0].worker_catalog_service_account_name, "datafold-worker-catalog")
51+
worker_interactive_role_arn = try(module.gcp[0].worker_interactive_role_arn, "")
52+
worker_interactive_service_account_name = try(module.gcp[0].worker_interactive_service_account_name, "datafold-worker-interactive")
53+
worker_singletons_role_arn = try(module.gcp[0].worker_singletons_role_arn, "")
54+
worker_singletons_service_account_name = try(module.gcp[0].worker_singletons_service_account_name, "datafold-worker-singletons")
55+
worker_lineage_role_arn = try(module.gcp[0].worker_lineage_role_arn, "")
56+
worker_lineage_service_account_name = try(module.gcp[0].worker_lineage_service_account_name, "datafold-worker-lineage")
57+
worker_monitor_role_arn = try(module.gcp[0].worker_monitor_role_arn, "")
58+
worker_monitor_service_account_name = try(module.gcp[0].worker_monitor_service_account_name, "datafold-worker-monitor")
59+
storage_worker_role_arn = try(module.gcp[0].storage_worker_role_arn, "")
60+
storage_worker_service_account_name = try(module.gcp[0].storage_worker_service_account_name, "datafold-storage-worker")
61+
3362
}
3463
)
3564

‎examples/deployment/infra/main.tf‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,14 +36,20 @@ module "gcp" {
3636
# Virtual Private Cloud
3737
whitelisted_ingress_cidrs = local.lb_whitelisted_ingress_cidrs
3838
whitelisted_egress_cidrs = concat(
39-
local.github_cidrs
39+
local.github_cidrs,
4040
)
41-
deploy_vpc_flow_logs = true
41+
vpc_cidr = "10.0.0.0/16"
42+
43+
# Clickhouse
44+
clickhouse_data_disk_size = 200
45+
46+
# Database
47+
database_version = "POSTGRES_15"
48+
deploy_vpc_flow_logs = true
4249

4350
# Clickhouse
4451
clickhouse_data_disk_size = 50
4552

4653
# k8s
4754
k8s_authorized_networks = local.authorized_networks
48-
k8s_cluster_version = "1.28.11-gke.1260000"
4955
}

‎examples/deployment/templates/infra_settings.tpl‎

Lines changed: 72 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ clickhouse:
33
gcs_bucket: ${clickhouse_gcs_bucket}
44
s3_bucket: ${clickhouse_s3_bucket}
55
s3_region: ${clickhouse_s3_region}
6+
s3_backup_role: ${clickhouse_s3_backup_role}
7+
gcp_backup_account: ${gcp_backup_account}
68
azblob_account_name: ${clickhouse_azblob_account_name}
79
azblob_container: ${clickhouse_azblob_container}
810
storage:
@@ -11,9 +13,6 @@ clickhouse:
1113
logSize: ${clickhouse_logs_size}
1214
logVolumeId: ${clickhouse_log_volume_id}
1315
secrets:
14-
access_key: ${clickhouse_access_key}
15-
secret_key: ${clickhouse_secret_key}
16-
clickhouse_backup_sa: ${clickhouse_backup_sa}
1716
azblob_account_key: ${clickhouse_azblob_account_key}
1817

1918
redis:
@@ -47,3 +46,73 @@ secrets:
4746
password: ${postgres_password}
4847
port: ${postgres_port}
4948
user: ${postgres_user}
49+
50+
dfshell:
51+
serviceAccount:
52+
name: ${dfshell_service_account_name}
53+
roleArn: ${dfshell_role_arn}
54+
55+
worker-portal:
56+
serviceAccount:
57+
name: ${worker_portal_service_account_name}
58+
roleArn: ${worker_portal_role_arn}
59+
60+
operator:
61+
serviceAccount:
62+
name: ${operator_service_account_name}
63+
roleArn: ${operator_role_arn}
64+
65+
server:
66+
serviceAccount:
67+
name: ${server_service_account_name}
68+
roleArn: ${server_role_arn}
69+
70+
scheduler:
71+
serviceAccount:
72+
name: ${scheduler_service_account_name}
73+
roleArn: ${scheduler_role_arn}
74+
75+
worker:
76+
serviceAccount:
77+
name: ${worker_service_account_name}
78+
roleArn: ${worker_role_arn}
79+
80+
worker2:
81+
serviceAccount:
82+
name: ${worker_service_account_name}
83+
roleArn: ${worker_role_arn}
84+
85+
worker3:
86+
serviceAccount:
87+
name: ${worker_service_account_name}
88+
roleArn: ${worker_role_arn}
89+
90+
worker-catalog:
91+
serviceAccount:
92+
name: ${worker_catalog_service_account_name}
93+
roleArn: ${worker_catalog_role_arn}
94+
95+
worker-interactive:
96+
serviceAccount:
97+
name: ${worker_interactive_service_account_name}
98+
roleArn: ${worker_interactive_role_arn}
99+
100+
worker-singletons:
101+
serviceAccount:
102+
name: ${worker_singletons_service_account_name}
103+
roleArn: ${worker_singletons_role_arn}
104+
105+
worker-lineage:
106+
serviceAccount:
107+
name: ${worker_lineage_service_account_name}
108+
roleArn: ${worker_lineage_role_arn}
109+
110+
worker-monitor:
111+
serviceAccount:
112+
name: ${worker_monitor_service_account_name}
113+
roleArn: ${worker_monitor_role_arn}
114+
115+
storage-worker:
116+
serviceAccount:
117+
name: ${storage_worker_service_account_name}
118+
roleArn: ${storage_worker_role_arn}

‎modules/clickhouse_backup/iam.tf‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,3 @@ resource "google_project_iam_member" "clickhouse" {
2020
member = "serviceAccount:${google_service_account.clickhouse.email}"
2121
}
2222

23-
resource "google_service_account_key" "clickhouse" {
24-
count = var.clickhouse_get_backup_sa_from_secrets_yaml ? 0 : 1
25-
service_account_id = resource.google_service_account.clickhouse.id
26-
}

‎modules/clickhouse_backup/outputs.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@ output "clickhouse_gcs_bucket" {
33
}
44

55
output "clickhouse_backup_sa" {
6-
value = var.clickhouse_get_backup_sa_from_secrets_yaml ? var.clickhouse_backup_sa_key : one(resource.google_service_account_key.clickhouse[*].private_key)
6+
value = resource.google_service_account.clickhouse.account_id
77
}

‎modules/gke/main.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ resource "google_container_cluster" "default" {
2020
project = var.project_id
2121
network = var.vpc_id
2222
subnetwork = var.subnetwork
23+
location = var.azs[0]
2324
min_master_version = data.google_container_engine_versions.cluster.latest_master_version
2425

2526
networking_mode = "VPC_NATIVE"
@@ -120,6 +121,10 @@ resource "google_container_cluster" "default" {
120121
autoscaling_profile = "OPTIMIZE_UTILIZATION"
121122
}
122123

124+
workload_identity_config {
125+
workload_pool = "${var.project_id}.svc.id.goog"
126+
}
127+
123128
deletion_protection = var.k8s_deletion_protection
124129
}
125130

‎variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ variable "restricted_roles" {
5252

5353
variable "redis_data_size" {
5454
type = number
55-
default = 10
55+
default = 50
5656
description = "Redis volume size"
5757
}
5858

0 commit comments

Comments
 (0)