Skip to content

Commit e2a47b2

Browse files
dak1n1dak1n1
authored
Merge pull request #731 from andrein/data_source_kubernetes_service_account
Add kubernetes_service_account data source
2 parents 989d07d + 9ebfb2b commit e2a47b2

File tree

6 files changed

+237
-7
lines changed

6 files changed

+237
-7
lines changed

‎kubernetes/data_source_kubernetes_service_account.go‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
package kubernetes
2+
3+
import (
4+
"fmt"
5+
6+
"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
7+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
8+
)
9+
10+
func dataSourceKubernetesServiceAccount() *schema.Resource {
11+
return &schema.Resource{
12+
Read: dataSourceKubernetesServiceAccountRead,
13+
14+
Schema: map[string]*schema.Schema{
15+
"metadata": namespacedMetadataSchema("service account", false),
16+
"image_pull_secret": {
17+
Type: schema.TypeList,
18+
Description: "A list of references to secrets in the same namespace to use for pulling any images in pods that reference this Service Account. More info: http://kubernetes.io/docs/user-guide/secrets#manually-specifying-an-imagepullsecret",
19+
Computed: true,
20+
Elem: &schema.Resource{
21+
Schema: map[string]*schema.Schema{
22+
"name": {
23+
Type: schema.TypeString,
24+
Description: "Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names",
25+
Computed: true,
26+
},
27+
},
28+
},
29+
},
30+
"secret": {
31+
Type: schema.TypeList,
32+
Description: "A list of secrets allowed to be used by pods running using this Service Account. More info: http://kubernetes.io/docs/user-guide/secrets",
33+
Computed: true,
34+
Elem: &schema.Resource{
35+
Schema: map[string]*schema.Schema{
36+
"name": {
37+
Type: schema.TypeString,
38+
Description: "Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names",
39+
Computed: true,
40+
},
41+
},
42+
},
43+
},
44+
"automount_service_account_token": {
45+
Type: schema.TypeBool,
46+
Description: "True to enable automatic mounting of the service account token",
47+
Computed: true,
48+
},
49+
"default_secret_name": {
50+
Type: schema.TypeString,
51+
Computed: true,
52+
},
53+
},
54+
}
55+
}
56+
57+
func dataSourceKubernetesServiceAccountRead(d *schema.ResourceData, meta interface{}) error {
58+
conn, err := meta.(KubeClientsets).MainClientset()
59+
if err != nil {
60+
return err
61+
}
62+
metadata := expandMetadata(d.Get("metadata").([]interface{}))
63+
64+
sa, err := conn.CoreV1().ServiceAccounts(metadata.Namespace).Get(metadata.Name, metav1.GetOptions{})
65+
if err != nil {
66+
return fmt.Errorf("Unable to fetch service account from Kubernetes: %s", err)
67+
}
68+
69+
defaultSecret, err := findDefaultServiceAccount(sa, conn)
70+
if err != nil {
71+
return fmt.Errorf("Failed to discover the default service account token: %s", err)
72+
}
73+
74+
err = d.Set("default_secret_name", defaultSecret)
75+
if err != nil {
76+
return fmt.Errorf("Unable to set default_secret_name: %s", err)
77+
}
78+
79+
d.SetId(buildId(sa.ObjectMeta))
80+
81+
return resourceKubernetesServiceAccountRead(d, meta)
82+
}

‎kubernetes/data_source_kubernetes_service_account_test.go‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
package kubernetes
2+
3+
import (
4+
"fmt"
5+
// "regexp"
6+
"testing"
7+
8+
"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
9+
"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
10+
)
11+
12+
func TestAccKubernetesDataSourceServiceAccount_basic(t *testing.T) {
13+
name := fmt.Sprintf("tf-acc-test-%s", acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum))
14+
15+
resource.Test(t, resource.TestCase{
16+
PreCheck: func() { testAccPreCheck(t) },
17+
Providers: testAccProviders,
18+
Steps: []resource.TestStep{
19+
{
20+
Config: testAccKubernetesDataSourceServiceAccountConfig_basic(name),
21+
Check: resource.ComposeAggregateTestCheckFunc(
22+
resource.TestCheckResourceAttr("data.kubernetes_service_account.test", "metadata.0.name", name),
23+
resource.TestCheckResourceAttr("data.kubernetes_service_account.test", "metadata.0.annotations.TestAnnotation", "annotation"),
24+
resource.TestCheckResourceAttr("data.kubernetes_service_account.test", "metadata.0.labels.TestLabel", "label"),
25+
resource.TestCheckResourceAttr("data.kubernetes_service_account.test", "secret.0.name", name+"-secret"),
26+
resource.TestCheckResourceAttr("data.kubernetes_service_account.test", "image_pull_secret.0.name", name+"-image-pull-secret"),
27+
resource.TestCheckResourceAttr("data.kubernetes_service_account.test", "automount_service_account_token", "false"),
28+
resource.TestCheckResourceAttrSet("data.kubernetes_service_account.test", "default_secret_name"),
29+
),
30+
},
31+
},
32+
})
33+
}
34+
35+
func testAccKubernetesDataSourceServiceAccountConfig_basic(name string) string {
36+
return fmt.Sprintf(`
37+
resource "kubernetes_service_account" "test" {
38+
metadata {
39+
annotations = {
40+
TestAnnotation = "annotation"
41+
}
42+
43+
labels = {
44+
TestLabel = "label"
45+
}
46+
name = "%s"
47+
}
48+
49+
secret {
50+
name = "${kubernetes_secret.secret.metadata.0.name}"
51+
}
52+
53+
image_pull_secret {
54+
name = "${kubernetes_secret.image_pull_secret.metadata.0.name}"
55+
}
56+
}
57+
58+
resource "kubernetes_secret" "secret" {
59+
metadata {
60+
name = "%s-secret"
61+
}
62+
}
63+
64+
resource "kubernetes_secret" "image_pull_secret" {
65+
metadata {
66+
name = "%s-image-pull-secret"
67+
}
68+
}
69+
70+
data "kubernetes_service_account" "test" {
71+
metadata {
72+
name = "${kubernetes_service_account.test.metadata.0.name}"
73+
}
74+
}
75+
`, name, name, name)
76+
}

‎kubernetes/provider.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
apimachineryschema "k8s.io/apimachinery/pkg/runtime/schema"
1414
kubernetes "k8s.io/client-go/kubernetes"
1515
_ "k8s.io/client-go/plugin/pkg/client/auth"
16-
"k8s.io/client-go/rest"
1716
restclient "k8s.io/client-go/rest"
1817

1918
"k8s.io/client-go/tools/clientcmd"
@@ -137,10 +136,11 @@ func Provider() terraform.ResourceProvider {
137136
},
138137

139138
DataSourcesMap: map[string]*schema.Resource{
140-
"kubernetes_config_map": dataSourceKubernetesConfigMap(),
141-
"kubernetes_secret": dataSourceKubernetesSecret(),
142-
"kubernetes_service": dataSourceKubernetesService(),
143-
"kubernetes_storage_class": dataSourceKubernetesStorageClass(),
139+
"kubernetes_config_map": dataSourceKubernetesConfigMap(),
140+
"kubernetes_secret": dataSourceKubernetesSecret(),
141+
"kubernetes_service": dataSourceKubernetesService(),
142+
"kubernetes_service_account": dataSourceKubernetesServiceAccount(),
143+
"kubernetes_storage_class": dataSourceKubernetesStorageClass(),
144144
},
145145

146146
ResourcesMap: map[string]*schema.Resource{
@@ -194,7 +194,7 @@ type KubeClientsets interface {
194194
}
195195

196196
type kubeClientsets struct {
197-
config *rest.Config
197+
config *restclient.Config
198198
mainClientset *kubernetes.Clientset
199199
aggregatorClientset *aggregator.Clientset
200200
}

‎website/docs/d/service_account.html.markdown‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
layout: "kubernetes"
3+
page_title: "Kubernetes: kubernetes_service_account"
4+
sidebar_current: "docs-kubernetes-data-source-service-account"
5+
description: |-
6+
A service account provides an identity for processes that run in a Pod.
7+
---
8+
9+
# kubernetes_service_account
10+
11+
A service account provides an identity for processes that run in a Pod. This data source reads the service account and makes specific attributes available to Terraform.
12+
13+
Read more at [Kubernetes reference](https://kubernetes.io/docs/admin/service-accounts-admin/)
14+
15+
## Example Usage
16+
17+
```hcl
18+
data "kubernetes_service_account" "example" {
19+
metadata {
20+
name = "terraform-example"
21+
}
22+
}
23+
24+
data "kubernetes_secret" "example" {
25+
metadata {
26+
name = "${data.kubernetes_service_account.example.default_secret_name}"
27+
}
28+
}
29+
```
30+
31+
## Argument Reference
32+
33+
The following arguments are supported:
34+
35+
* `metadata` - (Required) Standard service account's metadata. For more info see [Kubernetes reference](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata)
36+
37+
## Nested Blocks
38+
39+
### `metadata`
40+
41+
#### Arguments
42+
43+
* `name` - (Required) Name of the service account, must be unique. For more info see [Kubernetes reference](http://kubernetes.io/docs/user-guide/identifiers#names)
44+
* `namespace` - (Optional) Namespace defines the space within which name of the service account must be unique.
45+
46+
#### Attributes
47+
48+
* `generation` - A sequence number representing a specific generation of the desired state.
49+
* `resource_version` - An opaque value that represents the internal version of this service account that can be used by clients to determine when service account has changed. For more info see [Kubernetes reference](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency)
50+
* `self_link` - A URL representing this service account.
51+
* `uid` - The unique in time and space value for this service account. For more info see [Kubernetes reference](http://kubernetes.io/docs/user-guide/identifiers#uids)
52+
53+
## Attribute Reference
54+
55+
* `image_pull_secret` - A list of image pull secrets associated with the service account.
56+
* `secret` - A list of secrets associated with the service account.
57+
* `default_secret_name` - Name of the default secret, containing service account token, created & managed by the service.
58+
59+
### `image_pull_secret`
60+
61+
#### Attributes
62+
63+
* `name` - Name of the referent. For more info see [Kubernetes reference](http://kubernetes.io/docs/user-guide/identifiers#names)
64+
65+
### `secret`
66+
67+
#### Attributes
68+
69+
* `name` - Name of the referent. For more info see [Kubernetes reference](http://kubernetes.io/docs/user-guide/identifiers#names)

‎website/docs/r/service_account.html.markdown‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ description: |-
1010

1111
A service account provides an identity for processes that run in a Pod.
1212

13-
Read more at [Kubernetes reference](https://kubernetes.io/docs/admin/service-accounts-admin)/
13+
Read more at [Kubernetes reference](https://kubernetes.io/docs/admin/service-accounts-admin/)
1414

1515
## Example Usage
1616

‎website/kubernetes.erb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@
2424
<li<%= sidebar_current("docs-kubernetes-data-source-secret") %>>
2525
<a href="/docs/providers/kubernetes/d/secret.html">kubernetes_secret</a>
2626
</li>
27+
<li<%= sidebar_current("docs-kubernetes-data-source-service-account") %>>
28+
<a href="/docs/providers/kubernetes/d/service_account.html">kubernetes_service_account</a>
29+
</li>
2730
<li<%= sidebar_current("docs-kubernetes-data-source-service") %>>
2831
<a href="/docs/providers/kubernetes/d/service.html">kubernetes_service</a>
2932
</li>

0 commit comments

Comments
 (0)