Skip to content

Commit 31d03a5

Browse files
boomanaiden154boomanaiden154
authored
[CI] Add service accounts for accessing buckets
This patch wires up the necessary service accounts so that we can access the GCS buckets set up in an earlier patch from inside the cluster. Reviewers: lnihlen, Keenuts, cmtice, dschuff, gburgessiv Reviewed By: cmtice Pull Request: #508
1 parent b1e32bb commit 31d03a5

File tree

3 files changed

+116
-19
lines changed

3 files changed

+116
-19
lines changed

‎premerge/gke_cluster/main.tf

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,3 +176,65 @@ resource "google_storage_bucket" "object_cache_windows" {
176176
uniform_bucket_level_access = true
177177
public_access_prevention = "enforced"
178178
}
179+
180+
resource "google_service_account" "object_cache_linux_gsa" {
181+
account_id = format("%s-linux-gsa", var.region)
182+
display_name = format("%s Linux Object Cache Service Account", var.region)
183+
}
184+
185+
resource "google_service_account" "object_cache_windows_gsa" {
186+
account_id = format("%s-windows-gsa", var.region)
187+
display_name = format("%s Windows Object Cache Service Account", var.region)
188+
}
189+
190+
resource "google_storage_bucket_iam_binding" "linux_bucket_binding" {
191+
bucket = google_storage_bucket.object_cache_linux.name
192+
role = "roles/storage.objectUser"
193+
members = [
194+
format("serviceAccount:%s", google_service_account.object_cache_linux_gsa.email),
195+
]
196+
197+
depends_on = [
198+
google_storage_bucket.object_cache_linux,
199+
google_service_account.object_cache_linux_gsa,
200+
]
201+
}
202+
203+
resource "google_storage_bucket_iam_binding" "windows_bucket_binding" {
204+
bucket = google_storage_bucket.object_cache_windows.name
205+
role = "roles/storage.objectUser"
206+
members = [
207+
format("serviceAccount:%s", google_service_account.object_cache_windows_gsa.email),
208+
]
209+
210+
depends_on = [
211+
google_storage_bucket.object_cache_windows,
212+
google_service_account.object_cache_windows_gsa
213+
]
214+
}
215+
216+
resource "google_service_account_iam_binding" "linux_bucket_gsa_workload_binding" {
217+
service_account_id = google_service_account.object_cache_linux_gsa.name
218+
role = "roles/iam.workloadIdentityUser"
219+
220+
members = [
221+
"serviceAccount:${google_service_account.object_cache_linux_gsa.project}.svc.id.goog[${var.linux_runners_namespace_name}/${var.linux_runners_kubernetes_service_account_name}]",
222+
]
223+
224+
depends_on = [
225+
google_service_account.object_cache_linux_gsa,
226+
]
227+
}
228+
229+
resource "google_service_account_iam_binding" "windows_bucket_gsa_workload_binding" {
230+
service_account_id = google_service_account.object_cache_windows_gsa.name
231+
role = "roles/iam.workloadIdentityUser"
232+
233+
members = [
234+
"serviceAccount:${google_service_account.object_cache_windows_gsa.project}.svc.id.goog[${var.windows_2022_runners_namespace_name}/${var.windows_2022_runners_kubernetes_service_account_name}]",
235+
]
236+
237+
depends_on = [
238+
google_service_account.object_cache_windows_gsa,
239+
]
240+
}

‎premerge/gke_cluster/variables.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,23 @@ variable "service_node_pool_locations" {
3333
type = list(any)
3434
default = null
3535
}
36+
37+
variable "linux_runners_namespace_name" {
38+
description = "The name of the namespace containing the Linux runners"
39+
type = string
40+
}
41+
42+
variable "linux_runners_kubernetes_service_account_name" {
43+
description = "The name of the kubernetes service account used to access the Linux object cache GCS bucket"
44+
type = string
45+
}
46+
47+
variable "windows_2022_runners_namespace_name" {
48+
description = "The name of the namespace containing the Windows runners"
49+
type = string
50+
}
51+
52+
variable "windows_2022_runners_kubernetes_service_account_name" {
53+
description = "The name of the kubernetes service account used to access the Windows object cache GCS bucket"
54+
type = string
55+
}

‎premerge/main.tf

Lines changed: 34 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -43,29 +43,44 @@ resource "local_file" "terraform_state" {
4343

4444
data "google_client_config" "current" {}
4545

46+
locals {
47+
linux_runners_namespace_name = "llvm-premerge-linux-runners"
48+
linux_runners_kubernetes_service_account_name = "linux-runners-ksa"
49+
windows_2022_runners_namespace_name = "llvm-premerge-windows-2022-runners"
50+
windows_2022_runners_kubernetes_service_account_name = "windows-runners-ksa"
51+
}
52+
4653
module "premerge_cluster_us_central" {
47-
source = "./gke_cluster"
48-
cluster_name = "llvm-premerge-cluster-us-central"
49-
region = "us-central1-a"
50-
libcxx_machine_type = "n2d-standard-32"
51-
linux_machine_type = "n2-standard-64"
52-
windows_machine_type = "n2-standard-32"
53-
gcs_bucket_location = "us-central1"
54+
source = "./gke_cluster"
55+
cluster_name = "llvm-premerge-cluster-us-central"
56+
region = "us-central1-a"
57+
libcxx_machine_type = "n2d-standard-32"
58+
linux_machine_type = "n2-standard-64"
59+
windows_machine_type = "n2-standard-32"
60+
gcs_bucket_location = "us-central1"
61+
linux_runners_namespace_name = local.linux_runners_namespace_name
62+
linux_runners_kubernetes_service_account_name = local.linux_runners_kubernetes_service_account_name
63+
windows_2022_runners_namespace_name = local.windows_2022_runners_namespace_name
64+
windows_2022_runners_kubernetes_service_account_name = local.windows_2022_runners_kubernetes_service_account_name
5465
}
5566

5667
# We explicitly specify a single zone for the service node pool locations as
5768
# terraform by default will create node_count nodes per zone. We only want
5869
# node_count nodes rather than (node_count * zone count) nodes, so we
5970
# explicitly enumerate a specific region.
6071
module "premerge_cluster_us_west" {
61-
source = "./gke_cluster"
62-
cluster_name = "llvm-premerge-cluster-us-west"
63-
region = "us-west1"
64-
libcxx_machine_type = "n2d-standard-32"
65-
linux_machine_type = "n2d-standard-64"
66-
windows_machine_type = "n2d-standard-32"
67-
service_node_pool_locations = ["us-west1-a"]
68-
gcs_bucket_location = "us-west1"
72+
source = "./gke_cluster"
73+
cluster_name = "llvm-premerge-cluster-us-west"
74+
region = "us-west1"
75+
libcxx_machine_type = "n2d-standard-32"
76+
linux_machine_type = "n2d-standard-64"
77+
windows_machine_type = "n2d-standard-32"
78+
service_node_pool_locations = ["us-west1-a"]
79+
gcs_bucket_location = "us-west1"
80+
linux_runners_namespace_name = local.linux_runners_namespace_name
81+
linux_runners_kubernetes_service_account_name = local.linux_runners_kubernetes_service_account_name
82+
windows_2022_runners_namespace_name = local.windows_2022_runners_namespace_name
83+
windows_2022_runners_kubernetes_service_account_name = local.windows_2022_runners_kubernetes_service_account_name
6984
}
7085

7186
provider "helm" {
@@ -130,8 +145,8 @@ module "premerge_cluster_us_central_resources" {
130145
cluster_name = "llvm-premerge-cluster-us-central"
131146
grafana_token = data.google_secret_manager_secret_version.grafana_token.secret_data
132147
runner_group_name = "llvm-premerge-cluster-us-central"
133-
linux_runners_namespace_name = "llvm-premerge-linux-runners"
134-
windows_2022_runners_namespace_name = "llvm-premerge-windows-2022-runners"
148+
linux_runners_namespace_name = local.linux_runners_namespace_name
149+
windows_2022_runners_namespace_name = local.windows_2022_runners_namespace_name
135150
github_arc_version = "0.12.1"
136151
providers = {
137152
kubernetes = kubernetes.llvm-premerge-us-central
@@ -147,8 +162,8 @@ module "premerge_cluster_us_west_resources" {
147162
cluster_name = "llvm-premerge-cluster-us-west"
148163
grafana_token = data.google_secret_manager_secret_version.grafana_token.secret_data
149164
runner_group_name = "llvm-premerge-cluster-us-west"
150-
linux_runners_namespace_name = "llvm-premerge-linux-runners"
151-
windows_2022_runners_namespace_name = "llvm-premerge-windows-2022-runners"
165+
linux_runners_namespace_name = local.linux_runners_namespace_name
166+
windows_2022_runners_namespace_name = local.windows_2022_runners_namespace_name
152167
github_arc_version = "0.12.1"
153168
providers = {
154169
kubernetes = kubernetes.llvm-premerge-us-west

0 commit comments

Comments
 (0)