Skip to content

Commit 75a56f1

Browse files
Dev25Dev25
authored
feat: Support service account impersonation for wait-for-cluster script (#729)
* Rebase impersonation support PR for scripts Signed-off-by: Dev <[email protected]> * Set var type to string Signed-off-by: Dev <[email protected]> * Rerun make docker_generate_docs Signed-off-by: Dev <[email protected]>
1 parent df98cf9 commit 75a56f1

File tree

31 files changed

+88
-33
lines changed

31 files changed

+88
-33
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@ Then perform the following commands on the root folder:
136136
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
137137
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
138138
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
139+
| impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | `string` | `""` | no |
139140
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | `number` | `0` | no |
140141
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
141142
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -536,13 +536,12 @@ module "gcloud_wait_for_cluster" {
536536
source = "terraform-google-modules/gcloud/google"
537537
version = "~> 2.0.2"
538538
enabled = ! var.skip_provisioners
539-
540-
upgrade = var.gcloud_upgrade
539+
upgrade = var.gcloud_upgrade
541540

542541
create_cmd_entrypoint = "${path.module}/scripts/wait-for-cluster.sh"
543-
create_cmd_body = "${var.project_id} ${var.name}"
542+
create_cmd_body = "${var.project_id} ${var.name} ${var.impersonate_service_account}"
544543
destroy_cmd_entrypoint = "${path.module}/scripts/wait-for-cluster.sh"
545-
destroy_cmd_body = "${var.project_id} ${var.name}"
544+
destroy_cmd_body = "${var.project_id} ${var.name} ${var.impersonate_service_account}"
546545

547546
module_depends_on = concat(
548547
[google_container_cluster.primary.master_version],

‎autogen/main/scripts/wait-for-cluster.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,12 @@ fi
2222

2323
PROJECT=$1
2424
CLUSTER_NAME=$2
25+
IMPERSONATE_SERVICE_ACCOUNT=$3
2526

2627
echo "Waiting for cluster $CLUSTER_NAME in project $PROJECT to reconcile..."
2728

2829
while
29-
current_status=$(gcloud container clusters list --project="$PROJECT" --filter=name:"$CLUSTER_NAME" --format="value(status)")
30+
current_status=$(gcloud container clusters list --project="$PROJECT" --filter=name:"$CLUSTER_NAME" --format="value(status)" --impersonate-service-account="$IMPERSONATE_SERVICE_ACCOUNT")
3031
[[ "${current_status}" != "RUNNING" ]]
3132
do printf ".";sleep 5; done
3233

‎autogen/main/variables.tf.tmpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -555,3 +555,9 @@ variable "disable_default_snat" {
555555
default = false
556556
}
557557
{% endif %}
558+
559+
variable "impersonate_service_account" {
560+
type = string
561+
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
562+
default = ""
563+
}

‎cluster.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -320,13 +320,12 @@ module "gcloud_wait_for_cluster" {
320320
source = "terraform-google-modules/gcloud/google"
321321
version = "~> 2.0.2"
322322
enabled = ! var.skip_provisioners
323-
324323
upgrade = var.gcloud_upgrade
325324

326325
create_cmd_entrypoint = "${path.module}/scripts/wait-for-cluster.sh"
327-
create_cmd_body = "${var.project_id} ${var.name}"
326+
create_cmd_body = "${var.project_id} ${var.name} ${var.impersonate_service_account}"
328327
destroy_cmd_entrypoint = "${path.module}/scripts/wait-for-cluster.sh"
329-
destroy_cmd_body = "${var.project_id} ${var.name}"
328+
destroy_cmd_body = "${var.project_id} ${var.name} ${var.impersonate_service_account}"
330329

331330
module_depends_on = concat(
332331
[google_container_cluster.primary.master_version],

‎modules/beta-private-cluster-update-variant/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,7 @@ Then perform the following commands on the root folder:
180180
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
181181
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
182182
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
183+
| impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | `string` | `""` | no |
183184
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | `number` | `0` | no |
184185
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
185186
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -494,13 +494,12 @@ module "gcloud_wait_for_cluster" {
494494
source = "terraform-google-modules/gcloud/google"
495495
version = "~> 2.0.2"
496496
enabled = ! var.skip_provisioners
497-
498497
upgrade = var.gcloud_upgrade
499498

500499
create_cmd_entrypoint = "${path.module}/scripts/wait-for-cluster.sh"
501-
create_cmd_body = "${var.project_id} ${var.name}"
500+
create_cmd_body = "${var.project_id} ${var.name} ${var.impersonate_service_account}"
502501
destroy_cmd_entrypoint = "${path.module}/scripts/wait-for-cluster.sh"
503-
destroy_cmd_body = "${var.project_id} ${var.name}"
502+
destroy_cmd_body = "${var.project_id} ${var.name} ${var.impersonate_service_account}"
504503

505504
module_depends_on = concat(
506505
[google_container_cluster.primary.master_version],

‎modules/beta-private-cluster-update-variant/scripts/wait-for-cluster.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,12 @@ fi
2222

2323
PROJECT=$1
2424
CLUSTER_NAME=$2
25+
IMPERSONATE_SERVICE_ACCOUNT=$3
2526

2627
echo "Waiting for cluster $CLUSTER_NAME in project $PROJECT to reconcile..."
2728

2829
while
29-
current_status=$(gcloud container clusters list --project="$PROJECT" --filter=name:"$CLUSTER_NAME" --format="value(status)")
30+
current_status=$(gcloud container clusters list --project="$PROJECT" --filter=name:"$CLUSTER_NAME" --format="value(status)" --impersonate-service-account="$IMPERSONATE_SERVICE_ACCOUNT")
3031
[[ "${current_status}" != "RUNNING" ]]
3132
do printf ".";sleep 5; done
3233

‎modules/beta-private-cluster-update-variant/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -539,3 +539,9 @@ variable "disable_default_snat" {
539539
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
540540
default = false
541541
}
542+
543+
variable "impersonate_service_account" {
544+
type = string
545+
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
546+
default = ""
547+
}

‎modules/beta-private-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,7 @@ Then perform the following commands on the root folder:
158158
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
159159
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
160160
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
161+
| impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | `string` | `""` | no |
161162
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | `number` | `0` | no |
162163
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
163164
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |

0 commit comments

Comments
 (0)