support GKE specific network roles in stages 01 and 02

fast/stages/02-networking-nva/main.tf

@@ -31,7 +31,9 @@ locals {
   stage3_sas_delegated_grants = [
     "roles/composer.sharedVpcAgent",
     "roles/compute.networkUser",
+    "roles/compute.networkViewer",
     "roles/container.hostServiceAgentUser",
+    "roles/multiclusterservicediscovery.serviceAgent",
     "roles/vpcaccess.user",
   ]
 }

fast/stages/02-networking-nva/spoke-dev.tf

@@ -41,7 +41,8 @@ module "dev-spoke-project" {
   metric_scopes = [module.landing-project.project_id]
   iam = {
     "roles/dns.admin" = compact([
-      try(local.service_accounts.project-factory-dev, null)
+      try(local.service_accounts.gke-dev, null),
+      try(local.service_accounts.project-factory-dev, null),
     ])
   }
 }

fast/stages/02-networking-nva/spoke-prod.tf

@@ -41,7 +41,8 @@ module "prod-spoke-project" {
   metric_scopes = [module.landing-project.project_id]
   iam = {
     "roles/dns.admin" = compact([
-      try(local.service_accounts.project-factory-prod, null)
+      try(local.service_accounts.gke-prod, null),
+      try(local.service_accounts.project-factory-prod, null),
     ])
   }
 }

fast/stages/02-networking-peering/main.tf

@@ -32,7 +32,9 @@ locals {
   stage3_sas_delegated_grants = [
     "roles/composer.sharedVpcAgent",
     "roles/compute.networkUser",
+    "roles/compute.networkViewer",
     "roles/container.hostServiceAgentUser",
+    "roles/multiclusterservicediscovery.serviceAgent",
     "roles/vpcaccess.user",
   ]
   service_accounts = {

fast/stages/02-networking-peering/spoke-dev.tf

@@ -42,7 +42,8 @@ module "dev-spoke-project" {
   metric_scopes = [module.landing-project.project_id]
   iam = {
     "roles/dns.admin" = compact([
-      try(local.service_accounts.project-factory-dev, null)
+      try(local.service_accounts.gke-dev, null),
+      try(local.service_accounts.project-factory-dev, null),
     ])
   }
 }

fast/stages/02-networking-peering/spoke-prod.tf

@@ -42,7 +42,8 @@ module "prod-spoke-project" {
   metric_scopes = [module.landing-project.project_id]
   iam = {
     "roles/dns.admin" = compact([
-      try(local.service_accounts.project-factory-prod, null)
+      try(local.service_accounts.gke-prod, null),
+      try(local.service_accounts.project-factory-prod, null),
     ])
   }
 }

fast/stages/02-networking-vpn/main.tf

@@ -32,7 +32,9 @@ locals {
   stage3_sas_delegated_grants = [
     "roles/composer.sharedVpcAgent",
     "roles/compute.networkUser",
+    "roles/compute.networkViewer",
     "roles/container.hostServiceAgentUser",
+    "roles/multiclusterservicediscovery.serviceAgent",
     "roles/vpcaccess.user",
   ]
   service_accounts = {

fast/stages/02-networking-vpn/spoke-dev.tf

@@ -42,6 +42,7 @@ module "dev-spoke-project" {
   metric_scopes = [module.landing-project.project_id]
   iam = {
     "roles/dns.admin" = compact([
+      try(local.service_accounts.gke-dev, null),
       try(local.service_accounts.project-factory-dev, null)
     ])
   }

fast/stages/02-networking-vpn/spoke-prod.tf

@@ -42,6 +42,7 @@ module "prod-spoke-project" {
   metric_scopes = [module.landing-project.project_id]
   iam = {
     "roles/dns.admin" = compact([
+      try(local.service_accounts.gke-prod, null),
       try(local.service_accounts.project-factory-prod, null)
     ])
   }