From a106688b0e5b5567a02effacb3656f83a569f7bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Wed, 13 Aug 2025 14:29:15 +0000 Subject: [PATCH] Fix references to service_account --- modules/cloud-run-v2/README.md | 90 +++++++++---------- modules/cloud-run-v2/main.tf | 6 +- modules/cloud-run-v2/variables.tf | 6 +- ...ervice-eventarc-auditlogs-external-sa.yaml | 2 +- .../examples/service-eventarc-storage.yaml | 2 +- 5 files changed, 50 insertions(+), 56 deletions(-) diff --git a/modules/cloud-run-v2/README.md b/modules/cloud-run-v2/README.md index 65d62f630..88bedde92 100644 --- a/modules/cloud-run-v2/README.md +++ b/modules/cloud-run-v2/README.md @@ -611,13 +611,20 @@ module "cloud_run" { service = "cloudresourcemanager.googleapis.com" } } - service_account_create = true + service_account_email = module.iam-service-account.email } - service_account_email = module.iam-service-account.email } iam = { "roles/run.invoker" = [module.iam-service-account.iam_email] } + deletion_protection = false + depends_on = [google_project_iam_member.eventarc_receiver] +} + +resource "google_project_iam_member" "eventarc_receiver" { + project = var.project_id + role = "roles/eventarc.eventReceiver" + member = module.iam-service-account.iam_email } # tftest fixtures=fixtures/iam-service-account.tf inventory=service-eventarc-auditlogs-external-sa.yaml e2e ``` @@ -645,11 +652,14 @@ module "cloud_run" { path = "/webhook" # optional: URL path for the Cloud Run service } } + service_account_email = module.iam-service-account.email } - service_account_email = module.iam-service-account.email } deletion_protection = false - depends_on = [google_project_iam_member.trigger_sa_event_receiver] + depends_on = [ + google_project_iam_member.gcs_pubsb_publisher, + google_project_iam_member.trigger_sa_event_receiver, + ] } resource "google_project_iam_member" "trigger_sa_event_receiver" { @@ -658,6 +668,12 @@ resource "google_project_iam_member" "trigger_sa_event_receiver" { role = "roles/eventarc.eventReceiver" } +resource "google_project_iam_member" "gcs_pubsb_publisher" { + member = "serviceAccount:service-${var.project_number}@gs-project-accounts.iam.gserviceaccount.com" + project = var.project_id + role = "roles/pubsub.publisher" +} + # tftest fixtures=fixtures/gcs.tf,fixtures/iam-service-account.tf inventory=service-eventarc-storage.yaml e2e ``` @@ -956,50 +972,28 @@ module "worker" { ## Variables -| name | description | type | required | default | -|--------------------------------------------------------|---|:---:|:---:|:---:| -| [name](variables.tf#L152) | Name used for Cloud Run service. | string | ✓ | | -| [project_id](variables.tf#L157) | Project id used for all resources. | string | ✓ | | -| [region](variables.tf#L162) | Region used for all resources. | string | ✓ | | -| [containers](variables.tf#L17) | Containers in name => attributes format. | map(object({…})) | | {} | -| [deletion_protection](variables.tf#L89) | Deletion protection setting for this Cloud Run service. | string | | null | -| [encryption_key](variables.tf#L95) | The full resource name of the Cloud KMS CryptoKey. | string | | null | -| [iam](variables.tf#L101) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | -| [job_config](variables.tf#L107) | Cloud Run Job specific configuration. | object({…}) | | {} | -| [labels](variables.tf#L122) | Resource labels. | map(string) | | {} | -| [launch_stage](variables.tf#L128) | The launch stage as defined by Google Cloud Platform Launch Stages. | string | | null | -| [managed_revision](variables.tf#L145) | Whether the Terraform module should control the deployment of revisions. | bool | | true | -| [revision](variables.tf#L167) | Revision template configurations. | object({…}) | | {} | -| [service_account](variables.tf#L227) | Service account email. Unused if service account is auto-created. | string | | null | -| [service_account_create](variables.tf#L233) | Auto-create service account. | bool | | false | -| [service_config](variables.tf#L239) | Cloud Run service specific configuration options. | object({…}) | | {} | -| [tag_bindings](variables.tf#L303) | Tag bindings for this service, in key => tag value id format. | map(string) | | {} | -| [type](variables.tf#L310) | Type of Cloud Run resource to deploy: JOB, SERVICE or WORKERPOOL. | string | | "SERVICE" | -| [volumes](variables.tf#L320) | Named volumes in containers in name => attributes format. | map(object({…})) | | {} | -| [name](variables.tf#L209) | Name used for Cloud Run service. | string | ✓ | | -| [project_id](variables.tf#L224) | Project id used for all resources. | string | ✓ | | -| [region](variables.tf#L229) | Region used for all resources. | string | ✓ | | -| [containers](variables.tf#L17) | Containers in name => attributes format. | map(object({…})) | | {} | -| [create_job](variables.tf#L80) | Create Cloud Run Job instead of Service. | bool | | false | -| [custom_audiences](variables.tf#L86) | Custom audiences for service. | list(string) | | null | -| [deletion_protection](variables.tf#L92) | Deletion protection setting for this Cloud Run service. | string | | null | -| [encryption_key](variables.tf#L98) | The full resource name of the Cloud KMS CryptoKey. | string | | null | -| [eventarc_triggers](variables.tf#L104) | Event arc triggers for different sources. | object({…}) | | {} | -| [iam](variables.tf#L125) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | -| [iap_config](variables.tf#L131) | If present, turns on Identity-Aware Proxy (IAP) for the Cloud Run service. | object({…}) | | null | -| [ingress](variables.tf#L156) | Ingress settings. | string | | null | -| [invoker_iam_disabled](variables.tf#L173) | Disables IAM permission check for run.routes.invoke for callers of this service. | bool | | false | -| [labels](variables.tf#L179) | Resource labels. | map(string) | | {} | -| [launch_stage](variables.tf#L185) | The launch stage as defined by Google Cloud Platform Launch Stages. | string | | null | -| [managed_revision](variables.tf#L202) | Whether the Terraform module should control the deployment of revisions. | bool | | true | -| [prefix](variables.tf#L214) | Optional prefix used for resource names. | string | | null | -| [revision](variables.tf#L234) | Revision template configurations. | object({…}) | | {} | -| [service_account](variables.tf#L273) | Service account email. Unused if service account is auto-created. | string | | null | -| [service_account_create](variables.tf#L279) | Auto-create service account. | bool | | false | -| [tag_bindings](variables.tf#L285) | Tag bindings for this service, in key => tag value id format. | map(string) | | {} | -| [volumes](variables.tf#L292) | Named volumes in containers in name => attributes format. | map(object({…})) | | {} | -| [vpc_connector_create](variables-vpcconnector.tf#L17) | Populate this to create a Serverless VPC Access connector. | object({…}) | | null | -| [workerpool_config](variables.tf#L354) | Cloud Run Worker Pool specific configuration. | object({…}) | | {} | +| name | description | type | required | default | +|---|---|:---:|:---:|:---:| +| [name](variables.tf#L152) | Name used for Cloud Run service. | string | ✓ | | +| [project_id](variables.tf#L157) | Project id used for all resources. | string | ✓ | | +| [region](variables.tf#L162) | Region used for all resources. | string | ✓ | | +| [containers](variables.tf#L17) | Containers in name => attributes format. | map(object({…})) | | {} | +| [deletion_protection](variables.tf#L89) | Deletion protection setting for this Cloud Run service. | string | | null | +| [encryption_key](variables.tf#L95) | The full resource name of the Cloud KMS CryptoKey. | string | | null | +| [iam](variables.tf#L101) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | +| [job_config](variables.tf#L107) | Cloud Run Job specific configuration. | object({…}) | | {} | +| [labels](variables.tf#L122) | Resource labels. | map(string) | | {} | +| [launch_stage](variables.tf#L128) | The launch stage as defined by Google Cloud Platform Launch Stages. | string | | null | +| [managed_revision](variables.tf#L145) | Whether the Terraform module should control the deployment of revisions. | bool | | true | +| [revision](variables.tf#L167) | Revision template configurations. | object({…}) | | {} | +| [service_account](variables.tf#L227) | Service account email. Unused if service account is auto-created. | string | | null | +| [service_account_create](variables.tf#L233) | Auto-create service account. | bool | | false | +| [service_config](variables.tf#L239) | Cloud Run service specific configuration options. | object({…}) | | {} | +| [tag_bindings](variables.tf#L302) | Tag bindings for this service, in key => tag value id format. | map(string) | | {} | +| [type](variables.tf#L309) | Type of Cloud Run resource to deploy: JOB, SERVICE or WORKERPOOL. | string | | "SERVICE" | +| [volumes](variables.tf#L319) | Named volumes in containers in name => attributes format. | map(object({…})) | | {} | +| [vpc_connector_create](variables-vpcconnector.tf#L17) | Populate this to create a Serverless VPC Access connector. | object({…}) | | null | +| [workerpool_config](variables.tf#L353) | Cloud Run Worker Pool specific configuration. | object({…}) | | {} | ## Outputs diff --git a/modules/cloud-run-v2/main.tf b/modules/cloud-run-v2/main.tf index 8f52c9f91..f0aa07ff1 100644 --- a/modules/cloud-run-v2/main.tf +++ b/modules/cloud-run-v2/main.tf @@ -98,7 +98,7 @@ resource "google_eventarc_trigger" "audit_log_triggers" { region = google_cloud_run_v2_service.service[0].location } } - service_account = var.eventarc_triggers.service_account_email + service_account = var.service_config.eventarc_triggers.service_account_email } resource "google_eventarc_trigger" "pubsub_triggers" { @@ -121,7 +121,7 @@ resource "google_eventarc_trigger" "pubsub_triggers" { region = google_cloud_run_v2_service.service[0].location } } - service_account = var.eventarc_triggers.service_account_email + service_account = var.service_config.eventarc_triggers.service_account_email } resource "google_eventarc_trigger" "storage_triggers" { @@ -144,5 +144,5 @@ resource "google_eventarc_trigger" "storage_triggers" { path = try(each.value.path, null) } } - service_account = var.eventarc_triggers.service_account_email + service_account = var.service_config.eventarc_triggers.service_account_email } diff --git a/modules/cloud-run-v2/variables.tf b/modules/cloud-run-v2/variables.tf index 5894b2b2c..69e87fe18 100644 --- a/modules/cloud-run-v2/variables.tf +++ b/modules/cloud-run-v2/variables.tf @@ -251,7 +251,7 @@ variable "service_config" { bucket = string path = optional(string) }))) - service_account_email = optional(string) + service_account_email = optional(string) }), {}) gen2_execution_environment = optional(bool, false) iap_config = optional(object({ @@ -271,8 +271,8 @@ variable "service_config" { nullable = false validation { - condition = var.service_config.eventarc_triggers.audit_log == null || (var.service_config.eventarc_triggers.audit_log != null && (var.service_config.eventarc_triggers.service_account_email != null || var.service_config.eventarc_triggers.service_account_create)) - error_message = "When setting var.eventarc_triggers.audit_log provide either service_account_email or set service_account_create to true" + condition = var.service_config.eventarc_triggers.audit_log == null || var.service_config.eventarc_triggers.service_account_email != null + error_message = "When setting var.eventarc_triggers.audit_log provide service_account_email." } validation { diff --git a/tests/modules/cloud_run_v2/examples/service-eventarc-auditlogs-external-sa.yaml b/tests/modules/cloud_run_v2/examples/service-eventarc-auditlogs-external-sa.yaml index 055cb620c..6eecd6c4b 100644 --- a/tests/modules/cloud_run_v2/examples/service-eventarc-auditlogs-external-sa.yaml +++ b/tests/modules/cloud_run_v2/examples/service-eventarc-auditlogs-external-sa.yaml @@ -57,6 +57,6 @@ counts: google_eventarc_trigger: 1 google_service_account: 1 modules: 2 - resources: 4 + resources: 5 outputs: {} diff --git a/tests/modules/cloud_run_v2/examples/service-eventarc-storage.yaml b/tests/modules/cloud_run_v2/examples/service-eventarc-storage.yaml index 3b4522fc2..34c549968 100644 --- a/tests/modules/cloud_run_v2/examples/service-eventarc-storage.yaml +++ b/tests/modules/cloud_run_v2/examples/service-eventarc-storage.yaml @@ -53,6 +53,6 @@ counts: google_cloud_run_v2_service: 1 google_eventarc_trigger: 1 modules: 3 - resources: 6 + resources: 7 outputs: {}