Fix references to service_account
This commit is contained in:
Wiktor Niesiobędzki
@@ -611,13 +611,20 @@ module "cloud_run" {
|
||||
service = "cloudresourcemanager.googleapis.com"
|
||||
}
|
||||
}
|
||||
service_account_create = true
|
||||
service_account_email = module.iam-service-account.email
|
||||
}
|
||||
service_account_email = module.iam-service-account.email
|
||||
}
|
||||
iam = {
|
||||
"roles/run.invoker" = [module.iam-service-account.iam_email]
|
||||
}
|
||||
deletion_protection = false
|
||||
depends_on = [google_project_iam_member.eventarc_receiver]
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "eventarc_receiver" {
|
||||
project = var.project_id
|
||||
role = "roles/eventarc.eventReceiver"
|
||||
member = module.iam-service-account.iam_email
|
||||
}
|
||||
# tftest fixtures=fixtures/iam-service-account.tf inventory=service-eventarc-auditlogs-external-sa.yaml e2e
|
||||
```
|
||||
@@ -645,11 +652,14 @@ module "cloud_run" {
|
||||
path = "/webhook" # optional: URL path for the Cloud Run service
|
||||
}
|
||||
}
|
||||
service_account_email = module.iam-service-account.email
|
||||
}
|
||||
service_account_email = module.iam-service-account.email
|
||||
}
|
||||
deletion_protection = false
|
||||
depends_on = [google_project_iam_member.trigger_sa_event_receiver]
|
||||
depends_on = [
|
||||
google_project_iam_member.gcs_pubsb_publisher,
|
||||
google_project_iam_member.trigger_sa_event_receiver,
|
||||
]
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "trigger_sa_event_receiver" {
|
||||
@@ -658,6 +668,12 @@ resource "google_project_iam_member" "trigger_sa_event_receiver" {
|
||||
role = "roles/eventarc.eventReceiver"
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "gcs_pubsb_publisher" {
|
||||
member = "serviceAccount:service-${var.project_number}@gs-project-accounts.iam.gserviceaccount.com"
|
||||
project = var.project_id
|
||||
role = "roles/pubsub.publisher"
|
||||
}
|
||||
|
||||
# tftest fixtures=fixtures/gcs.tf,fixtures/iam-service-account.tf inventory=service-eventarc-storage.yaml e2e
|
||||
```
|
||||
|
||||
@@ -956,50 +972,28 @@ module "worker" {
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
| name | description | type | required | default |
|
||||
|--------------------------------------------------------|---|:---:|:---:|:---:|
|
||||
| [name](variables.tf#L152) | Name used for Cloud Run service. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L157) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L162) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [containers](variables.tf#L17) | Containers in name => attributes format. | <code title="map(object({ image = string depends_on = optional(list(string)) command = optional(list(string)) args = optional(list(string)) env = optional(map(string)) env_from_key = optional(map(object({ secret = string version = string }))) liveness_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) port = optional(number) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) ports = optional(map(object({ container_port = optional(number) name = optional(string) }))) resources = optional(object({ limits = optional(map(string)) cpu_idle = optional(bool) startup_cpu_boost = optional(bool) })) startup_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) port = optional(number) })) tcp_socket = optional(object({ port = optional(number) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) volume_mounts = optional(map(string)) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [deletion_protection](variables.tf#L89) | Deletion protection setting for this Cloud Run service. | <code>string</code> | | <code>null</code> |
|
||||
| [encryption_key](variables.tf#L95) | The full resource name of the Cloud KMS CryptoKey. | <code>string</code> | | <code>null</code> |
|
||||
| [iam](variables.tf#L101) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [job_config](variables.tf#L107) | Cloud Run Job specific configuration. | <code title="object({ max_retries = optional(number) task_count = optional(number) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L122) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [launch_stage](variables.tf#L128) | The launch stage as defined by Google Cloud Platform Launch Stages. | <code>string</code> | | <code>null</code> |
|
||||
| [managed_revision](variables.tf#L145) | Whether the Terraform module should control the deployment of revisions. | <code>bool</code> | | <code>true</code> |
|
||||
| [revision](variables.tf#L167) | Revision template configurations. | <code title="object({ gpu_zonal_redundancy_disabled = optional(bool) labels = optional(map(string)) name = optional(string) node_selector = optional(object({ accelerator = string })) vpc_access = optional(object({ connector = optional(string) egress = optional(string) network = optional(string) subnet = optional(string) tags = optional(list(string)) }), {}) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L227) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L233) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [service_config](variables.tf#L239) | Cloud Run service specific configuration options. | <code title="object({ custom_audiences = optional(list(string), null) eventarc_triggers = optional( object({ audit_log = optional(map(object({ method = string service = string }))) pubsub = optional(map(string)) storage = optional(map(object({ bucket = string path = optional(string) }))) service_account_email = optional(string) service_account_create = optional(bool, false) }), {}) gen2_execution_environment = optional(bool, false) iap_config = optional(object({ iam = optional(list(string), []) iam_additive = optional(list(string), []) }), null) ingress = optional(string, null) invoker_iam_disabled = optional(bool, false) max_concurrency = optional(number) scaling = optional(object({ max_instance_count = optional(number) min_instance_count = optional(number) })) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L303) | Tag bindings for this service, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [type](variables.tf#L310) | Type of Cloud Run resource to deploy: JOB, SERVICE or WORKERPOOL. | <code>string</code> | | <code>"SERVICE"</code> |
|
||||
| [volumes](variables.tf#L320) | Named volumes in containers in name => attributes format. | <code title="map(object({ secret = optional(object({ name = string default_mode = optional(string) path = optional(string) version = optional(string) mode = optional(string) })) cloud_sql_instances = optional(list(string)) empty_dir_size = optional(string) gcs = optional(object({ bucket = string is_read_only = optional(bool) })) nfs = optional(object({ server = string path = optional(string) is_read_only = optional(bool) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [name](variables.tf#L209) | Name used for Cloud Run service. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L224) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L229) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [containers](variables.tf#L17) | Containers in name => attributes format. | <code title="map(object({ image = string depends_on = optional(list(string)) command = optional(list(string)) args = optional(list(string)) env = optional(map(string)) env_from_key = optional(map(object({ secret = string version = string }))) liveness_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) port = optional(number) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) ports = optional(map(object({ container_port = optional(number) name = optional(string) }))) resources = optional(object({ limits = optional(object({ cpu = string memory = string })) cpu_idle = optional(bool) startup_cpu_boost = optional(bool) })) startup_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) port = optional(number) })) tcp_socket = optional(object({ port = optional(number) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) volume_mounts = optional(map(string)) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [create_job](variables.tf#L80) | Create Cloud Run Job instead of Service. | <code>bool</code> | | <code>false</code> |
|
||||
| [custom_audiences](variables.tf#L86) | Custom audiences for service. | <code>list(string)</code> | | <code>null</code> |
|
||||
| [deletion_protection](variables.tf#L92) | Deletion protection setting for this Cloud Run service. | <code>string</code> | | <code>null</code> |
|
||||
| [encryption_key](variables.tf#L98) | The full resource name of the Cloud KMS CryptoKey. | <code>string</code> | | <code>null</code> |
|
||||
| [eventarc_triggers](variables.tf#L104) | Event arc triggers for different sources. | <code title="object({ audit_log = optional(map(object({ method = string service = string }))) pubsub = optional(map(string)) storage = optional(map(object({ bucket = string path = optional(string) }))) service_account_email = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [iam](variables.tf#L125) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iap_config](variables.tf#L131) | If present, turns on Identity-Aware Proxy (IAP) for the Cloud Run service. | <code title="object({ iam = optional(list(string), []) iam_additive = optional(list(string), []) })">object({…})</code> | | <code>null</code> |
|
||||
| [ingress](variables.tf#L156) | Ingress settings. | <code>string</code> | | <code>null</code> |
|
||||
| [invoker_iam_disabled](variables.tf#L173) | Disables IAM permission check for run.routes.invoke for callers of this service. | <code>bool</code> | | <code>false</code> |
|
||||
| [labels](variables.tf#L179) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [launch_stage](variables.tf#L185) | The launch stage as defined by Google Cloud Platform Launch Stages. | <code>string</code> | | <code>null</code> |
|
||||
| [managed_revision](variables.tf#L202) | Whether the Terraform module should control the deployment of revisions. | <code>bool</code> | | <code>true</code> |
|
||||
| [prefix](variables.tf#L214) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [revision](variables.tf#L234) | Revision template configurations. | <code title="object({ labels = optional(map(string)) name = optional(string) gen2_execution_environment = optional(bool) max_concurrency = optional(number) max_instance_count = optional(number) min_instance_count = optional(number) job = optional(object({ max_retries = optional(number) task_count = optional(number) }), {}) vpc_access = optional(object({ connector = optional(string) egress = optional(string) network = optional(string) subnet = optional(string) tags = optional(list(string)) }), {}) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L273) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L279) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [tag_bindings](variables.tf#L285) | Tag bindings for this service, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [volumes](variables.tf#L292) | Named volumes in containers in name => attributes format. | <code title="map(object({ secret = optional(object({ name = string default_mode = optional(string) path = optional(string) version = optional(string) mode = optional(string) })) cloud_sql_instances = optional(list(string)) empty_dir_size = optional(string) gcs = optional(object({ bucket = string is_read_only = optional(bool) })) nfs = optional(object({ server = string path = optional(string) is_read_only = optional(bool) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [vpc_connector_create](variables-vpcconnector.tf#L17) | Populate this to create a Serverless VPC Access connector. | <code title="object({ ip_cidr_range = optional(string) machine_type = optional(string) name = optional(string) network = optional(string) instances = optional(object({ max = optional(number) min = optional(number) }), {} ) throughput = optional(object({ max = optional(number) min = optional(number) }), {} ) subnet = optional(object({ name = optional(string) project_id = optional(string) }), {}) })">object({…})</code> | | <code>null</code> |
|
||||
| [workerpool_config](variables.tf#L354) | Cloud Run Worker Pool specific configuration. | <code title="object({ scaling = optional(object({ manual_instance_count = optional(number) max_instance_count = optional(number) min_instance_count = optional(number) mode = optional(string) })) })">object({…})</code> | | <code>{}</code> |
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [name](variables.tf#L152) | Name used for Cloud Run service. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L157) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L162) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [containers](variables.tf#L17) | Containers in name => attributes format. | <code title="map(object({ image = string depends_on = optional(list(string)) command = optional(list(string)) args = optional(list(string)) env = optional(map(string)) env_from_key = optional(map(object({ secret = string version = string }))) liveness_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) port = optional(number) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) ports = optional(map(object({ container_port = optional(number) name = optional(string) }))) resources = optional(object({ limits = optional(map(string)) cpu_idle = optional(bool) startup_cpu_boost = optional(bool) })) startup_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) port = optional(number) })) tcp_socket = optional(object({ port = optional(number) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) volume_mounts = optional(map(string)) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [deletion_protection](variables.tf#L89) | Deletion protection setting for this Cloud Run service. | <code>string</code> | | <code>null</code> |
|
||||
| [encryption_key](variables.tf#L95) | The full resource name of the Cloud KMS CryptoKey. | <code>string</code> | | <code>null</code> |
|
||||
| [iam](variables.tf#L101) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [job_config](variables.tf#L107) | Cloud Run Job specific configuration. | <code title="object({ max_retries = optional(number) task_count = optional(number) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L122) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [launch_stage](variables.tf#L128) | The launch stage as defined by Google Cloud Platform Launch Stages. | <code>string</code> | | <code>null</code> |
|
||||
| [managed_revision](variables.tf#L145) | Whether the Terraform module should control the deployment of revisions. | <code>bool</code> | | <code>true</code> |
|
||||
| [revision](variables.tf#L167) | Revision template configurations. | <code title="object({ gpu_zonal_redundancy_disabled = optional(bool) labels = optional(map(string)) name = optional(string) node_selector = optional(object({ accelerator = string })) vpc_access = optional(object({ connector = optional(string) egress = optional(string) network = optional(string) subnet = optional(string) tags = optional(list(string)) }), {}) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L227) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L233) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [service_config](variables.tf#L239) | Cloud Run service specific configuration options. | <code title="object({ custom_audiences = optional(list(string), null) eventarc_triggers = optional( object({ audit_log = optional(map(object({ method = string service = string }))) pubsub = optional(map(string)) storage = optional(map(object({ bucket = string path = optional(string) }))) service_account_email = optional(string) }), {}) gen2_execution_environment = optional(bool, false) iap_config = optional(object({ iam = optional(list(string), []) iam_additive = optional(list(string), []) }), null) ingress = optional(string, null) invoker_iam_disabled = optional(bool, false) max_concurrency = optional(number) scaling = optional(object({ max_instance_count = optional(number) min_instance_count = optional(number) })) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L302) | Tag bindings for this service, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [type](variables.tf#L309) | Type of Cloud Run resource to deploy: JOB, SERVICE or WORKERPOOL. | <code>string</code> | | <code>"SERVICE"</code> |
|
||||
| [volumes](variables.tf#L319) | Named volumes in containers in name => attributes format. | <code title="map(object({ secret = optional(object({ name = string default_mode = optional(string) path = optional(string) version = optional(string) mode = optional(string) })) cloud_sql_instances = optional(list(string)) empty_dir_size = optional(string) gcs = optional(object({ bucket = string is_read_only = optional(bool) })) nfs = optional(object({ server = string path = optional(string) is_read_only = optional(bool) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [vpc_connector_create](variables-vpcconnector.tf#L17) | Populate this to create a Serverless VPC Access connector. | <code title="object({ ip_cidr_range = optional(string) machine_type = optional(string) name = optional(string) network = optional(string) instances = optional(object({ max = optional(number) min = optional(number) }), {} ) throughput = optional(object({ max = optional(number) min = optional(number) }), {} ) subnet = optional(object({ name = optional(string) project_id = optional(string) }), {}) })">object({…})</code> | | <code>null</code> |
|
||||
| [workerpool_config](variables.tf#L353) | Cloud Run Worker Pool specific configuration. | <code title="object({ scaling = optional(object({ manual_instance_count = optional(number) max_instance_count = optional(number) min_instance_count = optional(number) mode = optional(string) })) })">object({…})</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -98,7 +98,7 @@ resource "google_eventarc_trigger" "audit_log_triggers" {
|
||||
region = google_cloud_run_v2_service.service[0].location
|
||||
}
|
||||
}
|
||||
service_account = var.eventarc_triggers.service_account_email
|
||||
service_account = var.service_config.eventarc_triggers.service_account_email
|
||||
}
|
||||
|
||||
resource "google_eventarc_trigger" "pubsub_triggers" {
|
||||
@@ -121,7 +121,7 @@ resource "google_eventarc_trigger" "pubsub_triggers" {
|
||||
region = google_cloud_run_v2_service.service[0].location
|
||||
}
|
||||
}
|
||||
service_account = var.eventarc_triggers.service_account_email
|
||||
service_account = var.service_config.eventarc_triggers.service_account_email
|
||||
}
|
||||
|
||||
resource "google_eventarc_trigger" "storage_triggers" {
|
||||
@@ -144,5 +144,5 @@ resource "google_eventarc_trigger" "storage_triggers" {
|
||||
path = try(each.value.path, null)
|
||||
}
|
||||
}
|
||||
service_account = var.eventarc_triggers.service_account_email
|
||||
service_account = var.service_config.eventarc_triggers.service_account_email
|
||||
}
|
||||
|
||||
@@ -251,7 +251,7 @@ variable "service_config" {
|
||||
bucket = string
|
||||
path = optional(string)
|
||||
})))
|
||||
service_account_email = optional(string)
|
||||
service_account_email = optional(string)
|
||||
}), {})
|
||||
gen2_execution_environment = optional(bool, false)
|
||||
iap_config = optional(object({
|
||||
@@ -271,8 +271,8 @@ variable "service_config" {
|
||||
nullable = false
|
||||
|
||||
validation {
|
||||
condition = var.service_config.eventarc_triggers.audit_log == null || (var.service_config.eventarc_triggers.audit_log != null && (var.service_config.eventarc_triggers.service_account_email != null || var.service_config.eventarc_triggers.service_account_create))
|
||||
error_message = "When setting var.eventarc_triggers.audit_log provide either service_account_email or set service_account_create to true"
|
||||
condition = var.service_config.eventarc_triggers.audit_log == null || var.service_config.eventarc_triggers.service_account_email != null
|
||||
error_message = "When setting var.eventarc_triggers.audit_log provide service_account_email."
|
||||
}
|
||||
|
||||
validation {
|
||||
|
||||
Reference in New Issue
Block a user