Allow using no service account in compute-vm (#1692)
* module and tests * align blueprints * tfdoc * remove stale variables * fix blueprint * variable description
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
96c28e605b
commit
df5daab6cc
@@ -9,11 +9,14 @@ In both modes, an optional service account can be created and assigned to either
|
||||
|
||||
## Examples
|
||||
|
||||
|
||||
<!-- BEGIN TOC -->
|
||||
- [Examples](#examples)
|
||||
- [Instance using defaults](#instance-using-defaults)
|
||||
- [Service account management](#service-account-management)
|
||||
- [Compute default service account](#compute-default-service-account)
|
||||
- [Custom service account](#custom-service-account)
|
||||
- [Custom service account, auto created](#custom-service-account-auto-created)
|
||||
- [No service account](#no-service-account)
|
||||
- [Disk management](#disk-management)
|
||||
- [Disk sources](#disk-sources)
|
||||
- [Disk types and options](#disk-types-and-options)
|
||||
@@ -50,18 +53,22 @@ module "simple-vm-example" {
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}]
|
||||
service_account_create = true
|
||||
}
|
||||
# tftest modules=1 resources=2 inventory=simple.yaml
|
||||
# tftest modules=1 resources=1 inventory=defaults.yaml
|
||||
```
|
||||
|
||||
### Service account management
|
||||
|
||||
VM service accounts can be managed in three different ways:
|
||||
VM service accounts can be managed in four different ways:
|
||||
|
||||
- You can let the module create a service account for you by setting `service_account_create = true`
|
||||
- You can use an existing service account by setting `service_account_create = false` (the default value) and passing the full email address of the service account to the `service_account` variable. This is useful, for example, if you want to reuse the service account from another previously created instance, or if you want to create the service account manually with the `iam-service-account` module. In this case, you probably also want to set `service_account_scopes` to `cloud-platform`.
|
||||
- Lastly, you can use the default compute service account by setting `service_account_crate = false`. Please note that using the default compute service account is not recommended.
|
||||
- in its default configuration, the module uses the Compute default service account with a basic set of scopes (`devstorage.read_only`, `logging.write`, `monitoring.write`)
|
||||
- a custom service account can be used by passing its email in the `service_account.email` variable
|
||||
- a custom service account can be created by the module and used by setting the `service_account.auto_create` variable to `true`
|
||||
- the instance can be created with no service account by setting the `service_account` variable to `null`
|
||||
|
||||
Scopes for custom service accounts are set by default to `cloud-platform` and `userinfo.email`, and can be further customized regardless of which service account is used by directly setting the `service_account.scopes` variable.
|
||||
|
||||
#### Compute default service account
|
||||
|
||||
```hcl
|
||||
module "vm-managed-sa-example" {
|
||||
@@ -73,9 +80,13 @@ module "vm-managed-sa-example" {
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}]
|
||||
service_account_create = true
|
||||
}
|
||||
# tftest modules=1 resources=1 inventory=sa-default.yaml
|
||||
```
|
||||
|
||||
#### Custom service account
|
||||
|
||||
```hcl
|
||||
module "vm-managed-sa-example2" {
|
||||
source = "./fabric/modules/compute-vm"
|
||||
project_id = var.project_id
|
||||
@@ -85,24 +96,47 @@ module "vm-managed-sa-example2" {
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}]
|
||||
service_account = module.vm-managed-sa-example.service_account_email
|
||||
service_account_scopes = ["cloud-platform"]
|
||||
service_account = {
|
||||
email = "sa-0@myproj.iam.gserviceaccount.com"
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=1 inventory=sa-custom.yaml
|
||||
```
|
||||
|
||||
# not recommended
|
||||
module "vm-default-sa-example2" {
|
||||
#### Custom service account, auto created
|
||||
|
||||
```hcl
|
||||
module "vm-managed-sa-example2" {
|
||||
source = "./fabric/modules/compute-vm"
|
||||
project_id = var.project_id
|
||||
zone = "europe-west1-b"
|
||||
name = "test3"
|
||||
name = "test2"
|
||||
network_interfaces = [{
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}]
|
||||
service_account_create = false
|
||||
service_account = {
|
||||
auto_create = true
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2 inventory=sa-managed.yaml
|
||||
```
|
||||
|
||||
# tftest modules=3 resources=4 inventory=sas.yaml
|
||||
#### No service account
|
||||
|
||||
```hcl
|
||||
module "vm-managed-sa-example2" {
|
||||
source = "./fabric/modules/compute-vm"
|
||||
project_id = var.project_id
|
||||
zone = "europe-west1-b"
|
||||
name = "test2"
|
||||
network_interfaces = [{
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}]
|
||||
service_account = null
|
||||
}
|
||||
# tftest modules=1 resources=1 inventory=sa-none.yaml
|
||||
```
|
||||
|
||||
### Disk management
|
||||
@@ -137,7 +171,9 @@ module "vm-disks-example" {
|
||||
replica_zone = "${var.region}-c"
|
||||
}
|
||||
}]
|
||||
service_account_create = true
|
||||
service_account = {
|
||||
auto_create = true
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
@@ -163,8 +199,10 @@ module "vm-disks-example" {
|
||||
replica_zone = "${var.region}-c"
|
||||
}
|
||||
}]
|
||||
service_account_create = true
|
||||
create_template = true
|
||||
service_account = {
|
||||
auto_create = true
|
||||
}
|
||||
create_template = true
|
||||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
@@ -205,7 +243,9 @@ module "vm-disk-options-example" {
|
||||
}
|
||||
}
|
||||
]
|
||||
service_account_create = true
|
||||
service_account = {
|
||||
auto_create = true
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=4 inventory=disk-options.yaml
|
||||
```
|
||||
@@ -230,7 +270,9 @@ module "simple-vm-example" {
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}]
|
||||
service_account_create = true
|
||||
service_account = {
|
||||
auto_create = true
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=3 inventory=independent-boot-disk.yaml
|
||||
```
|
||||
@@ -331,7 +373,9 @@ module "vm-with-gvnic" {
|
||||
subnetwork = var.subnet.self_link
|
||||
nic_type = "GVNIC"
|
||||
}]
|
||||
service_account_create = true
|
||||
service_account = {
|
||||
auto_create = true
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=3 inventory=gvnic.yaml
|
||||
```
|
||||
@@ -361,7 +405,9 @@ module "vm-metadata-example" {
|
||||
apt-get install -y nginx
|
||||
EOF
|
||||
}
|
||||
service_account_create = true
|
||||
service_account = {
|
||||
auto_create = true
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2 inventory=metadata.yaml
|
||||
```
|
||||
@@ -465,7 +511,9 @@ module "kms-vm-example" {
|
||||
name = "attached-disk"
|
||||
size = 10
|
||||
}]
|
||||
service_account_create = true
|
||||
service_account = {
|
||||
auto_create = true
|
||||
}
|
||||
encryption = {
|
||||
encrypt_boot = true
|
||||
kms_key_self_link = var.kms_key.self_link
|
||||
@@ -499,7 +547,9 @@ module "cos-test" {
|
||||
size = 10
|
||||
}
|
||||
]
|
||||
service_account = "vm-default@my-project.iam.gserviceaccount.com"
|
||||
service_account = {
|
||||
email = "vm-default@my-project.iam.gserviceaccount.com"
|
||||
}
|
||||
create_template = true
|
||||
}
|
||||
# tftest modules=1 resources=1 inventory=template.yaml
|
||||
@@ -526,8 +576,10 @@ module "instance-group" {
|
||||
boot_disk = {
|
||||
image = "projects/cos-cloud/global/images/family/cos-stable"
|
||||
}
|
||||
service_account = var.service_account.email
|
||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
||||
service_account = {
|
||||
email = var.service_account.email
|
||||
scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
||||
}
|
||||
metadata = {
|
||||
user-data = local.cloud_config
|
||||
}
|
||||
@@ -633,7 +685,7 @@ module "instance" {
|
||||
| [name](variables.tf#L235) | Instance name. | <code>string</code> | ✓ | |
|
||||
| [network_interfaces](variables.tf#L240) | Network interfaces configuration. Use self links for Shared VPC, set addresses to null if not needed. | <code title="list(object({ nat = optional(bool, false) network = string subnetwork = string addresses = optional(object({ internal = optional(string) external = optional(string) }), null) alias_ips = optional(map(string), {}) nic_type = optional(string) }))">list(object({…}))</code> | ✓ | |
|
||||
| [project_id](variables.tf#L277) | Project id. | <code>string</code> | ✓ | |
|
||||
| [zone](variables.tf#L379) | Compute zone. | <code>string</code> | ✓ | |
|
||||
| [zone](variables.tf#L369) | Compute zone. | <code>string</code> | ✓ | |
|
||||
| [attached_disk_defaults](variables.tf#L17) | Defaults for attached disks options. | <code title="object({ auto_delete = optional(bool, false) mode = string replica_zone = string type = string })">object({…})</code> | | <code title="{ auto_delete = true mode = "READ_WRITE" replica_zone = null type = "pd-balanced" }">{…}</code> |
|
||||
| [attached_disks](variables.tf#L37) | Additional disks, if options is null defaults will be used in its place. Source type is one of 'image' (zonal disks in vms and template), 'snapshot' (vm), 'existing', and null. | <code title="list(object({ name = string device_name = optional(string) size = string snapshot_schedule = optional(string) source = optional(string) source_type = optional(string) options = optional( object({ auto_delete = optional(bool, false) mode = optional(string, "READ_WRITE") replica_zone = optional(string) type = optional(string, "pd-balanced") }), { auto_delete = true mode = "READ_WRITE" replica_zone = null type = "pd-balanced" } ) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [boot_disk](variables.tf#L83) | Boot disk properties. | <code title="object({ auto_delete = optional(bool, true) snapshot_schedule = optional(string) source = optional(string) initialize_params = optional(object({ image = optional(string, "projects/debian-cloud/global/images/family/debian-11") size = optional(number, 10) type = optional(string, "pd-balanced") })) use_independent_disk = optional(bool, false) })">object({…})</code> | | <code title="{ initialize_params = {} }">{…}</code> |
|
||||
@@ -653,13 +705,11 @@ module "instance" {
|
||||
| [min_cpu_platform](variables.tf#L229) | Minimum CPU platform. | <code>string</code> | | <code>null</code> |
|
||||
| [options](variables.tf#L255) | Instance options. | <code title="object({ allow_stopping_for_update = optional(bool, true) deletion_protection = optional(bool, false) spot = optional(bool, false) termination_action = optional(string) })">object({…})</code> | | <code title="{ allow_stopping_for_update = true deletion_protection = false spot = false termination_action = null }">{…}</code> |
|
||||
| [scratch_disks](variables.tf#L282) | Scratch disks configuration. | <code title="object({ count = number interface = string })">object({…})</code> | | <code title="{ count = 0 interface = "NVME" }">{…}</code> |
|
||||
| [service_account](variables.tf#L294) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L300) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [service_account_scopes](variables.tf#L308) | Scopes applied to service account. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [shielded_config](variables.tf#L314) | Shielded VM configuration of the instances. | <code title="object({ enable_secure_boot = bool enable_vtpm = bool enable_integrity_monitoring = bool })">object({…})</code> | | <code>null</code> |
|
||||
| [snapshot_schedules](variables.tf#L324) | Snapshot schedule resource policies that can be attached to disks. | <code title="map(object({ schedule = object({ daily = optional(object({ days_in_cycle = number start_time = string })) hourly = optional(object({ hours_in_cycle = number start_time = string })) weekly = optional(list(object({ day = string start_time = string }))) }) description = optional(string) retention_policy = optional(object({ max_retention_days = number on_source_disk_delete_keep = optional(bool) })) snapshot_properties = optional(object({ chain_name = optional(string) guest_flush = optional(bool) labels = optional(map(string)) storage_locations = optional(list(string)) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L367) | Tag bindings for this instance, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
||||
| [tags](variables.tf#L373) | Instance network tags for firewall rule targets. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [service_account](variables.tf#L294) | Service account email and scopes. If email is null, the default Compute service account will be used unless auto_create is true, in which case a service account will be created. Set the variable to null to avoid attaching a service account. | <code title="object({ auto_create = optional(bool, false) email = optional(string) scopes = optional(list(string)) })">object({…})</code> | | <code>{}</code> |
|
||||
| [shielded_config](variables.tf#L304) | Shielded VM configuration of the instances. | <code title="object({ enable_secure_boot = bool enable_vtpm = bool enable_integrity_monitoring = bool })">object({…})</code> | | <code>null</code> |
|
||||
| [snapshot_schedules](variables.tf#L314) | Snapshot schedule resource policies that can be attached to disks. | <code title="map(object({ schedule = object({ daily = optional(object({ days_in_cycle = number start_time = string })) hourly = optional(object({ hours_in_cycle = number start_time = string })) weekly = optional(list(object({ day = string start_time = string }))) }) description = optional(string) retention_policy = optional(object({ max_retention_days = number on_source_disk_delete_keep = optional(bool) })) snapshot_properties = optional(object({ chain_name = optional(string) guest_flush = optional(bool) labels = optional(map(string)) storage_locations = optional(list(string)) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L357) | Tag bindings for this instance, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
||||
| [tags](variables.tf#L363) | Instance network tags for firewall rule targets. | <code>list(string)</code> | | <code>[]</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
@@ -668,13 +718,13 @@ module "instance" {
|
||||
| [external_ip](outputs.tf#L17) | Instance main interface external IP addresses. | |
|
||||
| [group](outputs.tf#L26) | Instance group resource. | |
|
||||
| [id](outputs.tf#L31) | Fully qualified instance id. | |
|
||||
| [instance](outputs.tf#L36) | Instance resource. | |
|
||||
| [internal_ip](outputs.tf#L41) | Instance main interface internal IP address. | |
|
||||
| [internal_ips](outputs.tf#L49) | Instance interfaces internal IP addresses. | |
|
||||
| [self_link](outputs.tf#L57) | Instance self links. | |
|
||||
| [service_account](outputs.tf#L62) | Service account resource. | |
|
||||
| [service_account_email](outputs.tf#L69) | Service account email. | |
|
||||
| [service_account_iam_email](outputs.tf#L74) | Service account email. | |
|
||||
| [instance](outputs.tf#L36) | Instance resource. | ✓ |
|
||||
| [internal_ip](outputs.tf#L42) | Instance main interface internal IP address. | |
|
||||
| [internal_ips](outputs.tf#L50) | Instance interfaces internal IP addresses. | |
|
||||
| [self_link](outputs.tf#L58) | Instance self links. | |
|
||||
| [service_account](outputs.tf#L63) | Service account resource. | |
|
||||
| [service_account_email](outputs.tf#L68) | Service account email. | |
|
||||
| [service_account_iam_email](outputs.tf#L73) | Service account email. | |
|
||||
| [template](outputs.tf#L82) | Template resource. | |
|
||||
| [template_name](outputs.tf#L87) | Template name. | |
|
||||
<!-- END TFDOC -->
|
||||
|
||||
@@ -35,31 +35,29 @@ locals {
|
||||
: "MIGRATE"
|
||||
)
|
||||
region = join("-", slice(split("-", var.zone), 0, 2))
|
||||
service_account_email = (
|
||||
var.service_account_create
|
||||
? (
|
||||
length(google_service_account.service_account) > 0
|
||||
service_account = var.service_account == null ? null : {
|
||||
email = (
|
||||
var.service_account.auto_create
|
||||
? google_service_account.service_account[0].email
|
||||
: null
|
||||
: var.service_account.email
|
||||
)
|
||||
: var.service_account
|
||||
)
|
||||
service_account_scopes = (
|
||||
length(var.service_account_scopes) > 0
|
||||
? var.service_account_scopes
|
||||
: (
|
||||
var.service_account_create
|
||||
? [
|
||||
"https://www.googleapis.com/auth/cloud-platform",
|
||||
"https://www.googleapis.com/auth/userinfo.email"
|
||||
]
|
||||
: [
|
||||
"https://www.googleapis.com/auth/devstorage.read_only",
|
||||
"https://www.googleapis.com/auth/logging.write",
|
||||
"https://www.googleapis.com/auth/monitoring.write"
|
||||
]
|
||||
scopes = (
|
||||
var.service_account.scopes != null ? var.service_account.scopes : (
|
||||
var.service_account.email == null && !var.service_account.auto_create
|
||||
# default scopes for Compute default SA
|
||||
? [
|
||||
"https://www.googleapis.com/auth/devstorage.read_only",
|
||||
"https://www.googleapis.com/auth/logging.write",
|
||||
"https://www.googleapis.com/auth/monitoring.write"
|
||||
]
|
||||
# default scopes for own SA
|
||||
: [
|
||||
"https://www.googleapis.com/auth/cloud-platform",
|
||||
"https://www.googleapis.com/auth/userinfo.email"
|
||||
]
|
||||
)
|
||||
)
|
||||
)
|
||||
}
|
||||
termination_action = var.options.spot ? coalesce(var.options.termination_action, "STOP") : null
|
||||
}
|
||||
|
||||
@@ -275,9 +273,12 @@ resource "google_compute_instance" "default" {
|
||||
}
|
||||
}
|
||||
|
||||
service_account {
|
||||
email = local.service_account_email
|
||||
scopes = local.service_account_scopes
|
||||
dynamic "service_account" {
|
||||
for_each = var.service_account == null ? [] : [""]
|
||||
content {
|
||||
email = local.service_account.email
|
||||
scopes = local.service_account.scopes
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "shielded_instance_config" {
|
||||
@@ -399,9 +400,12 @@ resource "google_compute_instance_template" "default" {
|
||||
provisioning_model = var.options.spot ? "SPOT" : "STANDARD"
|
||||
}
|
||||
|
||||
service_account {
|
||||
email = local.service_account_email
|
||||
scopes = local.service_account_scopes
|
||||
dynamic "service_account" {
|
||||
for_each = var.service_account == null ? [] : [""]
|
||||
content {
|
||||
email = local.service_account.email
|
||||
scopes = local.service_account.scopes
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "shielded_instance_config" {
|
||||
@@ -442,7 +446,7 @@ resource "google_compute_instance_group" "unmanaged" {
|
||||
}
|
||||
|
||||
resource "google_service_account" "service_account" {
|
||||
count = var.service_account_create ? 1 : 0
|
||||
count = try(var.service_account.auto_create, null) == true ? 1 : 0
|
||||
project = var.project_id
|
||||
account_id = "tf-vm-${var.name}"
|
||||
display_name = "Terraform VM ${var.name}."
|
||||
|
||||
@@ -35,6 +35,7 @@ output "id" {
|
||||
|
||||
output "instance" {
|
||||
description = "Instance resource."
|
||||
sensitive = true
|
||||
value = try(google_compute_instance.default.0, null)
|
||||
}
|
||||
|
||||
@@ -61,22 +62,21 @@ output "self_link" {
|
||||
|
||||
output "service_account" {
|
||||
description = "Service account resource."
|
||||
value = (
|
||||
var.service_account_create ? google_service_account.service_account.0 : null
|
||||
)
|
||||
value = try(google_service_account.service_account.0, null)
|
||||
}
|
||||
|
||||
output "service_account_email" {
|
||||
description = "Service account email."
|
||||
value = local.service_account_email
|
||||
value = try(local.service_account.email, null)
|
||||
}
|
||||
|
||||
output "service_account_iam_email" {
|
||||
description = "Service account email."
|
||||
value = join("", [
|
||||
"serviceAccount:",
|
||||
local.service_account_email == null ? "" : local.service_account_email
|
||||
])
|
||||
value = (
|
||||
try(local.service_account.email, null) == null
|
||||
? null
|
||||
: "serviceAccount:${local.service_account.email}"
|
||||
)
|
||||
}
|
||||
|
||||
output "template" {
|
||||
|
||||
9
modules/compute-vm/test.tfvars
Normal file
9
modules/compute-vm/test.tfvars
Normal file
@@ -0,0 +1,9 @@
|
||||
project_id = "tf-playground-svpc-gce"
|
||||
zone = "europe-west8-b"
|
||||
name = "test-sa"
|
||||
instance_type = "e2-small"
|
||||
network_interfaces = [{
|
||||
network = "https://www.googleapis.com/compute/v1/projects/ldj-dev-net-spoke-0/global/networks/dev-spoke-0"
|
||||
subnetwork = "https://www.googleapis.com/compute/v1/projects/ldj-dev-net-spoke-0/regions/europe-west8/subnetworks/gce"
|
||||
}]
|
||||
# service_account = null
|
||||
@@ -292,23 +292,13 @@ variable "scratch_disks" {
|
||||
}
|
||||
|
||||
variable "service_account" {
|
||||
description = "Service account email. Unused if service account is auto-created."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "service_account_create" {
|
||||
description = "Auto-create service account."
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
# scopes and scope aliases list
|
||||
# https://cloud.google.com/sdk/gcloud/reference/compute/instances/create#--scopes
|
||||
variable "service_account_scopes" {
|
||||
description = "Scopes applied to service account."
|
||||
type = list(string)
|
||||
default = []
|
||||
description = "Service account email and scopes. If email is null, the default Compute service account will be used unless auto_create is true, in which case a service account will be created. Set the variable to null to avoid attaching a service account."
|
||||
type = object({
|
||||
auto_create = optional(bool, false)
|
||||
email = optional(string)
|
||||
scopes = optional(list(string))
|
||||
})
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "shielded_config" {
|
||||
|
||||
Reference in New Issue
Block a user