Skip to content

Commit

Permalink
fix #714 (#715)
Browse files Browse the repository at this point in the history
  • Loading branch information
@ludoo
ludoo authored Jul 5, 2022
1 parent 9336ac6 commit 8585852
Show file tree
Hide file tree
Showing 12 changed files with 54 additions and 33 deletions.
10 changes: 6 additions & 4 deletions fast/stages/02-networking-nva/landing.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,12 @@ module "landing-project" {
service_projects = []
}
iam = {
"roles/dns.admin" = [local.service_accounts.project-factory-prod]
(local.custom_roles.service_project_network_admin) = [
local.service_accounts.project-factory-prod
]
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-prod, null)
])
(local.custom_roles.service_project_network_admin) = compact([
try(local.service_accounts.project-factory-prod, null)
])
}
}

Expand Down
3 changes: 2 additions & 1 deletion fast/stages/02-networking-nva/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,8 @@ locals {
})]
}
service_accounts = {
for k, v in coalesce(var.service_accounts, {}) : k => "serviceAccount:${v}"
for k, v in coalesce(var.service_accounts, {}) :
k => "serviceAccount:${v}" if v != null
}
stage3_sas_delegated_grants = [
"roles/composer.sharedVpcAgent",
Expand Down
8 changes: 5 additions & 3 deletions fast/stages/02-networking-nva/spoke-dev.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,9 @@ module "dev-spoke-project" {
}
metric_scopes = [module.landing-project.project_id]
iam = {
"roles/dns.admin" = compact([local.service_accounts.project-factory-dev])
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-dev, null)
])
}
}

Expand Down Expand Up @@ -124,8 +126,8 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
project = module.dev-spoke-project.project_id
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
local.service_accounts.data-platform-dev,
local.service_accounts.project-factory-dev,
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.project-factory-dev, null),
])
condition {
title = "dev_stage3_sa_delegated_grants"
Expand Down
8 changes: 5 additions & 3 deletions fast/stages/02-networking-nva/spoke-prod.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,9 @@ module "prod-spoke-project" {
}
metric_scopes = [module.landing-project.project_id]
iam = {
"roles/dns.admin" = compact([local.service_accounts.project-factory-prod])
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-prod, null)
])
}
}

Expand Down Expand Up @@ -124,8 +126,8 @@ resource "google_project_iam_binding" "prod_spoke_project_iam_delegated" {
project = module.prod-spoke-project.project_id
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
local.service_accounts.data-platform-prod,
local.service_accounts.project-factory-prod,
try(local.service_accounts.data-platform-prod, null),
try(local.service_accounts.project-factory-prod, null),
])
condition {
title = "prod_stage3_sa_delegated_grants"
Expand Down
10 changes: 6 additions & 4 deletions fast/stages/02-networking-peering/landing.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,12 @@ module "landing-project" {
service_projects = []
}
iam = {
"roles/dns.admin" = [local.service_accounts.project-factory-prod]
(local.custom_roles.service_project_network_admin) = [
local.service_accounts.project-factory-prod
]
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-prod, null)
])
(local.custom_roles.service_project_network_admin) = compact([
try(local.service_accounts.project-factory-prod, null)
])
}
}

Expand Down
3 changes: 2 additions & 1 deletion fast/stages/02-networking-peering/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,8 @@ locals {
"roles/vpcaccess.user",
]
service_accounts = {
for k, v in coalesce(var.service_accounts, {}) : k => "serviceAccount:${v}"
for k, v in coalesce(var.service_accounts, {}) :
k => "serviceAccount:${v}" if v != null
}
}

Expand Down
8 changes: 5 additions & 3 deletions fast/stages/02-networking-peering/spoke-dev.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@ module "dev-spoke-project" {
}
metric_scopes = [module.landing-project.project_id]
iam = {
"roles/dns.admin" = compact([local.service_accounts.project-factory-dev])
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-dev, null)
])
}
}

Expand Down Expand Up @@ -101,8 +103,8 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
project = module.dev-spoke-project.project_id
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
local.service_accounts.data-platform-dev,
local.service_accounts.project-factory-dev,
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.project-factory-dev, null),
])
condition {
title = "dev_stage3_sa_delegated_grants"
Expand Down
8 changes: 5 additions & 3 deletions fast/stages/02-networking-peering/spoke-prod.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@ module "prod-spoke-project" {
}
metric_scopes = [module.landing-project.project_id]
iam = {
"roles/dns.admin" = compact([local.service_accounts.project-factory-prod])
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-prod, null)
])
}
}

Expand Down Expand Up @@ -101,8 +103,8 @@ resource "google_project_iam_binding" "prod_spoke_project_iam_delegated" {
project = module.prod-spoke-project.project_id
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
local.service_accounts.data-platform-prod,
local.service_accounts.project-factory-prod,
try(local.service_accounts.data-platform-prod, null),
try(local.service_accounts.project-factory-prod, null),
])
condition {
title = "prod_stage3_sa_delegated_grants"
Expand Down
10 changes: 6 additions & 4 deletions fast/stages/02-networking-vpn/landing.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,12 @@ module "landing-project" {
service_projects = []
}
iam = {
"roles/dns.admin" = [local.service_accounts.project-factory-prod]
(local.custom_roles.service_project_network_admin) = [
local.service_accounts.project-factory-prod
]
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-prod, null)
])
(local.custom_roles.service_project_network_admin) = compact([
try(local.service_accounts.project-factory-prod, null)
])
}
}

Expand Down
3 changes: 2 additions & 1 deletion fast/stages/02-networking-vpn/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,8 @@ locals {
"roles/vpcaccess.user",
]
service_accounts = {
for k, v in coalesce(var.service_accounts, {}) : k => "serviceAccount:${v}"
for k, v in coalesce(var.service_accounts, {}) :
k => "serviceAccount:${v}" if v != null
}
}

Expand Down
8 changes: 5 additions & 3 deletions fast/stages/02-networking-vpn/spoke-dev.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@ module "dev-spoke-project" {
}
metric_scopes = [module.landing-project.project_id]
iam = {
"roles/dns.admin" = compact([local.service_accounts.project-factory-dev])
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-dev, null)
])
}
}

Expand Down Expand Up @@ -101,8 +103,8 @@ resource "google_project_iam_binding" "dev_spoke_project_iam_delegated" {
project = module.dev-spoke-project.project_id
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
local.service_accounts.data-platform-dev,
local.service_accounts.project-factory-dev,
try(local.service_accounts.data-platform-dev, null),
try(local.service_accounts.project-factory-dev, null),
])
condition {
title = "dev_stage3_sa_delegated_grants"
Expand Down
8 changes: 5 additions & 3 deletions fast/stages/02-networking-vpn/spoke-prod.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@ module "prod-spoke-project" {
}
metric_scopes = [module.landing-project.project_id]
iam = {
"roles/dns.admin" = compact([local.service_accounts.project-factory-prod])
"roles/dns.admin" = compact([
try(local.service_accounts.project-factory-prod, null)
])
}
}

Expand Down Expand Up @@ -101,8 +103,8 @@ resource "google_project_iam_binding" "prod_spoke_project_iam_delegated" {
project = module.prod-spoke-project.project_id
role = "roles/resourcemanager.projectIamAdmin"
members = compact([
local.service_accounts.data-platform-prod,
local.service_accounts.project-factory-prod,
try(local.service_accounts.data-platform-prod, null),
try(local.service_accounts.project-factory-prod, null),
])
condition {
title = "prod_stage3_sa_delegated_grants"
Expand Down

0 comments on commit 8585852

Please sign in to comment.