fix(multitenant): remove unused app service accounts

2-multitenant/envs/development/README.md

@@ -12,7 +12,6 @@
 |------|-------------|
 | app\_certificates | App Certificates |
 | app\_ip\_addresses | App IP Addresses |
-| app\_service\_accounts | IP Addresses |
 | cluster\_membership\_ids | GKE cluster membership IDs |
 | cluster\_project\_id | Cluster Project ID |
 | cluster\_regions | Regions with clusters |

2-multitenant/envs/development/outputs.tf

@@ -58,8 +58,3 @@ output "app_certificates" {
   description = "App Certificates"
   value       = module.env.app_certificates
 }
-
-output "app_service_accounts" {
-  description = "IP Addresses"
-  value       = module.env.app_service_accounts
-}

2-multitenant/envs/nonproduction/README.md

@@ -12,7 +12,6 @@
 |------|-------------|
 | app\_certificates | App Certificates |
 | app\_ip\_addresses | App IP Addresses |
-| app\_service\_accounts | IP Addresses |
 | cluster\_membership\_ids | GKE cluster membership IDs |
 | cluster\_project\_id | Cluster Project ID |
 | cluster\_regions | Regions with clusters |

2-multitenant/envs/nonproduction/outputs.tf

@@ -58,8 +58,3 @@ output "app_certificates" {
   description = "App Certificates"
   value       = module.env.app_certificates
 }
-
-output "app_service_accounts" {
-  description = "IP Addresses"
-  value       = module.env.app_service_accounts
-}

2-multitenant/envs/production/README.md

@@ -12,7 +12,6 @@
 |------|-------------|
 | app\_certificates | App Certificates |
 | app\_ip\_addresses | App IP Addresses |
-| app\_service\_accounts | IP Addresses |
 | cluster\_membership\_ids | GKE cluster membership IDs |
 | cluster\_project\_id | Cluster Project ID |
 | cluster\_regions | Regions with clusters |

2-multitenant/envs/production/outputs.tf

@@ -58,8 +58,3 @@ output "app_certificates" {
   description = "App Certificates"
   value       = module.env.app_certificates
 }
-
-output "app_service_accounts" {
-  description = "IP Addresses"
-  value       = module.env.app_service_accounts
-}

2-multitenant/modules/env_baseline/README.md

@@ -31,7 +31,6 @@ The following resources are created:
 |------|-------------|
 | app\_certificates | App Certificates |
 | app\_ip\_addresses | App IP Addresses |
-| app\_service\_accounts | App Service Accounts |
 | cluster\_ids | GKE cluster IDs |
 | cluster\_membership\_ids | GKE cluster membership IDs |
 | cluster\_project\_id | Cluster Project ID |

2-multitenant/modules/env_baseline/outputs.tf

@@ -66,10 +66,3 @@ output "app_certificates" {
     for value in google_compute_managed_ssl_certificate.app_ssl_certificates : value.name
   ]
 }
-
-output "app_service_accounts" {
-  description = "App Service Accounts"
-  value = {
-    for value in google_service_account.app_service_accounts : value.display_name => value.email
-  }
-}

test/integration/multitenant/multitenant_test.go

@@ -120,25 +120,6 @@ func TestMultitenant(t *testing.T) {
 					assert.Equal(fmt.Sprintf("%s.svc.id.goog", clusterProjectID), membershipOp.Get("authority.workloadIdentityPool").String(), fmt.Sprintf("Membership %s workloadIdentityPool should be %s.svc.id.goog", id, clusterProjectID))
 				}
 
-				// App Service Accounts
-				for _, appName := range testutils.AppNames {
-					workloadIdentitiesSAEmail := fmt.Sprintf("%s@%s.iam.gserviceaccount.com", appName, clusterProjectID)
-					saOp := gcloud.Run(t, fmt.Sprintf("iam service-accounts describe %s --project %s", workloadIdentitiesSAEmail, clusterProjectID))
-					assert.False(saOp.Get("disabled").Bool(), "Service account should not be disabled.")
-
-					workloadIdentitiesUsers := []string{
-						fmt.Sprintf("serviceAccount:%s.svc.id.goog[accounts-%s/%s]", clusterProjectID, envName, appName),
-						fmt.Sprintf("serviceAccount:%s.svc.id.goog[ledger-%s/%s]", clusterProjectID, envName, appName),
-					}
-
-					workloadIdentitiesSAIamFilter := "bindings.role:'roles/iam.workloadIdentityUser'"
-					workloadIdentitiesSAIamCommonArgs := gcloud.WithCommonArgs([]string{"--flatten", "bindings", "--filter", workloadIdentitiesSAIamFilter, "--format", "json"})
-					workloadIdentitiesSAPolicyOp := gcloud.Run(t, fmt.Sprintf("iam service-accounts get-iam-policy %s", workloadIdentitiesSAEmail), workloadIdentitiesSAIamCommonArgs).Array()[0]
-					workloadIdentitiesSaListMembers := utils.GetResultStrSlice(workloadIdentitiesSAPolicyOp.Get("bindings.members").Array())
-					assert.Subset(workloadIdentitiesSaListMembers, workloadIdentitiesUsers, fmt.Sprintf("service account %s should have workload identity users", workloadIdentitiesSAEmail))
-					assert.Equal(len(workloadIdentitiesUsers), len(workloadIdentitiesSaListMembers), fmt.Sprintf("service account % should have %d workload identity users", workloadIdentitiesSAEmail, len(workloadIdentitiesUsers)))
-				}
-
 				// Service Identity
 				fleetProjectNumber := gcloud.Runf(t, "projects describe %s", fleetProjectID).Get("projectNumber").String()
 				gkeServiceAgent := fmt.Sprintf("service-%[email protected]", fleetProjectNumber)