From 0b40d96e386394d834c38426b42cf5eb978ea2d7 Mon Sep 17 00:00:00 2001
From: Thomas Griseau <48803465+griseau@users.noreply.github.com>
Date: Wed, 26 Apr 2023 20:03:35 +0200
Subject: [PATCH] fix: use provided service_account_name if available (#1610)
---
README.md | 3 ++-
autogen/main/sa.tf.tmpl | 4 +++-
autogen/main/variables.tf.tmpl | 8 +++++++-
modules/beta-autopilot-private-cluster/README.md | 3 ++-
modules/beta-autopilot-private-cluster/sa.tf | 4 +++-
modules/beta-autopilot-private-cluster/variables.tf | 8 +++++++-
modules/beta-autopilot-public-cluster/README.md | 3 ++-
modules/beta-autopilot-public-cluster/sa.tf | 4 +++-
modules/beta-autopilot-public-cluster/variables.tf | 8 +++++++-
modules/beta-private-cluster-update-variant/README.md | 3 ++-
modules/beta-private-cluster-update-variant/sa.tf | 4 +++-
modules/beta-private-cluster-update-variant/variables.tf | 8 +++++++-
modules/beta-private-cluster/README.md | 3 ++-
modules/beta-private-cluster/sa.tf | 4 +++-
modules/beta-private-cluster/variables.tf | 8 +++++++-
modules/beta-public-cluster-update-variant/README.md | 3 ++-
modules/beta-public-cluster-update-variant/sa.tf | 4 +++-
modules/beta-public-cluster-update-variant/variables.tf | 8 +++++++-
modules/beta-public-cluster/README.md | 3 ++-
modules/beta-public-cluster/sa.tf | 4 +++-
modules/beta-public-cluster/variables.tf | 8 +++++++-
modules/private-cluster-update-variant/README.md | 3 ++-
modules/private-cluster-update-variant/sa.tf | 4 +++-
modules/private-cluster-update-variant/variables.tf | 8 +++++++-
modules/private-cluster/README.md | 3 ++-
modules/private-cluster/sa.tf | 4 +++-
modules/private-cluster/variables.tf | 8 +++++++-
sa.tf | 4 +++-
variables.tf | 8 +++++++-
29 files changed, 118 insertions(+), 29 deletions(-)
diff --git a/README.md b/README.md
index e83b1b53c5..d51aebaab1 100644
--- a/README.md
+++ b/README.md
@@ -203,7 +203,8 @@ Then perform the following commands on the root folder:
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
-| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
+| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
+| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | object({
metadata = string
}) | {
"metadata": "INCLUDE_ALL_METADATA"
} | no |
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
diff --git a/autogen/main/sa.tf.tmpl b/autogen/main/sa.tf.tmpl
index 16aaf5287f..0b47560236 100644
--- a/autogen/main/sa.tf.tmpl
+++ b/autogen/main/sa.tf.tmpl
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/autogen/main/variables.tf.tmpl b/autogen/main/variables.tf.tmpl
index c4f44dfcc7..3f0959f2cf 100644
--- a/autogen/main/variables.tf.tmpl
+++ b/autogen/main/variables.tf.tmpl
@@ -379,7 +379,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}
diff --git a/modules/beta-autopilot-private-cluster/README.md b/modules/beta-autopilot-private-cluster/README.md
index d95e559333..9763ef9ef7 100644
--- a/modules/beta-autopilot-private-cluster/README.md
+++ b/modules/beta-autopilot-private-cluster/README.md
@@ -120,7 +120,8 @@ Then perform the following commands on the root folder:
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
-| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
+| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
+| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | object({
metadata = string
}) | {
"metadata": "INCLUDE_ALL_METADATA"
} | no |
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
diff --git a/modules/beta-autopilot-private-cluster/sa.tf b/modules/beta-autopilot-private-cluster/sa.tf
index eb63753625..5e703de5aa 100644
--- a/modules/beta-autopilot-private-cluster/sa.tf
+++ b/modules/beta-autopilot-private-cluster/sa.tf
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/modules/beta-autopilot-private-cluster/variables.tf b/modules/beta-autopilot-private-cluster/variables.tf
index 007b2046a2..8dc2c9a8df 100644
--- a/modules/beta-autopilot-private-cluster/variables.tf
+++ b/modules/beta-autopilot-private-cluster/variables.tf
@@ -222,7 +222,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}
diff --git a/modules/beta-autopilot-public-cluster/README.md b/modules/beta-autopilot-public-cluster/README.md
index bd1724b8c3..05876ae443 100644
--- a/modules/beta-autopilot-public-cluster/README.md
+++ b/modules/beta-autopilot-public-cluster/README.md
@@ -109,7 +109,8 @@ Then perform the following commands on the root folder:
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
-| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
+| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
+| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | object({
metadata = string
}) | {
"metadata": "INCLUDE_ALL_METADATA"
} | no |
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
diff --git a/modules/beta-autopilot-public-cluster/sa.tf b/modules/beta-autopilot-public-cluster/sa.tf
index eb63753625..5e703de5aa 100644
--- a/modules/beta-autopilot-public-cluster/sa.tf
+++ b/modules/beta-autopilot-public-cluster/sa.tf
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/modules/beta-autopilot-public-cluster/variables.tf b/modules/beta-autopilot-public-cluster/variables.tf
index 897e261e80..95d24d69f2 100644
--- a/modules/beta-autopilot-public-cluster/variables.tf
+++ b/modules/beta-autopilot-public-cluster/variables.tf
@@ -222,7 +222,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}
diff --git a/modules/beta-private-cluster-update-variant/README.md b/modules/beta-private-cluster-update-variant/README.md
index 7305b970ed..eb3e39aaf8 100644
--- a/modules/beta-private-cluster-update-variant/README.md
+++ b/modules/beta-private-cluster-update-variant/README.md
@@ -254,7 +254,8 @@ Then perform the following commands on the root folder:
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
-| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
+| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
+| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | object({
metadata = string
}) | {
"metadata": "INCLUDE_ALL_METADATA"
} | no |
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
diff --git a/modules/beta-private-cluster-update-variant/sa.tf b/modules/beta-private-cluster-update-variant/sa.tf
index eb63753625..5e703de5aa 100644
--- a/modules/beta-private-cluster-update-variant/sa.tf
+++ b/modules/beta-private-cluster-update-variant/sa.tf
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/modules/beta-private-cluster-update-variant/variables.tf b/modules/beta-private-cluster-update-variant/variables.tf
index 7ed013cfc8..2f5a967c46 100644
--- a/modules/beta-private-cluster-update-variant/variables.tf
+++ b/modules/beta-private-cluster-update-variant/variables.tf
@@ -358,7 +358,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}
diff --git a/modules/beta-private-cluster/README.md b/modules/beta-private-cluster/README.md
index afbdf287e4..75b04ff7b1 100644
--- a/modules/beta-private-cluster/README.md
+++ b/modules/beta-private-cluster/README.md
@@ -232,7 +232,8 @@ Then perform the following commands on the root folder:
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
-| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
+| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
+| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | object({
metadata = string
}) | {
"metadata": "INCLUDE_ALL_METADATA"
} | no |
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
diff --git a/modules/beta-private-cluster/sa.tf b/modules/beta-private-cluster/sa.tf
index eb63753625..5e703de5aa 100644
--- a/modules/beta-private-cluster/sa.tf
+++ b/modules/beta-private-cluster/sa.tf
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/modules/beta-private-cluster/variables.tf b/modules/beta-private-cluster/variables.tf
index 7ed013cfc8..2f5a967c46 100644
--- a/modules/beta-private-cluster/variables.tf
+++ b/modules/beta-private-cluster/variables.tf
@@ -358,7 +358,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}
diff --git a/modules/beta-public-cluster-update-variant/README.md b/modules/beta-public-cluster-update-variant/README.md
index a73037e17a..4822ebf461 100644
--- a/modules/beta-public-cluster-update-variant/README.md
+++ b/modules/beta-public-cluster-update-variant/README.md
@@ -243,7 +243,8 @@ Then perform the following commands on the root folder:
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
-| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
+| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
+| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | object({
metadata = string
}) | {
"metadata": "INCLUDE_ALL_METADATA"
} | no |
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
diff --git a/modules/beta-public-cluster-update-variant/sa.tf b/modules/beta-public-cluster-update-variant/sa.tf
index eb63753625..5e703de5aa 100644
--- a/modules/beta-public-cluster-update-variant/sa.tf
+++ b/modules/beta-public-cluster-update-variant/sa.tf
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/modules/beta-public-cluster-update-variant/variables.tf b/modules/beta-public-cluster-update-variant/variables.tf
index 04a2a21685..d096780a3c 100644
--- a/modules/beta-public-cluster-update-variant/variables.tf
+++ b/modules/beta-public-cluster-update-variant/variables.tf
@@ -358,7 +358,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}
diff --git a/modules/beta-public-cluster/README.md b/modules/beta-public-cluster/README.md
index 7e3388050c..a6d1d33d3d 100644
--- a/modules/beta-public-cluster/README.md
+++ b/modules/beta-public-cluster/README.md
@@ -221,7 +221,8 @@ Then perform the following commands on the root folder:
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
-| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
+| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
+| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | object({
metadata = string
}) | {
"metadata": "INCLUDE_ALL_METADATA"
} | no |
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
diff --git a/modules/beta-public-cluster/sa.tf b/modules/beta-public-cluster/sa.tf
index eb63753625..5e703de5aa 100644
--- a/modules/beta-public-cluster/sa.tf
+++ b/modules/beta-public-cluster/sa.tf
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/modules/beta-public-cluster/variables.tf b/modules/beta-public-cluster/variables.tf
index 04a2a21685..d096780a3c 100644
--- a/modules/beta-public-cluster/variables.tf
+++ b/modules/beta-public-cluster/variables.tf
@@ -358,7 +358,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}
diff --git a/modules/private-cluster-update-variant/README.md b/modules/private-cluster-update-variant/README.md
index 8debffb70d..9e614719be 100644
--- a/modules/private-cluster-update-variant/README.md
+++ b/modules/private-cluster-update-variant/README.md
@@ -236,7 +236,8 @@ Then perform the following commands on the root folder:
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
-| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
+| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
+| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | object({
metadata = string
}) | {
"metadata": "INCLUDE_ALL_METADATA"
} | no |
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
diff --git a/modules/private-cluster-update-variant/sa.tf b/modules/private-cluster-update-variant/sa.tf
index eb63753625..5e703de5aa 100644
--- a/modules/private-cluster-update-variant/sa.tf
+++ b/modules/private-cluster-update-variant/sa.tf
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/modules/private-cluster-update-variant/variables.tf b/modules/private-cluster-update-variant/variables.tf
index 7564e7993d..b48d88f205 100644
--- a/modules/private-cluster-update-variant/variables.tf
+++ b/modules/private-cluster-update-variant/variables.tf
@@ -350,7 +350,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}
diff --git a/modules/private-cluster/README.md b/modules/private-cluster/README.md
index d0441b09a1..5c27de7a04 100644
--- a/modules/private-cluster/README.md
+++ b/modules/private-cluster/README.md
@@ -214,7 +214,8 @@ Then perform the following commands on the root folder:
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
-| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
+| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
+| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | object({
metadata = string
}) | {
"metadata": "INCLUDE_ALL_METADATA"
} | no |
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
diff --git a/modules/private-cluster/sa.tf b/modules/private-cluster/sa.tf
index eb63753625..5e703de5aa 100644
--- a/modules/private-cluster/sa.tf
+++ b/modules/private-cluster/sa.tf
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/modules/private-cluster/variables.tf b/modules/private-cluster/variables.tf
index 7564e7993d..b48d88f205 100644
--- a/modules/private-cluster/variables.tf
+++ b/modules/private-cluster/variables.tf
@@ -350,7 +350,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}
diff --git a/sa.tf b/sa.tf
index eb63753625..5e703de5aa 100644
--- a/sa.tf
+++ b/sa.tf
@@ -23,6 +23,8 @@ locals {
["dummy"],
),
)
+ service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
resource "google_service_account" "cluster_service_account" {
count = var.create_service_account ? 1 : 0
project = var.project_id
- account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
+ account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
display_name = "Terraform-managed service account for cluster ${var.name}"
}
diff --git a/variables.tf b/variables.tf
index 08b7a7465d..70747fcc8a 100644
--- a/variables.tf
+++ b/variables.tf
@@ -350,7 +350,13 @@ variable "registry_project_ids" {
variable "service_account" {
type = string
- description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
+ description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
+ default = ""
+}
+
+variable "service_account_name" {
+ type = string
+ description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
default = ""
}