Feat: adding a module for networking/iam requirements and example for composer-v2 #60
Conversation
There was a problem hiding this comment.
Nothing seemed off regarding the missing project_id var you mentioned as I see the project_id plumbed correctly. Could you add this to the https://github.com/terraform-google-modules/terraform-google-composer/blob/master/build/int.cloudbuild.yaml to kick off tests in CI and see if any issues happen
modules/composer_net/composer-iam.tf
Outdated
| resource "google_project_iam_member" "service_account_user" { | ||
| project = var.service_project_id | ||
| role = "roles/iam.serviceAccountUser" | ||
| member = "serviceAccount:${google_service_account.composer_sa.email}" |
There was a problem hiding this comment.
Can we scope this to just a single SA rather than giving access to all service accounts in a project?
There was a problem hiding this comment.
it wasn't possible. I ran into error messages otherwise. both for IAM binding as well as composer.worker.
|
@bharathkkb i am in process of completely overhauling the setup process. I am including creation of two projects (host/ service project), creating dns zones, records (for restricted VIP, etc). The attachment of service project to host project requires "roles/compute.xpnAdmin" at folder/org level. However, I am worried how we can do this via your CI pipeline. I think the orchestrator service account gets org viewer, project creator, and thats about it. How do we ensure we get folder IAM permissions so that it can do that IAM binding ? Which step in your CI pipeline does that? or should I just do it via gcloud in the init pipeline? |
|
@bharathkkb sorry for the excessive nudge. I have it almost figured out. I have an e2e project setup that creates all pre reqs as well. to summarize I have two questions
|
modules/composer_net/variables.tf
Outdated
| default = null | ||
| } | ||
|
|
||
| variable "pod_ip_allocation_range_name" { |
There was a problem hiding this comment.
@sanmaym should we remove this?
|
@sanmaym |
This feature incorporates the networking and IAM requirements that are pre requisite for having a successful composer-v2 environment within Shared VPC and within VPC Service Control Perimeter