chore: Attach KMS Key in Safer IAP GKE cluster #1614
Conversation
avinashkumar1289
requested review from
a team,
Jberlinsky and
ericyz
as code owners
avinashkumar1289
changed the title
|
To be clear -- this PR does not create new support for KMS, it just adds an example of providing a KMS key to the existing module. Is that the intent? |
|
Yes so it provide an example of creating a KMS Key and attach the key to GKE that's the intent. |
avinashkumar1289
changed the title
|
/gcbrun |
| data "google_project" "project" {} | ||
|
|
||
| locals { | ||
| gke_sa = "serviceAccount:service-${data.google_project.project.number}@container-engine-robot.iam.gserviceaccount.com" | ||
| } | ||
|
|
There was a problem hiding this comment.
We can generate this using service identities from the project services module in apis.tf and use the enabled_api_identities output to retrieve the sa email.
There was a problem hiding this comment.
Hi @bharathkkb Thanks for the response. activate_api_identities requires the api and the role. I can pass the api but what should be the role I need to pass ? Because this service account needs the KMS encrypter/Decrypter role which is taken care at the KMS Module
Something like. this
encrypters = [
"serviceAccount:${module.enabled_google_apis.enabled_api_identities["container.googleapis.com"]}",
]
decrypters = [
"serviceAccount:${module.enabled_google_apis.enabled_api_identities["container.googleapis.com"]}",
]
activate_api_identities = [{
api = "container.googleapis.com",
roles = [????],
}]
There was a problem hiding this comment.
Updating the role at api_identities and removed thee role from KMS module
| variable "keyring" { | ||
| description = "Keyring name." | ||
| type = string | ||
| default = "gke-keyring" | ||
| } | ||
|
|
||
| variable "keys" { | ||
| description = "Key names." | ||
| type = list(string) | ||
| default = ["gke-key"] | ||
| } |
There was a problem hiding this comment.
We are transitioning to inline these variables so you can directly provide them in kms.tf
There was a problem hiding this comment.
@bharathkkb updated the comment
bharathkkb
changed the title
…aform-google-kubernetes-engine into avinashjha/gke-kms
…aform-google-kubernetes-engine into avinashjha/gke-kms
|
/gcbrun |
…les#1614) Co-authored-by: Bharath KKB <[email protected]>
This request have changes