Skip to content

Commit b4bcfb9

Browse files
bharathkkbmilesmatthias
bharathkkb
and
milesmatthias
authored
feat: Add new Workload identity [submodule](./modules/workload-identity) (terraform-google-modules#417)
* initial workload identity addition various typo & linting fixes update README with output instead of hardcoded name update README to avoid cycle fix linting add missing outputs to fix linting update readme, generate docs fix linting for workload identity output updates from peer review add integration step for verifying workload identity initial workload identity integration test remove duplicate comment update dev tools version and just focus on workload identity tests here need these dependent steps project_ids is what we're using for variables add project_id output give registry_project_id a default in workload identity since we're not using it generate docs add the kubernetes provider rename cluster service account to work with this module bump google tf provider version newer gke clusters need to use kubernetes monitoring updated variable defaults in readme update monitoring variable in all modules update logging service variable too shorten some names to match identity account_id regex * accept incoming for conflicts on readme * fix WI config, fix tests * re enable all tests * fix vars,op * re enable cloud build for all tests * fix flake8 errors * increase timeout * add defaults, address comments Co-authored-by: Miles Matthias <miles.matthias@gmail.com>
1 parent c8fde26 commit b4bcfb9

File tree

17 files changed

+769
-16
lines changed

17 files changed

+769
-16
lines changed

‎.kitchen.yml‎

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.
55
# You may obtain a copy of the License at
6-
#
76
# http://www.apache.org/licenses/LICENSE-2.0
87
#
98
# Unless required by applicable law or agreed to in writing, software
@@ -15,7 +14,7 @@
1514
---
1615
driver:
1716
name: "terraform"
18-
command_timeout: 1800
17+
command_timeout: 2700
1918

2019
provisioner:
2120
name: "terraform"
@@ -133,28 +132,41 @@ suites:
133132
controls:
134133
- gcloud
135134
- kubectl
136-
# Disabled due to issue #264
137-
# (https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/264)
138-
# - name: stub_domains_private
139-
# driver:
140-
# root_module_directory: test/fixtures/stub_domains_private
141-
# systems:
142-
# - name: stub_domains_private
143-
# backend: local
135+
# Disabled due to issue #264
136+
# (https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/264)
137+
# - name: stub_domains_private
138+
# driver:
139+
# root_module_directory: test/fixtures/stub_domains_private
140+
# systems:
141+
# - name: stub_domains_private
142+
# backend: local
144143
- name: "upstream_nameservers"
145144
driver:
146145
root_module_directory: test/fixtures/upstream_nameservers
147146
verifier:
148-
systems:
149-
- name: upstream_nameservers
150-
backend: local
147+
systems:
148+
- name: upstream_nameservers
149+
backend: local
151150
- name: "stub_domains_upstream_nameservers"
152151
driver:
153152
root_module_directory: test/fixtures/stub_domains_upstream_nameservers
154153
verifier:
155-
systems:
156-
- name: stub_domains_upstream_nameservers
157-
backend: local
154+
systems:
155+
- name: stub_domains_upstream_nameservers
156+
backend: local
157+
- name: "workload_identity"
158+
driver:
159+
root_module_directory: test/fixtures/workload_identity
160+
verifier:
161+
systems:
162+
- name: gcloud
163+
backend: local
164+
controls:
165+
- gcloud
166+
- name: gcp
167+
backend: gcp
168+
controls:
169+
- gcp
158170
- name: "workload_metadata_config"
159171
driver:
160172
root_module_directory: test/fixtures/workload_metadata_config

‎build/int.cloudbuild.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -344,6 +344,26 @@ steps:
344344
- verify sandbox-enabled-local
345345
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
346346
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy sandbox-enabled-local']
347+
- id: create workload-identity-local
348+
waitFor:
349+
- prepare
350+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
351+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create workload-identity-local']
352+
- id: converge workload-identity-local
353+
waitFor:
354+
- create workload-identity-local
355+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
356+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge workload-identity-local']
357+
- id: verify workload-identity-local
358+
waitFor:
359+
- converge workload-identity-local
360+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
361+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify workload-identity-local']
362+
- id: destroy workload-identity-local
363+
waitFor:
364+
- verify workload-identity-local
365+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
366+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy workload-identity-local']
347367
tags:
348368
- 'ci'
349369
- 'integration'

‎examples/workload_identity/README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Simple Zonal Cluster with Workload Identity
2+
3+
This example illustrates how to create a simple cluster, with a GCP service account bound as the identity running workloads on your GKE cluster.
4+
5+
Read more about [workload identity in the docs](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity).
6+
7+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8+
## Inputs
9+
10+
| Name | Description | Type | Default | Required |
11+
|------|-------------|:----:|:-----:|:-----:|
12+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
13+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
14+
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
15+
| network | The VPC network to host the cluster in | string | n/a | yes |
16+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
17+
| region | The region to host the cluster in | string | `"us-central1"` | no |
18+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
19+
20+
## Outputs
21+
22+
| Name | Description |
23+
|------|-------------|
24+
| ca\_certificate | |
25+
| client\_token | |
26+
| cluster\_name | Cluster name |
27+
| k8s\_service\_account\_email | K8S GCP service account. |
28+
| k8s\_service\_account\_name | K8S GCP service name |
29+
| kubernetes\_endpoint | |
30+
| location | Cluster location (zones) |
31+
| project\_id | Project id where GKE cluster is created. |
32+
| region | Cluster region |
33+
| service\_account | The default service account used for running nodes. |
34+
35+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
36+
37+
To provision this example, run the following from within this directory:
38+
- `terraform init` to get the plugins
39+
- `terraform plan` to see the infrastructure plan
40+
- `terraform apply` to apply the infrastructure build
41+
- `terraform destroy` to destroy the built infrastructure

‎examples/workload_identity/main.tf‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "regional"
19+
}
20+
21+
provider "google" {
22+
version = "~> 2.20.1"
23+
region = var.region
24+
}
25+
26+
provider "kubernetes" {
27+
version = "~> 1.10"
28+
host = module.gke.endpoint
29+
token = data.google_client_config.default.access_token
30+
cluster_ca_certificate = base64decode(module.gke.ca_certificate)
31+
}
32+
33+
module "gke" {
34+
source = "../../modules/beta-public-cluster/"
35+
project_id = var.project_id
36+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
37+
region = var.region
38+
network = var.network
39+
subnetwork = var.subnetwork
40+
ip_range_pods = var.ip_range_pods
41+
ip_range_services = var.ip_range_services
42+
remove_default_node_pool = true
43+
service_account = "create"
44+
identity_namespace = "${var.project_id}.svc.id.goog"
45+
node_metadata = "GKE_METADATA_SERVER"
46+
node_pools = [
47+
{
48+
name = "wi-pool"
49+
min_count = 1
50+
max_count = 2
51+
auto_upgrade = true
52+
}
53+
]
54+
}
55+
56+
module "workload_identity" {
57+
source = "../../modules/workload-identity"
58+
project_id = var.project_id
59+
name = "iden-${module.gke.name}"
60+
namespace = "default"
61+
use_existing_k8s_sa = false
62+
}
63+
64+
data "google_client_config" "default" {
65+
}

‎examples/workload_identity/outputs.tf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = module.gke.endpoint
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = base64encode(data.google_client_config.default.access_token)
25+
}
26+
27+
output "ca_certificate" {
28+
value = module.gke.ca_certificate
29+
}
30+
31+
output "service_account" {
32+
description = "The default service account used for running nodes."
33+
value = module.gke.service_account
34+
}
35+
36+
output "region" {
37+
description = "Cluster region"
38+
value = module.gke.region
39+
}
40+
41+
output "location" {
42+
description = "Cluster location (zones)"
43+
value = module.gke.location
44+
}
45+
46+
output "project_id" {
47+
description = "Project id where GKE cluster is created."
48+
value = var.project_id
49+
}
50+
51+
output "cluster_name" {
52+
description = "Cluster name"
53+
value = module.gke.name
54+
}
55+
56+
output "k8s_service_account_email" {
57+
description = "K8S GCP service account."
58+
value = module.workload_identity.gcp_service_account_email
59+
}
60+
61+
output "k8s_service_account_name" {
62+
description = "K8S GCP service name"
63+
value = module.workload_identity.gcp_service_account_name
64+
}

‎examples/workload_identity/variables.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "cluster_name_suffix" {
22+
description = "A suffix to append to the default cluster name"
23+
default = ""
24+
}
25+
26+
variable "region" {
27+
description = "The region to host the cluster in"
28+
default = "us-central1"
29+
}
30+
31+
variable "network" {
32+
description = "The VPC network to host the cluster in"
33+
}
34+
35+
variable "subnetwork" {
36+
description = "The subnetwork to host the cluster in"
37+
}
38+
39+
variable "ip_range_pods" {
40+
description = "The secondary ip range to use for pods"
41+
}
42+
43+
variable "ip_range_services" {
44+
description = "The secondary ip range to use for pods"
45+
}
46+

0 commit comments

Comments
 (0)