Terraform module for creating GCP IAM resources required to connect GKE with CAST AI.

Website: https://www.cast.ai

Requirements

• Terraform 0.13+

Using the module

module "castai_gke_iam" {
  source = "castai/gke-iam/castai"
  
  project_id = var.project_id
  gke_cluster_name = var.cluster_name

}

Examples

Usage examples are located in terraform provider repo

Requirements

Name	Version
terraform	>= 0.13
castai	>= 5.1.0
google	>= 2.49

Providers

Name	Version
castai	>= 5.1.0
google	>= 2.49

Modules

No modules.

Resources

Name	Type
google_project_iam_binding.compute_manager_binding	resource
google_project_iam_custom_role.castai_role	resource
google_project_iam_custom_role.compute_manager_role	resource
google_project_iam_member.project	resource
google_project_iam_member.scoped_project	resource
google_project_iam_member.scoped_service_account_user	resource
google_project_iam_member.workload_identity_project	resource
google_project_iam_member.workload_identity_scoped_project	resource
google_project_iam_member.workload_identity_scoped_service_account_user	resource
google_service_account.castai_service_account	resource
google_service_account_key.castai_key	resource
castai_gke_user_policies.gke	data source

Inputs

Name	Description	Type	Default	Required
cloud_proxy_service_account_name	Name of the cloud-proxy Kubernetes Service Account	string	"castai-cloud-proxy"	no
cloud_proxy_service_account_namespace	Namespace of the cloud-proxy Kubernetes Service Account	string	"castai-agent"	no
compute_manager_project_ids	Projects list for shared sole tenancy nodes	list(string)	[]	no
create_service_account	Whether an Service Account with private key should be created	bool	true	no
gke_cluster_name	GKE cluster name for which to create IAM roles	string	n/a	yes
project_id	The project id from GCP	string	n/a	yes
service_accounts_unique_ids	Service Accounts' unique IDs used by node pools in the cluster	list(string)	[]	no
setup_cloud_proxy_workload_identity	Whether the workload identity for castai-cloud-proxy should be setup	bool	false	no
workload_identity_namespace	Override workload identity namespace, default is .svc.id.goog	string	""	no

Outputs

Name	Description
private_key	n/a
service_account_email	n/a
service_account_id	n/a