Skip to content

Commit b4ac6d9

Browse files
jullianowjullianow
authored
feat(sa): Adjustment to the SA description and reference to the member attribute (#2518)
1 parent dcbbb2a commit b4ac6d9

File tree

12 files changed

+59
-49
lines changed

12 files changed

+59
-49
lines changed

‎autogen/main/sa.tf.tmpl‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_service_account" "cluster_service_account" {
4343
count = var.create_service_account ? 1 : 0
4444
project = var.project_id
4545
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
46-
display_name = "Terraform-managed service account for cluster ${var.name}"
46+
description = "Terraform-managed service account for cluster ${var.name}"
47+
display_name = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4748
}
4849

4950
resource "google_project_iam_member" "cluster_service_account_node_service_account" {
@@ -71,21 +72,21 @@ resource "google_project_iam_member" "cluster_service_account_gcr" {
7172
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7273
project = each.key
7374
role = "roles/storage.objectViewer"
74-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
75+
member = google_service_account.cluster_service_account[0].member
7576
}
7677

7778
resource "google_project_iam_member" "cluster_service_account_artifact_registry" {
7879
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7980
project = each.key
8081
role = "roles/artifactregistry.reader"
81-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
82+
member = google_service_account.cluster_service_account[0].member
8283
}
8384

8485
resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
8586
for_each = var.create_service_account && var.grant_registry_access {% if autopilot_cluster != true %}&& var.enable_gcfs {% endif %}? toset(local.registry_projects_list) : []
8687
project = each.key
8788
role = "roles/serviceusage.serviceUsageConsumer"
88-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
89+
member = google_service_account.cluster_service_account[0].member
8990
}
9091
{% if beta_cluster %}
9192

@@ -100,6 +101,6 @@ resource "google_project_iam_member" "service_agent" {
100101
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
101102
project = var.project_id
102103
role = each.value
103-
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
104+
member = google_project_service_identity.fleet_project[0].member
104105
}
105106
{% endif %}

‎modules/beta-autopilot-private-cluster/sa.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_service_account" "cluster_service_account" {
4343
count = var.create_service_account ? 1 : 0
4444
project = var.project_id
4545
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
46-
display_name = "Terraform-managed service account for cluster ${var.name}"
46+
description = "Terraform-managed service account for cluster ${var.name}"
47+
display_name = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4748
}
4849

4950
resource "google_project_iam_member" "cluster_service_account_node_service_account" {
@@ -71,21 +72,21 @@ resource "google_project_iam_member" "cluster_service_account_gcr" {
7172
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7273
project = each.key
7374
role = "roles/storage.objectViewer"
74-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
75+
member = google_service_account.cluster_service_account[0].member
7576
}
7677

7778
resource "google_project_iam_member" "cluster_service_account_artifact_registry" {
7879
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7980
project = each.key
8081
role = "roles/artifactregistry.reader"
81-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
82+
member = google_service_account.cluster_service_account[0].member
8283
}
8384

8485
resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
8586
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
8687
project = each.key
8788
role = "roles/serviceusage.serviceUsageConsumer"
88-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
89+
member = google_service_account.cluster_service_account[0].member
8990
}
9091

9192
resource "google_project_service_identity" "fleet_project" {
@@ -99,5 +100,5 @@ resource "google_project_iam_member" "service_agent" {
99100
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
100101
project = var.project_id
101102
role = each.value
102-
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
103+
member = google_project_service_identity.fleet_project[0].member
103104
}

‎modules/beta-autopilot-public-cluster/sa.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_service_account" "cluster_service_account" {
4343
count = var.create_service_account ? 1 : 0
4444
project = var.project_id
4545
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
46-
display_name = "Terraform-managed service account for cluster ${var.name}"
46+
description = "Terraform-managed service account for cluster ${var.name}"
47+
display_name = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4748
}
4849

4950
resource "google_project_iam_member" "cluster_service_account_node_service_account" {
@@ -71,21 +72,21 @@ resource "google_project_iam_member" "cluster_service_account_gcr" {
7172
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7273
project = each.key
7374
role = "roles/storage.objectViewer"
74-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
75+
member = google_service_account.cluster_service_account[0].member
7576
}
7677

7778
resource "google_project_iam_member" "cluster_service_account_artifact_registry" {
7879
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7980
project = each.key
8081
role = "roles/artifactregistry.reader"
81-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
82+
member = google_service_account.cluster_service_account[0].member
8283
}
8384

8485
resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
8586
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
8687
project = each.key
8788
role = "roles/serviceusage.serviceUsageConsumer"
88-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
89+
member = google_service_account.cluster_service_account[0].member
8990
}
9091

9192
resource "google_project_service_identity" "fleet_project" {
@@ -99,5 +100,5 @@ resource "google_project_iam_member" "service_agent" {
99100
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
100101
project = var.project_id
101102
role = each.value
102-
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
103+
member = google_project_service_identity.fleet_project[0].member
103104
}

‎modules/beta-private-cluster-update-variant/sa.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_service_account" "cluster_service_account" {
4343
count = var.create_service_account ? 1 : 0
4444
project = var.project_id
4545
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
46-
display_name = "Terraform-managed service account for cluster ${var.name}"
46+
description = "Terraform-managed service account for cluster ${var.name}"
47+
display_name = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4748
}
4849

4950
resource "google_project_iam_member" "cluster_service_account_node_service_account" {
@@ -71,21 +72,21 @@ resource "google_project_iam_member" "cluster_service_account_gcr" {
7172
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7273
project = each.key
7374
role = "roles/storage.objectViewer"
74-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
75+
member = google_service_account.cluster_service_account[0].member
7576
}
7677

7778
resource "google_project_iam_member" "cluster_service_account_artifact_registry" {
7879
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7980
project = each.key
8081
role = "roles/artifactregistry.reader"
81-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
82+
member = google_service_account.cluster_service_account[0].member
8283
}
8384

8485
resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
8586
for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
8687
project = each.key
8788
role = "roles/serviceusage.serviceUsageConsumer"
88-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
89+
member = google_service_account.cluster_service_account[0].member
8990
}
9091

9192
resource "google_project_service_identity" "fleet_project" {
@@ -99,5 +100,5 @@ resource "google_project_iam_member" "service_agent" {
99100
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
100101
project = var.project_id
101102
role = each.value
102-
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
103+
member = google_project_service_identity.fleet_project[0].member
103104
}

‎modules/beta-private-cluster/sa.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_service_account" "cluster_service_account" {
4343
count = var.create_service_account ? 1 : 0
4444
project = var.project_id
4545
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
46-
display_name = "Terraform-managed service account for cluster ${var.name}"
46+
description = "Terraform-managed service account for cluster ${var.name}"
47+
display_name = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4748
}
4849

4950
resource "google_project_iam_member" "cluster_service_account_node_service_account" {
@@ -71,21 +72,21 @@ resource "google_project_iam_member" "cluster_service_account_gcr" {
7172
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7273
project = each.key
7374
role = "roles/storage.objectViewer"
74-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
75+
member = google_service_account.cluster_service_account[0].member
7576
}
7677

7778
resource "google_project_iam_member" "cluster_service_account_artifact_registry" {
7879
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7980
project = each.key
8081
role = "roles/artifactregistry.reader"
81-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
82+
member = google_service_account.cluster_service_account[0].member
8283
}
8384

8485
resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
8586
for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
8687
project = each.key
8788
role = "roles/serviceusage.serviceUsageConsumer"
88-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
89+
member = google_service_account.cluster_service_account[0].member
8990
}
9091

9192
resource "google_project_service_identity" "fleet_project" {
@@ -99,5 +100,5 @@ resource "google_project_iam_member" "service_agent" {
99100
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
100101
project = var.project_id
101102
role = each.value
102-
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
103+
member = google_project_service_identity.fleet_project[0].member
103104
}

‎modules/beta-public-cluster-update-variant/sa.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_service_account" "cluster_service_account" {
4343
count = var.create_service_account ? 1 : 0
4444
project = var.project_id
4545
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
46-
display_name = "Terraform-managed service account for cluster ${var.name}"
46+
description = "Terraform-managed service account for cluster ${var.name}"
47+
display_name = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4748
}
4849

4950
resource "google_project_iam_member" "cluster_service_account_node_service_account" {
@@ -71,21 +72,21 @@ resource "google_project_iam_member" "cluster_service_account_gcr" {
7172
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7273
project = each.key
7374
role = "roles/storage.objectViewer"
74-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
75+
member = google_service_account.cluster_service_account[0].member
7576
}
7677

7778
resource "google_project_iam_member" "cluster_service_account_artifact_registry" {
7879
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7980
project = each.key
8081
role = "roles/artifactregistry.reader"
81-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
82+
member = google_service_account.cluster_service_account[0].member
8283
}
8384

8485
resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
8586
for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
8687
project = each.key
8788
role = "roles/serviceusage.serviceUsageConsumer"
88-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
89+
member = google_service_account.cluster_service_account[0].member
8990
}
9091

9192
resource "google_project_service_identity" "fleet_project" {
@@ -99,5 +100,5 @@ resource "google_project_iam_member" "service_agent" {
99100
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
100101
project = var.project_id
101102
role = each.value
102-
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
103+
member = google_project_service_identity.fleet_project[0].member
103104
}

‎modules/beta-public-cluster/sa.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_service_account" "cluster_service_account" {
4343
count = var.create_service_account ? 1 : 0
4444
project = var.project_id
4545
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
46-
display_name = "Terraform-managed service account for cluster ${var.name}"
46+
description = "Terraform-managed service account for cluster ${var.name}"
47+
display_name = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4748
}
4849

4950
resource "google_project_iam_member" "cluster_service_account_node_service_account" {
@@ -71,21 +72,21 @@ resource "google_project_iam_member" "cluster_service_account_gcr" {
7172
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7273
project = each.key
7374
role = "roles/storage.objectViewer"
74-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
75+
member = google_service_account.cluster_service_account[0].member
7576
}
7677

7778
resource "google_project_iam_member" "cluster_service_account_artifact_registry" {
7879
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7980
project = each.key
8081
role = "roles/artifactregistry.reader"
81-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
82+
member = google_service_account.cluster_service_account[0].member
8283
}
8384

8485
resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
8586
for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
8687
project = each.key
8788
role = "roles/serviceusage.serviceUsageConsumer"
88-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
89+
member = google_service_account.cluster_service_account[0].member
8990
}
9091

9192
resource "google_project_service_identity" "fleet_project" {
@@ -99,5 +100,5 @@ resource "google_project_iam_member" "service_agent" {
99100
for_each = var.fleet_project_grant_service_agent ? toset(["roles/gkehub.serviceAgent", "roles/gkehub.crossProjectServiceAgent"]) : []
100101
project = var.project_id
101102
role = each.value
102-
member = "serviceAccount:${google_project_service_identity.fleet_project[0].email}"
103+
member = google_project_service_identity.fleet_project[0].member
103104
}

‎modules/private-cluster-update-variant/sa.tf‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_service_account" "cluster_service_account" {
4343
count = var.create_service_account ? 1 : 0
4444
project = var.project_id
4545
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
46-
display_name = "Terraform-managed service account for cluster ${var.name}"
46+
description = "Terraform-managed service account for cluster ${var.name}"
47+
display_name = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4748
}
4849

4950
resource "google_project_iam_member" "cluster_service_account_node_service_account" {
@@ -71,19 +72,19 @@ resource "google_project_iam_member" "cluster_service_account_gcr" {
7172
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7273
project = each.key
7374
role = "roles/storage.objectViewer"
74-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
75+
member = google_service_account.cluster_service_account[0].member
7576
}
7677

7778
resource "google_project_iam_member" "cluster_service_account_artifact_registry" {
7879
for_each = var.create_service_account && var.grant_registry_access ? toset(local.registry_projects_list) : []
7980
project = each.key
8081
role = "roles/artifactregistry.reader"
81-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
82+
member = google_service_account.cluster_service_account[0].member
8283
}
8384

8485
resource "google_project_iam_member" "cluster_service_account_service_usage_consumer" {
8586
for_each = var.create_service_account && var.grant_registry_access && var.enable_gcfs ? toset(local.registry_projects_list) : []
8687
project = each.key
8788
role = "roles/serviceusage.serviceUsageConsumer"
88-
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
89+
member = google_service_account.cluster_service_account[0].member
8990
}

0 commit comments

Comments
 (0)