Skip to content

Allow to set a different universe than GCP #1026

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ybelleguic wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Allow to set a different universe than GCP #1026

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@ module "project-factory" {
tag_binding_values = var.tag_binding_values
cloud_armor_tier = var.cloud_armor_tier
deletion_policy = var.deletion_policy
universe_subdomain = var.universe_subdomain
}

/******************************************
Expand All @@ -89,6 +90,7 @@ module "shared_vpc_access" {
lookup_project_numbers = false
grant_services_security_admin_role = var.grant_services_security_admin_role
grant_network_role = var.grant_network_role
universe_subdomain = var.universe_subdomain
# Workaround for import complaining about count cannot determine resource instances
# until apply. https://github.com/hashicorp/terraform/issues/24690
depends_on = [module.project-factory.enabled_apis]
Expand Down
8 changes: 5 additions & 3 deletions modules/core_project_factory/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,10 +46,12 @@ locals {
"serviceAccount:%s",
try(google_service_account.default_service_account[0].email, ""),
) : ""
api_s_account = format(
"%s@cloudservices.gserviceaccount.com",
google_project.main.number,
api_s_account = (
var.universe_subdomain != null ?
"${google_project.main.number}@cloudservices.${var.universe_subdomain}.iam.gserviceaccount.com" :
"${google_project.main.number}@cloudservices.gserviceaccount.com"
)

activate_apis = var.activate_apis
api_s_account_fmt = format("serviceAccount:%s", local.api_s_account)
project_bucket_name = var.bucket_name != "" ? var.bucket_name : format("%s-state", local.temp_project_id)
Expand Down
6 changes: 6 additions & 0 deletions modules/core_project_factory/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -288,3 +288,9 @@ variable "deletion_policy" {
type = string
default = "PREVENT"
}

variable "universe_subdomain" {
description = "When using a different universe than GCP (e.g s3ns), service accounts don't have the same domain. If set, the universe subdomain will be injected into the service accounts"
type = string
default = null
}
1 change: 1 addition & 0 deletions modules/gsuite_enabled/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,7 @@ module "project-factory" {
default_service_account = var.default_service_account
disable_dependent_services = var.disable_dependent_services
default_network_tier = var.default_network_tier
universe_subdomain = var.universe_subdomain
}

/******************************************
Expand Down
6 changes: 6 additions & 0 deletions modules/gsuite_enabled/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,3 +244,9 @@ variable "default_network_tier" {
type = string
default = ""
}

variable "universe_subdomain" {
description = "When using a different universe than GCP (e.g s3ns), service accounts don't have the same domain. If set, the universe subdomain will be injected into the service accounts"
type = string
default = null
}
29 changes: 15 additions & 14 deletions modules/shared_vpc_access/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,53 +21,54 @@ data "google_project" "service_project" {

locals {
service_project_number = var.lookup_project_numbers ? data.google_project.service_project[0].number : var.service_project_number
universe_subdomain = var.universe_subdomain != null ? "${var.universe_subdomain}." : ""
apis = {
"container.googleapis.com" : {
service_account = format("service-%s@container-engine-robot.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@container-engine-robot.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkUser"
}
"dataproc.googleapis.com" : {
service_account = format("service-%s@dataproc-accounts.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@dataproc-accounts.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkUser"
},
"dataflow.googleapis.com" : {
service_account = format("service-%s@dataflow-service-producer-prod.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@dataflow-service-producter-prod.${local.universe_subdomain}iam.gserviceaccount.com"
Copy link

@gemini-code-assist gemini-code-assist bot Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

There is a typo in the Dataflow service account name. producter should be producer.

      service_account = "service-${local.service_project_number}@dataflow-service-producer-prod.${local.universe_subdomain}iam.gserviceaccount.com"

role = "roles/compute.networkUser"
},
"datafusion.googleapis.com" : {
service_account = format("service-%s@gcp-sa-datafusion.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@gcp-sa-datafusion.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkViewer"
},
"composer.googleapis.com" : {
service_account = format("service-%s@cloudcomposer-accounts.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@cloudcomposer-accounts.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkUser"
}
"vpcaccess.googleapis.com" : {
service_account = format("service-%s@gcp-sa-vpcaccess.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@gcp-sa-vpcaccess.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkUser"
}
"datastream.googleapis.com" : {
service_account = format("service-%s@gcp-sa-datastream.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@gcp-sa-datastream.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkUser"
}
"notebooks.googleapis.com" : {
service_account = format("service-%s@gcp-sa-notebooks.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@gcp-sa-notebooks.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkUser"
}
"networkconnectivity.googleapis.com" : {
service_account = format("service-%s@gcp-sa-networkconnectivity.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@gcp-sa-networkconnectivity.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkUser"
}
"run.googleapis.com" : {
service_account = format("service-%s@serverless-robot-prod.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@serverless-robot-prod.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkUser"
}
"aiplatform.googleapis.com" : {
service_account = format("service-%s@gcp-sa-aiplatform.iam.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@gcp-sa-aiplatform.${local.universe_subdomain}iam.gserviceaccount.com"
role = "roles/compute.networkUser"
}
"cloudbuild.googleapis.com" : {
service_account = format("%s@cloudbuild.gserviceaccount.com", local.service_project_number)
service_account = "service-${local.service_project_number}@cloudbuild.${local.universe_subdomain}gserviceaccount.com"
Copy link

@gemini-code-assist gemini-code-assist bot Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The format for the Cloud Build service account appears to be incorrect. The service- prefix is not part of the standard [PROJECT_NUMBER]@cloudbuild.gserviceaccount.com service account. This change mixes the legacy service account format with the service agent format and will likely result in an invalid service account email. Please remove the service- prefix.

      service_account = "${local.service_project_number}@cloudbuild.${local.universe_subdomain}gserviceaccount.com"

role = "roles/compute.networkUser"
}
}
Expand Down Expand Up @@ -143,7 +144,7 @@ resource "google_compute_subnetwork_iam_member" "cloudservices_shared_vpc_subnet
index(split("/", split(",", local.subnetwork_api[count.index])[1]), "regions") + 1,
)
project = var.host_project_id
member = format("serviceAccount:%s@cloudservices.gserviceaccount.com", local.service_project_number)
member = "serviceAccount:${local.service_project_number}@cloudservices.${local.universe_subdomain}gserviceaccount.com"
Copy link

@gemini-code-assist gemini-code-assist bot Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The construction of the cloudservices service account email for universe domains is inconsistent with the implementation in modules/core_project_factory/main.tf. It's missing the .iam part of the domain for universe configurations. This will lead to an incorrect service account email when a universe_subdomain is specified.

  member  = "serviceAccount:${local.service_project_number}@cloudservices.${local.universe_subdomain}${var.universe_subdomain != null ? "iam." : ""}gserviceaccount.com"

}

/******************************************
Expand Down Expand Up @@ -228,7 +229,7 @@ resource "google_project_iam_member" "managed_kafka_service_agent" {
count = local.managedkafka_shared_vpc_enabled && var.enable_shared_vpc_service_project && var.grant_network_role ? 1 : 0
project = var.host_project_id
role = "roles/managedkafka.serviceAgent"
member = format("serviceAccount:service-%s@gcp-sa-managedkafka.iam.gserviceaccount.com", local.service_project_number)
member = "serviceAccount:service-${local.service_project_number}@gcp-sa-managedkafka.${local.universe_subdomain}iam.gserviceaccount.com"
}

/******************************************
Expand Down
6 changes: 6 additions & 0 deletions modules/shared_vpc_access/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,3 +70,9 @@ variable "grant_network_role" {
type = bool
default = true
}

variable "universe_subdomain" {
description = "When using a different universe than GCP (e.g s3ns), service accounts don't have the same domain. If set, the universe subdomain will be injected into the service accounts"
type = string
default = null
}
2 changes: 2 additions & 0 deletions modules/svpc_service_project/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ module "project-factory" {
disable_dependent_services = var.disable_dependent_services
default_network_tier = var.default_network_tier
deletion_policy = var.deletion_policy
universe_subdomain = var.universe_subdomain
}

/******************************************
Expand All @@ -76,6 +77,7 @@ module "shared_vpc_access" {
lookup_project_numbers = false
grant_services_security_admin_role = var.grant_services_security_admin_role
grant_network_role = var.grant_network_role
universe_subdomain = var.universe_subdomain
# Workaround for import complaining about count cannot determine resource instances
# until apply. https://github.com/hashicorp/terraform/issues/24690
depends_on = [module.project-factory.enabled_apis]
Expand Down
6 changes: 6 additions & 0 deletions modules/svpc_service_project/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -234,3 +234,9 @@ variable "deletion_policy" {
type = string
default = "PREVENT"
}

variable "universe_subdomain" {
description = "When using a different universe than GCP (e.g s3ns), service accounts don't have the same domain. If set, the universe subdomain will be injected into the service accounts"
type = string
default = null
}
6 changes: 6 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,3 +377,9 @@ variable "deletion_policy" {
type = string
default = "PREVENT"
}

variable "universe_subdomain" {
description = "When using a different universe than GCP (e.g s3ns), service accounts don't have the same domain. If set, the universe subdomain will be injected into the service accounts"
type = string
default = null
}