From 203a0f6bd3959ada7ac7b9210787d53e86ec709c Mon Sep 17 00:00:00 2001 From: Florin Hillebrand Date: Thu, 17 Oct 2024 08:51:13 +0200 Subject: [PATCH 1/3] fix: Add create_ignore_already_exists to workload_identity (#2141) --- modules/workload-identity/README.md | 1 + modules/workload-identity/main.tf | 9 +++++---- modules/workload-identity/variables.tf | 6 ++++++ 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/modules/workload-identity/README.md b/modules/workload-identity/README.md index d11a8dbb71..11ea26f844 100644 --- a/modules/workload-identity/README.md +++ b/modules/workload-identity/README.md @@ -148,6 +148,7 @@ Error: Get "http://localhost/api/v1/namespaces/default/serviceaccounts/your-serv | annotate\_k8s\_sa | Annotate the kubernetes service account with 'iam.gke.io/gcp-service-account' annotation. Valid in cases when an existing SA is used. | `bool` | `true` | no | | automount\_service\_account\_token | Enable automatic mounting of the service account token | `bool` | `false` | no | | cluster\_name | Cluster name. Required if using existing KSA. | `string` | `""` | no | +| create\_ignore\_already\_exists | If set to true, skip service account creation if a service account with the same email already exists. | `bool` | `false` | no | | gcp\_sa\_description | The Service Google service account desciption; if null, will be left out | `string` | `null` | no | | gcp\_sa\_display\_name | The Google service account display name; if null, a default string will be used | `string` | `null` | no | | gcp\_sa\_name | Name for the Google service account; overrides `var.name`. | `string` | `null` | no | diff --git a/modules/workload-identity/main.tf b/modules/workload-identity/main.tf index 2c2d278ae3..caa38fe424 100644 --- a/modules/workload-identity/main.tf +++ b/modules/workload-identity/main.tf @@ -42,10 +42,11 @@ data "google_service_account" "cluster_service_account" { resource "google_service_account" "cluster_service_account" { count = var.use_existing_gcp_sa ? 0 : 1 - account_id = local.gcp_given_name - display_name = coalesce(var.gcp_sa_display_name, substr("GCP SA bound to K8S SA ${local.k8s_sa_project_id}[${local.k8s_given_name}]", 0, 100)) - description = var.gcp_sa_description - project = var.project_id + account_id = local.gcp_given_name + display_name = coalesce(var.gcp_sa_display_name, substr("GCP SA bound to K8S SA ${local.k8s_sa_project_id}[${local.k8s_given_name}]", 0, 100)) + description = var.gcp_sa_description + project = var.project_id + create_ignore_already_exists = var.create_ignore_already_exists } resource "kubernetes_service_account" "main" { diff --git a/modules/workload-identity/variables.tf b/modules/workload-identity/variables.tf index 32b1c861dc..00cf782e48 100644 --- a/modules/workload-identity/variables.tf +++ b/modules/workload-identity/variables.tf @@ -137,3 +137,9 @@ variable "gcp_sa_description" { error_message = "The Google service account description must be at most 256 characters" } } + +variable "create_ignore_already_exists" { + description = "If set to true, skip service account creation if a service account with the same email already exists." + type = bool + default = false +} From da2facf173f2df4e5a3abbaeb52465cdce570d51 Mon Sep 17 00:00:00 2001 From: Florin Hillebrand Date: Fri, 25 Oct 2024 18:09:51 +0200 Subject: [PATCH 2/3] sq null default --- modules/workload-identity/variables.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/workload-identity/variables.tf b/modules/workload-identity/variables.tf index 00cf782e48..9d8f457584 100644 --- a/modules/workload-identity/variables.tf +++ b/modules/workload-identity/variables.tf @@ -141,5 +141,5 @@ variable "gcp_sa_description" { variable "create_ignore_already_exists" { description = "If set to true, skip service account creation if a service account with the same email already exists." type = bool - default = false + default = null } From 0d69fc7a4240f486355c99f14021ce9a7e272b2a Mon Sep 17 00:00:00 2001 From: Florin Hillebrand Date: Fri, 25 Oct 2024 18:10:16 +0200 Subject: [PATCH 3/3] sq add gcp_sa_ prefix --- modules/workload-identity/README.md | 2 +- modules/workload-identity/main.tf | 2 +- modules/workload-identity/variables.tf | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/workload-identity/README.md b/modules/workload-identity/README.md index 11ea26f844..d7e374ad6e 100644 --- a/modules/workload-identity/README.md +++ b/modules/workload-identity/README.md @@ -148,7 +148,7 @@ Error: Get "http://localhost/api/v1/namespaces/default/serviceaccounts/your-serv | annotate\_k8s\_sa | Annotate the kubernetes service account with 'iam.gke.io/gcp-service-account' annotation. Valid in cases when an existing SA is used. | `bool` | `true` | no | | automount\_service\_account\_token | Enable automatic mounting of the service account token | `bool` | `false` | no | | cluster\_name | Cluster name. Required if using existing KSA. | `string` | `""` | no | -| create\_ignore\_already\_exists | If set to true, skip service account creation if a service account with the same email already exists. | `bool` | `false` | no | +| gcp\_sa\_create\_ignore\_already\_exists | If set to true, skip service account creation if a service account with the same email already exists. | `bool` | `null` | no | | gcp\_sa\_description | The Service Google service account desciption; if null, will be left out | `string` | `null` | no | | gcp\_sa\_display\_name | The Google service account display name; if null, a default string will be used | `string` | `null` | no | | gcp\_sa\_name | Name for the Google service account; overrides `var.name`. | `string` | `null` | no | diff --git a/modules/workload-identity/main.tf b/modules/workload-identity/main.tf index caa38fe424..eaa9a0b47d 100644 --- a/modules/workload-identity/main.tf +++ b/modules/workload-identity/main.tf @@ -46,7 +46,7 @@ resource "google_service_account" "cluster_service_account" { display_name = coalesce(var.gcp_sa_display_name, substr("GCP SA bound to K8S SA ${local.k8s_sa_project_id}[${local.k8s_given_name}]", 0, 100)) description = var.gcp_sa_description project = var.project_id - create_ignore_already_exists = var.create_ignore_already_exists + create_ignore_already_exists = var.gcp_sa_create_ignore_already_exists } resource "kubernetes_service_account" "main" { diff --git a/modules/workload-identity/variables.tf b/modules/workload-identity/variables.tf index 9d8f457584..c773126532 100644 --- a/modules/workload-identity/variables.tf +++ b/modules/workload-identity/variables.tf @@ -138,7 +138,7 @@ variable "gcp_sa_description" { } } -variable "create_ignore_already_exists" { +variable "gcp_sa_create_ignore_already_exists" { description = "If set to true, skip service account creation if a service account with the same email already exists." type = bool default = null