3-fleetscope/modules/env_baseline/acm.tf (77 lines of code) (raw):
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
locals {
cluster_membership_ids = { for k, v in var.cluster_membership_ids : k => v }
use_csr = var.config_sync_secret_type == "gcpserviceaccount"
}
data "google_project" "cluster_project" {
project_id = var.cluster_project_id
}
resource "google_sourcerepo_repository" "acm_repo" {
count = local.use_csr ? 1 : 0
project = var.cluster_project_id
name = "eab-acm"
create_ignore_already_exists = true
}
resource "google_service_account" "root_reconciler" {
count = local.use_csr ? 1 : 0
project = var.cluster_project_id
account_id = "root-reconciler"
display_name = "root-reconciler"
create_ignore_already_exists = true
}
resource "google_project_iam_member" "root_reconciler" {
count = local.use_csr ? 1 : 0
project = var.cluster_project_id
role = "roles/source.reader"
member = "serviceAccount:${google_service_account.root_reconciler[0].email}"
}
resource "google_service_account_iam_member" "workload_identity" {
count = local.use_csr ? 1 : 0
service_account_id = google_service_account.root_reconciler[0].name
role = "roles/iam.workloadIdentityUser"
member = "serviceAccount:${var.cluster_project_id}.svc.id.goog[config-management-system/root-reconciler]"
}
resource "google_gke_hub_feature" "acm_feature" {
name = "configmanagement"
project = var.cluster_project_id
location = "global"
}
resource "google_gke_hub_feature_membership" "acm_feature_member" {
for_each = local.cluster_membership_ids
project = var.cluster_project_id
location = "global"
feature = google_gke_hub_feature.acm_feature.name
membership = regex(local.membership_re, each.value)[2]
membership_location = regex(local.membership_re, each.value)[1]
configmanagement {
version = "1.19.0"
config_sync {
enabled = true
source_format = "unstructured"
git {
sync_repo = local.use_csr ? google_sourcerepo_repository.acm_repo[0].url : var.config_sync_repository_url
secret_type = var.config_sync_secret_type
gcp_service_account_email = local.use_csr ? google_service_account.root_reconciler[0].email : null
policy_dir = var.config_sync_policy_dir
sync_branch = var.config_sync_branch
}
}
}
depends_on = [
google_gke_hub_feature.acm_feature
]
}