zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

shared vpc roles

This commit is contained in:
Ludovico Magnocavallo 2022-02-10 15:24:29 +01:00
parent c05db9c661
commit 5019531c8b
1 changed files with 37 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
examples/data-solutions/data-platform-foundations/main.tf
View File

@ -15,6 +15,20 @@
# tfdoc:file:description Core locals. # tfdoc:file:description Core locals.
locals { locals {
# we cannot reference service accounts directly as they are dynamic
_shared_vpc_bindings = {
"roles/compute.networkUser" = [
"load-robot-df", "load-sa-df-worker",
"orch-cloudservices", "orch-robot-df", "orch-robot-gke",
"transf-robot-df", "transf-sa-df-worker",
]
"roles/composer.sharedVpcAgent" = [
"orch-robot-cs"
]
"roles/container.hostServiceAgentUser" = [
"orch-robot-df"
]
}
groups = { groups = {
for k, v in var.groups : k => "${v}@${var.organization_domain}" for k, v in var.groups : k => "${v}@${var.organization_domain}"
} }
@ -23,33 +37,31 @@ locals {
} }
service_encryption_keys = var.service_encryption_keys service_encryption_keys = var.service_encryption_keys
shared_vpc_project = try(var.network_config.host_project, null) shared_vpc_project = try(var.network_config.host_project, null)
shared_vpc_roles = { # this is needed so that for_each only uses static values
"roles/compute.networkUser" = [ shared_vpc_role_members = {
# load Dataflow service agent and worker service account load-robot-df = module.load-project.service_accounts.robots.dataflow
module.load-project.service_accounts.robots.dataflow, load-sa-df-worker = module.load-sa-df-0.iam_email
module.load-sa-df-0.iam_email, orch-cloudservices = module.orch-project.service_accounts.cloud_services
module.transf-project.service_accounts.robots.dataflow, orch-robot-cs = module.orch-project.service_accounts.robots.composer
module.transf-sa-df-0.iam_email, orch-robot-df = module.orch-project.service_accounts.robots.dataflow
# orchestration Composer service agents orch-robot-gke = module.orch-project.service_accounts.robots.container-engine
module.orch-project.service_accounts.cloud_services, transf-robot-df = module.transf-project.service_accounts.robots.dataflow
module.orch-project.service_accounts.robots.container-engine, transf-sa-df-worker = module.transf-sa-df-0.iam_email
module.orch-project.service_accounts.robots.dataflow, }
], # reassemble in a format suitable for for_each
"roles/composer.sharedVpcAgent" = [ shared_vpc_bindings_map = {
# orchestration Composer service agent for binding in flatten([
module.orch-project.service_accounts.robots.composer for role, members in local._shared_vpc_bindings : [
], for member in members : { role = role, member = member }
"roles/container.hostServiceAgentUser" = [ ]
# orchestration Composer service agents ]) : "${binding.role}-${binding.member}" => binding
module.orch-project.service_accounts.robots.dataflow,
]
} }
use_shared_vpc = var.network_config != null use_shared_vpc = var.network_config != null
} }
resource "google_project_iam_binding" "shared_vpc_roles" { resource "google_project_iam_member" "shared_vpc" {
for_each = local.use_shared_vpc ? null : local.shared_vpc_roles for_each = local.use_shared_vpc ? local.shared_vpc_bindings_map : {}
project = try(var.network_config.host_project, null) project = var.network_config.host_project
role = each.key role = each.value.role
members = each.value member = lookup(local.shared_vpc_role_members, each.value.member)
} }