Fix subnet iam_bindings to use arbitrary keys
This commit is contained in:
Julio Castillo
parent
0221198b2f
commit
616c6fbc48
|
|
@ -118,8 +118,9 @@ module "vpc" {
|
|||
]
|
||||
}
|
||||
iam_bindings = {
|
||||
"roles/compute.networkUser" = {
|
||||
subnet-1-iam = {
|
||||
members = ["group:group2@example.com"]
|
||||
role = "roles/compute.networkUser"
|
||||
condition = {
|
||||
expression = "resource.matchTag('123456789012/env', 'prod')"
|
||||
title = "test_condition"
|
||||
|
|
@ -132,7 +133,7 @@ module "vpc" {
|
|||
region = "europe-west1"
|
||||
ip_cidr_range = "10.0.1.0/24"
|
||||
iam_bindings_additive = {
|
||||
subnet-2-am1 = {
|
||||
subnet-2-iam = {
|
||||
member = "user:am1@example.com"
|
||||
role = "roles/compute.networkUser"
|
||||
subnet = "europe-west1/subnet-2"
|
||||
|
|
@ -553,10 +554,10 @@ module "vpc" {
|
|||
| [routing_mode](variables.tf#L147) | The network routing mode (default 'GLOBAL'). | <code>string</code> | | <code>"GLOBAL"</code> |
|
||||
| [shared_vpc_host](variables.tf#L157) | Enable shared VPC for this project. | <code>bool</code> | | <code>false</code> |
|
||||
| [shared_vpc_service_projects](variables.tf#L163) | Shared VPC service projects to register with this host. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [subnets](variables.tf#L169) | Subnet configuration. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) enable_private_access = optional(bool, true) flow_logs_config = optional(object({ aggregation_interval = optional(string) filter_expression = optional(string) flow_sampling = optional(number) metadata = optional(string) metadata_fields = optional(list(string)) })) ipv6 = optional(object({ access_type = optional(string, "INTERNAL") })) secondary_ip_ranges = optional(map(string)) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_proxy_only](variables.tf#L215) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) active = optional(bool, true) global = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_psc](variables.tf#L248) | List of subnets for Private Service Connect service producers. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [vpc_create](variables.tf#L279) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
|
||||
| [subnets](variables.tf#L169) | Subnet configuration. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) enable_private_access = optional(bool, true) flow_logs_config = optional(object({ aggregation_interval = optional(string) filter_expression = optional(string) flow_sampling = optional(number) metadata = optional(string) metadata_fields = optional(list(string)) })) ipv6 = optional(object({ access_type = optional(string, "INTERNAL") })) secondary_ip_ranges = optional(map(string)) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_proxy_only](variables.tf#L216) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) active = optional(bool, true) global = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_psc](variables.tf#L250) | List of subnets for Private Service Connect service producers. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [vpc_create](variables.tf#L282) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
|
|||
|
|
@ -36,36 +36,37 @@ locals {
|
|||
} : null
|
||||
global = try(v.global, false)
|
||||
ip_cidr_range = v.ip_cidr_range
|
||||
ipv6 = can(v.ipv6) ? {
|
||||
ipv6 = !can(v.ipv6) ? null : {
|
||||
access_type = try(v.ipv6.access_type, "INTERNAL")
|
||||
} : null
|
||||
}
|
||||
name = try(v.name, k)
|
||||
region = v.region
|
||||
secondary_ip_ranges = try(v.secondary_ip_ranges, null)
|
||||
iam = try(v.iam, {})
|
||||
iam_bindings = can(v.iam_bindings) ? {
|
||||
iam_bindings = !can(v.iam_bindings) ? {} : {
|
||||
for k2, v2 in v.iam_bindings :
|
||||
k2 => {
|
||||
role = v2.role
|
||||
members = v2.members
|
||||
condition = can(v2.condition) ? {
|
||||
condition = !can(v2.condition) ? null : {
|
||||
expression = v2.condition.expression
|
||||
title = v2.condition.title
|
||||
description = try(v2.condition.description, null)
|
||||
} : null
|
||||
}
|
||||
}
|
||||
} : {}
|
||||
iam_bindings_additive = can(v.iam_bindings_additive) ? {
|
||||
}
|
||||
iam_bindings_additive = !can(v.iam_bindings_additive) ? {} : {
|
||||
for k2, v2 in v.iam_bindings_additive :
|
||||
k2 => {
|
||||
member = v2.member
|
||||
role = v2.role
|
||||
condition = can(v2.condition) ? {
|
||||
condition = !can(v2.condition) ? null : {
|
||||
expression = v2.condition.expression
|
||||
title = v2.condition.title
|
||||
description = try(v2.condition.description, null)
|
||||
} : null
|
||||
}
|
||||
}
|
||||
} : {}
|
||||
}
|
||||
_is_regular = !try(v.psc == true, false) && !try(v.proxy_only == true, false)
|
||||
_is_psc = try(v.psc == true, false)
|
||||
_is_proxy_only = try(v.proxy_only == true, false)
|
||||
|
|
@ -89,16 +90,17 @@ locals {
|
|||
]
|
||||
],
|
||||
))
|
||||
subnet_iam_bindings = flatten([
|
||||
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [
|
||||
for role, data in s.iam_bindings : {
|
||||
role = role
|
||||
subnet_iam_bindings = merge([
|
||||
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : {
|
||||
for key, data in s.iam_bindings :
|
||||
key => {
|
||||
role = data.role
|
||||
subnet = "${s.region}/${s.name}"
|
||||
members = data.members
|
||||
condition = data.condition
|
||||
}
|
||||
]
|
||||
])
|
||||
}
|
||||
]...)
|
||||
# note: all additive bindings share a single namespace for the key.
|
||||
# In other words, if you have multiple additive bindings with the
|
||||
# same name, only one will be used
|
||||
|
|
@ -210,10 +212,7 @@ resource "google_compute_subnetwork_iam_binding" "authoritative" {
|
|||
}
|
||||
|
||||
resource "google_compute_subnetwork_iam_binding" "bindings" {
|
||||
for_each = {
|
||||
for binding in local.subnet_iam_bindings :
|
||||
"${binding.subnet}.${binding.role}.${try(binding.condition.title, "")}" => binding
|
||||
}
|
||||
for_each = local.subnet_iam_bindings
|
||||
project = var.project_id
|
||||
subnetwork = local.all_subnets[each.value.subnet].name
|
||||
region = local.all_subnets[each.value.subnet].region
|
||||
|
|
|
|||
|
|
@ -191,6 +191,7 @@ variable "subnets" {
|
|||
|
||||
iam = optional(map(list(string)), {})
|
||||
iam_bindings = optional(map(object({
|
||||
role = string
|
||||
members = list(string)
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
|
|
@ -224,6 +225,7 @@ variable "subnets_proxy_only" {
|
|||
|
||||
iam = optional(map(list(string)), {})
|
||||
iam_bindings = optional(map(object({
|
||||
role = string
|
||||
members = list(string)
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
|
|
@ -255,6 +257,7 @@ variable "subnets_psc" {
|
|||
|
||||
iam = optional(map(list(string)), {})
|
||||
iam_bindings = optional(map(object({
|
||||
role = string
|
||||
members = list(string)
|
||||
condition = optional(object({
|
||||
expression = string
|
||||
|
|
|
|||
|
|
@ -80,7 +80,7 @@ values:
|
|||
region: europe-west1
|
||||
role: roles/compute.networkUser
|
||||
subnetwork: subnet-1
|
||||
module.vpc.google_compute_subnetwork_iam_binding.bindings["europe-west1/subnet-1.roles/compute.networkUser.test_condition"]:
|
||||
module.vpc.google_compute_subnetwork_iam_binding.bindings["subnet-1-iam"]:
|
||||
condition:
|
||||
- description: null
|
||||
expression: resource.matchTag('123456789012/env', 'prod')
|
||||
|
|
|
|||
Loading…
Reference in New Issue