Fix subnet iam_bindings to use arbitrary keys
This commit is contained in:
parent
0221198b2f
commit
616c6fbc48
|
@ -118,8 +118,9 @@ module "vpc" {
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
iam_bindings = {
|
iam_bindings = {
|
||||||
"roles/compute.networkUser" = {
|
subnet-1-iam = {
|
||||||
members = ["group:group2@example.com"]
|
members = ["group:group2@example.com"]
|
||||||
|
role = "roles/compute.networkUser"
|
||||||
condition = {
|
condition = {
|
||||||
expression = "resource.matchTag('123456789012/env', 'prod')"
|
expression = "resource.matchTag('123456789012/env', 'prod')"
|
||||||
title = "test_condition"
|
title = "test_condition"
|
||||||
|
@ -132,7 +133,7 @@ module "vpc" {
|
||||||
region = "europe-west1"
|
region = "europe-west1"
|
||||||
ip_cidr_range = "10.0.1.0/24"
|
ip_cidr_range = "10.0.1.0/24"
|
||||||
iam_bindings_additive = {
|
iam_bindings_additive = {
|
||||||
subnet-2-am1 = {
|
subnet-2-iam = {
|
||||||
member = "user:am1@example.com"
|
member = "user:am1@example.com"
|
||||||
role = "roles/compute.networkUser"
|
role = "roles/compute.networkUser"
|
||||||
subnet = "europe-west1/subnet-2"
|
subnet = "europe-west1/subnet-2"
|
||||||
|
@ -553,10 +554,10 @@ module "vpc" {
|
||||||
| [routing_mode](variables.tf#L147) | The network routing mode (default 'GLOBAL'). | <code>string</code> | | <code>"GLOBAL"</code> |
|
| [routing_mode](variables.tf#L147) | The network routing mode (default 'GLOBAL'). | <code>string</code> | | <code>"GLOBAL"</code> |
|
||||||
| [shared_vpc_host](variables.tf#L157) | Enable shared VPC for this project. | <code>bool</code> | | <code>false</code> |
|
| [shared_vpc_host](variables.tf#L157) | Enable shared VPC for this project. | <code>bool</code> | | <code>false</code> |
|
||||||
| [shared_vpc_service_projects](variables.tf#L163) | Shared VPC service projects to register with this host. | <code>list(string)</code> | | <code>[]</code> |
|
| [shared_vpc_service_projects](variables.tf#L163) | Shared VPC service projects to register with this host. | <code>list(string)</code> | | <code>[]</code> |
|
||||||
| [subnets](variables.tf#L169) | Subnet configuration. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) enable_private_access = optional(bool, true) flow_logs_config = optional(object({ aggregation_interval = optional(string) filter_expression = optional(string) flow_sampling = optional(number) metadata = optional(string) metadata_fields = optional(list(string)) })) ipv6 = optional(object({ access_type = optional(string, "INTERNAL") })) secondary_ip_ranges = optional(map(string)) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
| [subnets](variables.tf#L169) | Subnet configuration. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) enable_private_access = optional(bool, true) flow_logs_config = optional(object({ aggregation_interval = optional(string) filter_expression = optional(string) flow_sampling = optional(number) metadata = optional(string) metadata_fields = optional(list(string)) })) ipv6 = optional(object({ access_type = optional(string, "INTERNAL") })) secondary_ip_ranges = optional(map(string)) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||||
| [subnets_proxy_only](variables.tf#L215) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) active = optional(bool, true) global = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
| [subnets_proxy_only](variables.tf#L216) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) active = optional(bool, true) global = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||||
| [subnets_psc](variables.tf#L248) | List of subnets for Private Service Connect service producers. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
| [subnets_psc](variables.tf#L250) | List of subnets for Private Service Connect service producers. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||||
| [vpc_create](variables.tf#L279) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
|
| [vpc_create](variables.tf#L282) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
|
|
||||||
|
|
|
@ -36,36 +36,37 @@ locals {
|
||||||
} : null
|
} : null
|
||||||
global = try(v.global, false)
|
global = try(v.global, false)
|
||||||
ip_cidr_range = v.ip_cidr_range
|
ip_cidr_range = v.ip_cidr_range
|
||||||
ipv6 = can(v.ipv6) ? {
|
ipv6 = !can(v.ipv6) ? null : {
|
||||||
access_type = try(v.ipv6.access_type, "INTERNAL")
|
access_type = try(v.ipv6.access_type, "INTERNAL")
|
||||||
} : null
|
}
|
||||||
name = try(v.name, k)
|
name = try(v.name, k)
|
||||||
region = v.region
|
region = v.region
|
||||||
secondary_ip_ranges = try(v.secondary_ip_ranges, null)
|
secondary_ip_ranges = try(v.secondary_ip_ranges, null)
|
||||||
iam = try(v.iam, {})
|
iam = try(v.iam, {})
|
||||||
iam_bindings = can(v.iam_bindings) ? {
|
iam_bindings = !can(v.iam_bindings) ? {} : {
|
||||||
for k2, v2 in v.iam_bindings :
|
for k2, v2 in v.iam_bindings :
|
||||||
k2 => {
|
k2 => {
|
||||||
|
role = v2.role
|
||||||
members = v2.members
|
members = v2.members
|
||||||
condition = can(v2.condition) ? {
|
condition = !can(v2.condition) ? null : {
|
||||||
expression = v2.condition.expression
|
expression = v2.condition.expression
|
||||||
title = v2.condition.title
|
title = v2.condition.title
|
||||||
description = try(v2.condition.description, null)
|
description = try(v2.condition.description, null)
|
||||||
} : null
|
}
|
||||||
}
|
}
|
||||||
} : {}
|
}
|
||||||
iam_bindings_additive = can(v.iam_bindings_additive) ? {
|
iam_bindings_additive = !can(v.iam_bindings_additive) ? {} : {
|
||||||
for k2, v2 in v.iam_bindings_additive :
|
for k2, v2 in v.iam_bindings_additive :
|
||||||
k2 => {
|
k2 => {
|
||||||
member = v2.member
|
member = v2.member
|
||||||
role = v2.role
|
role = v2.role
|
||||||
condition = can(v2.condition) ? {
|
condition = !can(v2.condition) ? null : {
|
||||||
expression = v2.condition.expression
|
expression = v2.condition.expression
|
||||||
title = v2.condition.title
|
title = v2.condition.title
|
||||||
description = try(v2.condition.description, null)
|
description = try(v2.condition.description, null)
|
||||||
} : null
|
}
|
||||||
}
|
}
|
||||||
} : {}
|
}
|
||||||
_is_regular = !try(v.psc == true, false) && !try(v.proxy_only == true, false)
|
_is_regular = !try(v.psc == true, false) && !try(v.proxy_only == true, false)
|
||||||
_is_psc = try(v.psc == true, false)
|
_is_psc = try(v.psc == true, false)
|
||||||
_is_proxy_only = try(v.proxy_only == true, false)
|
_is_proxy_only = try(v.proxy_only == true, false)
|
||||||
|
@ -89,16 +90,17 @@ locals {
|
||||||
]
|
]
|
||||||
],
|
],
|
||||||
))
|
))
|
||||||
subnet_iam_bindings = flatten([
|
subnet_iam_bindings = merge([
|
||||||
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [
|
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : {
|
||||||
for role, data in s.iam_bindings : {
|
for key, data in s.iam_bindings :
|
||||||
role = role
|
key => {
|
||||||
|
role = data.role
|
||||||
subnet = "${s.region}/${s.name}"
|
subnet = "${s.region}/${s.name}"
|
||||||
members = data.members
|
members = data.members
|
||||||
condition = data.condition
|
condition = data.condition
|
||||||
}
|
}
|
||||||
]
|
}
|
||||||
])
|
]...)
|
||||||
# note: all additive bindings share a single namespace for the key.
|
# note: all additive bindings share a single namespace for the key.
|
||||||
# In other words, if you have multiple additive bindings with the
|
# In other words, if you have multiple additive bindings with the
|
||||||
# same name, only one will be used
|
# same name, only one will be used
|
||||||
|
@ -210,10 +212,7 @@ resource "google_compute_subnetwork_iam_binding" "authoritative" {
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "google_compute_subnetwork_iam_binding" "bindings" {
|
resource "google_compute_subnetwork_iam_binding" "bindings" {
|
||||||
for_each = {
|
for_each = local.subnet_iam_bindings
|
||||||
for binding in local.subnet_iam_bindings :
|
|
||||||
"${binding.subnet}.${binding.role}.${try(binding.condition.title, "")}" => binding
|
|
||||||
}
|
|
||||||
project = var.project_id
|
project = var.project_id
|
||||||
subnetwork = local.all_subnets[each.value.subnet].name
|
subnetwork = local.all_subnets[each.value.subnet].name
|
||||||
region = local.all_subnets[each.value.subnet].region
|
region = local.all_subnets[each.value.subnet].region
|
||||||
|
|
|
@ -191,6 +191,7 @@ variable "subnets" {
|
||||||
|
|
||||||
iam = optional(map(list(string)), {})
|
iam = optional(map(list(string)), {})
|
||||||
iam_bindings = optional(map(object({
|
iam_bindings = optional(map(object({
|
||||||
|
role = string
|
||||||
members = list(string)
|
members = list(string)
|
||||||
condition = optional(object({
|
condition = optional(object({
|
||||||
expression = string
|
expression = string
|
||||||
|
@ -224,6 +225,7 @@ variable "subnets_proxy_only" {
|
||||||
|
|
||||||
iam = optional(map(list(string)), {})
|
iam = optional(map(list(string)), {})
|
||||||
iam_bindings = optional(map(object({
|
iam_bindings = optional(map(object({
|
||||||
|
role = string
|
||||||
members = list(string)
|
members = list(string)
|
||||||
condition = optional(object({
|
condition = optional(object({
|
||||||
expression = string
|
expression = string
|
||||||
|
@ -255,6 +257,7 @@ variable "subnets_psc" {
|
||||||
|
|
||||||
iam = optional(map(list(string)), {})
|
iam = optional(map(list(string)), {})
|
||||||
iam_bindings = optional(map(object({
|
iam_bindings = optional(map(object({
|
||||||
|
role = string
|
||||||
members = list(string)
|
members = list(string)
|
||||||
condition = optional(object({
|
condition = optional(object({
|
||||||
expression = string
|
expression = string
|
||||||
|
|
|
@ -80,7 +80,7 @@ values:
|
||||||
region: europe-west1
|
region: europe-west1
|
||||||
role: roles/compute.networkUser
|
role: roles/compute.networkUser
|
||||||
subnetwork: subnet-1
|
subnetwork: subnet-1
|
||||||
module.vpc.google_compute_subnetwork_iam_binding.bindings["europe-west1/subnet-1.roles/compute.networkUser.test_condition"]:
|
module.vpc.google_compute_subnetwork_iam_binding.bindings["subnet-1-iam"]:
|
||||||
condition:
|
condition:
|
||||||
- description: null
|
- description: null
|
||||||
expression: resource.matchTag('123456789012/env', 'prod')
|
expression: resource.matchTag('123456789012/env', 'prod')
|
||||||
|
|
Loading…
Reference in New Issue