Merge branch 'master' into eddern/fix-apigee-addons-config
This commit is contained in:
commit
d7857f26e9
|
@ -28,7 +28,9 @@ module "mgmt_server" {
|
||||||
nat = false
|
nat = false
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
boot_disk = {
|
boot_disk = {
|
||||||
initialize_params = {
|
initialize_params = {
|
||||||
image = var.mgmt_server_config.image
|
image = var.mgmt_server_config.image
|
||||||
|
|
|
@ -79,7 +79,9 @@ module "server" {
|
||||||
-Force
|
-Force
|
||||||
EOT
|
EOT
|
||||||
}
|
}
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
boot_disk = {
|
boot_disk = {
|
||||||
initialize_params = {
|
initialize_params = {
|
||||||
image = var.image
|
image = var.image
|
||||||
|
|
|
@ -111,7 +111,9 @@ module "vm-ns-editor" {
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
metadata = { startup-script = local.startup-script }
|
metadata = { startup-script = local.startup-script }
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
tags = ["ssh"]
|
tags = ["ssh"]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -127,6 +129,8 @@ module "vm-svc-editor" {
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
metadata = { startup-script = local.startup-script }
|
metadata = { startup-script = local.startup-script }
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
tags = ["ssh"]
|
tags = ["ssh"]
|
||||||
}
|
}
|
||||||
|
|
|
@ -43,8 +43,9 @@ module "test-vm" {
|
||||||
options = null
|
options = null
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
service_account = module.service-account-sql.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = module.service-account-sql.email
|
||||||
|
}
|
||||||
boot_disk = {
|
boot_disk = {
|
||||||
initialize_params = {
|
initialize_params = {
|
||||||
image = "projects/debian-cloud/global/images/family/debian-10"
|
image = "projects/debian-cloud/global/images/family/debian-10"
|
||||||
|
|
|
@ -55,13 +55,10 @@ locals {
|
||||||
module "nodes" {
|
module "nodes" {
|
||||||
source = "../../../modules/compute-vm"
|
source = "../../../modules/compute-vm"
|
||||||
for_each = toset(local.node_netbios_names)
|
for_each = toset(local.node_netbios_names)
|
||||||
|
|
||||||
project_id = var.project_id
|
project_id = var.project_id
|
||||||
zone = local.node_zones[each.value]
|
zone = local.node_zones[each.value]
|
||||||
name = each.value
|
name = each.value
|
||||||
|
|
||||||
instance_type = var.node_instance_type
|
instance_type = var.node_instance_type
|
||||||
|
|
||||||
network_interfaces = [{
|
network_interfaces = [{
|
||||||
network = local.network
|
network = local.network
|
||||||
subnetwork = local.subnetwork
|
subnetwork = local.subnetwork
|
||||||
|
@ -70,7 +67,6 @@ module "nodes" {
|
||||||
internal = module.ip-addresses.internal_addresses[each.value].address
|
internal = module.ip-addresses.internal_addresses[each.value].address
|
||||||
}
|
}
|
||||||
}]
|
}]
|
||||||
|
|
||||||
boot_disk = {
|
boot_disk = {
|
||||||
initialize_params = {
|
initialize_params = {
|
||||||
image = var.node_image
|
image = var.node_image
|
||||||
|
@ -78,7 +74,6 @@ module "nodes" {
|
||||||
size = var.boot_disk_size
|
size = var.boot_disk_size
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
attached_disks = [{
|
attached_disks = [{
|
||||||
name = "${each.value}-datadisk"
|
name = "${each.value}-datadisk"
|
||||||
size = var.data_disk_size
|
size = var.data_disk_size
|
||||||
|
@ -86,35 +81,28 @@ module "nodes" {
|
||||||
source = null
|
source = null
|
||||||
options = null
|
options = null
|
||||||
}]
|
}]
|
||||||
|
service_account = {
|
||||||
service_account = module.compute-service-account.email
|
email = module.compute-service-account.email
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
}
|
||||||
metadata = {
|
metadata = {
|
||||||
enable-wsfc = "true"
|
enable-wsfc = "true"
|
||||||
sysprep-specialize-script-ps1 = local.scripts["specialize-node"]
|
sysprep-specialize-script-ps1 = local.scripts["specialize-node"]
|
||||||
windows-startup-script-ps1 = local.scripts["windows-startup-node"]
|
windows-startup-script-ps1 = local.scripts["windows-startup-node"]
|
||||||
}
|
}
|
||||||
|
|
||||||
group = {
|
group = {
|
||||||
named_ports = {
|
named_ports = {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
service_account_create = false
|
|
||||||
create_template = false
|
|
||||||
}
|
}
|
||||||
|
|
||||||
# Witness
|
# Witness
|
||||||
module "witness" {
|
module "witness" {
|
||||||
source = "../../../modules/compute-vm"
|
source = "../../../modules/compute-vm"
|
||||||
for_each = toset([local.witness_netbios_name])
|
for_each = toset([local.witness_netbios_name])
|
||||||
|
|
||||||
project_id = var.project_id
|
project_id = var.project_id
|
||||||
zone = local.node_zones[each.value]
|
zone = local.node_zones[each.value]
|
||||||
name = each.value
|
name = each.value
|
||||||
|
|
||||||
instance_type = var.witness_instance_type
|
instance_type = var.witness_instance_type
|
||||||
|
|
||||||
network_interfaces = [{
|
network_interfaces = [{
|
||||||
network = local.network
|
network = local.network
|
||||||
subnetwork = local.subnetwork
|
subnetwork = local.subnetwork
|
||||||
|
@ -123,20 +111,16 @@ module "witness" {
|
||||||
internal = module.ip-addresses.internal_addresses[each.value].address
|
internal = module.ip-addresses.internal_addresses[each.value].address
|
||||||
}
|
}
|
||||||
}]
|
}]
|
||||||
|
|
||||||
boot_disk = {
|
boot_disk = {
|
||||||
image = var.witness_image
|
image = var.witness_image
|
||||||
type = "pd-ssd"
|
type = "pd-ssd"
|
||||||
size = var.boot_disk_size
|
size = var.boot_disk_size
|
||||||
}
|
}
|
||||||
|
service_account = {
|
||||||
service_account = module.witness-service-account.email
|
email = module.witness-service-account.email
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
}
|
||||||
metadata = {
|
metadata = {
|
||||||
sysprep-specialize-script-ps1 = local.scripts["specialize-witness"]
|
sysprep-specialize-script-ps1 = local.scripts["specialize-witness"]
|
||||||
windows-startup-script-ps1 = local.scripts["windows-startup-witness"]
|
windows-startup-script-ps1 = local.scripts["windows-startup-witness"]
|
||||||
}
|
}
|
||||||
|
|
||||||
service_account_create = false
|
|
||||||
create_template = false
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -30,7 +30,9 @@ module "mgmt_server" {
|
||||||
nat = false
|
nat = false
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
boot_disk = {
|
boot_disk = {
|
||||||
initialize_params = {
|
initialize_params = {
|
||||||
image = var.mgmt_server_config.image
|
image = var.mgmt_server_config.image
|
||||||
|
|
|
@ -28,7 +28,9 @@ module "mgmt_server" {
|
||||||
nat = false
|
nat = false
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
boot_disk = {
|
boot_disk = {
|
||||||
initialize_params = {
|
initialize_params = {
|
||||||
image = var.mgmt_server_config.image
|
image = var.mgmt_server_config.image
|
||||||
|
|
|
@ -298,8 +298,9 @@ module "proxy-vm" {
|
||||||
user-data = !var.tls ? module.cos-nginx.0.cloud_config : module.cos-nginx-tls.0.cloud_config
|
user-data = !var.tls ? module.cos-nginx.0.cloud_config : module.cos-nginx-tls.0.cloud_config
|
||||||
google-logging-enabled = true
|
google-logging-enabled = true
|
||||||
}
|
}
|
||||||
service_account = module.service-account-proxy.email
|
service_account = {
|
||||||
service_account_create = false
|
email = module.service-account-proxy.email
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
module "glb" {
|
module "glb" {
|
||||||
|
|
|
@ -241,8 +241,9 @@ module "vm-test1" {
|
||||||
subnetwork = module.vpc.subnet_self_links["${var.region.gcp1}/subnet1"]
|
subnetwork = module.vpc.subnet_self_links["${var.region.gcp1}/subnet1"]
|
||||||
}]
|
}]
|
||||||
metadata = { startup-script = local.vm-startup-script }
|
metadata = { startup-script = local.vm-startup-script }
|
||||||
service_account = module.service-account-gce.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = module.service-account-gce.email
|
||||||
|
}
|
||||||
tags = ["ssh"]
|
tags = ["ssh"]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -258,8 +259,9 @@ module "vm-test2" {
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
metadata = { startup-script = local.vm-startup-script }
|
metadata = { startup-script = local.vm-startup-script }
|
||||||
service_account = module.service-account-gce.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = module.service-account-gce.email
|
||||||
|
}
|
||||||
tags = ["ssh"]
|
tags = ["ssh"]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -322,7 +324,8 @@ module "vm-onprem" {
|
||||||
network = module.vpc.name
|
network = module.vpc.name
|
||||||
subnetwork = module.vpc.subnet_self_links["${var.region.gcp1}/subnet1"]
|
subnetwork = module.vpc.subnet_self_links["${var.region.gcp1}/subnet1"]
|
||||||
}]
|
}]
|
||||||
service_account = module.service-account-onprem.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = module.service-account-onprem.email
|
||||||
|
}
|
||||||
tags = ["ssh"]
|
tags = ["ssh"]
|
||||||
}
|
}
|
||||||
|
|
|
@ -48,7 +48,9 @@ module "test-vm-consumer" {
|
||||||
nat = false
|
nat = false
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
metadata = {
|
metadata = {
|
||||||
startup-script = templatefile("${path.module}/startup.sh", { proxy_url = "http://proxy.internal:3128" })
|
startup-script = templatefile("${path.module}/startup.sh", { proxy_url = "http://proxy.internal:3128" })
|
||||||
}
|
}
|
||||||
|
|
|
@ -155,8 +155,9 @@ module "squid-vm" {
|
||||||
image = "cos-cloud/cos-stable"
|
image = "cos-cloud/cos-stable"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
service_account = module.service-account-squid.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = module.service-account-squid.email
|
||||||
|
}
|
||||||
metadata = {
|
metadata = {
|
||||||
user-data = module.cos-squid.cloud_config
|
user-data = module.cos-squid.cloud_config
|
||||||
google-logging-enabled = true
|
google-logging-enabled = true
|
||||||
|
|
|
@ -167,8 +167,9 @@ module "squid-vm" {
|
||||||
image = "cos-cloud/cos-stable"
|
image = "cos-cloud/cos-stable"
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
service_account = module.service-account-squid.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = module.service-account-squid.email
|
||||||
|
}
|
||||||
metadata = {
|
metadata = {
|
||||||
user-data = module.cos-squid.cloud_config
|
user-data = module.cos-squid.cloud_config
|
||||||
}
|
}
|
||||||
|
@ -270,5 +271,7 @@ module "test-vm" {
|
||||||
nat = false
|
nat = false
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -23,9 +23,10 @@ module "nva_instance_templates" {
|
||||||
can_ip_forward = true
|
can_ip_forward = true
|
||||||
create_template = true
|
create_template = true
|
||||||
name = "nva-${each.value}"
|
name = "nva-${each.value}"
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
zone = local.zones[each.key]
|
zone = local.zones[each.key]
|
||||||
|
|
||||||
metadata = {
|
metadata = {
|
||||||
startup-script = templatefile(
|
startup-script = templatefile(
|
||||||
"${path.module}/data/nva-startup-script.tftpl",
|
"${path.module}/data/nva-startup-script.tftpl",
|
||||||
|
@ -36,7 +37,6 @@ module "nva_instance_templates" {
|
||||||
}
|
}
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
network_interfaces = [
|
network_interfaces = [
|
||||||
{
|
{
|
||||||
network = module.vpc_landing_untrusted.self_link
|
network = module.vpc_landing_untrusted.self_link
|
||||||
|
@ -47,7 +47,6 @@ module "nva_instance_templates" {
|
||||||
subnetwork = module.vpc_landing_trusted.subnet_self_links["${each.value}/trusted-${each.value}"]
|
subnetwork = module.vpc_landing_trusted.subnet_self_links["${each.value}/trusted-${each.value}"]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
|
||||||
tags = [
|
tags = [
|
||||||
"http-server",
|
"http-server",
|
||||||
"https-server",
|
"https-server",
|
||||||
|
|
|
@ -94,24 +94,23 @@ module "test_vms" {
|
||||||
source = "../../../modules/compute-vm"
|
source = "../../../modules/compute-vm"
|
||||||
name = "spoke-01-${each.value}"
|
name = "spoke-01-${each.value}"
|
||||||
project_id = module.project_spoke_01.project_id
|
project_id = module.project_spoke_01.project_id
|
||||||
create_template = var.ilb_create
|
|
||||||
service_account_create = true
|
|
||||||
zone = local.zones[each.key]
|
zone = local.zones[each.key]
|
||||||
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
metadata = {
|
metadata = {
|
||||||
startup-script = "apt update && apt install -y nginx"
|
startup-script = "apt update && apt install -y nginx"
|
||||||
}
|
}
|
||||||
|
|
||||||
network_interfaces = [{
|
network_interfaces = [{
|
||||||
network = module.vpc_spoke_01.self_link
|
network = module.vpc_spoke_01.self_link
|
||||||
subnetwork = module.vpc_spoke_01.subnet_self_links["${each.value}/spoke-01-${each.value}"]
|
subnetwork = module.vpc_spoke_01.subnet_self_links["${each.value}/spoke-01-${each.value}"]
|
||||||
}]
|
}]
|
||||||
|
|
||||||
tags = [
|
tags = [
|
||||||
"http-server",
|
"http-server",
|
||||||
"https-server",
|
"https-server",
|
||||||
"ssh"
|
"ssh"
|
||||||
]
|
]
|
||||||
|
create_template = var.ilb_create
|
||||||
}
|
}
|
||||||
|
|
||||||
module "test_vm_migs" {
|
module "test_vm_migs" {
|
||||||
|
|
|
@ -189,8 +189,9 @@ module "vm-hub" {
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
metadata = { startup-script = local.vm-startup-script }
|
metadata = { startup-script = local.vm-startup-script }
|
||||||
service_account = module.service-account-gce.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = module.service-account-gce.email
|
||||||
|
}
|
||||||
tags = ["ssh"]
|
tags = ["ssh"]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -206,8 +207,9 @@ module "vm-spoke-1" {
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
metadata = { startup-script = local.vm-startup-script }
|
metadata = { startup-script = local.vm-startup-script }
|
||||||
service_account = module.service-account-gce.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = module.service-account-gce.email
|
||||||
|
}
|
||||||
tags = ["ssh"]
|
tags = ["ssh"]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -223,8 +225,9 @@ module "vm-spoke-2" {
|
||||||
addresses = null
|
addresses = null
|
||||||
}]
|
}]
|
||||||
metadata = { startup-script = local.vm-startup-script }
|
metadata = { startup-script = local.vm-startup-script }
|
||||||
service_account = module.service-account-gce.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = module.service-account-gce.email
|
||||||
|
}
|
||||||
tags = ["ssh"]
|
tags = ["ssh"]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -21,7 +21,6 @@ module "gw" {
|
||||||
zone = each.value
|
zone = each.value
|
||||||
name = "${var.prefix}-gw-${each.key}"
|
name = "${var.prefix}-gw-${each.key}"
|
||||||
instance_type = "f1-micro"
|
instance_type = "f1-micro"
|
||||||
|
|
||||||
boot_disk = {
|
boot_disk = {
|
||||||
initialize_params = {
|
initialize_params = {
|
||||||
image = "projects/ubuntu-os-cloud/global/images/family/ubuntu-2004-lts",
|
image = "projects/ubuntu-os-cloud/global/images/family/ubuntu-2004-lts",
|
||||||
|
@ -29,7 +28,6 @@ module "gw" {
|
||||||
size = 10
|
size = 10
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
network_interfaces = [
|
network_interfaces = [
|
||||||
{
|
{
|
||||||
network = module.vpc-left.self_link
|
network = module.vpc-left.self_link
|
||||||
|
@ -52,10 +50,11 @@ module "gw" {
|
||||||
ip_cidr_right = var.ip_ranges.right
|
ip_cidr_right = var.ip_ranges.right
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
service_account = try(
|
service_account = {
|
||||||
|
email = try(
|
||||||
module.service-accounts.emails["${var.prefix}-gce-vm"], null
|
module.service-accounts.emails["${var.prefix}-gce-vm"], null
|
||||||
)
|
)
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
}
|
||||||
group = { named_ports = null }
|
group = { named_ports = null }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -39,10 +39,9 @@ module "vm-left" {
|
||||||
metadata = {
|
metadata = {
|
||||||
startup-script = local.vm_startup_script
|
startup-script = local.vm_startup_script
|
||||||
}
|
}
|
||||||
service_account = try(
|
service_account = {
|
||||||
module.service-accounts.email, null
|
email = try(module.service-accounts.email, null)
|
||||||
)
|
}
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
|
||||||
}
|
}
|
||||||
|
|
||||||
module "vm-right" {
|
module "vm-right" {
|
||||||
|
@ -62,8 +61,7 @@ module "vm-right" {
|
||||||
metadata = {
|
metadata = {
|
||||||
startup-script = local.vm_startup_script
|
startup-script = local.vm_startup_script
|
||||||
}
|
}
|
||||||
service_account = try(
|
service_account = {
|
||||||
module.service-accounts.email, null
|
email = try(module.service-accounts.email, null)
|
||||||
)
|
}
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -192,7 +192,9 @@ module "vm-bastion" {
|
||||||
"service tinyproxy restart"
|
"service tinyproxy restart"
|
||||||
])
|
])
|
||||||
}
|
}
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
################################################################################
|
################################################################################
|
||||||
|
|
|
@ -9,11 +9,14 @@ In both modes, an optional service account can be created and assigned to either
|
||||||
|
|
||||||
## Examples
|
## Examples
|
||||||
|
|
||||||
|
|
||||||
<!-- BEGIN TOC -->
|
<!-- BEGIN TOC -->
|
||||||
- [Examples](#examples)
|
- [Examples](#examples)
|
||||||
- [Instance using defaults](#instance-using-defaults)
|
- [Instance using defaults](#instance-using-defaults)
|
||||||
- [Service account management](#service-account-management)
|
- [Service account management](#service-account-management)
|
||||||
|
- [Compute default service account](#compute-default-service-account)
|
||||||
|
- [Custom service account](#custom-service-account)
|
||||||
|
- [Custom service account, auto created](#custom-service-account-auto-created)
|
||||||
|
- [No service account](#no-service-account)
|
||||||
- [Disk management](#disk-management)
|
- [Disk management](#disk-management)
|
||||||
- [Disk sources](#disk-sources)
|
- [Disk sources](#disk-sources)
|
||||||
- [Disk types and options](#disk-types-and-options)
|
- [Disk types and options](#disk-types-and-options)
|
||||||
|
@ -50,18 +53,22 @@ module "simple-vm-example" {
|
||||||
network = var.vpc.self_link
|
network = var.vpc.self_link
|
||||||
subnetwork = var.subnet.self_link
|
subnetwork = var.subnet.self_link
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=2 inventory=simple.yaml
|
# tftest modules=1 resources=1 inventory=defaults.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
### Service account management
|
### Service account management
|
||||||
|
|
||||||
VM service accounts can be managed in three different ways:
|
VM service accounts can be managed in four different ways:
|
||||||
|
|
||||||
- You can let the module create a service account for you by setting `service_account_create = true`
|
- in its default configuration, the module uses the Compute default service account with a basic set of scopes (`devstorage.read_only`, `logging.write`, `monitoring.write`)
|
||||||
- You can use an existing service account by setting `service_account_create = false` (the default value) and passing the full email address of the service account to the `service_account` variable. This is useful, for example, if you want to reuse the service account from another previously created instance, or if you want to create the service account manually with the `iam-service-account` module. In this case, you probably also want to set `service_account_scopes` to `cloud-platform`.
|
- a custom service account can be used by passing its email in the `service_account.email` variable
|
||||||
- Lastly, you can use the default compute service account by setting `service_account_crate = false`. Please note that using the default compute service account is not recommended.
|
- a custom service account can be created by the module and used by setting the `service_account.auto_create` variable to `true`
|
||||||
|
- the instance can be created with no service account by setting the `service_account` variable to `null`
|
||||||
|
|
||||||
|
Scopes for custom service accounts are set by default to `cloud-platform` and `userinfo.email`, and can be further customized regardless of which service account is used by directly setting the `service_account.scopes` variable.
|
||||||
|
|
||||||
|
#### Compute default service account
|
||||||
|
|
||||||
```hcl
|
```hcl
|
||||||
module "vm-managed-sa-example" {
|
module "vm-managed-sa-example" {
|
||||||
|
@ -73,9 +80,13 @@ module "vm-managed-sa-example" {
|
||||||
network = var.vpc.self_link
|
network = var.vpc.self_link
|
||||||
subnetwork = var.subnet.self_link
|
subnetwork = var.subnet.self_link
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
|
||||||
}
|
}
|
||||||
|
# tftest modules=1 resources=1 inventory=sa-default.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Custom service account
|
||||||
|
|
||||||
|
```hcl
|
||||||
module "vm-managed-sa-example2" {
|
module "vm-managed-sa-example2" {
|
||||||
source = "./fabric/modules/compute-vm"
|
source = "./fabric/modules/compute-vm"
|
||||||
project_id = var.project_id
|
project_id = var.project_id
|
||||||
|
@ -85,24 +96,47 @@ module "vm-managed-sa-example2" {
|
||||||
network = var.vpc.self_link
|
network = var.vpc.self_link
|
||||||
subnetwork = var.subnet.self_link
|
subnetwork = var.subnet.self_link
|
||||||
}]
|
}]
|
||||||
service_account = module.vm-managed-sa-example.service_account_email
|
service_account = {
|
||||||
service_account_scopes = ["cloud-platform"]
|
email = "sa-0@myproj.iam.gserviceaccount.com"
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
# tftest modules=1 resources=1 inventory=sa-custom.yaml
|
||||||
|
```
|
||||||
|
|
||||||
# not recommended
|
#### Custom service account, auto created
|
||||||
module "vm-default-sa-example2" {
|
|
||||||
|
```hcl
|
||||||
|
module "vm-managed-sa-example2" {
|
||||||
source = "./fabric/modules/compute-vm"
|
source = "./fabric/modules/compute-vm"
|
||||||
project_id = var.project_id
|
project_id = var.project_id
|
||||||
zone = "europe-west1-b"
|
zone = "europe-west1-b"
|
||||||
name = "test3"
|
name = "test2"
|
||||||
network_interfaces = [{
|
network_interfaces = [{
|
||||||
network = var.vpc.self_link
|
network = var.vpc.self_link
|
||||||
subnetwork = var.subnet.self_link
|
subnetwork = var.subnet.self_link
|
||||||
}]
|
}]
|
||||||
service_account_create = false
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
# tftest modules=1 resources=2 inventory=sa-managed.yaml
|
||||||
|
```
|
||||||
|
|
||||||
# tftest modules=3 resources=4 inventory=sas.yaml
|
#### No service account
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
module "vm-managed-sa-example2" {
|
||||||
|
source = "./fabric/modules/compute-vm"
|
||||||
|
project_id = var.project_id
|
||||||
|
zone = "europe-west1-b"
|
||||||
|
name = "test2"
|
||||||
|
network_interfaces = [{
|
||||||
|
network = var.vpc.self_link
|
||||||
|
subnetwork = var.subnet.self_link
|
||||||
|
}]
|
||||||
|
service_account = null
|
||||||
|
}
|
||||||
|
# tftest modules=1 resources=1 inventory=sa-none.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
### Disk management
|
### Disk management
|
||||||
|
@ -137,7 +171,9 @@ module "vm-disks-example" {
|
||||||
replica_zone = "${var.region}-c"
|
replica_zone = "${var.region}-c"
|
||||||
}
|
}
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=2
|
# tftest modules=1 resources=2
|
||||||
```
|
```
|
||||||
|
@ -163,7 +199,9 @@ module "vm-disks-example" {
|
||||||
replica_zone = "${var.region}-c"
|
replica_zone = "${var.region}-c"
|
||||||
}
|
}
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
create_template = true
|
create_template = true
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=2
|
# tftest modules=1 resources=2
|
||||||
|
@ -205,7 +243,9 @@ module "vm-disk-options-example" {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=4 inventory=disk-options.yaml
|
# tftest modules=1 resources=4 inventory=disk-options.yaml
|
||||||
```
|
```
|
||||||
|
@ -230,7 +270,9 @@ module "simple-vm-example" {
|
||||||
network = var.vpc.self_link
|
network = var.vpc.self_link
|
||||||
subnetwork = var.subnet.self_link
|
subnetwork = var.subnet.self_link
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=3 inventory=independent-boot-disk.yaml
|
# tftest modules=1 resources=3 inventory=independent-boot-disk.yaml
|
||||||
```
|
```
|
||||||
|
@ -331,7 +373,9 @@ module "vm-with-gvnic" {
|
||||||
subnetwork = var.subnet.self_link
|
subnetwork = var.subnet.self_link
|
||||||
nic_type = "GVNIC"
|
nic_type = "GVNIC"
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=3 inventory=gvnic.yaml
|
# tftest modules=1 resources=3 inventory=gvnic.yaml
|
||||||
```
|
```
|
||||||
|
@ -361,7 +405,9 @@ module "vm-metadata-example" {
|
||||||
apt-get install -y nginx
|
apt-get install -y nginx
|
||||||
EOF
|
EOF
|
||||||
}
|
}
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=2 inventory=metadata.yaml
|
# tftest modules=1 resources=2 inventory=metadata.yaml
|
||||||
```
|
```
|
||||||
|
@ -465,7 +511,9 @@ module "kms-vm-example" {
|
||||||
name = "attached-disk"
|
name = "attached-disk"
|
||||||
size = 10
|
size = 10
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
encryption = {
|
encryption = {
|
||||||
encrypt_boot = true
|
encrypt_boot = true
|
||||||
kms_key_self_link = var.kms_key.self_link
|
kms_key_self_link = var.kms_key.self_link
|
||||||
|
@ -499,7 +547,9 @@ module "cos-test" {
|
||||||
size = 10
|
size = 10
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
service_account = "vm-default@my-project.iam.gserviceaccount.com"
|
service_account = {
|
||||||
|
email = "vm-default@my-project.iam.gserviceaccount.com"
|
||||||
|
}
|
||||||
create_template = true
|
create_template = true
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=1 inventory=template.yaml
|
# tftest modules=1 resources=1 inventory=template.yaml
|
||||||
|
@ -526,8 +576,10 @@ module "instance-group" {
|
||||||
boot_disk = {
|
boot_disk = {
|
||||||
image = "projects/cos-cloud/global/images/family/cos-stable"
|
image = "projects/cos-cloud/global/images/family/cos-stable"
|
||||||
}
|
}
|
||||||
service_account = var.service_account.email
|
service_account = {
|
||||||
service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
email = var.service_account.email
|
||||||
|
scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
||||||
|
}
|
||||||
metadata = {
|
metadata = {
|
||||||
user-data = local.cloud_config
|
user-data = local.cloud_config
|
||||||
}
|
}
|
||||||
|
@ -633,7 +685,7 @@ module "instance" {
|
||||||
| [name](variables.tf#L235) | Instance name. | <code>string</code> | ✓ | |
|
| [name](variables.tf#L235) | Instance name. | <code>string</code> | ✓ | |
|
||||||
| [network_interfaces](variables.tf#L240) | Network interfaces configuration. Use self links for Shared VPC, set addresses to null if not needed. | <code title="list(object({ nat = optional(bool, false) network = string subnetwork = string addresses = optional(object({ internal = optional(string) external = optional(string) }), null) alias_ips = optional(map(string), {}) nic_type = optional(string) }))">list(object({…}))</code> | ✓ | |
|
| [network_interfaces](variables.tf#L240) | Network interfaces configuration. Use self links for Shared VPC, set addresses to null if not needed. | <code title="list(object({ nat = optional(bool, false) network = string subnetwork = string addresses = optional(object({ internal = optional(string) external = optional(string) }), null) alias_ips = optional(map(string), {}) nic_type = optional(string) }))">list(object({…}))</code> | ✓ | |
|
||||||
| [project_id](variables.tf#L277) | Project id. | <code>string</code> | ✓ | |
|
| [project_id](variables.tf#L277) | Project id. | <code>string</code> | ✓ | |
|
||||||
| [zone](variables.tf#L379) | Compute zone. | <code>string</code> | ✓ | |
|
| [zone](variables.tf#L369) | Compute zone. | <code>string</code> | ✓ | |
|
||||||
| [attached_disk_defaults](variables.tf#L17) | Defaults for attached disks options. | <code title="object({ auto_delete = optional(bool, false) mode = string replica_zone = string type = string })">object({…})</code> | | <code title="{ auto_delete = true mode = "READ_WRITE" replica_zone = null type = "pd-balanced" }">{…}</code> |
|
| [attached_disk_defaults](variables.tf#L17) | Defaults for attached disks options. | <code title="object({ auto_delete = optional(bool, false) mode = string replica_zone = string type = string })">object({…})</code> | | <code title="{ auto_delete = true mode = "READ_WRITE" replica_zone = null type = "pd-balanced" }">{…}</code> |
|
||||||
| [attached_disks](variables.tf#L37) | Additional disks, if options is null defaults will be used in its place. Source type is one of 'image' (zonal disks in vms and template), 'snapshot' (vm), 'existing', and null. | <code title="list(object({ name = string device_name = optional(string) size = string snapshot_schedule = optional(string) source = optional(string) source_type = optional(string) options = optional( object({ auto_delete = optional(bool, false) mode = optional(string, "READ_WRITE") replica_zone = optional(string) type = optional(string, "pd-balanced") }), { auto_delete = true mode = "READ_WRITE" replica_zone = null type = "pd-balanced" } ) }))">list(object({…}))</code> | | <code>[]</code> |
|
| [attached_disks](variables.tf#L37) | Additional disks, if options is null defaults will be used in its place. Source type is one of 'image' (zonal disks in vms and template), 'snapshot' (vm), 'existing', and null. | <code title="list(object({ name = string device_name = optional(string) size = string snapshot_schedule = optional(string) source = optional(string) source_type = optional(string) options = optional( object({ auto_delete = optional(bool, false) mode = optional(string, "READ_WRITE") replica_zone = optional(string) type = optional(string, "pd-balanced") }), { auto_delete = true mode = "READ_WRITE" replica_zone = null type = "pd-balanced" } ) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||||
| [boot_disk](variables.tf#L83) | Boot disk properties. | <code title="object({ auto_delete = optional(bool, true) snapshot_schedule = optional(string) source = optional(string) initialize_params = optional(object({ image = optional(string, "projects/debian-cloud/global/images/family/debian-11") size = optional(number, 10) type = optional(string, "pd-balanced") })) use_independent_disk = optional(bool, false) })">object({…})</code> | | <code title="{ initialize_params = {} }">{…}</code> |
|
| [boot_disk](variables.tf#L83) | Boot disk properties. | <code title="object({ auto_delete = optional(bool, true) snapshot_schedule = optional(string) source = optional(string) initialize_params = optional(object({ image = optional(string, "projects/debian-cloud/global/images/family/debian-11") size = optional(number, 10) type = optional(string, "pd-balanced") })) use_independent_disk = optional(bool, false) })">object({…})</code> | | <code title="{ initialize_params = {} }">{…}</code> |
|
||||||
|
@ -653,13 +705,11 @@ module "instance" {
|
||||||
| [min_cpu_platform](variables.tf#L229) | Minimum CPU platform. | <code>string</code> | | <code>null</code> |
|
| [min_cpu_platform](variables.tf#L229) | Minimum CPU platform. | <code>string</code> | | <code>null</code> |
|
||||||
| [options](variables.tf#L255) | Instance options. | <code title="object({ allow_stopping_for_update = optional(bool, true) deletion_protection = optional(bool, false) spot = optional(bool, false) termination_action = optional(string) })">object({…})</code> | | <code title="{ allow_stopping_for_update = true deletion_protection = false spot = false termination_action = null }">{…}</code> |
|
| [options](variables.tf#L255) | Instance options. | <code title="object({ allow_stopping_for_update = optional(bool, true) deletion_protection = optional(bool, false) spot = optional(bool, false) termination_action = optional(string) })">object({…})</code> | | <code title="{ allow_stopping_for_update = true deletion_protection = false spot = false termination_action = null }">{…}</code> |
|
||||||
| [scratch_disks](variables.tf#L282) | Scratch disks configuration. | <code title="object({ count = number interface = string })">object({…})</code> | | <code title="{ count = 0 interface = "NVME" }">{…}</code> |
|
| [scratch_disks](variables.tf#L282) | Scratch disks configuration. | <code title="object({ count = number interface = string })">object({…})</code> | | <code title="{ count = 0 interface = "NVME" }">{…}</code> |
|
||||||
| [service_account](variables.tf#L294) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
| [service_account](variables.tf#L294) | Service account email and scopes. If email is null, the default Compute service account will be used unless auto_create is true, in which case a service account will be created. Set the variable to null to avoid attaching a service account. | <code title="object({ auto_create = optional(bool, false) email = optional(string) scopes = optional(list(string)) })">object({…})</code> | | <code>{}</code> |
|
||||||
| [service_account_create](variables.tf#L300) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
| [shielded_config](variables.tf#L304) | Shielded VM configuration of the instances. | <code title="object({ enable_secure_boot = bool enable_vtpm = bool enable_integrity_monitoring = bool })">object({…})</code> | | <code>null</code> |
|
||||||
| [service_account_scopes](variables.tf#L308) | Scopes applied to service account. | <code>list(string)</code> | | <code>[]</code> |
|
| [snapshot_schedules](variables.tf#L314) | Snapshot schedule resource policies that can be attached to disks. | <code title="map(object({ schedule = object({ daily = optional(object({ days_in_cycle = number start_time = string })) hourly = optional(object({ hours_in_cycle = number start_time = string })) weekly = optional(list(object({ day = string start_time = string }))) }) description = optional(string) retention_policy = optional(object({ max_retention_days = number on_source_disk_delete_keep = optional(bool) })) snapshot_properties = optional(object({ chain_name = optional(string) guest_flush = optional(bool) labels = optional(map(string)) storage_locations = optional(list(string)) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [shielded_config](variables.tf#L314) | Shielded VM configuration of the instances. | <code title="object({ enable_secure_boot = bool enable_vtpm = bool enable_integrity_monitoring = bool })">object({…})</code> | | <code>null</code> |
|
| [tag_bindings](variables.tf#L357) | Tag bindings for this instance, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
||||||
| [snapshot_schedules](variables.tf#L324) | Snapshot schedule resource policies that can be attached to disks. | <code title="map(object({ schedule = object({ daily = optional(object({ days_in_cycle = number start_time = string })) hourly = optional(object({ hours_in_cycle = number start_time = string })) weekly = optional(list(object({ day = string start_time = string }))) }) description = optional(string) retention_policy = optional(object({ max_retention_days = number on_source_disk_delete_keep = optional(bool) })) snapshot_properties = optional(object({ chain_name = optional(string) guest_flush = optional(bool) labels = optional(map(string)) storage_locations = optional(list(string)) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [tags](variables.tf#L363) | Instance network tags for firewall rule targets. | <code>list(string)</code> | | <code>[]</code> |
|
||||||
| [tag_bindings](variables.tf#L367) | Tag bindings for this instance, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
|
||||||
| [tags](variables.tf#L373) | Instance network tags for firewall rule targets. | <code>list(string)</code> | | <code>[]</code> |
|
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
|
|
||||||
|
@ -668,13 +718,13 @@ module "instance" {
|
||||||
| [external_ip](outputs.tf#L17) | Instance main interface external IP addresses. | |
|
| [external_ip](outputs.tf#L17) | Instance main interface external IP addresses. | |
|
||||||
| [group](outputs.tf#L26) | Instance group resource. | |
|
| [group](outputs.tf#L26) | Instance group resource. | |
|
||||||
| [id](outputs.tf#L31) | Fully qualified instance id. | |
|
| [id](outputs.tf#L31) | Fully qualified instance id. | |
|
||||||
| [instance](outputs.tf#L36) | Instance resource. | |
|
| [instance](outputs.tf#L36) | Instance resource. | ✓ |
|
||||||
| [internal_ip](outputs.tf#L41) | Instance main interface internal IP address. | |
|
| [internal_ip](outputs.tf#L42) | Instance main interface internal IP address. | |
|
||||||
| [internal_ips](outputs.tf#L49) | Instance interfaces internal IP addresses. | |
|
| [internal_ips](outputs.tf#L50) | Instance interfaces internal IP addresses. | |
|
||||||
| [self_link](outputs.tf#L57) | Instance self links. | |
|
| [self_link](outputs.tf#L58) | Instance self links. | |
|
||||||
| [service_account](outputs.tf#L62) | Service account resource. | |
|
| [service_account](outputs.tf#L63) | Service account resource. | |
|
||||||
| [service_account_email](outputs.tf#L69) | Service account email. | |
|
| [service_account_email](outputs.tf#L68) | Service account email. | |
|
||||||
| [service_account_iam_email](outputs.tf#L74) | Service account email. | |
|
| [service_account_iam_email](outputs.tf#L73) | Service account email. | |
|
||||||
| [template](outputs.tf#L82) | Template resource. | |
|
| [template](outputs.tf#L82) | Template resource. | |
|
||||||
| [template_name](outputs.tf#L87) | Template name. | |
|
| [template_name](outputs.tf#L87) | Template name. | |
|
||||||
<!-- END TFDOC -->
|
<!-- END TFDOC -->
|
||||||
|
|
|
@ -35,31 +35,29 @@ locals {
|
||||||
: "MIGRATE"
|
: "MIGRATE"
|
||||||
)
|
)
|
||||||
region = join("-", slice(split("-", var.zone), 0, 2))
|
region = join("-", slice(split("-", var.zone), 0, 2))
|
||||||
service_account_email = (
|
service_account = var.service_account == null ? null : {
|
||||||
var.service_account_create
|
email = (
|
||||||
? (
|
var.service_account.auto_create
|
||||||
length(google_service_account.service_account) > 0
|
|
||||||
? google_service_account.service_account[0].email
|
? google_service_account.service_account[0].email
|
||||||
: null
|
: var.service_account.email
|
||||||
)
|
)
|
||||||
: var.service_account
|
scopes = (
|
||||||
)
|
var.service_account.scopes != null ? var.service_account.scopes : (
|
||||||
service_account_scopes = (
|
var.service_account.email == null && !var.service_account.auto_create
|
||||||
length(var.service_account_scopes) > 0
|
# default scopes for Compute default SA
|
||||||
? var.service_account_scopes
|
|
||||||
: (
|
|
||||||
var.service_account_create
|
|
||||||
? [
|
? [
|
||||||
"https://www.googleapis.com/auth/cloud-platform",
|
|
||||||
"https://www.googleapis.com/auth/userinfo.email"
|
|
||||||
]
|
|
||||||
: [
|
|
||||||
"https://www.googleapis.com/auth/devstorage.read_only",
|
"https://www.googleapis.com/auth/devstorage.read_only",
|
||||||
"https://www.googleapis.com/auth/logging.write",
|
"https://www.googleapis.com/auth/logging.write",
|
||||||
"https://www.googleapis.com/auth/monitoring.write"
|
"https://www.googleapis.com/auth/monitoring.write"
|
||||||
]
|
]
|
||||||
|
# default scopes for own SA
|
||||||
|
: [
|
||||||
|
"https://www.googleapis.com/auth/cloud-platform",
|
||||||
|
"https://www.googleapis.com/auth/userinfo.email"
|
||||||
|
]
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
|
}
|
||||||
termination_action = var.options.spot ? coalesce(var.options.termination_action, "STOP") : null
|
termination_action = var.options.spot ? coalesce(var.options.termination_action, "STOP") : null
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -275,9 +273,12 @@ resource "google_compute_instance" "default" {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
service_account {
|
dynamic "service_account" {
|
||||||
email = local.service_account_email
|
for_each = var.service_account == null ? [] : [""]
|
||||||
scopes = local.service_account_scopes
|
content {
|
||||||
|
email = local.service_account.email
|
||||||
|
scopes = local.service_account.scopes
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
dynamic "shielded_instance_config" {
|
dynamic "shielded_instance_config" {
|
||||||
|
@ -399,9 +400,12 @@ resource "google_compute_instance_template" "default" {
|
||||||
provisioning_model = var.options.spot ? "SPOT" : "STANDARD"
|
provisioning_model = var.options.spot ? "SPOT" : "STANDARD"
|
||||||
}
|
}
|
||||||
|
|
||||||
service_account {
|
dynamic "service_account" {
|
||||||
email = local.service_account_email
|
for_each = var.service_account == null ? [] : [""]
|
||||||
scopes = local.service_account_scopes
|
content {
|
||||||
|
email = local.service_account.email
|
||||||
|
scopes = local.service_account.scopes
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
dynamic "shielded_instance_config" {
|
dynamic "shielded_instance_config" {
|
||||||
|
@ -442,7 +446,7 @@ resource "google_compute_instance_group" "unmanaged" {
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "google_service_account" "service_account" {
|
resource "google_service_account" "service_account" {
|
||||||
count = var.service_account_create ? 1 : 0
|
count = try(var.service_account.auto_create, null) == true ? 1 : 0
|
||||||
project = var.project_id
|
project = var.project_id
|
||||||
account_id = "tf-vm-${var.name}"
|
account_id = "tf-vm-${var.name}"
|
||||||
display_name = "Terraform VM ${var.name}."
|
display_name = "Terraform VM ${var.name}."
|
||||||
|
|
|
@ -35,6 +35,7 @@ output "id" {
|
||||||
|
|
||||||
output "instance" {
|
output "instance" {
|
||||||
description = "Instance resource."
|
description = "Instance resource."
|
||||||
|
sensitive = true
|
||||||
value = try(google_compute_instance.default.0, null)
|
value = try(google_compute_instance.default.0, null)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -61,22 +62,21 @@ output "self_link" {
|
||||||
|
|
||||||
output "service_account" {
|
output "service_account" {
|
||||||
description = "Service account resource."
|
description = "Service account resource."
|
||||||
value = (
|
value = try(google_service_account.service_account.0, null)
|
||||||
var.service_account_create ? google_service_account.service_account.0 : null
|
|
||||||
)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
output "service_account_email" {
|
output "service_account_email" {
|
||||||
description = "Service account email."
|
description = "Service account email."
|
||||||
value = local.service_account_email
|
value = try(local.service_account.email, null)
|
||||||
}
|
}
|
||||||
|
|
||||||
output "service_account_iam_email" {
|
output "service_account_iam_email" {
|
||||||
description = "Service account email."
|
description = "Service account email."
|
||||||
value = join("", [
|
value = (
|
||||||
"serviceAccount:",
|
try(local.service_account.email, null) == null
|
||||||
local.service_account_email == null ? "" : local.service_account_email
|
? null
|
||||||
])
|
: "serviceAccount:${local.service_account.email}"
|
||||||
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
output "template" {
|
output "template" {
|
||||||
|
|
|
@ -0,0 +1,9 @@
|
||||||
|
project_id = "tf-playground-svpc-gce"
|
||||||
|
zone = "europe-west8-b"
|
||||||
|
name = "test-sa"
|
||||||
|
instance_type = "e2-small"
|
||||||
|
network_interfaces = [{
|
||||||
|
network = "https://www.googleapis.com/compute/v1/projects/ldj-dev-net-spoke-0/global/networks/dev-spoke-0"
|
||||||
|
subnetwork = "https://www.googleapis.com/compute/v1/projects/ldj-dev-net-spoke-0/regions/europe-west8/subnetworks/gce"
|
||||||
|
}]
|
||||||
|
# service_account = null
|
|
@ -292,23 +292,13 @@ variable "scratch_disks" {
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "service_account" {
|
variable "service_account" {
|
||||||
description = "Service account email. Unused if service account is auto-created."
|
description = "Service account email and scopes. If email is null, the default Compute service account will be used unless auto_create is true, in which case a service account will be created. Set the variable to null to avoid attaching a service account."
|
||||||
type = string
|
type = object({
|
||||||
default = null
|
auto_create = optional(bool, false)
|
||||||
}
|
email = optional(string)
|
||||||
|
scopes = optional(list(string))
|
||||||
variable "service_account_create" {
|
})
|
||||||
description = "Auto-create service account."
|
default = {}
|
||||||
type = bool
|
|
||||||
default = false
|
|
||||||
}
|
|
||||||
|
|
||||||
# scopes and scope aliases list
|
|
||||||
# https://cloud.google.com/sdk/gcloud/reference/compute/instances/create#--scopes
|
|
||||||
variable "service_account_scopes" {
|
|
||||||
description = "Scopes applied to service account."
|
|
||||||
type = list(string)
|
|
||||||
default = []
|
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "shielded_config" {
|
variable "shielded_config" {
|
||||||
|
|
|
@ -16,18 +16,18 @@ This example shows how to reference existing Managed Infrastructure Groups (MIGs
|
||||||
module "instance_template" {
|
module "instance_template" {
|
||||||
source = "./fabric/modules/compute-vm"
|
source = "./fabric/modules/compute-vm"
|
||||||
project_id = var.project_id
|
project_id = var.project_id
|
||||||
create_template = true
|
|
||||||
name = "vm-test"
|
|
||||||
service_account_create = true
|
|
||||||
zone = "europe-west1-b"
|
zone = "europe-west1-b"
|
||||||
|
name = "vm-test"
|
||||||
|
create_template = true
|
||||||
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
network_interfaces = [
|
network_interfaces = [
|
||||||
{
|
{
|
||||||
network = var.vpc.self_link
|
network = var.vpc.self_link
|
||||||
subnetwork = var.subnet.self_link
|
subnetwork = var.subnet.self_link
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
|
||||||
tags = [
|
tags = [
|
||||||
"http-server"
|
"http-server"
|
||||||
]
|
]
|
||||||
|
|
|
@ -24,18 +24,18 @@ This example shows how to reference existing Managed Infrastructure Groups (MIGs
|
||||||
module "instance_template" {
|
module "instance_template" {
|
||||||
source = "./fabric/modules/compute-vm"
|
source = "./fabric/modules/compute-vm"
|
||||||
project_id = var.project_id
|
project_id = var.project_id
|
||||||
create_template = true
|
|
||||||
name = "vm-test"
|
|
||||||
service_account_create = true
|
|
||||||
zone = "europe-west1-b"
|
zone = "europe-west1-b"
|
||||||
|
name = "vm-test"
|
||||||
|
create_template = true
|
||||||
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
network_interfaces = [
|
network_interfaces = [
|
||||||
{
|
{
|
||||||
network = var.vpc.self_link
|
network = var.vpc.self_link
|
||||||
subnetwork = var.subnet.self_link
|
subnetwork = var.subnet.self_link
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
|
||||||
tags = [
|
tags = [
|
||||||
"http-server"
|
"http-server"
|
||||||
]
|
]
|
||||||
|
|
|
@ -18,9 +18,10 @@ module "vm" {
|
||||||
network = var.vpc.self_link
|
network = var.vpc.self_link
|
||||||
subnetwork = var.subnet.self_link
|
subnetwork = var.subnet.self_link
|
||||||
}]
|
}]
|
||||||
service_account_create = true
|
service_account = {
|
||||||
|
auto_create = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
module "vpn-dynamic" {
|
module "vpn-dynamic" {
|
||||||
source = "./fabric/modules/net-vpn-dynamic"
|
source = "./fabric/modules/net-vpn-dynamic"
|
||||||
|
@ -31,7 +32,6 @@ module "vpn-dynamic" {
|
||||||
router_config = {
|
router_config = {
|
||||||
asn = 64514
|
asn = 64514
|
||||||
}
|
}
|
||||||
|
|
||||||
tunnels = {
|
tunnels = {
|
||||||
remote-1 = {
|
remote-1 = {
|
||||||
bgp_peer = {
|
bgp_peer = {
|
||||||
|
|
|
@ -0,0 +1,79 @@
|
||||||
|
# Copyright 2023 Google LLC
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
values:
|
||||||
|
module.simple-vm-example.google_compute_instance.default[0]:
|
||||||
|
advanced_machine_features: []
|
||||||
|
allow_stopping_for_update: true
|
||||||
|
attached_disk: []
|
||||||
|
boot_disk:
|
||||||
|
- auto_delete: true
|
||||||
|
disk_encryption_key_raw: null
|
||||||
|
initialize_params:
|
||||||
|
- image: projects/debian-cloud/global/images/family/debian-11
|
||||||
|
resource_manager_tags: null
|
||||||
|
size: 10
|
||||||
|
type: pd-balanced
|
||||||
|
mode: READ_WRITE
|
||||||
|
can_ip_forward: false
|
||||||
|
deletion_protection: false
|
||||||
|
description: Managed by the compute-vm Terraform module.
|
||||||
|
desired_status: null
|
||||||
|
enable_display: false
|
||||||
|
hostname: null
|
||||||
|
labels: null
|
||||||
|
machine_type: f1-micro
|
||||||
|
metadata: null
|
||||||
|
metadata_startup_script: null
|
||||||
|
name: test
|
||||||
|
network_interface:
|
||||||
|
- access_config: []
|
||||||
|
alias_ip_range: []
|
||||||
|
ipv6_access_config: []
|
||||||
|
network: projects/xxx/global/networks/aaa
|
||||||
|
nic_type: null
|
||||||
|
queue_count: null
|
||||||
|
subnetwork: subnet_self_link
|
||||||
|
network_performance_config: []
|
||||||
|
params: []
|
||||||
|
project: project-id
|
||||||
|
resource_policies: null
|
||||||
|
scheduling:
|
||||||
|
- automatic_restart: true
|
||||||
|
instance_termination_action: null
|
||||||
|
local_ssd_recovery_timeout: []
|
||||||
|
maintenance_interval: null
|
||||||
|
max_run_duration: []
|
||||||
|
min_node_cpus: null
|
||||||
|
node_affinities: []
|
||||||
|
on_host_maintenance: MIGRATE
|
||||||
|
preemptible: false
|
||||||
|
provisioning_model: STANDARD
|
||||||
|
scratch_disk: []
|
||||||
|
service_account:
|
||||||
|
- scopes:
|
||||||
|
- https://www.googleapis.com/auth/devstorage.read_only
|
||||||
|
- https://www.googleapis.com/auth/logging.write
|
||||||
|
- https://www.googleapis.com/auth/monitoring.write
|
||||||
|
shielded_instance_config: []
|
||||||
|
tags: null
|
||||||
|
timeouts: null
|
||||||
|
zone: europe-west1-b
|
||||||
|
|
||||||
|
counts:
|
||||||
|
google_compute_instance: 1
|
||||||
|
modules: 1
|
||||||
|
resources: 1
|
||||||
|
|
||||||
|
outputs: {}
|
|
@ -13,7 +13,7 @@
|
||||||
# limitations under the License.
|
# limitations under the License.
|
||||||
|
|
||||||
values:
|
values:
|
||||||
module.simple-vm-example.google_compute_instance.default[0]:
|
module.vm-managed-sa-example2.google_compute_instance.default[0]:
|
||||||
advanced_machine_features: []
|
advanced_machine_features: []
|
||||||
allow_stopping_for_update: true
|
allow_stopping_for_update: true
|
||||||
attached_disk: []
|
attached_disk: []
|
||||||
|
@ -22,20 +22,21 @@ values:
|
||||||
disk_encryption_key_raw: null
|
disk_encryption_key_raw: null
|
||||||
initialize_params:
|
initialize_params:
|
||||||
- image: projects/debian-cloud/global/images/family/debian-11
|
- image: projects/debian-cloud/global/images/family/debian-11
|
||||||
resource_manager_tags:
|
resource_manager_tags: null
|
||||||
size: 10
|
size: 10
|
||||||
type: pd-balanced
|
type: pd-balanced
|
||||||
mode: READ_WRITE
|
mode: READ_WRITE
|
||||||
can_ip_forward: false
|
can_ip_forward: false
|
||||||
deletion_protection: false
|
deletion_protection: false
|
||||||
description: Managed by the compute-vm Terraform module.
|
description: Managed by the compute-vm Terraform module.
|
||||||
|
desired_status: null
|
||||||
enable_display: false
|
enable_display: false
|
||||||
hostname: null
|
hostname: null
|
||||||
labels: null
|
labels: null
|
||||||
machine_type: f1-micro
|
machine_type: f1-micro
|
||||||
metadata: null
|
metadata: null
|
||||||
metadata_startup_script: null
|
metadata_startup_script: null
|
||||||
name: test
|
name: test2
|
||||||
network_interface:
|
network_interface:
|
||||||
- access_config: []
|
- access_config: []
|
||||||
alias_ip_range: []
|
alias_ip_range: []
|
||||||
|
@ -44,7 +45,10 @@ values:
|
||||||
nic_type: null
|
nic_type: null
|
||||||
queue_count: null
|
queue_count: null
|
||||||
subnetwork: subnet_self_link
|
subnetwork: subnet_self_link
|
||||||
|
network_performance_config: []
|
||||||
|
params: []
|
||||||
project: project-id
|
project: project-id
|
||||||
|
resource_policies: null
|
||||||
scheduling:
|
scheduling:
|
||||||
- automatic_restart: true
|
- automatic_restart: true
|
||||||
instance_termination_action: null
|
instance_termination_action: null
|
||||||
|
@ -58,18 +62,18 @@ values:
|
||||||
provisioning_model: STANDARD
|
provisioning_model: STANDARD
|
||||||
scratch_disk: []
|
scratch_disk: []
|
||||||
service_account:
|
service_account:
|
||||||
- scopes:
|
- email: sa-0@myproj.iam.gserviceaccount.com
|
||||||
|
scopes:
|
||||||
- https://www.googleapis.com/auth/cloud-platform
|
- https://www.googleapis.com/auth/cloud-platform
|
||||||
- https://www.googleapis.com/auth/userinfo.email
|
- https://www.googleapis.com/auth/userinfo.email
|
||||||
shielded_instance_config: []
|
shielded_instance_config: []
|
||||||
tags: null
|
tags: null
|
||||||
|
timeouts: null
|
||||||
zone: europe-west1-b
|
zone: europe-west1-b
|
||||||
module.simple-vm-example.google_service_account.service_account[0]:
|
|
||||||
account_id: tf-vm-test
|
|
||||||
display_name: Terraform VM test.
|
|
||||||
project: project-id
|
|
||||||
|
|
||||||
|
|
||||||
counts:
|
counts:
|
||||||
google_compute_instance: 1
|
google_compute_instance: 1
|
||||||
google_service_account: 1
|
modules: 1
|
||||||
|
resources: 1
|
||||||
|
|
||||||
|
outputs: {}
|
|
@ -0,0 +1,79 @@
|
||||||
|
# Copyright 2023 Google LLC
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
values:
|
||||||
|
module.vm-managed-sa-example.google_compute_instance.default[0]:
|
||||||
|
advanced_machine_features: []
|
||||||
|
allow_stopping_for_update: true
|
||||||
|
attached_disk: []
|
||||||
|
boot_disk:
|
||||||
|
- auto_delete: true
|
||||||
|
disk_encryption_key_raw: null
|
||||||
|
initialize_params:
|
||||||
|
- image: projects/debian-cloud/global/images/family/debian-11
|
||||||
|
resource_manager_tags: null
|
||||||
|
size: 10
|
||||||
|
type: pd-balanced
|
||||||
|
mode: READ_WRITE
|
||||||
|
can_ip_forward: false
|
||||||
|
deletion_protection: false
|
||||||
|
description: Managed by the compute-vm Terraform module.
|
||||||
|
desired_status: null
|
||||||
|
enable_display: false
|
||||||
|
hostname: null
|
||||||
|
labels: null
|
||||||
|
machine_type: f1-micro
|
||||||
|
metadata: null
|
||||||
|
metadata_startup_script: null
|
||||||
|
name: test1
|
||||||
|
network_interface:
|
||||||
|
- access_config: []
|
||||||
|
alias_ip_range: []
|
||||||
|
ipv6_access_config: []
|
||||||
|
network: projects/xxx/global/networks/aaa
|
||||||
|
nic_type: null
|
||||||
|
queue_count: null
|
||||||
|
subnetwork: subnet_self_link
|
||||||
|
network_performance_config: []
|
||||||
|
params: []
|
||||||
|
project: project-id
|
||||||
|
resource_policies: null
|
||||||
|
scheduling:
|
||||||
|
- automatic_restart: true
|
||||||
|
instance_termination_action: null
|
||||||
|
local_ssd_recovery_timeout: []
|
||||||
|
maintenance_interval: null
|
||||||
|
max_run_duration: []
|
||||||
|
min_node_cpus: null
|
||||||
|
node_affinities: []
|
||||||
|
on_host_maintenance: MIGRATE
|
||||||
|
preemptible: false
|
||||||
|
provisioning_model: STANDARD
|
||||||
|
scratch_disk: []
|
||||||
|
service_account:
|
||||||
|
- scopes:
|
||||||
|
- https://www.googleapis.com/auth/devstorage.read_only
|
||||||
|
- https://www.googleapis.com/auth/logging.write
|
||||||
|
- https://www.googleapis.com/auth/monitoring.write
|
||||||
|
shielded_instance_config: []
|
||||||
|
tags: null
|
||||||
|
timeouts: null
|
||||||
|
zone: europe-west1-b
|
||||||
|
|
||||||
|
counts:
|
||||||
|
google_compute_instance: 1
|
||||||
|
modules: 1
|
||||||
|
resources: 1
|
||||||
|
|
||||||
|
outputs: {}
|
|
@ -0,0 +1,86 @@
|
||||||
|
# Copyright 2023 Google LLC
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
values:
|
||||||
|
module.vm-managed-sa-example2.google_compute_instance.default[0]:
|
||||||
|
advanced_machine_features: []
|
||||||
|
allow_stopping_for_update: true
|
||||||
|
attached_disk: []
|
||||||
|
boot_disk:
|
||||||
|
- auto_delete: true
|
||||||
|
disk_encryption_key_raw: null
|
||||||
|
initialize_params:
|
||||||
|
- image: projects/debian-cloud/global/images/family/debian-11
|
||||||
|
resource_manager_tags: null
|
||||||
|
size: 10
|
||||||
|
type: pd-balanced
|
||||||
|
mode: READ_WRITE
|
||||||
|
can_ip_forward: false
|
||||||
|
deletion_protection: false
|
||||||
|
description: Managed by the compute-vm Terraform module.
|
||||||
|
desired_status: null
|
||||||
|
enable_display: false
|
||||||
|
hostname: null
|
||||||
|
labels: null
|
||||||
|
machine_type: f1-micro
|
||||||
|
metadata: null
|
||||||
|
metadata_startup_script: null
|
||||||
|
name: test2
|
||||||
|
network_interface:
|
||||||
|
- access_config: []
|
||||||
|
alias_ip_range: []
|
||||||
|
ipv6_access_config: []
|
||||||
|
network: projects/xxx/global/networks/aaa
|
||||||
|
nic_type: null
|
||||||
|
queue_count: null
|
||||||
|
subnetwork: subnet_self_link
|
||||||
|
network_performance_config: []
|
||||||
|
params: []
|
||||||
|
project: project-id
|
||||||
|
resource_policies: null
|
||||||
|
scheduling:
|
||||||
|
- automatic_restart: true
|
||||||
|
instance_termination_action: null
|
||||||
|
local_ssd_recovery_timeout: []
|
||||||
|
maintenance_interval: null
|
||||||
|
max_run_duration: []
|
||||||
|
min_node_cpus: null
|
||||||
|
node_affinities: []
|
||||||
|
on_host_maintenance: MIGRATE
|
||||||
|
preemptible: false
|
||||||
|
provisioning_model: STANDARD
|
||||||
|
scratch_disk: []
|
||||||
|
service_account:
|
||||||
|
- scopes:
|
||||||
|
- https://www.googleapis.com/auth/cloud-platform
|
||||||
|
- https://www.googleapis.com/auth/userinfo.email
|
||||||
|
shielded_instance_config: []
|
||||||
|
tags: null
|
||||||
|
timeouts: null
|
||||||
|
zone: europe-west1-b
|
||||||
|
module.vm-managed-sa-example2.google_service_account.service_account[0]:
|
||||||
|
account_id: tf-vm-test2
|
||||||
|
description: null
|
||||||
|
disabled: false
|
||||||
|
display_name: Terraform VM test2.
|
||||||
|
project: project-id
|
||||||
|
timeouts: null
|
||||||
|
|
||||||
|
counts:
|
||||||
|
google_compute_instance: 1
|
||||||
|
google_service_account: 1
|
||||||
|
modules: 1
|
||||||
|
resources: 2
|
||||||
|
|
||||||
|
outputs: {}
|
|
@ -0,0 +1,75 @@
|
||||||
|
# Copyright 2023 Google LLC
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
values:
|
||||||
|
module.vm-managed-sa-example2.google_compute_instance.default[0]:
|
||||||
|
advanced_machine_features: []
|
||||||
|
allow_stopping_for_update: true
|
||||||
|
attached_disk: []
|
||||||
|
boot_disk:
|
||||||
|
- auto_delete: true
|
||||||
|
disk_encryption_key_raw: null
|
||||||
|
initialize_params:
|
||||||
|
- image: projects/debian-cloud/global/images/family/debian-11
|
||||||
|
resource_manager_tags: null
|
||||||
|
size: 10
|
||||||
|
type: pd-balanced
|
||||||
|
mode: READ_WRITE
|
||||||
|
can_ip_forward: false
|
||||||
|
deletion_protection: false
|
||||||
|
description: Managed by the compute-vm Terraform module.
|
||||||
|
desired_status: null
|
||||||
|
enable_display: false
|
||||||
|
hostname: null
|
||||||
|
labels: null
|
||||||
|
machine_type: f1-micro
|
||||||
|
metadata: null
|
||||||
|
metadata_startup_script: null
|
||||||
|
name: test2
|
||||||
|
network_interface:
|
||||||
|
- access_config: []
|
||||||
|
alias_ip_range: []
|
||||||
|
ipv6_access_config: []
|
||||||
|
network: projects/xxx/global/networks/aaa
|
||||||
|
nic_type: null
|
||||||
|
queue_count: null
|
||||||
|
subnetwork: subnet_self_link
|
||||||
|
network_performance_config: []
|
||||||
|
params: []
|
||||||
|
project: project-id
|
||||||
|
resource_policies: null
|
||||||
|
scheduling:
|
||||||
|
- automatic_restart: true
|
||||||
|
instance_termination_action: null
|
||||||
|
local_ssd_recovery_timeout: []
|
||||||
|
maintenance_interval: null
|
||||||
|
max_run_duration: []
|
||||||
|
min_node_cpus: null
|
||||||
|
node_affinities: []
|
||||||
|
on_host_maintenance: MIGRATE
|
||||||
|
preemptible: false
|
||||||
|
provisioning_model: STANDARD
|
||||||
|
scratch_disk: []
|
||||||
|
service_account: []
|
||||||
|
shielded_instance_config: []
|
||||||
|
tags: null
|
||||||
|
timeouts: null
|
||||||
|
zone: europe-west1-b
|
||||||
|
|
||||||
|
counts:
|
||||||
|
google_compute_instance: 1
|
||||||
|
modules: 1
|
||||||
|
resources: 1
|
||||||
|
|
||||||
|
outputs: {}
|
|
@ -1,49 +0,0 @@
|
||||||
# Copyright 2023 Google LLC
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
|
|
||||||
values:
|
|
||||||
module.vm-default-sa-example2.google_compute_instance.default[0]:
|
|
||||||
name: test3
|
|
||||||
project: project-id
|
|
||||||
service_account:
|
|
||||||
- scopes:
|
|
||||||
- https://www.googleapis.com/auth/devstorage.read_only
|
|
||||||
- https://www.googleapis.com/auth/logging.write
|
|
||||||
- https://www.googleapis.com/auth/monitoring.write
|
|
||||||
zone: europe-west1-b
|
|
||||||
module.vm-managed-sa-example.google_compute_instance.default[0]:
|
|
||||||
name: test1
|
|
||||||
project: project-id
|
|
||||||
service_account:
|
|
||||||
- scopes:
|
|
||||||
- https://www.googleapis.com/auth/cloud-platform
|
|
||||||
- https://www.googleapis.com/auth/userinfo.email
|
|
||||||
zone: europe-west1-b
|
|
||||||
module.vm-managed-sa-example.google_service_account.service_account[0]:
|
|
||||||
account_id: tf-vm-test1
|
|
||||||
display_name: Terraform VM test1.
|
|
||||||
project: project-id
|
|
||||||
module.vm-managed-sa-example2.google_compute_instance.default[0]:
|
|
||||||
name: test2
|
|
||||||
project: project-id
|
|
||||||
service_account:
|
|
||||||
- scopes:
|
|
||||||
- https://www.googleapis.com/auth/cloud-platform
|
|
||||||
zone: europe-west1-b
|
|
||||||
|
|
||||||
counts:
|
|
||||||
google_compute_instance: 3
|
|
||||||
google_service_account: 1
|
|
||||||
modules: 3
|
|
||||||
resources: 4
|
|
|
@ -57,9 +57,8 @@ values:
|
||||||
service_account:
|
service_account:
|
||||||
- email: vm-default@my-project.iam.gserviceaccount.com
|
- email: vm-default@my-project.iam.gserviceaccount.com
|
||||||
scopes:
|
scopes:
|
||||||
- https://www.googleapis.com/auth/devstorage.read_only
|
- https://www.googleapis.com/auth/cloud-platform
|
||||||
- https://www.googleapis.com/auth/logging.write
|
- https://www.googleapis.com/auth/userinfo.email
|
||||||
- https://www.googleapis.com/auth/monitoring.write
|
|
||||||
|
|
||||||
counts:
|
counts:
|
||||||
google_compute_instance_template: 1
|
google_compute_instance_template: 1
|
||||||
|
|
Loading…
Reference in New Issue