|
1 | 1 | /** |
2 | | - * Copyright 2018 Google LLC |
| 2 | + * Copyright 2022 Google LLC |
3 | 3 | * |
4 | 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
5 | 5 | * you may not use this file except in compliance with the License. |
|
14 | 14 | * limitations under the License. |
15 | 15 | */ |
16 | 16 |
|
17 | | -data "google_project" "asm_project" { |
18 | | - project_id = var.project_id |
19 | | -} |
20 | | - |
21 | 17 | locals { |
22 | | - options_string = length(var.options) > 0 ? join(",", var.options) : "none" |
23 | | - custom_overlays_string = length(var.custom_overlays) > 0 ? join(",", var.custom_overlays) : "none" |
24 | | - asm_git_tag_string = (var.asm_git_tag == "" ? "none" : var.asm_git_tag) |
25 | | - service_account_string = (var.service_account == "" ? "none" : var.service_account) |
26 | | - key_file_string = (var.key_file == "" ? "none" : var.key_file) |
27 | | - ca_cert = lookup(var.ca_certs, "ca_cert", "none") |
28 | | - ca_key = lookup(var.ca_certs, "ca_key", "none") |
29 | | - root_cert = lookup(var.ca_certs, "root_cert", "none") |
30 | | - cert_chain = lookup(var.ca_certs, "cert_chain", "none") |
31 | | - revision_name_string = (var.revision_name == "" ? "none" : var.revision_name) |
32 | | - asm_minor_version = tonumber(split(".", var.asm_version)[1]) |
33 | | - # https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages/blob/1cf61b679cd369f42a0e735f8e201de1a6a6433b/scripts/asm-installer/install_asm#L1970 |
34 | | - iam_roles = [ |
35 | | - "roles/container.admin", |
36 | | - "roles/meshconfig.admin", |
37 | | - "roles/gkehub.admin", |
38 | | - ] |
39 | | - # https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages/blob/1cf61b679cd369f42a0e735f8e201de1a6a6433b/scripts/asm-installer/install_asm#L1958 |
40 | | - mcp_iam_roles = [ |
41 | | - "roles/serviceusage.serviceUsageConsumer", |
42 | | - "roles/container.admin", |
43 | | - "roles/monitoring.metricWriter", |
44 | | - "roles/logging.logWriter", |
45 | | - "roles/gkehub.viewer", |
46 | | - "roles/gkehub.gatewayAdmin", |
47 | | - ] |
48 | | - # if enable_gcp_iam_roles is set, grant IAM roles to first non null principal in the order below |
49 | | - asm_iam_member = var.enable_gcp_iam_roles ? coalesce(var.impersonate_service_account, var.service_account, var.iam_member) : "" |
50 | | - # compute any additonal resources that ASM provisioner should depend on |
51 | | - additional_depends_on = concat(var.enable_gcp_apis ? [module.asm-services[0].project_id] : [], local.asm_iam_member != "" ? [for k, v in google_project_iam_member.asm_iam : v.etag] : []) |
52 | | - # base command template for ASM installation |
53 | | - kubectl_create_command_base = "${path.module}/scripts/install_asm.sh ${var.project_id} ${var.cluster_name} ${var.location} ${var.asm_version} ${var.mode} ${var.managed_control_plane} ${var.skip_validation} ${local.options_string} ${local.custom_overlays_string} ${var.enable_all} ${var.enable_cluster_roles} ${var.enable_cluster_labels} ${var.enable_gcp_components} ${var.enable_registration} ${var.outdir} ${var.ca} ${local.ca_cert} ${local.ca_key} ${local.root_cert} ${local.cert_chain} ${local.service_account_string} ${local.key_file_string} ${local.asm_git_tag_string} ${local.revision_name_string}" |
| 18 | + // GKE release channel is a list with max length 1 https://github.com/hashicorp/terraform-provider-google/blob/9d5f69f9f0f74f1a8245f1a52dd6cffb572bbce4/google/resource_container_cluster.go#L954 |
| 19 | + gke_release_channel = data.google_container_cluster.asm.release_channel != null ? data.google_container_cluster.asm.release_channel[0].channel : "" |
| 20 | + gke_release_channel_filtered = lower(local.gke_release_channel) == "unspecified" ? "" : local.gke_release_channel |
| 21 | + // In order or precedence, use (1) user specified channel, (2) GKE release channel, and (3) regular channel |
| 22 | + channel = lower(coalesce(var.channel, local.gke_release_channel_filtered, "regular")) |
| 23 | + revision_name = "asm-managed${local.channel == "regular" ? "" : "-${local.channel}"}" |
| 24 | + // Fleet ID should default to project ID if unset |
| 25 | + fleet_id = coalesce(var.fleet_id, var.project_id) |
54 | 26 | } |
55 | 27 |
|
56 | | -resource "google_project_iam_member" "asm_iam" { |
57 | | - for_each = toset(local.asm_iam_member != "" ? (var.managed_control_plane ? local.mcp_iam_roles : local.iam_roles) : []) |
| 28 | +data "google_container_cluster" "asm" { |
58 | 29 | project = var.project_id |
59 | | - role = each.value |
60 | | - member = "serviceAccount:${local.asm_iam_member}" |
| 30 | + name = var.cluster_name |
| 31 | + location = var.cluster_location |
61 | 32 | } |
62 | 33 |
|
63 | | -module "asm-services" { |
64 | | - source = "terraform-google-modules/project-factory/google//modules/project_services" |
65 | | - version = "~> 11.3" |
66 | | - |
67 | | - count = var.enable_gcp_apis ? 1 : 0 |
| 34 | +resource "kubernetes_namespace" "system" { |
| 35 | + metadata { |
| 36 | + name = "istio-system" |
| 37 | + } |
| 38 | +} |
68 | 39 |
|
69 | | - project_id = var.project_id |
70 | | - disable_services_on_destroy = false |
71 | | - disable_dependent_services = false |
| 40 | +resource "kubernetes_config_map" "asm_options" { |
| 41 | + metadata { |
| 42 | + name = "asm-options" |
| 43 | + namespace = kubernetes_namespace.system.metadata[0].name |
| 44 | + } |
72 | 45 |
|
73 | | - # https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages/blob/1cf61b679cd369f42a0e735f8e201de1a6a6433b/scripts/asm-installer/install_asm#L2005 |
74 | | - activate_apis = [ |
75 | | - "container.googleapis.com", |
76 | | - "monitoring.googleapis.com", |
77 | | - "logging.googleapis.com", |
78 | | - "cloudtrace.googleapis.com", |
79 | | - "meshtelemetry.googleapis.com", |
80 | | - "meshconfig.googleapis.com", |
81 | | - "meshca.googleapis.com", |
82 | | - "iamcredentials.googleapis.com", |
83 | | - "gkeconnect.googleapis.com", |
84 | | - "gkehub.googleapis.com", |
85 | | - "cloudresourcemanager.googleapis.com", |
86 | | - "stackdriver.googleapis.com", |
87 | | - ] |
| 46 | + data = { |
| 47 | + multicluster_mode = var.multicluster_mode |
| 48 | + } |
88 | 49 | } |
89 | 50 |
|
90 | | -module "asm_install" { |
| 51 | +module "cpr" { |
91 | 52 | source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper" |
92 | 53 | version = "~> 3.1" |
93 | 54 |
|
94 | | - module_depends_on = concat([var.cluster_endpoint], local.additional_depends_on) |
| 55 | + project_id = var.project_id |
| 56 | + cluster_name = var.cluster_name |
| 57 | + cluster_location = var.cluster_location |
95 | 58 |
|
96 | | - gcloud_sdk_version = var.gcloud_sdk_version |
97 | | - upgrade = true |
98 | | - additional_components = ["kubectl", "kpt", "beta"] |
99 | | - cluster_name = var.cluster_name |
100 | | - cluster_location = var.location |
101 | | - project_id = var.project_id |
102 | | - service_account_key_file = var.service_account_key_file |
103 | | - impersonate_service_account = var.impersonate_service_account |
| 59 | + kubectl_create_command = "${path.module}/scripts/create_cpr.sh ${local.revision_name} ${local.channel} ${var.enable_cni} ${var.enable_vpc_sc}" |
| 60 | + kubectl_destroy_command = "${path.module}/scripts/destroy_cpr.sh ${local.revision_name}" |
104 | 61 |
|
105 | | - # enable_namespace_creation flag is only available starting 1.10 |
106 | | - kubectl_create_command = (local.asm_minor_version > 9 ? "${local.kubectl_create_command_base} ${var.enable_namespace_creation}" : local.kubectl_create_command_base) |
107 | | - kubectl_destroy_command = "${path.module}/scripts/destroy_asm.sh" |
| 62 | + module_depends_on = [kubernetes_config_map.asm_options] |
108 | 63 | } |
0 commit comments