Skip to content
This repository has been archived by the owner on Oct 20, 2023. It is now read-only.

Feature/add gke tests #541

Closed
wants to merge 11 commits into from
+1,355 −807
Closed

Feature/add gke tests #541

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
b6632b2
Add tests for the GKE end-to-end example.
gkowalski-google Mar 9, 2020
9e3be7e
Update symlinks for client tests
gkowalski-google Mar 9, 2020
4d65c21
Move shared controls to shared controls directory
gkowalski-google Mar 9, 2020
6be5f57
Update test for cron job
gkowalski-google Mar 9, 2020
0348958
Add newline at end of example outputs
gkowalski-google Mar 9, 2020
4fc5019
Fix lint issues
gkowalski-google Mar 9, 2020
5cdc2df
Updating the way Forseti Server Configuration is retrieved from GCS (…
hiloboy0119 Mar 12, 2020
ea57b3b
Remove version constraint since it's already specified in the version…
gkowalski-google Mar 12, 2020
978b20e
Lint fixes
gkowalski-google Mar 16, 2020
34416a1
Use workload identity namespace output from the cluster to resolve th…
gkowalski-google Mar 16, 2020
fac9fbd
Update readme for gke example
gkowalski-google Mar 16, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions examples/on_gke_end_to_end/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,4 +174,5 @@ module "forseti" {
policy_library_sync_enabled = var.policy_library_sync_enabled
server_log_level = var.server_log_level
client_instance_metadata = var.client_instance_metadata
workload_identity_namespace = module.gke.identity_namespace
}
8 changes: 4 additions & 4 deletions modules/on_gke/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ locals {
"storage-api.googleapis.com",
"groupssettings.googleapis.com",
]
workload_identity = "${var.project_id}.svc.id.goog"
workload_identity_namespace = var.workload_identity_namespace == null ? "${var.project_id}.svc.id.goog" : var.workload_identity_namespace
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I recommend not making this conditional: input variable or bust.

workload_identity_server_suffix = "[${local.kubernetes_namespace}/forseti-server]"
workload_identity_client_suffix = "[${local.kubernetes_namespace}/forseti-orchestrator]"
workload_config_validator_suffix = "[${local.kubernetes_namespace}/config-validator]"
Expand Down Expand Up @@ -158,7 +158,7 @@ resource "google_service_account_iam_binding" "forseti_server_workload_identity"
role = "roles/iam.workloadIdentityUser"

members = [
"serviceAccount:${local.workload_identity}${local.workload_identity_server_suffix}"
"serviceAccount:${local.workload_identity_namespace}${local.workload_identity_server_suffix}"
]
}

Expand All @@ -167,8 +167,8 @@ resource "google_service_account_iam_binding" "forseti_client_workload_identity"
role = "roles/iam.workloadIdentityUser"

members = [
"serviceAccount:${local.workload_identity}${local.workload_identity_client_suffix}",
"serviceAccount:${local.workload_identity}${local.workload_config_validator_suffix}"
"serviceAccount:${local.workload_identity_namespace}${local.workload_identity_client_suffix}",
"serviceAccount:${local.workload_identity_namespace}${local.workload_config_validator_suffix}"
]
}

Expand Down
8 changes: 5 additions & 3 deletions modules/on_gke/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,12 +60,16 @@ variable "sendgrid_api_key" {
#------------#
# GKE config #
#------------#

variable "gke_node_pool_name" {
description = "The name of the GKE node-pool where Forseti is being deployed"
default = "default-pool"
}

variable "workload_identity_namespace" {
description = "Workload Identity namespace"
default = null
}

#----------------#
# Forseti config #
#----------------#
Expand Down Expand Up @@ -710,7 +714,6 @@ variable "inventory_email_summary_enabled" {
#---------------------------------------#
# Groups Settings scanner configuration #
#---------------------------------------#

variable "groups_settings_max_calls" {
description = "Maximum calls that can be made to the G Suite Groups API"
default = "5"
Expand Down Expand Up @@ -893,7 +896,6 @@ variable "cloudsql_password" {
#-------------#
# Helm config #
#-------------#

variable "git_sync_image" {
description = "The container image used by the config-validator git-sync side-car"
default = "gcr.io/google-containers/git-sync"
Expand Down