Skip to content

Commit 14f9570

Browse files
ameukamameukam
committed
Add Terraform subrepo for monitoring
Related to: - Ref: kubernetes#2588 Bootstrap a new suberepo that will host the Terraform resources consuming the GCP monitoring API. I also bumped the terraform provider for this subrepo and will the other declarations of the provider in a followup PR. Signed-off-by: Arnaud Meukam <[email protected]>
1 parent a54c739 commit 14f9570

File tree

6 files changed

+145
-4
lines changed

6 files changed

+145
-4
lines changed

‎infra/gcp/bash/ensure-main-project.sh

+10-4
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ readonly DNS_GROUP="[email protected]"
7474
readonly TERRAFORM_STATE_BUCKET_ENTRIES=(
7575
"${LEGACY_CLUSTER_TERRAFORM_BUCKET}:${CLUSTER_ADMINS_GROUP}"
7676
k8s-infra-tf-aws:[email protected]
77+
k8s-infra-tf-monitoring:"${CLUSTER_ADMINS_GROUP}"
7778
k8s-infra-tf-prow-clusters:[email protected]
7879
k8s-infra-tf-public-clusters:"${CLUSTER_ADMINS_GROUP}"
7980
k8s-infra-tf-public-pii:"${CLUSTER_ADMINS_GROUP}"
@@ -470,28 +471,33 @@ function ensure_main_project() {
470471
color 6 "Ensuring specific workload identity serviceaccounts exist in: ${project}"; (
471472
local svcacct_args cluster_args
472473

473-
color 6 "Ensuring GCP Auditor serviceaccount"
474+
color 6 "Ensuring GCP Auditor service account"
474475
# roles/viewer on kubernetes-public is a bootstrap; the true purpose
475476
# is custom role audit.viewer on the kubernetes.io org, but that is
476477
# handled by ensure-organization.sh
477478
svcacct_args=("${project}" "k8s-infra-gcp-auditor" "roles/viewer")
478479
cluster_args=("k8s-infra-prow-build-trusted" "${PROWJOB_POD_NAMESPACE}")
479480
ensure_workload_identity_serviceaccount "${svcacct_args[@]}" "${cluster_args[@]}" 2>&1 | indent
480481

481-
color 6 "Ensuring DNS Updater serviceaccount"
482+
color 6 "Ensuring DNS Updater service account"
482483
svcacct_args=("${project}" "k8s-infra-dns-updater" "roles/dns.admin")
483484
cluster_args=("k8s-infra-prow-build-trusted" "${PROWJOB_POD_NAMESPACE}")
484485
ensure_workload_identity_serviceaccount "${svcacct_args[@]}" "${cluster_args[@]}" 2>&1 | indent
485486

486-
color 6 "Ensuring Monitoring Viewer serviceaccount"
487+
color 6 "Ensuring Monitoring Viewer service account"
487488
svcacct_args=("${project}" "k8s-infra-monitoring-viewer" "roles/monitoring.viewer")
488489
cluster_args=("${project}" "monitoring")
489490
ensure_workload_identity_serviceaccount "${svcacct_args[@]}" "${cluster_args[@]}" 2>&1 | indent
490491

491-
color 6 "Ensuring Kubernetes External Secrets serviceaccount"
492+
color 6 "Ensuring Kubernetes External Secrets service account"
492493
svcacct_args=("${project}" "kubernetes-external-secrets" "roles/secretmanager.secretAccessor")
493494
cluster_args=("${project}" "kubernetes-external-secrets")
494495
ensure_workload_identity_serviceaccount "${svcacct_args[@]}" "${cluster_args[@]}" 2>&1 | indent
496+
497+
color 6 "Ensure Monitoring Admin service account for Terraform"
498+
svcacct_args=("${project}" "tf-monitoring-deployer" "roles/monitoring.admin")
499+
cluster_args=("${project}" "${PROWJOB_POD_NAMESPACE}")
500+
ensure_workload_identity_serviceaccount "${svcacct_args[@]}" "${cluster_args[@]}" 2>&1 | indent
495501
) 2>&1 | indent
496502

497503
color 6 "Ensuring DNS is configured in: ${project}"

‎infra/gcp/terraform/k8s-infra-monitoring/deploy.sh

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2021 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# intended to be run by k8s-infra-prow-build-trusted or a member of
18+
# [email protected]
19+
20+
set -o errexit
21+
set -o nounset
22+
set -o pipefail
23+
24+
SCRIPT_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
25+
26+
readonly project=kubernetes-public
27+
readonly region=us-central1
28+
29+
function deploy_terraform() {
30+
pushd "${SCRIPT_ROOT}"
31+
terraform init
32+
terraform apply -auto-approve
33+
popd
34+
}
35+
36+
function main() {
37+
echo "deploying resources in project ${project} and region ${region}"
38+
deploy_terraform
39+
}
40+
41+
main

‎infra/gcp/terraform/k8s-infra-monitoring/main.tf

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
Copyright 2021 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
data "google_project" "project" {
18+
project_id = "kubernetes-public"
19+
}
20+
21+
// Slack channel on https://kubernetes.slack.com used for alerting
22+
data "google_monitoring_notification_channel" "slack_alerts" {
23+
display_name = "#k8s-infra-alerts"
24+
project = data.google_project.project.project_id
25+
}
26+
27+

‎infra/gcp/terraform/k8s-infra-monitoring/provider.tf

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/*
2+
Copyright 2021 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
/*
18+
This file defines:
19+
- Required provider versions
20+
- Storage backend details
21+
*/
22+
23+
terraform {
24+
25+
required_providers {
26+
google = {
27+
source = "hashicorp/google"
28+
version = "~> 3.87.0"
29+
}
30+
google-beta = {
31+
source = "hashicorp/google-beta"
32+
version = "~> 3.87.0"
33+
}
34+
}
35+
}

‎infra/gcp/terraform/k8s-infra-monitoring/versions.tf

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/*
2+
Copyright 2021 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
/*
18+
This file defines:
19+
- Required Terraform version
20+
*/
21+
22+
terraform {
23+
required_version = "~> 1.0.0"
24+
}

‎infra/gcp/terraform/k8s-infra-prow-build-trusted/prow-build-trusted/resources/test-pods/test-pods-serviceaccounts.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,14 @@ metadata:
5757
iam.gke.io/gcp-service-account: [email protected]
5858
name: gsuite-groups-manager
5959
namespace: test-pods
60+
---
61+
kind: ServiceAccount
62+
apiVersion: v1
63+
metadata:
64+
annotations:
65+
iam.gke.io/gcp-service-account: [email protected]
66+
name: tf-monitoring-deployer
67+
namespace: test-pods
6068

6169
# Image promotion service accounts
6270
---

0 commit comments

Comments
 (0)