Skip to content

Allow service account impersonation in the local-exec gcloud runs. #151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
May 24, 2022
Merged

Allow service account impersonation in the local-exec gcloud runs. #151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4fc7a67
Allow service account impersonation
rwblokzijl Mar 30, 2022
1f435d4
Update docs
rwblokzijl Mar 30, 2022
214eea9
Fix linting error
rwblokzijl Mar 30, 2022
2ec1ef1
Merge branch 'master' of github.com:terraform-google-modules/terrafor…
rwblokzijl Apr 6, 2022
e566e6f
Apply suggested changes
rwblokzijl May 23, 2022
def7e76
Update docs
rwblokzijl May 23, 2022
b45871a
Add period
rwblokzijl May 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions modules/cloudbuild/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ Functional examples and sample Cloud Build definitions are included in the [exam
| folder\_id | The ID of a folder to host this project | `string` | `""` | no |
| gar\_repo\_name | Custom name to use for GAR repo. | `string` | `""` | no |
| group\_org\_admins | Google Group for GCP Organization Administrators | `string` | n/a | yes |
| impersonate\_service\_account | The service account to impersonate while running the gcloud builds submit command. | `string` | `""` | no |
| org\_id | GCP Organization ID | `string` | n/a | yes |
| project\_id | Custom project ID to use for project created. | `string` | `""` | no |
| project\_labels | Labels to apply to the project. | `map(string)` | `{}` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/cloudbuild/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ locals {
activate_apis = distinct(concat(var.activate_apis, local.cloudbuild_apis))
apply_branches_regex = "^(${join("|", var.terraform_apply_branches)})$"
gar_name = split("/", google_artifact_registry_repository.tf-image-repo.name)[length(split("/", google_artifact_registry_repository.tf-image-repo.name)) - 1]
impersonate_service_account = var.impersonate_service_account != "" ? "--impersonate-service-account=${var.impersonate_service_account}" : ""
}

resource "random_id" "suffix" {
Expand Down Expand Up @@ -193,7 +194,7 @@ resource "null_resource" "cloudbuild_terraform_builder" {

provisioner "local-exec" {
command = <<EOT
gcloud builds submit ${path.module}/cloudbuild_builder/ --project ${module.cloudbuild_project.project_id} --config=${path.module}/cloudbuild_builder/cloudbuild.yaml --substitutions=_TERRAFORM_VERSION=${var.terraform_version},_TERRAFORM_VERSION_SHA256SUM=${var.terraform_version_sha256sum},_TERRAFORM_VALIDATOR_RELEASE=${var.terraform_validator_release},_REGION=${google_artifact_registry_repository.tf-image-repo.location},_REPOSITORY=${local.gar_name}
gcloud ${local.impersonate_service_account} builds submit ${path.module}/cloudbuild_builder/ --project ${module.cloudbuild_project.project_id} --config=${path.module}/cloudbuild_builder/cloudbuild.yaml --substitutions=_TERRAFORM_VERSION=${var.terraform_version},_TERRAFORM_VERSION_SHA256SUM=${var.terraform_version_sha256sum},_TERRAFORM_VALIDATOR_RELEASE=${var.terraform_validator_release},_REGION=${google_artifact_registry_repository.tf-image-repo.location},_REPOSITORY=${local.gar_name}
EOT
}
depends_on = [
Expand Down
5 changes: 5 additions & 0 deletions modules/cloudbuild/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,3 +187,8 @@ variable "random_suffix" {
default = true
}

variable "impersonate_service_account" {
description = "The service account to impersonate while running the gcloud builds submit command."
type = string
default = ""
}