generated from kedacore/github-template
-
Notifications
You must be signed in to change notification settings - Fork 8
/
main.tf
48 lines (42 loc) · 2.17 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
data "google_project" "project" {}
resource "google_service_account" "service_account" {
account_id = "e2e-test-user"
display_name = "KEDA e2e test user"
}
resource "google_service_account_key" "credentials" {
service_account_id = google_service_account.service_account.name
}
resource "google_project_iam_member" "project" {
project = data.google_project.project.project_id
role = "roles/owner"
member = "serviceAccount:${google_service_account.service_account.email}"
}
resource "google_iam_workload_identity_pool" "pools" {
count = length(var.identity_providers)
project = data.google_project.project.project_id
workload_identity_pool_id = var.identity_providers[count.index].provider_name
display_name = var.identity_providers[count.index].provider_name
description = "Workload identity pool for ${var.identity_providers[count.index].provider_name}"
disabled = false
}
resource "google_iam_workload_identity_pool_provider" "main" {
count = length(google_iam_workload_identity_pool.pools)
project = data.google_project.project.project_id
workload_identity_pool_id = google_iam_workload_identity_pool.pools[count.index].workload_identity_pool_id
workload_identity_pool_provider_id = var.identity_providers[count.index].provider_name
display_name = var.identity_providers[count.index].provider_name
description = "Workload identity provider for ${var.identity_providers[count.index].provider_name}"
attribute_mapping = {
"google.subject" = "assertion.sub"
}
oidc {
allowed_audiences = ["sts.googleapis.com"]
issuer_uri = var.identity_providers[count.index].oidc_issuer_url
}
}
resource "google_service_account_iam_member" "wif-sa" {
count = length(google_iam_workload_identity_pool.pools)
service_account_id = google_service_account.service_account.id
role = "roles/iam.workloadIdentityUser"
member = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.pools[count.index].name}/*"
}