feat(bootstrap): TF changes for GCP CAPI migration (#835)

Signed-off-by: David van der Spek <[email protected]>

Author: davidspek

bootstrap/plural/recipes/gcp-cluster-api-simple-test.yaml

@@ -16,7 +16,7 @@ sections:
           message: must begin with a lowercase letter, and can only contain lowercase letters, numbers or hyphens after
     items:
       - type: TERRAFORM
-        name: gcp-bootstrap-cluster-api
+        name: gcp-bootstrap
       - type: HELM
         name: bootstrap
       - type: HELM

bootstrap/terraform/gcp-bootstrap-cluster-api/deps.yaml

@@ -1,3 +1,3 @@
 # GCP Kubernetes bootstrapping
 
-Provisions a gke cluster with node pool, along with default networking etc.
+Provisions a gke cluster with node pool, along with default networking etc.

bootstrap/terraform/gcp-bootstrap-cluster-api/main.tf

@@ -2,13 +2,14 @@ apiVersion: plural.sh/v1alpha1
 kind: Dependencies
 metadata:
   description: Creates a GKE cluster and adds initial configuration
-  version: 0.2.23
+  version: 0.2.24
 spec:
   dependencies: []
   providers:
   - gcp
   outputs:
     cluster: cluster
     vpc_network: vpc_network
+    capi_sa_workload_identity_email: capi_sa_workload_identity_email
   provider_wirings:
     cluster: module.gcp-bootstrap.cluster

bootstrap/terraform/gcp-bootstrap-cluster-api/terraform.tfvars

@@ -5,4 +5,4 @@ locals {
   services_cidr_name = "${var.gcp_region}-${var.cluster_name}-services"
   vpc_network_name   = var.vpc_network_name != "" ? var.vpc_network_name : "${var.vpc_name_prefix}-network"
   vpc_subnetwork_name = var.vpc_subnetwork_name != "" ? var.vpc_subnetwork_name : "${var.vpc_name_prefix}-subnetwork"
-}
+}

bootstrap/terraform/gcp-bootstrap-cluster-api/variables.tf

@@ -1,4 +1,5 @@
 resource "google_compute_network" "vpc_network" {
+  count                   = var.cluster_api ? 0 : 1
   name                    = local.vpc_network_name
   auto_create_subnetworks = "false"
 
@@ -13,11 +14,10 @@ resource "google_compute_network" "vpc_network" {
 }
 
 resource "google_compute_subnetwork" "vpc_subnetwork" {
-  name = local.vpc_subnetwork_name
-
+  count         = var.cluster_api ? 0 : 1
+  name          = local.vpc_subnetwork_name
   ip_cidr_range = var.vpc_subnetwork_cidr_range
-
-  network = google_compute_network.vpc_network.name
+  network       = one(google_compute_network.vpc_network[*].name)
 
   secondary_ip_range {
     range_name    = local.pods_cidr_name
@@ -44,14 +44,15 @@ resource "google_compute_subnetwork" "vpc_subnetwork" {
 }
 
 module "gke" {
+  count                      = var.cluster_api ? 0 : 1
   source                     = "github.com/pluralsh/terraform-google-kubernetes-engine?ref=filestore-csi-driver"
   project_id                 = var.gcp_project_id
   name                       = var.cluster_name
   region                     = local.gcp_region
-  network                    = google_compute_network.vpc_network.name
-  subnetwork                 = google_compute_subnetwork.vpc_subnetwork.name
-  ip_range_pods              = google_compute_subnetwork.vpc_subnetwork.secondary_ip_range[0].range_name
-  ip_range_services          = google_compute_subnetwork.vpc_subnetwork.secondary_ip_range[1].range_name
+  network                    = one(google_compute_network.vpc_network[*].name)
+  subnetwork                 = one(google_compute_subnetwork.vpc_subnetwork[*].name)
+  ip_range_pods              = one(google_compute_subnetwork.vpc_subnetwork[*].secondary_ip_range[0].range_name)
+  ip_range_services          = one(google_compute_subnetwork.vpc_subnetwork[*].secondary_ip_range[1].range_name)
   horizontal_pod_autoscaling = true
   http_load_balancing        = true
   remove_default_node_pool   = true
@@ -69,7 +70,7 @@ module "gke" {
     },
     var.cluster_labels,
   )
-  grant_registry_access      = var.grant_registry_access
+  grant_registry_access = var.grant_registry_access
 
   node_pools = var.node_pools
 
@@ -88,18 +89,40 @@ module "gke" {
 }
 
 resource "kubernetes_namespace" "bootstrap" {
+  count = var.cluster_api ? 0 : 1
+
   metadata {
     name = var.namespace
 
     labels = {
       "app.kubernetes.io/managed-by" = "plural"
-      "app.plural.sh/name" = "bootstrap"
+      "app.plural.sh/name"           = "bootstrap"
     }
   }
 
   depends_on = [module.gke.endpoint]
 }
 
+resource "kubernetes_service_account" "certmanager" {
+  count = var.cluster_api ? 0 : 1
+  metadata {
+    name      = "certmanager"
+    namespace = var.namespace
+
+    annotations = {
+      "iam.gke.io/gcp-service-account" = module.certmanager-workload-identity.gcp_service_account_email
+    }
+  }
+
+  depends_on = [kubernetes_namespace.bootstrap]
+}
+
+data "google_container_cluster" "cluster" {
+  count    = var.cluster_api ? 1 : 0
+  name     = var.cluster_name
+  location = var.gcp_region
+}
+
 module "externaldns-workload-identity" {
   source              = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
   name                = "${var.cluster_name}-externaldns"
@@ -139,15 +162,20 @@ module "certmanager-workload-identity" {
   depends_on = [google_project_service.iam]
 }
 
-resource "kubernetes_service_account" "certmanager" {
-  metadata {
-    name      = "certmanager"
-    namespace = var.namespace
-
-    annotations = {
-      "iam.gke.io/gcp-service-account" = module.certmanager-workload-identity.gcp_service_account_email
-    }
-  }
+module "capi-workload-identity" {
+  source              = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
+  name                = "${var.cluster_name}-cluster-api-provider-gcp"
+  namespace           = var.namespace
+  project_id          = var.gcp_project_id
+  use_existing_k8s_sa = true
+  annotate_k8s_sa     = false
+  k8s_sa_name         = "bootstrap-cluster-api-provider-gcp"
+  roles               = [
+    "roles/iam.serviceAccountUser",
+    "roles/iam.workloadIdentityUser",
+    "roles/compute.admin",
+    "roles/container.admin",
+  ]
 
-  depends_on = [kubernetes_namespace.bootstrap]
-}
+  module_depends_on = [google_project_service.iam]
+}

bootstrap/terraform/gcp-bootstrap/README.md

@@ -0,0 +1,51 @@
+/** main.tf **/
+moved {
+  from = google_compute_network.vpc_network
+  to = google_compute_network.vpc_network[0]
+}
+
+moved {
+  from = google_compute_subnetwork.vpc_subnetwork
+  to = google_compute_subnetwork.vpc_subnetwork[0]
+}
+
+moved {
+  from = module.gke
+  to = module.gke[0]
+}
+
+moved {
+  from = kubernetes_namespace.bootstrap
+  to = kubernetes_namespace.bootstrap[0]
+}
+
+moved {
+  from = kubernetes_service_account.certmanager
+  to = kubernetes_service_account.certmanager[0]
+}
+
+/** services.tf **/
+moved {
+  from = google_project_service.gcr
+  to = google_project_service.gcr[0]
+}
+
+moved {
+  from = google_project_service.container
+  to = google_project_service.container[0]
+}
+
+moved {
+  from = google_project_service.storage
+  to = google_project_service.storage[0]
+}
+
+moved {
+  from = google_project_service.dns
+  to = google_project_service.dns[0]
+}
+
+moved {
+  from = google_project_service.compute
+  to = google_project_service.compute[0]
+}