Skip to content

Commit 131e3d0

Browse files
boomanaiden154boomanaiden154
authored
[CI] Wire up kubernetes service accounts for object caching
This patch wires up the kubernetes service accounts for object caching. This will enable attaching them to test pods to test that the authentication and everything actually works. After we have validated that the setup works we can work on enabling it on all the incoming jobs. Reviewers: dschuff, lnihlen, Keenuts, cmtice, gburgessiv Reviewed By: cmtice Pull Request: #509
1 parent 31d03a5 commit 131e3d0

File tree

4 files changed

+81
-21
lines changed

4 files changed

+81
-21
lines changed

‎premerge/gke_cluster/outputs.tf

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,12 @@ output "client_key" {
1212

1313
output "cluster_ca_certificate" {
1414
value = google_container_cluster.llvm_premerge.master_auth.0.cluster_ca_certificate
15-
}
15+
}
16+
17+
output "linux_object_cache_gcp_service_account_email" {
18+
value = google_service_account.object_cache_linux_gsa.email
19+
}
20+
21+
output "windows_2022_object_cache_gcp_service_account_email" {
22+
value = google_service_account.object_cache_windows_gsa.email
23+
}

‎premerge/main.tf

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -138,33 +138,41 @@ provider "kubernetes" {
138138
}
139139

140140
module "premerge_cluster_us_central_resources" {
141-
source = "./premerge_resources"
142-
github_app_id = data.google_secret_manager_secret_version.github_app_id.secret_data
143-
github_app_installation_id = data.google_secret_manager_secret_version.github_app_installation_id.secret_data
144-
github_app_private_key = data.google_secret_manager_secret_version.github_app_private_key.secret_data
145-
cluster_name = "llvm-premerge-cluster-us-central"
146-
grafana_token = data.google_secret_manager_secret_version.grafana_token.secret_data
147-
runner_group_name = "llvm-premerge-cluster-us-central"
148-
linux_runners_namespace_name = local.linux_runners_namespace_name
149-
windows_2022_runners_namespace_name = local.windows_2022_runners_namespace_name
150-
github_arc_version = "0.12.1"
141+
source = "./premerge_resources"
142+
github_app_id = data.google_secret_manager_secret_version.github_app_id.secret_data
143+
github_app_installation_id = data.google_secret_manager_secret_version.github_app_installation_id.secret_data
144+
github_app_private_key = data.google_secret_manager_secret_version.github_app_private_key.secret_data
145+
cluster_name = "llvm-premerge-cluster-us-central"
146+
grafana_token = data.google_secret_manager_secret_version.grafana_token.secret_data
147+
runner_group_name = "llvm-premerge-cluster-us-central"
148+
linux_runners_namespace_name = local.linux_runners_namespace_name
149+
linux_runners_kubernetes_service_account_name = local.linux_runners_kubernetes_service_account_name
150+
windows_2022_runners_namespace_name = local.windows_2022_runners_namespace_name
151+
windows_2022_runners_kubernetes_service_account_name = local.windows_2022_runners_kubernetes_service_account_name
152+
linux_object_cache_gcp_service_account_email = module.premerge_cluster_us_central.linux_object_cache_gcp_service_account_email
153+
windows_2022_object_cache_gcp_service_account_email = module.premerge_cluster_us_central.windows_2022_object_cache_gcp_service_account_email
154+
github_arc_version = "0.12.1"
151155
providers = {
152156
kubernetes = kubernetes.llvm-premerge-us-central
153157
helm = helm.llvm-premerge-us-central
154158
}
155159
}
156160

157161
module "premerge_cluster_us_west_resources" {
158-
source = "./premerge_resources"
159-
github_app_id = data.google_secret_manager_secret_version.github_app_id.secret_data
160-
github_app_installation_id = data.google_secret_manager_secret_version.github_app_installation_id.secret_data
161-
github_app_private_key = data.google_secret_manager_secret_version.github_app_private_key.secret_data
162-
cluster_name = "llvm-premerge-cluster-us-west"
163-
grafana_token = data.google_secret_manager_secret_version.grafana_token.secret_data
164-
runner_group_name = "llvm-premerge-cluster-us-west"
165-
linux_runners_namespace_name = local.linux_runners_namespace_name
166-
windows_2022_runners_namespace_name = local.windows_2022_runners_namespace_name
167-
github_arc_version = "0.12.1"
162+
source = "./premerge_resources"
163+
github_app_id = data.google_secret_manager_secret_version.github_app_id.secret_data
164+
github_app_installation_id = data.google_secret_manager_secret_version.github_app_installation_id.secret_data
165+
github_app_private_key = data.google_secret_manager_secret_version.github_app_private_key.secret_data
166+
cluster_name = "llvm-premerge-cluster-us-west"
167+
grafana_token = data.google_secret_manager_secret_version.grafana_token.secret_data
168+
runner_group_name = "llvm-premerge-cluster-us-west"
169+
linux_runners_namespace_name = local.linux_runners_namespace_name
170+
linux_runners_kubernetes_service_account_name = local.linux_runners_kubernetes_service_account_name
171+
windows_2022_runners_namespace_name = local.windows_2022_runners_namespace_name
172+
windows_2022_runners_kubernetes_service_account_name = local.windows_2022_runners_kubernetes_service_account_name
173+
linux_object_cache_gcp_service_account_email = module.premerge_cluster_us_central.linux_object_cache_gcp_service_account_email
174+
windows_2022_object_cache_gcp_service_account_email = module.premerge_cluster_us_central.windows_2022_object_cache_gcp_service_account_email
175+
github_arc_version = "0.12.1"
168176
providers = {
169177
kubernetes = kubernetes.llvm-premerge-us-west
170178
helm = helm.llvm-premerge-us-west

‎premerge/premerge_resources/main.tf

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,30 @@ resource "helm_release" "github_actions_runner_set_libcxx_next" {
234234
]
235235
}
236236

237+
resource "kubernetes_service_account" "linux_object_cache_ksa" {
238+
metadata {
239+
name = var.linux_runners_kubernetes_service_account_name
240+
namespace = var.linux_runners_namespace_name
241+
annotations = {
242+
"iam.gke.io/gcp-service-account" = var.linux_object_cache_gcp_service_account_email
243+
}
244+
}
245+
246+
depends_on = [kubernetes_namespace.llvm_premerge_linux_runners]
247+
}
248+
249+
resource "kubernetes_service_account" "windows_2022_object_cache_ksa" {
250+
metadata {
251+
name = var.windows_2022_runners_kubernetes_service_account_name
252+
namespace = var.windows_2022_runners_namespace_name
253+
annotations = {
254+
"iam.gke.io/gcp-service-account" = var.windows_2022_object_cache_gcp_service_account_email
255+
}
256+
}
257+
258+
depends_on = [kubernetes_namespace.llvm_premerge_windows_2022_runners]
259+
}
260+
237261
resource "kubernetes_namespace" "grafana" {
238262
metadata {
239263
name = "grafana"

‎premerge/premerge_resources/variables.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,27 @@ variable "linux_runners_namespace_name" {
8080
type = string
8181
}
8282

83+
variable "linux_runners_kubernetes_service_account_name" {
84+
description = "The name of the kubernetes service account used to access the Linux object cache GCS bucket"
85+
type = string
86+
}
87+
8388
variable "windows_2022_runners_namespace_name" {
8489
description = "The name of the namespace containing the Windows runners"
8590
type = string
8691
}
92+
93+
variable "windows_2022_runners_kubernetes_service_account_name" {
94+
description = "The name of the kubernetes service account used to access the Windows object cache GCS bucket"
95+
type = string
96+
}
97+
98+
variable "linux_object_cache_gcp_service_account_email" {
99+
description = "The email associated with the service account for accessing the object cache on Linux."
100+
type = string
101+
}
102+
103+
variable "windows_2022_object_cache_gcp_service_account_email" {
104+
description = "The email associated with the service account for accessing the object cache on Windows."
105+
type = string
106+
}

0 commit comments

Comments
 (0)