GCP: conditionally create bootstrap service account #6853
Conversation
We need to read GCP service account credentials for the GCP XPN passthrough use case. This commit moves the logic into the gcp tfvars package so that as the service account parsing logic becomes more complex it is contained within the gcp package--not the general tfvars.
|
/retest |
|
/cc @barbacbd |
patrickdillon
force-pushed
the
bootstrap-sa-passthrough
branch
from
a387765 to
9bdb61e
Compare
data/data/gcp/bootstrap/main.tf
Outdated
There was a problem hiding this comment.
This is only used once, should we bother making a local variable?
This changes the default behavior of always generating a service account to sign the ignition URL, to only generating the service account when it is needed; i.e. when authenticating with environmental authentication. Most of the time users provide a service account with key so we can just use that, as we did before environmental auth was recently introduced.
patrickdillon
force-pushed
the
bootstrap-sa-passthrough
branch
from
9bdb61e to
7deb657
Compare
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: patrickdillon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
@patrickdillon: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
4 participants
#6330, which introduced environmental auth, changed the default behavior of all installs to create a new service account for signing the ignition URL. Instead, we should only create that service account when using environmental auth (or for some other reason don't have a service account with a key).