Struggling a bit with something that seems pretty ...
# generalo
orange-tailor-85423
10/22/2018, 5:52 PMStruggling a bit with something that seems pretty simple in TF - building a service account then calling the ID of that account. I think I'm miissing something simple but could use some review
c
creamy-potato-29402
10/22/2018, 6:37 PM@orange-tailor-85423 what do you mean “calling the ID of that account”?
o
orange-tailor-85423
10/22/2018, 6:37 PMwhat that API expects - it wants the service account ID; /projects/mindbody/etc/etc/serviceaccount
orange-tailor-85423
10/22/2018, 6:38 PMSo I created that account - now I need to get that serviceAccountID and pass it to the function that creates the IAM/permissions
c
creamy-potato-29402
10/22/2018, 6:38 PMUh, in the code below you’re populating
serviceAccountIdnewserviceaccount.metadata.get()newserviceaccount.metadata.apply(m => m.name)creamy-potato-29402
10/22/2018, 6:38 PMor something like that.
o
orange-tailor-85423
10/22/2018, 6:38 PMok
c
creamy-potato-29402
10/22/2018, 6:39 PMBut, that does not look like what you’re doing before?
creamy-potato-29402
10/22/2018, 6:39 PMer, below?
creamy-potato-29402
10/22/2018, 6:39 PMWhat is
google_service_account.k8s_node.namecreamy-potato-29402
10/22/2018, 6:39 PMIs that equivalent to
.metadata.namecreamy-potato-29402
10/22/2018, 6:40 PMBecause it looks like that’s actually supposed to be a
google_service_accountServiceAccounto
orange-tailor-85423
10/22/2018, 6:40 PMyea, I think just bad naming on our part
c
creamy-potato-29402
10/22/2018, 6:41 PMNo, I mean that the GCP API seems to be asking for the ID of a GCP service account.
o
orange-tailor-85423
10/22/2018, 6:41 PMok - so I guess more general - I want to do this in a function rather than static const
c
creamy-potato-29402
10/22/2018, 6:41 PMYou’re making a Kubernetes service account.
o
orange-tailor-85423
10/22/2018, 6:42 PMHere's what the service account looks like in another project
orange-tailor-85423
10/22/2018, 6:42 PMorange-tailor-85423
10/22/2018, 6:42 PMit's an IAM account (GCP)
c
creamy-potato-29402
10/22/2018, 6:43 PMYes, the IAM account is bound to a GCP service account. But you’re making a Kubernetes service account, right?
creamy-potato-29402
10/22/2018, 6:49 PM@orange-tailor-85423 in other words, look at your code, you’re using
new k8s.core.v1.ServiceAccountnew gcp.serviceAccount.Account(...)o
orange-tailor-85423
10/22/2018, 7:39 PMyep - working on this too late at night
orange-tailor-85423
10/22/2018, 7:39 PMugh
orange-tailor-85423
10/22/2018, 7:40 PMnow what if I do those operations in a function....how can I leverage that object that the 1st function created?
orange-tailor-85423
10/22/2018, 7:40 PMjust do a return of the var object?
c
creamy-potato-29402
10/22/2018, 7:41 PMhmm, not sure I understand.
creamy-potato-29402
10/22/2018, 7:41 PMoh you mean
creamy-potato-29402
10/22/2018, 7:41 PMyou want to put it into a function
o
orange-tailor-85423
10/22/2018, 7:41 PMyes
orange-tailor-85423
10/22/2018, 7:42 PMfor example
orange-tailor-85423
10/22/2018, 7:42 PMexport function createNodeServiceAccount(clustername: string){
var sa = new gcp.serviceAccount.Account("k8s_node",
{
accountId:
${clusterName}-k8s-node1Service Account - ${clusterName} - K8s nodeorange-tailor-85423
10/22/2018, 7:42 PMthen call what got created to pass into this function:
orange-tailor-85423
10/22/2018, 7:42 PMexport function createServiceAccountIamMember(serviceAccountID: string){
var sam = new gcp.serviceAccount.IAMMember("k8s_node_account_iam",
{
serviceAccountId: sa.serviceAccountId,
role: "roles/iam.serviceAccountUser",
member: "serviceAccount:terraform@mindbody-admin.iam.gserviceaccount.com"
}
)
return sam
}
c
creamy-potato-29402
10/22/2018, 7:43 PMeven something like this should work:
Copy code
function foo() {
return [new gcp.serviceAccount.Account(...), new gcp.serviceAccount.IAMMember(...)]
}o
orange-tailor-85423
10/22/2018, 7:43 PMoh I see - just called inside the other function
orange-tailor-85423
10/22/2018, 7:44 PMthat way I can just create an account or do both operations
c
creamy-potato-29402
10/22/2018, 7:44 PMYeah
o
orange-tailor-85423
10/22/2018, 7:45 PMtrying
orange-tailor-85423
10/22/2018, 7:45 PMthanks Alex
orange-tailor-85423
10/22/2018, 7:45 PMI'm showing this to some people later on so need to get something working - hehe
c
creamy-potato-29402
10/22/2018, 7:46 PMor you could write your own component class:
Copy code
export class IamServiceAccouunt extends pulumi.ComponentResource {
private readonly sa: gcp.serviceAccount.Account;
private readonly iam: gcp.serviceAccount.IAMMember;
constructor(...) {
<http://this.sa|this.sa> = new gcp.serviceAccount.Account(...)
this.iam = new gcp.serviceAccount.IAMMember(...)
}
}creamy-potato-29402
10/22/2018, 7:47 PMThen you could just do something like
new IamServiceAccount(...)