update iam

This commit is contained in:
Come THURET 2024-12-06 14:29:33 +01:00
parent 6a77736278
commit 7bda536fda
6 changed files with 69 additions and 0 deletions

View File

@ -33,3 +33,25 @@ module "compute"{
zone = var.zone zone = var.zone
instance_type = var.instance_type instance_type = var.instance_type
} }
module "iam" {
source = "../../modules/iam"
project_id = var.project_id
}
data "google_client_openid_userinfo" "me" {
}
resource "local_file" "ansible_config" {
content = templatefile("${path.module}/../../templates/ansible.cfg.tpl",
{
remote_user = data.google_client_openid_userinfo.me.email
}
)
filename = "../../ansible/ansible.cfg"
}
resource "local_file" "service_account" {
content = base64decode(module.iam.service_account_key)
filename = "../../ansible/service_account.json"
}

View File

@ -25,3 +25,7 @@ output "instances_names" {
database = module.compute.instances_names.database database = module.compute.instances_names.database
} }
} }
output "frontend_ip" {
value = module.compute.frontend_ip
}

View File

@ -13,3 +13,7 @@ output "instances_names" {
database = google_compute_instance.tp07-database.name database = google_compute_instance.tp07-database.name
} }
} }
output "frontend_ip" {
value = google_compute_instance.tp07-frontend.network_interface.0.access_config.0.assigned_nat_ip
}

View File

@ -0,0 +1,24 @@
resource "google_service_account" "service_account" {
account_id = "terraform"
display_name = "terraform"
}
resource "google_service_account_key" "service_account" {
service_account_id = google_service_account.service_account.name
public_key_type = "TYPE_X509_PEM_FILE"
}
resource "google_project_iam_binding" "service_account_roles" {
project = var.project_id
role = "roles/viewer"
members = ["serviceAccount:${google_service_account.service_account.email}"]
}
data "google_client_openid_userinfo" "me" {
}
resource "google_os_login_ssh_public_key" "add_my_key" {
project = var.project_id
user = data.google_client_openid_userinfo.me.email
key = file("~/.ssh/id_ed25519.pub")
}

View File

@ -0,0 +1,10 @@
output "service_account_email" {
description = "Email du compte de service"
value = google_service_account.service_account.email
}
output "service_account_key" {
description = "Clé du compte de service"
value = google_service_account_key.service_account.private_key
sensitive = true
}

View File

@ -0,0 +1,5 @@
variable "project_id" {
description = "ID du projet GCP"
type = string
}