57 lines
1.8 KiB
HCL
57 lines
1.8 KiB
HCL
variable "gcp_project_id" {
|
|
type = string
|
|
description = "The GCP Project ID where the Service Account should be created. If empty, a new project named 'velero-backup-xxxx' will be created."
|
|
default = ""
|
|
}
|
|
|
|
resource "random_id" "project_suffix" {
|
|
byte_length = 4
|
|
}
|
|
|
|
resource "google_project" "backup_project" {
|
|
count = var.gcp_project_id == "" ? 1 : 0
|
|
name = "velero-backup"
|
|
project_id = "velero-backup-${random_id.project_suffix.hex}"
|
|
}
|
|
|
|
locals {
|
|
project_id = var.gcp_project_id == "" ? google_project.backup_project[0].project_id : var.gcp_project_id
|
|
}
|
|
|
|
resource "google_project_service" "drive_api" {
|
|
project = local.project_id
|
|
service = "drive.googleapis.com"
|
|
disable_on_destroy = false
|
|
}
|
|
|
|
resource "google_project_organization_policy" "allow_key_creation" {
|
|
project = local.project_id
|
|
constraint = "iam.disableServiceAccountKeyCreation"
|
|
|
|
boolean_policy {
|
|
enforced = false
|
|
}
|
|
}
|
|
|
|
resource "google_service_account" "velero_backup_sa" {
|
|
project = local.project_id
|
|
account_id = "velero-backup-sa"
|
|
display_name = "Velero GDrive Backup Service Account"
|
|
depends_on = [google_project_service.drive_api]
|
|
}
|
|
|
|
resource "google_service_account_key" "velero_backup_sa_key" {
|
|
service_account_id = google_service_account.velero_backup_sa.name
|
|
depends_on = [google_project_organization_policy.allow_key_creation]
|
|
}
|
|
|
|
resource "local_file" "gdrive_sa_key_file" {
|
|
content = base64decode(google_service_account_key.velero_backup_sa_key.private_key)
|
|
filename = "${path.module}/../k8s/velero/gdrive_sa.json.secret"
|
|
}
|
|
|
|
output "velero_backup_sa_email" {
|
|
value = google_service_account.velero_backup_sa.email
|
|
description = "The email address of the Google Cloud Service Account. Share your Google Drive backup folder with this email address and grant it Editor access."
|
|
}
|