Skip to content

Commit 901bccd

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #8175 from upodroid/datadog-gcp
deploy datadog to GCP
2 parents dbfbb74 + 0fb8506 commit 901bccd

File tree

15 files changed

+274
-147
lines changed

15 files changed

+274
-147
lines changed

‎infra/gcp/bash/ensure-organization.sh

Lines changed: 0 additions & 143 deletions
This file was deleted.

‎infra/gcp/terraform/boskos/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ module "project" {
6565
"logging.googleapis.com",
6666
"monitoring.googleapis.com",
6767
"secretmanager.googleapis.com",
68+
"cloudasset.googleapis.com",
6869
]
6970
}
7071

‎infra/gcp/terraform/k8s-infra-gcp-gcve/iam.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,5 +31,11 @@ module "iam" {
3131
"roles/secretmanager.secretAccessor" = [
3232
"serviceAccount:k8s-infra-prow-build.svc.id.goog[external-secrets/external-secrets]"
3333
]
34+
"roles/viewer" = [
35+
"serviceAccount:[email protected]"
36+
]
37+
"roles/serviceusage.serviceUsageConsumer" = [
38+
"serviceAccount:[email protected]"
39+
]
3440
}
3541
}

‎infra/gcp/terraform/k8s-infra-seed/README.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# k8s-infra-seed Terraform layer
2+
3+
This terraform layer manages the following infrastucture:
4+
5+
1. The kubernetes.io GCP organization
6+
1. All org level configurations
7+
1. The k8s-infra-seed GCP project.
8+
9+
It will eventually replace k8s-infra-kubernetes-io project.

‎infra/gcp/terraform/k8s-infra-seed/iam.tf

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
module "iam" {
18+
source = "terraform-google-modules/iam/google//modules/organizations_iam"
19+
version = "~> 8.1"
20+
21+
organizations = [data.google_organization.org.org_id]
22+
23+
mode = "authoritative"
24+
25+
bindings = {
26+
"roles/owner" = [
27+
google_service_account.atlantis.member,
28+
"group:[email protected]",
29+
]
30+
"roles/billing.admin" = [
31+
google_service_account.atlantis.member,
32+
"group:[email protected]",
33+
"user:[email protected]",
34+
]
35+
"roles/billing.viewer" = [
36+
"group:[email protected]"
37+
]
38+
"roles/resourcemanager.organizationAdmin" = [
39+
"serviceAccount:[email protected]",
40+
"group:[email protected]",
41+
"user:[email protected]",
42+
]
43+
"roles/resourcemanager.folderAdmin" = [
44+
"group:[email protected]",
45+
google_service_account.atlantis.member,
46+
]
47+
"roles/browser" = [
48+
"group:[email protected]",
49+
"group:[email protected]",
50+
"user:[email protected]",
51+
google_service_account.datadog.member,
52+
]
53+
"roles/resourcemanager.projectCreator" = [
54+
"group:[email protected]",
55+
google_service_account.atlantis.member,
56+
]
57+
"roles/orgpolicy.policyAdmin" = [
58+
"group:[email protected]",
59+
"serviceAccount:[email protected]",
60+
]
61+
"roles/cloudsupport.admin" = [
62+
"group:[email protected]",
63+
]
64+
"organizations/758905017065/roles/audit.viewer" = [
65+
"group:[email protected]",
66+
"serviceAccount:[email protected]"
67+
]
68+
"organizations/758905017065/roles/organization.admin" = [ #TODO: remove this role and use the predefined google roles
69+
"group:[email protected]"
70+
]
71+
"roles/serviceusage.serviceUsageConsumer" = [
72+
google_service_account.datadog.member,
73+
]
74+
"roles/compute.viewer" = [
75+
google_service_account.datadog.member,
76+
]
77+
"roles/cloudasset.viewer" = [
78+
google_service_account.datadog.member,
79+
]
80+
"roles/monitoring.viewer" = [
81+
google_service_account.datadog.member,
82+
]
83+
"roles/securitycenter.findingsViewer" = [
84+
google_service_account.datadog.member,
85+
]
86+
}
87+
}

‎infra/gcp/terraform/k8s-infra-seed/main.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
data "google_organization" "org" {
18+
domain = "kubernetes.io"
19+
}

‎infra/gcp/terraform/k8s-infra-seed/provider.tf

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
provider "google" {
18+
}
19+
20+
provider "google-beta" {
21+
}
22+
23+
terraform {
24+
required_version = "1.10.5"
25+
26+
backend "gcs" {
27+
bucket = "k8s-infra-terraform"
28+
prefix = "k8s-infra-seed"
29+
}
30+
31+
required_providers {
32+
google = {
33+
version = "6.26.0"
34+
}
35+
google-beta = {
36+
version = "6.26.0"
37+
}
38+
}
39+
}

‎infra/gcp/terraform/k8s-infra-seed/service-accounts.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
resource "google_service_account" "atlantis" {
18+
account_id = "atlantis"
19+
display_name = "Atlantis"
20+
project = var.seed_project_id
21+
}
22+
23+
resource "google_service_account_iam_binding" "atlantis" {
24+
service_account_id = google_service_account.atlantis.id
25+
26+
role = "roles/iam.workloadIdentityUser"
27+
members = [
28+
"serviceAccount:k8s-infra-prow.svc.id.goog[atlantis/atlantis]",
29+
]
30+
}
31+
32+
resource "google_service_account" "datadog" {
33+
account_id = "datadog"
34+
project = var.seed_project_id
35+
}
36+
37+
resource "google_service_account_iam_binding" "datadog" {
38+
service_account_id = google_service_account.datadog.id
39+
role = "roles/iam.serviceAccountTokenCreator"
40+
members = [
41+
"serviceAccount:ddgci-3aada836c27bc3f0fb00@datadog-gci-sts-us5-prod.iam.gserviceaccount.com",
42+
"serviceAccount:service-127754664067@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com"
43+
]
44+
}

‎infra/gcp/terraform/k8s-infra-seed/terraform.tfvars

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
seed_project_id = "k8s-infra-seed"

‎infra/gcp/terraform/k8s-infra-seed/variables.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
variable "seed_project_id" {
18+
description = "The ID of the seed project."
19+
type = string
20+
}

0 commit comments

Comments
 (0)