diff --git a/platforms/gke/base/use-cases/federated-learning/common.sh b/platforms/gke/base/use-cases/federated-learning/common.sh index ca08c41f..17d7788e 100755 --- a/platforms/gke/base/use-cases/federated-learning/common.sh +++ b/platforms/gke/base/use-cases/federated-learning/common.sh @@ -35,6 +35,7 @@ FEDERATED_LEARNING_SHARED_CONFIG_DIR="${FEDERATED_LEARNING_USE_CASE_TERRAFORM_DI # Terraservices that are necessary for the core platform federated_learning_core_platform_terraservices=( "key_management_service" + "service_account" ) # shellcheck disable=SC2034 # Variable is used in other scripts diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/_shared_config/uc_federated_learning_variables.tf b/platforms/gke/base/use-cases/federated-learning/terraform/_shared_config/uc_federated_learning_variables.tf index baa23d07..99b0e24f 100644 --- a/platforms/gke/base/use-cases/federated-learning/terraform/_shared_config/uc_federated_learning_variables.tf +++ b/platforms/gke/base/use-cases/federated-learning/terraform/_shared_config/uc_federated_learning_variables.tf @@ -15,4 +15,29 @@ locals { gke_robot_service_account = "service-${data.google_project.default.number}@container-engine-robot.iam.gserviceaccount.com" gke_robot_service_account_iam_email = "serviceAccount:${local.gke_robot_service_account}" + + tenants = { + for name in var.federated_learning_tenant_names : name => { + tenant_name = name + tenant_nodepool_name = format("%s-%s-pool", local.cluster_name, name) + tenant_nodepool_sa_name = format("%s-%s-nodes-sa", local.cluster_name, name) + tenant_apps_sa_name = format("%s-%s-apps-sa", local.cluster_name, name) + tenant_apps_kubernetes_service_account_name = local.tenant_apps_kubernetes_service_account_name + } + } + + # Put all service account names in a list so we can create them with a single + # google_service_account resource + service_account_names = concat( + [for tenant in local.tenants : tenant.tenant_nodepool_sa_name], + [for tenant in local.tenants : tenant.tenant_apps_sa_name], + ) + + tenant_apps_kubernetes_service_account_name = "fl-ksa" +} + +variable "federated_learning_tenant_names" { + default = ["fl-tenant-1"] + description = "List of named tenants to be created in the cluster. Each tenant gets a dedicated node pool and Kubernetes namespace, isolated from other tenants." + type = list(string) } diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/.terraform.lock.hcl b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/.terraform.lock.hcl new file mode 100644 index 00000000..bfed9458 --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/.terraform.lock.hcl @@ -0,0 +1,22 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/google" { + version = "6.12.0" + constraints = "6.12.0" + hashes = [ + "h1:rvZHMkoxkHrBYQXb/waoZiD2oo3FS1AF8HoWHlb6SN8=", + "zh:14701aa307a832d99f567b8056a4c5e4ee5a403d984c98f024deee7507a3f29c", + "zh:344eca00ffb2643c2fa7f52f069b659d50bb4c9369df4cad96ea0fadb54282c8", + "zh:5fb57c0acfd4d30a39941900040d5518a909d8c975af0c4366a7bfd0d0bb09a8", + "zh:617a77048a5b9aa568e8bc706cc84307a237b2dd0e49709028b283f8bbe42475", + "zh:677837a05fefe0342cf4d4bdc494e8fd4d62331cac947820e73df37e8f512688", + "zh:7b79f6e02474eef4a1480fc6589afb63ed16b25bf019b6056f9838e2845e2ef8", + "zh:7d891fceb5b15e81240d829f42e1a36e4c812bfc1abe7856756e59101932205f", + "zh:97f1e0ac799faf382426e070e888fac36b0867597b460dc95b0e7f657de21ba9", + "zh:9855f2f2f5919ff6a6a2c982439c910d28c8978ad18cd8f549a5d1ba9b4dc4c3", + "zh:ac551367180eb396af2a50244e80243d333d600a76002e29935262d76a02290b", + "zh:c354f34e6579933d21a98ce7f31f4ef8aeaceb04cfaedaff6d3f3c0be56b2c79", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_cluster.auto.tfvars b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_cluster.auto.tfvars new file mode 120000 index 00000000..98a694db --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_cluster.auto.tfvars @@ -0,0 +1 @@ +../../../../_shared_config/cluster.auto.tfvars \ No newline at end of file diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_cluster_variables.tf b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_cluster_variables.tf new file mode 120000 index 00000000..00625515 --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_cluster_variables.tf @@ -0,0 +1 @@ +../../../../_shared_config/cluster_variables.tf \ No newline at end of file diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_platform.auto.tfvars b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_platform.auto.tfvars new file mode 120000 index 00000000..125a652c --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_platform.auto.tfvars @@ -0,0 +1 @@ +../../../../_shared_config/platform.auto.tfvars \ No newline at end of file diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_platform_variables.tf b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_platform_variables.tf new file mode 120000 index 00000000..486b3eae --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_platform_variables.tf @@ -0,0 +1 @@ +../../../../_shared_config/platform_variables.tf \ No newline at end of file diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_terraform.auto.tfvars b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_terraform.auto.tfvars new file mode 120000 index 00000000..4af8b832 --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_terraform.auto.tfvars @@ -0,0 +1 @@ +../../../../_shared_config/terraform.auto.tfvars \ No newline at end of file diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_terraform_variables.tf b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_terraform_variables.tf new file mode 120000 index 00000000..d51ad696 --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_terraform_variables.tf @@ -0,0 +1 @@ +../../../../_shared_config/terraform_variables.tf \ No newline at end of file diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_uc_federated_learning.auto.tfvars b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_uc_federated_learning.auto.tfvars new file mode 120000 index 00000000..0d85666e --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_uc_federated_learning.auto.tfvars @@ -0,0 +1 @@ +../_shared_config/uc_federated_learning.auto.tfvars \ No newline at end of file diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_uc_federated_learning_variables.tf b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_uc_federated_learning_variables.tf new file mode 120000 index 00000000..f515b3cc --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/_uc_federated_learning_variables.tf @@ -0,0 +1 @@ +../_shared_config/uc_federated_learning_variables.tf \ No newline at end of file diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/main.tf b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/main.tf new file mode 100644 index 00000000..46bd055a --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/main.tf @@ -0,0 +1,21 @@ +# Copyright 2024 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +resource "google_service_account" "federated_learning_service_account" { + for_each = local.service_account_names + account_id = "${local.prefix}${lower(each.value)}" + display_name = "Terraform-managed service account for the federated learning use case in cluster ${local.cluster_name}" + description = index(var.names, each.value) >= length(var.descriptions) ? var.description : element(var.descriptions, index(var.names, each.value)) + project = google_project_service.iam_googleapis_com.project +} diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/output.tf b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/output.tf new file mode 100644 index 00000000..633bb7f1 --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/output.tf @@ -0,0 +1,13 @@ +# Copyright 2024 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/project.tf b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/project.tf new file mode 100644 index 00000000..cfa64332 --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/project.tf @@ -0,0 +1,24 @@ +# Copyright 2024 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +data "google_project" "default" { + project_id = var.cluster_project_id +} + +resource "google_project_service" "iam_googleapis_com" { + disable_dependent_services = false + disable_on_destroy = false + project = data.google_project.default.project_id + service = "iam.googleapis.com" +} diff --git a/platforms/gke/base/use-cases/federated-learning/terraform/service_account/versions.tf b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/versions.tf new file mode 100644 index 00000000..da72ce3e --- /dev/null +++ b/platforms/gke/base/use-cases/federated-learning/terraform/service_account/versions.tf @@ -0,0 +1,28 @@ +# Copyright 2024 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +terraform { + required_version = ">= 1.5.7" + + required_providers { + google = { + source = "hashicorp/google" + version = "6.12.0" + } + } + + provider_meta "google" { + module_name = "cloud-solutions/acp_fl_service_account_deploy-v1" + } +}