aledsdavies
commented
2 years ago Just to add as a workaround using terraform I have been using the following after creating a project.
data "google_iam_policy" "editor" {
binding {
members = [
"serviceAccount:${google_project.project.number}@cloudservices.gserviceaccount.com",
# "serviceAccount:${google_project.project.number}-compute@developer.gserviceaccount.com",
]
role = "roles/editor"
}
}
resource "google_project_iam_policy" "add" {
policy_data = data.google_iam_policy.editor.policy_data
project = google_project.project.project_id
}This will fix the issue preventing the GKE cluster from being removed.
This will still remove any permissions not tracked by Terraform. Including the users which created the project which would generally have the owner role.
However, the issue then is if you add any additional policies later that arent all tracked one big policy will override the one which was previously created. The same is true for I am binding you can get in a loop where one will override the other and each terraform apply will always delete already applied values.
The only way you can get it so that it won't override is if all changes to policies are applied using one google_project_iam_policy or google_project_iam_binding per project.
BartDuwez
michalswi
jeremiahbowen
roaks3
cooervo
Update
See Usability improvements for _iam_policy and _iam_binding resources #8354
As in Terraform google_project_iam_binding deletes GCP compute engine default service account from IAM principals,
Not sure who can get the clear idea what terraform does with
google_project_iam_bindingbut as GCP has identified, Terraform google_project_iam_binding has deleted all the accounts not in the members attribute that have "roles/Editor" role.Still, I believe this is a terraform defect.
As per the Google APIs Service Agent document, it is the essential service accounts that GCP internally manages. Terraform should not delete any such GCP managed internal service accounts as it bring the GCP projects down. I doubt in what use cases do we need this to happen.
Please, instead of of the assertin "work as designed", do not delete the GCP managed internal service accounts, as they are essential to make the GCP project work.
Original issue raised
Terraform google_project_iam_binding deletes GCP compute engine default service account from IAM principals has the detailed step-by-step reproduction steps and snapshots.
Community Note
modular-magicianuser, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned tohashibot, a community member has claimed the issue already.Terraform Version
Affected Resource(s)
GCP IAM Compute Engine default service account. It gets deleted by Terraform and cannot manage Compute Engine, hence GKE nodes as well.
Terraform Configuration Files
After further investigation, "roles/Editor" is sufficient to reproduce the issue.
Debug Output
Panic Output
Expected Behavior
Terraform will not remove the GCP Compute Engine Default service account from the IAM principals.
Actual Behavior
Before running the script, the Compute Engine default account exists in the IAM principals (with Compute Engine API enabled).
After running the terraform script. The GCP Compute Engine default service account get deleted by the script.
gcloud projects get-iam-policycommand does not show the Compute Engine default service account 1079157603081-compute@developer.gserviceaccount.com, either.Because of this, GKE cluster cannot be deleted, created because Compute Engine permissions have gone.
Steps to Reproduce
Please see * Terraform google_project_iam_binding deletes GCP compute engine default service account from IAM principals
terraform applyNow the GCP Compute Engine default service account was compromised and cannot manage Compute Engines and GKE nodes.
Important Factoids
No
References
Terraform google_project_iam_binding deletes GCP compute engine default service account from IAM principals
GCP GKE - Google Compute Engine: Not all instances running in IGM
Impact
GKE cannot be created anymore after the GCP Compute Engine Default Service Account disappeared in the IAM console. Need to create another project to be able to create GKE.
Cause
GCP identified that Terraform has deleted the Google APIs Service Agent which is Google-managed service accounts.
Terraform should not delete any such GCP managed internal service account essential to run GCP services, hence I regard this is a Terraform bug.
Fix
According to GCP:
As per the error message, add '1079157603081@cloudservices.gserviceaccount.com' in IAM.
The Google APIs Service Agent is restored in the view.
Create GKE.
b/304725229