Move the annotation to IAP (#329)

* Move the annotation to IAP Make it more general. Prepare for ray dash board Tested-by: zlq * Add external link fix the index Tested-by: zlq * Add external link fix the index Tested-by: zlq * Rervert the jupyter hub sa change to fix the cluster creation fail Tested-by: zlq * SA is not the root cause Tested-by: zlq
GoogleCloudPlatform · Mar 12, 2024 · e4a1606 · e4a1606
1 parent 1ae0f31
commit e4a1606
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 12 deletions.
diff --git a/applications/rag/frontend/main.tf b/applications/rag/frontend/main.tf
@@ -58,9 +58,6 @@ resource "kubernetes_service" "rag_frontend_service" {
   metadata {
     name      = "rag-frontend"
     namespace = var.namespace
-    annotations = var.add_auth ? {
-      "beta.cloud.google.com/backend-config" : jsonencode({ "default" = var.k8s_backend_config_name })
-    } : {}
   }
   spec {
     selector = {

diff --git a/modules/iap/charts/iap/templates/backend-config.yaml b/modules/iap/charts/iap/templates/backend-config.yaml
@@ -17,14 +17,6 @@ kind: BackendConfig
 metadata:
   name: {{ .Values.iap.backendConfig.name }}
 spec:
-  healthCheck:
-    checkIntervalSec: 15
-    timeoutSec: 15
-    healthyThreshold: 1
-    unhealthyThreshold: 2
-    type: HTTP
-    requestPath: /_chp_healthz
-    port: 8000
   iap:
     enabled: true
     oauthclientCredentials:

diff --git a/modules/iap/iap.tf b/modules/iap/iap.tf
@@ -106,4 +106,17 @@ resource "helm_release" "iap" {
     name  = "iap.ingress.backendServicePort"
     value = var.k8s_backend_service_port
   }
+}
+
+resource "kubernetes_annotations" "annotation" {
+  api_version = "v1"
+  kind        = "Service"
+  metadata {
+    name      = var.k8s_backend_service_name
+    namespace = var.namespace
+  }
+  annotations = {
+    "beta.cloud.google.com/backend-config" = "{\"default\": \"${var.k8s_backend_config_name}\"}"
+  }
+  depends_on = [helm_release.iap]
 }
diff --git a/modules/jupyter/main.tf b/modules/jupyter/main.tf
@@ -67,7 +67,7 @@ resource "kubernetes_annotations" "hub" {
 
 resource "google_service_account_iam_binding" "hub-workload-identity-user" {
   count              = var.add_auth ? 1 : 0
-  service_account_id = module.jupyterhub-workload-identity.gcp_service_account
+  service_account_id = module.jupyterhub-workload-identity.gcp_service_account.name
   role               = "roles/iam.workloadIdentityUser"
 
   members = [