diff --git a/README.md b/README.md
index c6ad020..c8ae753 100644
--- a/README.md
+++ b/README.md
@@ -7,13 +7,13 @@ Truefoundry Google Cloud platform features module
| Name | Version |
|------|---------|
| [terraform](#requirement\_terraform) | >= 1.4 |
-| [google](#requirement\_google) | 4.81.0 |
+| [google](#requirement\_google) | 4.85.0 |
## Providers
| Name | Version |
|------|---------|
-| [google](#provider\_google) | 4.81.0 |
+| [google](#provider\_google) | 4.85.0 |
## Modules
@@ -25,17 +25,17 @@ Truefoundry Google Cloud platform features module
| Name | Type |
|------|------|
-| [google_project_iam_custom_role.truefoundry_platform_feature_gcs_bucket_role](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/project_iam_custom_role) | resource |
-| [google_project_iam_custom_role.truefoundry_platform_feature_secret_manager_role](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/project_iam_custom_role) | resource |
-| [google_project_iam_member.truefoundry_platform_feature_artifact_registry_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/project_iam_member) | resource |
-| [google_project_iam_member.truefoundry_platform_feature_container_cluster_viewer_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/project_iam_member) | resource |
-| [google_project_iam_member.truefoundry_platform_feature_container_viewer_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/project_iam_member) | resource |
-| [google_project_iam_member.truefoundry_platform_feature_gcs_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/project_iam_member) | resource |
-| [google_project_iam_member.truefoundry_platform_feature_secret_manager_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/project_iam_member) | resource |
-| [google_project_iam_member.truefoundry_platform_feature_token_creator_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/project_iam_member) | resource |
-| [google_service_account.truefoundry_platform_feature_service_account](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/service_account) | resource |
-| [google_service_account_key.truefoundry_platform_feature_service_account_key](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/resources/service_account_key) | resource |
-| [google_project.truefoundry_platform_feature_project](https://registry.terraform.io/providers/hashicorp/google/4.81.0/docs/data-sources/project) | data source |
+| [google_project_iam_custom_role.truefoundry_platform_feature_cluster_integration_role](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/project_iam_custom_role) | resource |
+| [google_project_iam_custom_role.truefoundry_platform_feature_gcs_bucket_role](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/project_iam_custom_role) | resource |
+| [google_project_iam_custom_role.truefoundry_platform_feature_secret_manager_role](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/project_iam_custom_role) | resource |
+| [google_project_iam_member.truefoundry_platform_feature_artifact_registry_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.truefoundry_platform_feature_cluster_integration_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.truefoundry_platform_feature_gcs_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.truefoundry_platform_feature_secret_manager_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/project_iam_member) | resource |
+| [google_project_iam_member.truefoundry_platform_feature_token_creator_role_binding](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/project_iam_member) | resource |
+| [google_service_account.truefoundry_platform_feature_service_account](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/service_account) | resource |
+| [google_service_account_key.truefoundry_platform_feature_service_account_key](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/resources/service_account_key) | resource |
+| [google_project.truefoundry_platform_feature_project](https://registry.terraform.io/providers/hashicorp/google/4.85.0/docs/data-sources/project) | data source |
## Inputs
diff --git a/iam.tf b/iam.tf
index 528e594..3c45e17 100644
--- a/iam.tf
+++ b/iam.tf
@@ -54,6 +54,31 @@ resource "google_project_iam_custom_role" "truefoundry_platform_feature_gcs_buck
]
}
+// cluster integration role
+resource "google_project_iam_custom_role" "truefoundry_platform_feature_cluster_integration_role" {
+ count = var.feature_cluster_integration_enabled ? 1 : 0
+
+ role_id = replace("${local.trufoundry_platform_resources}_cluster_integration_tfy_role", "-", "_")
+ title = replace("${local.trufoundry_platform_resources}_cluster_integration_tfy_role", "-", "_")
+ description = "TrueFoundry platform feature role to view GKE cluster"
+ permissions = [
+ "container.clusters.get",
+ "container.clusters.list",
+ "container.nodes.get",
+ "container.nodes.getStatus",
+ "container.nodes.list",
+ "resourcemanager.projects.get",
+ ]
+}
+
+resource "google_project_iam_member" "truefoundry_platform_feature_cluster_integration_role_binding" {
+ count = var.feature_cluster_integration_enabled ? 1 : 0
+
+ project = var.project
+ role = google_project_iam_custom_role.truefoundry_platform_feature_cluster_integration_role[count.index].id
+ member = "serviceAccount:${google_service_account.truefoundry_platform_feature_service_account.email}"
+}
+
// custom role binding with condition for secret manager role
resource "google_project_iam_member" "truefoundry_platform_feature_secret_manager_role_binding" {
count = var.feature_secrets_enabled ? 1 : 0
@@ -102,24 +127,6 @@ resource "google_project_iam_member" "truefoundry_platform_feature_artifact_regi
member = "serviceAccount:${google_service_account.truefoundry_platform_feature_service_account.email}"
}
-// role binding container cluster viewer role to service account
-resource "google_project_iam_member" "truefoundry_platform_feature_container_cluster_viewer_role_binding" {
- count = var.feature_cluster_integration_enabled ? 1 : 0
-
- project = var.project
- role = "roles/container.clusterViewer"
- member = "serviceAccount:${google_service_account.truefoundry_platform_feature_service_account.email}"
-}
-
-// role binding container viewer role to service account
-resource "google_project_iam_member" "truefoundry_platform_feature_container_viewer_role_binding" {
- count = var.feature_cluster_integration_enabled ? 1 : 0
-
- project = var.project
- role = "roles/container.viewer"
- member = "serviceAccount:${google_service_account.truefoundry_platform_feature_service_account.email}"
-}
-
// service account key
resource "google_service_account_key" "truefoundry_platform_feature_service_account_key" {
service_account_id = google_service_account.truefoundry_platform_feature_service_account.id
diff --git a/versions.tf b/versions.tf
index fa38149..2d320eb 100644
--- a/versions.tf
+++ b/versions.tf
@@ -3,7 +3,7 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
- version = "4.81.0"
+ version = "4.85.0"
}
}
}
\ No newline at end of file