Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859# the google side of the cloudflare workers in modules/envs. workers/<env> reads all of this# back out of secret manager, so it never needs more than read access to the secretslocals { cloudflare = try(local.env.cloudflare, null) workers = try(local.env.workers, {})
worker_identities = { for w, c in local.workers : w => c.google_identity if try(c.google_identity, null) != null }
worker_secrets = toset(concat( local.cloudflare == null ? [] : [local.cloudflare.token_secret], flatten([for c in local.workers : values(try(c.secrets, {}))]), ))}
resource "google_project_service" "workers" { for_each = toset(flatten([for i in local.worker_identities : i.apis]))
project = local.project service = each.value disable_on_destroy = false}
resource "google_service_account" "worker" { for_each = local.worker_identities
project = local.project account_id = "${each.key}-${local.env.env_suffix}" display_name = "the ${each.key} cloudflare worker in ${var.env}"}
# a worker can't federate, so it gets a real key. the readme says how to rotate itresource "google_service_account_key" "worker" { for_each = local.worker_identities
service_account_id = google_service_account.worker[each.key].name}
resource "google_secret_manager_secret" "worker_key" { for_each = local.worker_identities
project = local.project secret_id = "${each.key}-google-key"
replication { auto {} }
depends_on = [google_project_service.this]}
resource "google_secret_manager_secret_version" "worker_key" { for_each = local.worker_identities
secret = google_secret_manager_secret.worker_key[each.key].id secret_data = base64decode(google_service_account_key.worker[each.key].private_key)}