<commit_before>locals {
  project = var.project_id
  project_roles = [
    "roles/iam.serviceAccountUser",
    "roles/logging.logWriter",
    "roles/monitoring.metricWriter",
    "roles/monitoring.viewer",
    "roles/stackdriver.resourceMetadata.writer",
    "roles/storage.admin",
    "roles/datastore.owner",
    "roles/firebase.admin",
  ]
  gke_pod_sa_email = "<EMAIL>"
}

module "service_accounts" {
  source        = "terraform-google-modules/service-accounts/google"
  version       = "~> 3.0"
  project_id    = var.project_id
  names         = ["gke-node-sa"]
  display_name  = "SA for GKE Node Pool"
  description   = "Service account is used in the gke node pool"
  project_roles = [for i in local.project_roles : "${var.project_id}=>${i}"]
}

module "gke" {
  depends_on = [
    module.service_accounts,
  ]

  source                     = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster"
  version                    = "v22.1.0"
  project_id                 = var.project_id
  name                       = var.cluster_name
  kubernetes_version         = "1.22.8-gke.202"
  region                     = var.region
  regional                   = true
  network                    = var.vpc_network
  subnetwork                 = "vpc-01-subnet-01"
  ip_range_pods              = "secondary-pod-range-01"
  ip_range_services          = "secondary-service-range-01"
  http_load_balancing        = true
  identity_namespace         = "enabled"
  horizontal_pod_autoscaling = true
  remove_default_node_pool   = true

  node_pools = [
    {
      name         = "default-pool"
      machine_type = var.machine_type
      min_count    = var.min_node_count
      max_count    = var.max_node_count
      disk_size_gb = var.disk_size_gb
      disk_type    = "pd-standard"
      image_type   = "COS_CONTAINERD"
      auto_repair  = true
      auto_upgrade = true
      # hard coding until resolved: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/991
      service_account    = "gke-node-sa@${var.<EMAIL>_<EMAIL>"
      preemptible        = false
      initial_node_count = "1"
      enable_secure_boot = true
    },
  ]
  node_pools_oauth_scopes = {
    node-pool-01 = [
      "https://www.googleapis.com/auth/cloud-platform",
    ]
  }

  node_pools_metadata = {
    node-pool-01 = {
      disable-legacy-endpoints = "true"
    }
  }

  node_pools_taints = {
    node-pool-01 = []
  }
}

# Creating a Kubernetes Service account for Workload Identity
resource "kubernetes_service_account" "ksa" {
  depends_on = [module.gke]

  metadata {
    name = "ksa"
    annotations = {
      "iam.gke.io/gcp-service-account" = local.gke_pod_sa_email
    }
  }
}

# Enable the IAM binding between YOUR-GSA-NAME and YOUR-KSA-NAME:
resource "google_service_account_iam_binding" "gsa-ksa-binding" {<commit_msg>fixed ksa using wait time<commit_after>locals {
  project = var.project_id
  project_roles = [
    "roles/iam.serviceAccountUser",
    "roles/logging.logWriter",
    "roles/monitoring.metricWriter",
    "roles/monitoring.viewer",
    "roles/stackdriver.resourceMetadata.writer",
    "roles/storage.admin",
    "roles/datastore.owner",
    "roles/firebase.admin",
  ]
  gke_pod_sa_email = "<EMAIL>"
}

module "service_accounts" {
  source        = "terraform-google-modules/service-accounts/google"
  version       = "~> 3.0"
  project_id    = var.project_id
  names         = ["gke-node-sa"]
  display_name  = "SA for GKE Node Pool"
  description   = "Service account is used in the gke node pool"
  project_roles = [for i in local.project_roles : "${var.project_id}=>${i}"]
}

module "gke" {
  depends_on = [
    module.service_accounts,
  ]

  source                     = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster"
  version                    = "v22.1.0"
  project_id                 = var.project_id
  name                       = var.cluster_name
  kubernetes_version         = "1.22.8-gke.202"
  region                     = var.region
  regional                   = true
  network                    = var.vpc_network
  subnetwork                 = "vpc-01-subnet-01"
  ip_range_pods              = "secondary-pod-range-01"
  ip_range_services          = "secondary-service-range-01"
  http_load_balancing        = true
  identity_namespace         = "enabled"
  horizontal_pod_autoscaling = true
  remove_default_node_pool   = true

  node_pools = [
    {
      name         = "default-pool"
      machine_type = var.machine_type
      min_count    = var.min_node_count
      max_count    = var.max_node_count
      disk_size_gb = var.disk_size_gb
      disk_type    = "pd-standard"
      image_type   = "COS_CONTAINERD"
      auto_repair  = true
      auto_upgrade = true
      # hard coding until resolved: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/991
      service_account    = "gke-node-sa@${var.project_id}.<EMAIL>"
      preemptible        = false
      initial_node_count = "1"
      enable_secure_boot = true
    },
  ]
  node_pools_oauth_scopes = {
    node-pool-01 = [
      "https://www.googleapis.com/auth/cloud-platform",
    ]
  }

  node_pools_metadata = {
    node-pool-01 = {
      disable-legacy-endpoints = "true"
    }
  }

  node_pools_taints = {
    node-pool-01 = []
  }
}

resource "time_sleep" "wait_30_seconds" {
  depends_on = [module.gke]
  create_duration = "30s"
}

# Creating a Kubernetes Service account for Workload Identity
resource "kubernetes_service_account" "ksa" {
  depends_on = [module.gke, time_sleep.wait_30_seconds]

  metadata {
    name = "ksa"
    annotations = {
      "iam.gke.io/gcp-service-account" = local.gke_pod_sa_email
    }
  }
}

# Enable the IAM binding between YOUR-GSA-NAME and YOUR-KSA-NAME:
resource "google_service_account_iam_binding" "gsa-ksa-binding" {
{'fraction_non_alphanumeric': 0.10884006131834441, 'fraction_numerical': 0.011582353943110203, 'mean_word_length': 2.34968625213919, 'pattern_counts': {'":': 0, '<': 8, '<?xml version=': 0, '>': 12, 'https://': 4, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2620601', 'n_tokens_mistral': 2051, 'n_tokens_neox': 1990, 'n_words': 314}