[修正] podのstatusを更新できなくてmattermostが再起動を繰り返していたため修正

[xpadev-net]

• container.pods.updateStatusを追加したpod_status_updaterロールを追加
• mattermost-primaryにpod_status_updaterを割り当て

[github-actions]

⚠️⚠️⚠️terraform/iam⚠️⚠️⚠️

Terraform Format and Style 🖌success

Terraform Plan 📖success

Show Plan

```terraform google_iam_workload_identity_pool.github-action-pool: Refreshing state... [id=projects/mitou-jr/locations/global/workloadIdentityPools/github-action] google_service_account.sa-ga-planner: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_service_account.sa-ga-basic-applier: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_project_iam_binding.iam-binding-k8s-operation: Refreshing state... [id=mitou-jr/roles/container.developer] google_storage_bucket_iam_binding.secret-bucket-access-binding: Refreshing state... [id=b/mitou-jr-secret/roles/storage.objectAdmin] google_project_iam_custom_role.tfplanner: Refreshing state... [id=projects/mitou-jr/roles/tfplanner] google_service_account.wi-mattermost-primary: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_project_iam_binding.monitoring-pubsub: Refreshing state... [id=mitou-jr/roles/pubsub.publisher] google_service_account.sa-ga-iam-applier: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_service_account.wi-secret-mattermost-primary: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]] google_iam_workload_identity_pool_provider.github-action-pool-provider: Refreshing state... [id=projects/mitou-jr/locations/global/workloadIdentityPools/github-action/providers/github-action-provider] google_project_iam_binding.kms-key-users: Refreshing state... [id=mitou-jr/roles/cloudkms.cryptoKeyEncrypterDecrypter] google_storage_bucket_iam_binding.main-bucket-access-binding: Refreshing state... [id=b/mitou-jr/roles/storage.objectAdmin] google_service_account_iam_binding.workload_identity_binding-basic: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_project_iam_binding.iam-binding-iam-applier["roles/iam.securityAdmin"]: Refreshing state... [id=mitou-jr/roles/iam.securityAdmin] google_service_account_iam_binding.workload_identity_binding-iam: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_project_iam_binding.iam-binding-basic-applier["roles/container.admin"]: Refreshing state... [id=mitou-jr/roles/container.admin] google_project_iam_binding.iam-binding-basic-applier["roles/storage.admin"]: Refreshing state... [id=mitou-jr/roles/storage.admin] google_project_iam_binding.iam-binding-basic-applier["roles/cloudsql.admin"]: Refreshing state... [id=mitou-jr/roles/cloudsql.admin] google_project_iam_binding.iam-binding-basic-applier["roles/compute.networkAdmin"]: Refreshing state... [id=mitou-jr/roles/compute.networkAdmin] google_service_account_iam_binding.workload_identity_binding-planner: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_project_iam_binding.secret-manager: Refreshing state... [id=mitou-jr/roles/secretmanager.secretAccessor] google_storage_bucket_iam_binding.iam-tf-bucket-sa-binding: Refreshing state... [id=b/mitou-jr-tf-iam/roles/storage.objectAdmin] google_storage_bucket_iam_binding.basic-tf-bucket-sa-binding: Refreshing state... [id=b/mitou-jr-tf-basic/roles/storage.objectAdmin] google_service_account_iam_binding.wi-bindings["default/external-secrets"]: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_service_account_iam_binding.wi-bindings["mattermost/mattermost-primary"]: Refreshing state... [id=projects/mitou-jr/serviceAccounts/[email protected]/roles/iam.workloadIdentityUser] google_project_iam_binding.tf-planners: Refreshing state... [id=mitou-jr/projects/mitou-jr/roles/tfplanner] google_project_iam_binding.viewers: Refreshing state... [id=mitou-jr/roles/viewer]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply":

google_project_iam_binding.iam-binding-k8s-operation has been changed

~ resource "google_project_iam_binding" "iam-binding-k8s-operation" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/container.developer"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.viewers has been changed

~ resource "google_project_iam_binding" "viewers" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/viewer"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-basic-applier["roles/storage.admin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-basic-applier" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/storage.admin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-basic-applier["roles/cloudsql.admin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-basic-applier" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/cloudsql.admin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-basic-applier["roles/compute.networkAdmin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-basic-applier" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/compute.networkAdmin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-basic-applier["roles/container.admin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-basic-applier" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/container.admin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.kms-key-users has been changed

~ resource "google_project_iam_binding" "kms-key-users" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/cloudkms.cryptoKeyEncrypterDecrypter"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.tf-planners has been changed

~ resource "google_project_iam_binding" "tf-planners" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/projects/mitou-jr/roles/tfplanner"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.monitoring-pubsub has been changed

~ resource "google_project_iam_binding" "monitoring-pubsub" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/pubsub.publisher"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.iam-binding-iam-applier["roles/iam.securityAdmin"] has been changed

~ resource "google_project_iam_binding" "iam-binding-iam-applier" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/iam.securityAdmin"
# (3 unchanged attributes hidden)
}

google_project_iam_binding.secret-manager has been changed

~ resource "google_project_iam_binding" "secret-manager" {
~ etag = "BwYXCk9pQCs=" -> "BwYXCzxwL0U="
id = "mitou-jr/roles/secretmanager.secretAccessor"
~ members = [
+ "user:[email protected]",
# (1 unchanged element hidden)
]
# (2 unchanged attributes hidden)
}

Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:

• create
  ~ update in-place

Terraform will perform the following actions:

google_project_iam_binding.pod_status_updater_binding will be created

• resource "google_project_iam_binding" "pod_status_updater_binding" {
  • etag = (known after apply)
  • id = (known after apply)
  • members = [
    • "serviceAccount:[email protected]",
      ]
  • project = "mitou-jr"
  • role = (known after apply)
    }

google_project_iam_binding.secret-manager will be updated in-place

~ resource "google_project_iam_binding" "secret-manager" {
id = "mitou-jr/roles/secretmanager.secretAccessor"
~ members = [
- "user:[email protected]",
# (1 unchanged element hidden)
]
# (3 unchanged attributes hidden)
}

google_project_iam_custom_role.pod_status_updater will be created

• resource "google_project_iam_custom_role" "pod_status_updater" {
  • deleted = (known after apply)
  • description = "Allows updating pod status"
  • id = (known after apply)
  • name = (known after apply)
  • permissions = [
    • "container.pods.updateStatus",
      ]
  • project = (known after apply)
  • role_id = "podStatusUpdater"
  • stage = "GA"
  • title = "Pod Status Updater"
    }

Plan: 2 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

</details>