feat: add support for custom monitoring metrics writer role

[samuelarogbonlo]

Pull Request: Custom Monitoring Metrics Writer Role Support

Fixes #2073

Description

This Pull Request adds the ability to specify a custom monitoring metrics writer role for the GKE node service account instead of using the default roles/monitoring.metricWriter role. This is particularly useful for organizations that restrict the use of default roles and require custom IAM roles with specific permissions.

Key Changes

1. Added Variable

• A new variable monitoring_metric_writer_role with a default value of roles/monitoring.metricWriter was added.
• This allows users to specify a custom IAM role if needed.

2. Backward Compatibility
   • Ensured backward compatibility by maintaining the default role (roles/monitoring.metricWriter) for users who do not override the variable.

---

Changes

• Added new variable monitoring_metric_writer_role in modules/beta-private-cluster/variables.tf
• Updated IAM role assignment in modules/beta-private-cluster/sa.tf to use the new variable
• Added input validation to ensure proper role format
• Maintained backward compatibility by defaulting to roles/monitoring.metricWriter

Testing Performed

Tested the following scenarios:

• Default behavior (using roles/monitoring.metricWriter)
• Custom role usage (using projects/{project_id}/roles/custom_metrics_writer)

Impact

• Backward Compatible: Existing users do not need to make any changes, as the default behavior remains unchanged.
• Enhanced Flexibility: Users can now assign custom roles for monitoring metrics, meeting organizational compliance requirements.

Checklist

• [ ✅ ] Code follows repository style and conventions
• [ ✅ ] All tests pass
• [ ✅ ] Documentation has been updated
• [ ✅ ] Backward compatibility is maintained
• [ ✅ ] Added validation for input variable
• [ ✅ ] Tested with both default and custom roles

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[apeabody]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Hi @samuelarogbonlo - Please address the CLA before we can review this PR. Thanks!

[samuelarogbonlo]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

I signed it!

[apeabody]

Thanks for the contribution @samuelarogbonlo!

[apeabody]

Thanks @samuelarogbonlo - Can you please run make build and make docker_generate_docs and commit the changes.

[samuelarogbonlo]

Thanks @samuelarogbonlo - Can you please run make build and make docker_generate_docs and commit the changes.

Done

[apeabody]

/gcbrun