Feature/node group sa main part

.github/workflows/terraform.yml

@@ -61,7 +61,7 @@ jobs:
     - name: Setup s3cmd
       run: |
         pip3 install s3cmd --no-cache --quiet
-        s3cmd --dump-config \
+        s3cmd --configure --dump-config \
         --access_key="${{ secrets.SA_ACCESS_KEY_ID }}" \
         --secret_key="${{ secrets.SA_SECRET_KEY }}" \
         --host="storage.eu-north1.nebius.cloud:443" \

dsvm/main.tf

@@ -9,9 +9,9 @@ resource "nebius_compute_v1_instance" "dsvm_instance" {
 
   network_interfaces = [
     {
-      name       = "eth0"
-      subnet_id  = var.subnet_id
-      ip_address = {}
+      name              = "eth0"
+      subnet_id         = var.subnet_id
+      ip_address        = {}
       public_ip_address = {}
     }
   ]

k8s-inference/README.md

@@ -73,6 +73,7 @@ There are additional configurable variables in `variables.tf`.
 ### Environment and network variables
 ```hcl
 # Cloud environment and network
+tenant_id      = "" # The tenant id
 parent_id      = "" # The project-id in this context
 subnet_id      = "" # Use the command "nebius vpc v1alpha1 network list" to see the subnet id
 region         = "" # The project region.

k8s-inference/main.tf

@@ -11,6 +11,24 @@ resource "nebius_mk8s_v1_cluster" "k8s-cluster" {
   }
 }
 
+data "nebius_iam_v1_group" "admins" {
+  count     = var.enable_k8s_node_group_sa ? 1 : 0
+  name      = "admins"
+  parent_id = var.tenant_id
+}
+
+resource "nebius_iam_v1_service_account" "k8s_node_group_sa" {
+  count     = var.enable_k8s_node_group_sa ? 1 : 0
+  parent_id = var.parent_id
+  name      = join("-", ["k8s_node_group_sa", local.release-suffix])
+}
+
+resource "nebius_iam_v1_group_membership" "k8s_node_group_sa-admin" {
+  count     = var.enable_k8s_node_group_sa ? 1 : 0
+  parent_id = data.nebius_iam_v1_group.admins[0].id
+  member_id = nebius_iam_v1_service_account.k8s_node_group_sa[count.index].id
+}
+
 resource "nebius_mk8s_v1_node_group" "cpu-only" {
   fixed_node_count = var.cpu_nodes_count
   parent_id        = nebius_mk8s_v1_cluster.k8s-cluster.id
@@ -24,6 +42,9 @@ resource "nebius_mk8s_v1_node_group" "cpu-only" {
       size_gibibytes = var.cpu_disk_size
       type           = var.cpu_disk_type
     }
+
+    service_account_id = var.enable_k8s_node_group_sa ? nebius_iam_v1_service_account.k8s_node_group_sa[0].id : null
+
     network_interfaces = [
       {
         public_ip_address = {}
@@ -66,6 +87,9 @@ resource "nebius_mk8s_v1_node_group" "gpu" {
       size_gibibytes = var.gpu_disk_size
       type           = var.gpu_disk_type
     }
+
+    service_account_id = var.enable_k8s_node_group_sa ? nebius_iam_v1_service_account.k8s_node_group_sa[0].id : null
+
     network_interfaces = [
       {
         subnet_id         = var.subnet_id

k8s-inference/terraform.tfvars

@@ -15,6 +15,7 @@ gpu_nodes_count = 1 # Number of GPU nodes
 # cpu_nodes_preset   =                 # CPU nodes preset
 # gpu_nodes_platform =                 # GPU nodes platform
 # gpu_nodes_preset   =                 # GPU nodes preset
+enable_k8s_node_group_sa = true
 
 # Observability
 enable_grafana    = true  # Enable or disable Grafana deployment with true or false

k8s-inference/variables.tf

@@ -1,4 +1,9 @@
 # Global
+variable "tenant_id" {
+  description = "Tenant ID."
+  type        = string
+}
+
 variable "parent_id" {
   description = "Project ID."
   type        = string
@@ -178,6 +183,12 @@ variable "gpu_nodes_assign_public_ip" {
   default     = false
 }
 
+variable "enable_k8s_node_group_sa" {
+  description = "Enable K8S Node Group Service Account"
+  type        = bool
+  default     = true
+}
+
 # Observability
 variable "enable_grafana" {
   description = "Enable Grafana."

k8s-training/README.md

@@ -82,6 +82,7 @@ Additional configurable variables can be found in the `variables.tf` file.
 
 ```hcl
 # Cloud environment and network
+tenant_id      = "" # The tenant id
 parent_id      = "" # The project-id in this context
 subnet_id      = "" # Run the `nebius vpc v1alpha1 network list` command to see the subnet id
 region         = "" # The project region

k8s-training/main.tf

@@ -11,6 +11,24 @@ resource "nebius_mk8s_v1_cluster" "k8s-cluster" {
   }
 }
 
+data "nebius_iam_v1_group" "admins" {
+  count     = var.enable_k8s_node_group_sa ? 1 : 0
+  name      = "admins"
+  parent_id = var.tenant_id
+}
+
+resource "nebius_iam_v1_service_account" "k8s_node_group_sa" {
+  count     = var.enable_k8s_node_group_sa ? 1 : 0
+  parent_id = var.parent_id
+  name      = join("-", ["k8s_node_group_sa", local.release-suffix])
+}
+
+resource "nebius_iam_v1_group_membership" "k8s_node_group_sa-admin" {
+  count     = var.enable_k8s_node_group_sa ? 1 : 0
+  parent_id = data.nebius_iam_v1_group.admins[0].id
+  member_id = nebius_iam_v1_service_account.k8s_node_group_sa[count.index].id
+}
+
 resource "nebius_mk8s_v1_node_group" "cpu-only" {
   fixed_node_count = var.cpu_nodes_count
   parent_id        = nebius_mk8s_v1_cluster.k8s-cluster.id
@@ -24,6 +42,9 @@ resource "nebius_mk8s_v1_node_group" "cpu-only" {
       size_gibibytes = var.cpu_disk_size
       type           = var.cpu_disk_type
     }
+
+    service_account_id = var.enable_k8s_node_group_sa ? nebius_iam_v1_service_account.k8s_node_group_sa[0].id : null
+
     network_interfaces = [
       {
         public_ip_address = {}
@@ -66,6 +87,9 @@ resource "nebius_mk8s_v1_node_group" "gpu" {
       size_gibibytes = var.gpu_disk_size
       type           = var.gpu_disk_type
     }
+
+    service_account_id = var.enable_k8s_node_group_sa ? nebius_iam_v1_service_account.k8s_node_group_sa[0].id : null
+
     network_interfaces = [
       {
         subnet_id         = var.subnet_id

k8s-training/terraform.tfvars

@@ -1,4 +1,5 @@
 # Cloud environment and network
+# tenant_id      = "" # Tenant ID
 # parent_id      = "" # The project-id in this context
 # subnet_id      = "" # Use the command "nebius vpc v1alpha1 network list" to see the subnet id
 # region         = "" # Project region
@@ -16,6 +17,7 @@ gpu_nodes_count = 1 # Number of GPU nodes
 # gpu_nodes_platform =                 # GPU nodes platform
 # gpu_nodes_preset   =                 # GPU nodes preset
 # infiniband_fabric  =                 # Infiniband fabric name.
+enable_k8s_node_group_sa = true
 
 
 # Observability

k8s-training/variables.tf

@@ -1,4 +1,9 @@
 # Global
+variable "tenant_id" {
+  description = "Tenant ID."
+  type        = string
+}
+
 variable "parent_id" {
   description = "Project ID."
   type        = string
@@ -184,6 +189,12 @@ variable "gpu_nodes_assign_public_ip" {
   default     = false
 }
 
+variable "enable_k8s_node_group_sa" {
+  description = "Enable K8S Node Group Service Account"
+  type        = bool
+  default     = true
+}
+
 # Observability
 variable "enable_grafana" {
   description = "Enable Grafana."

modules/instance/locals.tf

@@ -1,11 +1,11 @@
 locals {
 
   users = [
-    for user in var.users: {
+    for user in var.users : {
       user_name = user.user_name
       ssh_public_key = user.ssh_public_key != null ? user.ssh_public_key : (
-        fileexists(user.ssh_key_path) ? file(user.ssh_key_path) : null)
-      }
+      fileexists(user.ssh_key_path) ? file(user.ssh_key_path) : null)
+    }
   ]
 
   regions_default = {
@@ -30,13 +30,13 @@ locals {
   # gpu_nodes_platform = coalesce(var.gpu_nodes_platform, local.current_region_defaults.gpu_nodes_platform)
   # gpu_nodes_preset   = coalesce(var.gpu_nodes_preset, local.current_region_defaults.gpu_nodes_preset)
 
-  extra_path       = var.extra_path
-  extra_disk_id    = var.add_extra_storage ? substr(nebius_compute_v1_disk.extra-storage-disk[0].id, 0, 20) : ""
+  extra_path    = var.extra_path
+  extra_disk_id = var.add_extra_storage ? substr(nebius_compute_v1_disk.extra-storage-disk[0].id, 0, 20) : ""
 
 
   cloud_init_log = jsonencode({
-    extra_path       = local.extra_path
-    extra_disk_id    = local.extra_disk_id
+    extra_path    = local.extra_path
+    extra_disk_id = local.extra_disk_id
     state         = terraform.workspace
     users         = local.users
 

modules/instance/main.tf

@@ -42,7 +42,7 @@ resource "nebius_compute_v1_instance" "instance" {
 
   secondary_disks = var.add_extra_storage ? [
     {
-      attach_mode   = "READ_WRITE"
+      attach_mode = "READ_WRITE"
       existing_disk = {
         id = nebius_compute_v1_disk.extra-storage-disk[0].id
       }
@@ -61,15 +61,15 @@ resource "nebius_compute_v1_instance" "instance" {
 
 
   cloud_init_user_data = templatefile("../modules/cloud-init/simple-setup-init.tftpl", {
-    users = local.users,
-    extra_path       = local.extra_path,
-    extra_disk_id    = local.extra_disk_id,
-    shared_filesystem_id = var.shared_filesystem_id,
+    users                   = local.users,
+    extra_path              = local.extra_path,
+    extra_disk_id           = local.extra_disk_id,
+    shared_filesystem_id    = var.shared_filesystem_id,
     shared_filesystem_mount = var.shared_filesystem_mount,
-    aws_access_key_id = var.aws_access_key_id,
-    aws_secret_access_key = var.aws_secret_access_key,
-    mount_bucket = var.mount_bucket,
-    s3_mount_path = var.s3_mount_path
+    aws_access_key_id       = var.aws_access_key_id,
+    aws_secret_access_key   = var.aws_secret_access_key,
+    mount_bucket            = var.mount_bucket,
+    s3_mount_path           = var.s3_mount_path
   })
 }
 

modules/instance/provider.tf

@@ -1,8 +1,8 @@
 terraform {
   required_providers {
     nebius = {
-      source = "terraform-provider.storage.eu-north1.nebius.cloud/nebius/nebius"
-      version= ">= 0.4.24"
+      source  = "terraform-provider.storage.eu-north1.nebius.cloud/nebius/nebius"
+      version = ">= 0.4.24"
     }
   }
 }