Add latest changes from gitlab-org/gitlab@master

2 files changed, 71 insertions, 8 deletions

diff --git a/app/services/google_cloud/create_service_accounts_service.rb b/app/services/google_cloud/create_service_accounts_service.rb
new file mode 100644
index 00000000000..fa025e8f672
--- /dev/null
+++ b/app/services/google_cloud/create_service_accounts_service.rb
@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module GoogleCloud
+  class CreateServiceAccountsService < :: BaseService
+    def execute
+      service_account = google_api_client.create_service_account(gcp_project_id, service_account_name, service_account_desc)
+      service_account_key = google_api_client.create_service_account_key(gcp_project_id, service_account.unique_id)
+
+      service_accounts_service.add_for_project(
+        environment_name,
+        service_account.project_id,
+        service_account.to_json,
+        service_account_key.to_json,
+        environment_protected?
+      )
+
+      ServiceResponse.success(message: _('Service account generated successfully'), payload: {
+        service_account: service_account,
+        service_account_key: service_account_key
+      })
+    end
+
+    private
+
+    def google_oauth2_token
+      @params[:google_oauth2_token]
+    end
+
+    def gcp_project_id
+      @params[:gcp_project_id]
+    end
+
+    def environment_name
+      @params[:environment_name]
+    end
+
+    def google_api_client
+      GoogleApi::CloudPlatform::Client.new(google_oauth2_token, nil)
+    end
+
+    def service_accounts_service
+      GoogleCloud::ServiceAccountsService.new(project)
+    end
+
+    def service_account_name
+      "GitLab :: #{project.name} :: #{environment_name}"
+    end
+
+    def service_account_desc
+      "GitLab generated service account for project '#{project.name}' and environment '#{environment_name}'"
+    end
+
+    # Overriden in EE
+    def environment_protected?
+      false
+    end
+  end
+end
+
+GoogleCloud::CreateServiceAccountsService.prepend_mod
diff --git a/app/services/google_cloud/service_accounts_service.rb b/app/services/google_cloud/service_accounts_service.rb
index a512b27493d..3014daf08e2 100644
--- a/app/services/google_cloud/service_accounts_service.rb
+++ b/app/services/google_cloud/service_accounts_service.rb
@@ -27,39 +27,42 @@ module GoogleCloud
       end
     end
 
-    def add_for_project(environment, gcp_project_id, service_account, service_account_key)
+    def add_for_project(environment, gcp_project_id, service_account, service_account_key, is_protected)
       project_var_create_or_replace(
         environment,
         'GCP_PROJECT_ID',
-        gcp_project_id
+        gcp_project_id,
+        is_protected
       )
       project_var_create_or_replace(
         environment,
         'GCP_SERVICE_ACCOUNT',
-        service_account
+        service_account,
+        is_protected
       )
       project_var_create_or_replace(
         environment,
         'GCP_SERVICE_ACCOUNT_KEY',
-        service_account_key
+        service_account_key,
+        is_protected
       )
     end
 
     private
 
     def group_vars_by_environment
-      filtered_vars = @project.variables.filter { |variable| GCP_KEYS.include? variable.key }
+      filtered_vars = project.variables.filter { |variable| GCP_KEYS.include? variable.key }
       filtered_vars.each_with_object({}) do |variable, grouped|
         grouped[variable.environment_scope] ||= {}
         grouped[variable.environment_scope][variable.key] = variable.value
       end
     end
 
-    def project_var_create_or_replace(environment_scope, key, value)
+    def project_var_create_or_replace(environment_scope, key, value, is_protected)
       params = { key: key, filter: { environment_scope: environment_scope } }
-      existing_variable = ::Ci::VariablesFinder.new(@project, params).execute.first
+      existing_variable = ::Ci::VariablesFinder.new(project, params).execute.first
       existing_variable.destroy if existing_variable
-      @project.variables.create!(key: key, value: value, environment_scope: environment_scope, protected: true)
+      project.variables.create!(key: key, value: value, environment_scope: environment_scope, protected: is_protected)
     end
   end
 end