cloud-foundation-fabric/fast/stages/1-resman/branch-teams.tf

166 lines
6.2 KiB
Terraform
Raw Normal View History

/**
* Copyright 2022 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
Initial MVP for CI/CD (#608) * preliminary support for wif in stage 0 * IAM wif role * IAM wif role TODO * add support for external SA IAM to SA module * add name output to SA module * separate cicd SA * tfdoc * GITLAB principal (untested) * make GCS name output static * outputs bucket * fix stage 1 test * tweak outputs * tfdoc * move wif_pool to automation variable * add support for top-level and repository providers * add missing boilerplate * fix branchless principal * initial workflow * symlink provider template in stages * remove service accounts from stage 0 cicd tfvars * add cicd interface variable to resman stage * fix cicd variable in resman stage * better condition on outputs_location * fix last change * change outputs_location type * revert outputs_location change * split outputs in stage 0 * update ci/cd temporary notes * rename additive IAM resource in SA module * split outputs in stage 1 * remove unused locals * fix stage 1 tests * tfdoc * Upload action files to outputs_bucket * Fix tests and README * rename template, streamline outputs * local templates and gcs output for all stage 2 * add workflows to local output files * Use lowercase WIF providers everywhere * Bring back suffix for workflow files * Remove unused files * Update READMEs * preliminary CI/CD implementation for stage 1 * fix stage 1 * stage 1 cicd * tfdoc * fix tests * readme and links for cicd and wif * refactor wif providers * refactor cicd for stage 1 * fix stage 1 * wif org policies * split identity provider configuration from cicd * add type attribute to cicd repositories * valid cicd repositories have a workflow template * refactor stage 01 * fix stage 01 tests * minimal CI/CD documentation * better check_links error reporting * fix links * Added Gitlab specific configurations Set the default issuer_uri for Gitlab. Added allowed audiences to OIDC configuration. * Fixed TF formatting in identity providers. * Changing identity provider audience to null Changing identity provider audience to default to null. * add instructions for renaming workflows * address Julio's comments Co-authored-by: Julio Castillo <jccb@google.com> Co-authored-by: alexmeissner <alexmeissner@google.com>
2022-04-11 23:17:27 -07:00
# tfdoc:file:description Team stage resources.
2022-08-03 07:34:09 -07:00
# TODO(ludo): add support for CI/CD
############### top-level Teams branch and automation resources ###############
module "branch-teams-folder" {
source = "../../../modules/folder"
count = var.fast_features.teams ? 1 : 0
parent = "organizations/${var.organization.id}"
name = "Teams"
2022-08-03 07:34:09 -07:00
iam = {
"roles/logging.admin" = [module.branch-teams-sa.0.iam_email]
"roles/owner" = [module.branch-teams-sa.0.iam_email]
"roles/resourcemanager.folderAdmin" = [module.branch-teams-sa.0.iam_email]
"roles/resourcemanager.projectCreator" = [module.branch-teams-sa.0.iam_email]
"roles/compute.xpnAdmin" = [module.branch-teams-sa.0.iam_email]
}
tag_bindings = {
context = try(
module.organization.tag_values["${var.tag_names.context}/teams"].id, null
)
}
}
2022-08-03 07:34:09 -07:00
module "branch-teams-sa" {
source = "../../../modules/iam-service-account"
count = var.fast_features.teams ? 1 : 0
project_id = var.automation.project_id
name = "prod-resman-teams-0"
display_name = "Terraform resman teams service account."
prefix = var.prefix
2022-08-03 07:34:09 -07:00
iam_storage_roles = {
(var.automation.outputs_bucket) = ["roles/storage.admin"]
}
}
module "branch-teams-gcs" {
source = "../../../modules/gcs"
count = var.fast_features.teams ? 1 : 0
project_id = var.automation.project_id
name = "prod-resman-teams-0"
prefix = var.prefix
location = var.locations.gcs
storage_class = local.gcs_storage_class
versioning = true
2022-08-03 07:34:09 -07:00
iam = {
"roles/storage.objectAdmin" = [module.branch-teams-sa.0.iam_email]
}
}
2022-08-03 07:34:09 -07:00
################## per-team folders and automation resources ##################
module "branch-teams-team-folder" {
2022-08-03 07:34:09 -07:00
source = "../../../modules/folder"
for_each = var.fast_features.teams ? coalesce(var.team_folders, {}) : {}
parent = module.branch-teams-folder.0.id
name = each.value.descriptive_name
iam = {
"roles/logging.admin" = [module.branch-teams-team-sa[each.key].iam_email]
"roles/owner" = [module.branch-teams-team-sa[each.key].iam_email]
"roles/resourcemanager.folderAdmin" = [module.branch-teams-team-sa[each.key].iam_email]
"roles/resourcemanager.projectCreator" = [module.branch-teams-team-sa[each.key].iam_email]
"roles/compute.xpnAdmin" = [module.branch-teams-team-sa[each.key].iam_email]
}
group_iam = each.value.group_iam == null ? {} : each.value.group_iam
}
module "branch-teams-team-sa" {
source = "../../../modules/iam-service-account"
for_each = var.fast_features.teams ? coalesce(var.team_folders, {}) : {}
project_id = var.automation.project_id
name = "prod-teams-${each.key}-0"
display_name = "Terraform team ${each.key} service account."
prefix = var.prefix
iam = {
"roles/iam.serviceAccountTokenCreator" = (
each.value.impersonation_groups == null
? []
: [for g in each.value.impersonation_groups : "group:${g}"]
)
}
}
module "branch-teams-team-gcs" {
source = "../../../modules/gcs"
for_each = var.fast_features.teams ? coalesce(var.team_folders, {}) : {}
project_id = var.automation.project_id
name = "prod-teams-${each.key}-0"
prefix = var.prefix
location = var.locations.gcs
storage_class = local.gcs_storage_class
versioning = true
iam = {
"roles/storage.objectAdmin" = [module.branch-teams-team-sa[each.key].iam_email]
}
}
2022-08-03 07:34:09 -07:00
# per-team environment folders where project factory SAs can create projects
module "branch-teams-team-dev-folder" {
source = "../../../modules/folder"
for_each = var.fast_features.teams ? coalesce(var.team_folders, {}) : {}
parent = module.branch-teams-team-folder[each.key].id
# naming: environment descriptive name
name = "Development"
# environment-wide human permissions on the whole teams environment
group_iam = {}
iam = {
2022-08-03 07:34:09 -07:00
(local.custom_roles.service_project_network_admin) = (
local.branch_optional_sa_lists.pf-dev
)
# remove owner here and at project level if SA does not manage project resources
2022-08-03 07:34:09 -07:00
"roles/owner" = local.branch_optional_sa_lists.pf-dev
"roles/logging.admin" = local.branch_optional_sa_lists.pf-dev
"roles/resourcemanager.folderAdmin" = local.branch_optional_sa_lists.pf-dev
"roles/resourcemanager.projectCreator" = local.branch_optional_sa_lists.pf-dev
}
tag_bindings = {
environment = try(
module.organization.tag_values["${var.tag_names.environment}/development"].id, null
)
}
}
module "branch-teams-team-prod-folder" {
source = "../../../modules/folder"
for_each = var.fast_features.teams ? coalesce(var.team_folders, {}) : {}
parent = module.branch-teams-team-folder[each.key].id
# naming: environment descriptive name
name = "Production"
# environment-wide human permissions on the whole teams environment
group_iam = {}
iam = {
2022-08-03 07:34:09 -07:00
(local.custom_roles.service_project_network_admin) = (
local.branch_optional_sa_lists.pf-prod
)
# remove owner here and at project level if SA does not manage project resources
2022-08-03 07:34:09 -07:00
"roles/owner" = local.branch_optional_sa_lists.pf-prod
"roles/logging.admin" = local.branch_optional_sa_lists.pf-prod
"roles/resourcemanager.folderAdmin" = local.branch_optional_sa_lists.pf-prod
"roles/resourcemanager.projectCreator" = local.branch_optional_sa_lists.pf-prod
}
tag_bindings = {
environment = try(
module.organization.tag_values["${var.tag_names.environment}/production"].id, null
)
}
}