Added iam_bindings and iam_bindings_additive to apigee module
This commit is contained in:
parent
86d7ac1227
commit
022b9f5060
|
@ -17,6 +17,7 @@ This module simplifies the creation of a Apigee resources (organization, environ
|
||||||
- [New instance (Non VPC Peering Provisioning Mode)](#new-instance-non-vpc-peering-provisioning-mode)
|
- [New instance (Non VPC Peering Provisioning Mode)](#new-instance-non-vpc-peering-provisioning-mode)
|
||||||
- [New endpoint attachment](#new-endpoint-attachment)
|
- [New endpoint attachment](#new-endpoint-attachment)
|
||||||
- [Apigee add-ons](#apigee-add-ons)
|
- [Apigee add-ons](#apigee-add-ons)
|
||||||
|
- [IAM](#iam)
|
||||||
- [Variables](#variables)
|
- [Variables](#variables)
|
||||||
- [Outputs](#outputs)
|
- [Outputs](#outputs)
|
||||||
<!-- END TOC -->
|
<!-- END TOC -->
|
||||||
|
@ -87,7 +88,6 @@ module "apigee" {
|
||||||
|
|
||||||
When a new Apigee organization is created, it is automatically peered to the authorized network. You can prevent this from happening by using the `disable_vpc_peering` key in the `organization` variable, as shown below:
|
When a new Apigee organization is created, it is automatically peered to the authorized network. You can prevent this from happening by using the `disable_vpc_peering` key in the `organization` variable, as shown below:
|
||||||
|
|
||||||
|
|
||||||
```hcl
|
```hcl
|
||||||
module "apigee" {
|
module "apigee" {
|
||||||
source = "./fabric/modules/apigee"
|
source = "./fabric/modules/apigee"
|
||||||
|
@ -117,7 +117,6 @@ module "apigee" {
|
||||||
# tftest modules=1 resources=6 inventory=no-peering.yaml
|
# tftest modules=1 resources=6 inventory=no-peering.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
### All resources (CLOUD)
|
### All resources (CLOUD)
|
||||||
|
|
||||||
```hcl
|
```hcl
|
||||||
|
@ -147,9 +146,6 @@ module "apigee" {
|
||||||
display_name = "APIs prod"
|
display_name = "APIs prod"
|
||||||
description = "APIs prod"
|
description = "APIs prod"
|
||||||
envgroups = ["prod"]
|
envgroups = ["prod"]
|
||||||
iam = {
|
|
||||||
"roles/viewer" = ["group:devops@myorg.com"]
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
instances = {
|
instances = {
|
||||||
|
@ -176,7 +172,7 @@ module "apigee" {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=15
|
# tftest modules=1 resources=14
|
||||||
```
|
```
|
||||||
|
|
||||||
### All resources (HYBRID control plane)
|
### All resources (HYBRID control plane)
|
||||||
|
@ -205,13 +201,10 @@ module "apigee" {
|
||||||
display_name = "APIs prod"
|
display_name = "APIs prod"
|
||||||
description = "APIs prod"
|
description = "APIs prod"
|
||||||
envgroups = ["prod"]
|
envgroups = ["prod"]
|
||||||
iam = {
|
|
||||||
"roles/viewer" = ["group:devops@myorg.com"]
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=8
|
# tftest modules=1 resources=7
|
||||||
```
|
```
|
||||||
|
|
||||||
### New environment group
|
### New environment group
|
||||||
|
@ -311,18 +304,69 @@ module "apigee" {
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=1
|
# tftest modules=1 resources=1
|
||||||
```
|
```
|
||||||
|
|
||||||
|
### IAM
|
||||||
|
|
||||||
|
```hcl
|
||||||
|
module "apigee" {
|
||||||
|
source = "./fabric/modules/apigee"
|
||||||
|
project_id = "my-project"
|
||||||
|
organization = {
|
||||||
|
display_name = "My Organization"
|
||||||
|
description = "My Organization"
|
||||||
|
authorized_network = "my-vpc"
|
||||||
|
runtime_type = "CLOUD"
|
||||||
|
billing_type = "PAYG"
|
||||||
|
database_encryption_key = "123456789"
|
||||||
|
analytics_region = "europe-west1"
|
||||||
|
}
|
||||||
|
envgroups = {
|
||||||
|
test = ["test.example.com"]
|
||||||
|
prod = ["prod.example.com"]
|
||||||
|
}
|
||||||
|
environments = {
|
||||||
|
apis-test = {
|
||||||
|
display_name = "APIs test"
|
||||||
|
description = "APIs Test"
|
||||||
|
envgroups = ["test"]
|
||||||
|
iam = {
|
||||||
|
"roles/apigee.environmentAdmin" = ["group:apigee-env-admin@myorg.com"]
|
||||||
|
}
|
||||||
|
iam_bindings_additive = {
|
||||||
|
viewer = {
|
||||||
|
role = "roles/viewer"
|
||||||
|
member = "user:user1@myorg.com"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
apis-prod = {
|
||||||
|
display_name = "APIs prod"
|
||||||
|
description = "APIs prod"
|
||||||
|
envgroups = ["prod"]
|
||||||
|
iam_bindings = {
|
||||||
|
apigee-env-admin = {
|
||||||
|
role = "roles/apigee.environmentAdmin"
|
||||||
|
members = ["group:apigee-env-admin@myorg.com"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# tftest modules=1 resources=10
|
||||||
|
```
|
||||||
|
|
||||||
<!-- BEGIN TFDOC -->
|
<!-- BEGIN TFDOC -->
|
||||||
## Variables
|
## Variables
|
||||||
|
|
||||||
| name | description | type | required | default |
|
| name | description | type | required | default |
|
||||||
|---|---|:---:|:---:|:---:|
|
|---|---|:---:|:---:|:---:|
|
||||||
| [project_id](variables.tf#L117) | Project ID. | <code>string</code> | ✓ | |
|
| [project_id](variables.tf#L125) | Project ID. | <code>string</code> | ✓ | |
|
||||||
| [addons_config](variables.tf#L17) | Addons configuration. | <code title="object({ advanced_api_ops = optional(bool, false) api_security = optional(bool, false) connectors_platform = optional(bool, false) integration = optional(bool, false) monetization = optional(bool, false) })">object({…})</code> | | <code>null</code> |
|
| [addons_config](variables.tf#L17) | Addons configuration. | <code title="object({ advanced_api_ops = optional(bool, false) api_security = optional(bool, false) connectors_platform = optional(bool, false) integration = optional(bool, false) monetization = optional(bool, false) })">object({…})</code> | | <code>null</code> |
|
||||||
| [endpoint_attachments](variables.tf#L29) | Endpoint attachments. | <code title="map(object({ region = string service_attachment = string }))">map(object({…}))</code> | | <code>{}</code> |
|
| [endpoint_attachments](variables.tf#L29) | Endpoint attachments. | <code title="map(object({ region = string service_attachment = string }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [envgroups](variables.tf#L39) | Environment groups (NAME => [HOSTNAMES]). | <code>map(list(string))</code> | | <code>{}</code> |
|
| [envgroups](variables.tf#L39) | Environment groups (NAME => [HOSTNAMES]). | <code>map(list(string))</code> | | <code>{}</code> |
|
||||||
| [environments](variables.tf#L46) | Environments. | <code title="map(object({ display_name = optional(string) description = optional(string, "Terraform-managed") deployment_type = optional(string) api_proxy_type = optional(string) node_config = optional(object({ min_node_count = optional(number) max_node_count = optional(number) })) iam = optional(map(list(string))) envgroups = optional(list(string)) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [environments](variables.tf#L46) | Environments. | <code title="map(object({ display_name = optional(string) description = optional(string, "Terraform-managed") deployment_type = optional(string) api_proxy_type = optional(string) node_config = optional(object({ min_node_count = optional(number) max_node_count = optional(number) })) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) })), {}) iam_bindings_additive = optional(map(object({ role = string member = string })), {}) envgroups = optional(list(string), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [instances](variables.tf#L64) | Instances ([REGION] => [INSTANCE]). | <code title="map(object({ name = optional(string) display_name = optional(string) description = optional(string, "Terraform-managed") runtime_ip_cidr_range = optional(string) troubleshooting_ip_cidr_range = optional(string) disk_encryption_key = optional(string) consumer_accept_list = optional(list(string)) enable_nat = optional(bool, false) environments = optional(list(string)) }))">map(object({…}))</code> | | <code>{}</code> |
|
| [instances](variables.tf#L72) | Instances ([REGION] => [INSTANCE]). | <code title="map(object({ name = optional(string) display_name = optional(string) description = optional(string, "Terraform-managed") runtime_ip_cidr_range = optional(string) troubleshooting_ip_cidr_range = optional(string) disk_encryption_key = optional(string) consumer_accept_list = optional(list(string)) enable_nat = optional(bool, false) environments = optional(list(string), []) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
| [organization](variables.tf#L89) | Apigee organization. If set to null the organization must already exist. | <code title="object({ display_name = optional(string) description = optional(string, "Terraform-managed") authorized_network = optional(string) runtime_type = optional(string, "CLOUD") billing_type = optional(string) database_encryption_key = optional(string) analytics_region = optional(string, "europe-west1") retention = optional(string) disable_vpc_peering = optional(bool, false) })">object({…})</code> | | <code>null</code> |
|
| [organization](variables.tf#L97) | Apigee organization. If set to null the organization must already exist. | <code title="object({ display_name = optional(string) description = optional(string, "Terraform-managed") authorized_network = optional(string) runtime_type = optional(string, "CLOUD") billing_type = optional(string) database_encryption_key = optional(string) analytics_region = optional(string, "europe-west1") retention = optional(string) disable_vpc_peering = optional(bool, false) })">object({…})</code> | | <code>null</code> |
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,57 @@
|
||||||
|
/**
|
||||||
|
* Copyright 2023 Google LLC
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
resource "google_apigee_environment_iam_binding" "authoritative" {
|
||||||
|
for_each = merge(concat([for k1, v1 in var.environments : {
|
||||||
|
for k2, v2 in v1.iam : "${k1}-${k2}" => {
|
||||||
|
environment = "${k1}"
|
||||||
|
role = k2
|
||||||
|
members = v2
|
||||||
|
}
|
||||||
|
}])...)
|
||||||
|
org_id = local.org_id
|
||||||
|
env_id = google_apigee_environment.environments[each.value.environment].name
|
||||||
|
role = each.value.role
|
||||||
|
members = each.value.members
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_apigee_environment_iam_binding" "bindings" {
|
||||||
|
for_each = merge(concat([for k1, v1 in var.environments : {
|
||||||
|
for k2, v2 in coalesce(v1.iam_bindings, {}) : "${k1}-${k2}" => {
|
||||||
|
environment = "${k1}"
|
||||||
|
role = v2.role
|
||||||
|
members = v2.members
|
||||||
|
}
|
||||||
|
}])...)
|
||||||
|
org_id = local.org_id
|
||||||
|
env_id = google_apigee_environment.environments[each.value.environment].name
|
||||||
|
role = each.value.role
|
||||||
|
members = each.value.members
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_apigee_environment_iam_member" "bindings" {
|
||||||
|
for_each = merge(concat([for k1, v1 in var.environments : {
|
||||||
|
for k2, v2 in coalesce(v1.iam_bindings_additive, {}) : "${k1}-${k2}" => {
|
||||||
|
environment = "${k1}"
|
||||||
|
role = v2.role
|
||||||
|
member = v2.member
|
||||||
|
}
|
||||||
|
}])...)
|
||||||
|
org_id = local.org_id
|
||||||
|
env_id = google_apigee_environment.environments[each.value.environment].name
|
||||||
|
role = each.value.role
|
||||||
|
member = each.value.member
|
||||||
|
}
|
|
@ -62,7 +62,7 @@ resource "google_apigee_environment" "environments" {
|
||||||
|
|
||||||
resource "google_apigee_envgroup_attachment" "envgroup_attachments" {
|
resource "google_apigee_envgroup_attachment" "envgroup_attachments" {
|
||||||
for_each = merge(concat([for k1, v1 in var.environments : {
|
for_each = merge(concat([for k1, v1 in var.environments : {
|
||||||
for v2 in coalesce(v1.envgroups, []) : "${k1}-${v2}" => {
|
for v2 in v1.envgroups : "${k1}-${v2}" => {
|
||||||
environment = k1
|
environment = k1
|
||||||
envgroup = v2
|
envgroup = v2
|
||||||
}
|
}
|
||||||
|
@ -72,20 +72,6 @@ resource "google_apigee_envgroup_attachment" "envgroup_attachments" {
|
||||||
depends_on = [google_apigee_envgroup.envgroups]
|
depends_on = [google_apigee_envgroup.envgroups]
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "google_apigee_environment_iam_binding" "binding" {
|
|
||||||
for_each = merge(concat([for k1, v1 in var.environments : {
|
|
||||||
for k2, v2 in coalesce(v1.iam, {}) : "${k1}-${k2}" => {
|
|
||||||
environment = "${k1}"
|
|
||||||
role = k2
|
|
||||||
members = v2
|
|
||||||
}
|
|
||||||
}])...)
|
|
||||||
org_id = local.org_id
|
|
||||||
env_id = google_apigee_environment.environments[each.value.environment].name
|
|
||||||
role = each.value.role
|
|
||||||
members = each.value.members
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "google_apigee_instance" "instances" {
|
resource "google_apigee_instance" "instances" {
|
||||||
for_each = var.instances
|
for_each = var.instances
|
||||||
name = coalesce(each.value.name, "instance-${each.key}")
|
name = coalesce(each.value.name, "instance-${each.key}")
|
||||||
|
@ -114,7 +100,7 @@ resource "google_apigee_nat_address" "apigee_nat" {
|
||||||
|
|
||||||
resource "google_apigee_instance_attachment" "instance_attachments" {
|
resource "google_apigee_instance_attachment" "instance_attachments" {
|
||||||
for_each = merge(concat([for k1, v1 in var.instances : {
|
for_each = merge(concat([for k1, v1 in var.instances : {
|
||||||
for v2 in coalesce(v1.environments, []) :
|
for v2 in v1.environments :
|
||||||
"${k1}-${v2}" => {
|
"${k1}-${v2}" => {
|
||||||
instance = k1
|
instance = k1
|
||||||
environment = v2
|
environment = v2
|
||||||
|
|
|
@ -54,8 +54,16 @@ variable "environments" {
|
||||||
min_node_count = optional(number)
|
min_node_count = optional(number)
|
||||||
max_node_count = optional(number)
|
max_node_count = optional(number)
|
||||||
}))
|
}))
|
||||||
iam = optional(map(list(string)))
|
iam = optional(map(list(string)), {})
|
||||||
envgroups = optional(list(string))
|
iam_bindings = optional(map(object({
|
||||||
|
role = string
|
||||||
|
members = list(string)
|
||||||
|
})), {})
|
||||||
|
iam_bindings_additive = optional(map(object({
|
||||||
|
role = string
|
||||||
|
member = string
|
||||||
|
})), {})
|
||||||
|
envgroups = optional(list(string), [])
|
||||||
}))
|
}))
|
||||||
default = {}
|
default = {}
|
||||||
nullable = false
|
nullable = false
|
||||||
|
@ -72,7 +80,7 @@ variable "instances" {
|
||||||
disk_encryption_key = optional(string)
|
disk_encryption_key = optional(string)
|
||||||
consumer_accept_list = optional(list(string))
|
consumer_accept_list = optional(list(string))
|
||||||
enable_nat = optional(bool, false)
|
enable_nat = optional(bool, false)
|
||||||
environments = optional(list(string))
|
environments = optional(list(string), [])
|
||||||
}))
|
}))
|
||||||
validation {
|
validation {
|
||||||
condition = alltrue([
|
condition = alltrue([
|
||||||
|
|
|
@ -41,7 +41,7 @@ values:
|
||||||
description: APIs Test
|
description: APIs Test
|
||||||
display_name: APIs test
|
display_name: APIs test
|
||||||
name: apis-test
|
name: apis-test
|
||||||
google_apigee_environment_iam_binding.binding["apis-prod-roles/viewer"]:
|
google_apigee_environment_iam_binding.authoritative["apis-prod-roles/viewer"]:
|
||||||
condition: []
|
condition: []
|
||||||
env_id: apis-prod
|
env_id: apis-prod
|
||||||
members:
|
members:
|
||||||
|
|
|
@ -42,7 +42,7 @@ values:
|
||||||
description: APIs Test
|
description: APIs Test
|
||||||
display_name: APIs test
|
display_name: APIs test
|
||||||
name: apis-test
|
name: apis-test
|
||||||
google_apigee_environment_iam_binding.binding["apis-prod-roles/viewer"]:
|
google_apigee_environment_iam_binding.authoritative["apis-prod-roles/viewer"]:
|
||||||
condition: []
|
condition: []
|
||||||
env_id: apis-prod
|
env_id: apis-prod
|
||||||
members:
|
members:
|
||||||
|
|
Loading…
Reference in New Issue