Merge branch 'master' into elia-gcve
This commit is contained in:
Julio Castillo
GitHub
commit
49a4550b5d
17
CHANGELOG.md
17
CHANGELOG.md
|
|
@ -6,13 +6,29 @@ All notable changes to this project will be documented in this file.
|
|||
## [Unreleased]
|
||||
<!-- None < 2023-08-09 17:02:13+00:00 -->
|
||||
|
||||
### BLUEPRINTS
|
||||
|
||||
- [[#1595](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1595)] **incompatible change:** IAM interface refactor ([ludoo](https://github.com/ludoo)) <!-- 2023-08-20 07:44:20+00:00 -->
|
||||
- [[#1601](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1601)] [Data Platform] Update README.md ([lcaggio](https://github.com/lcaggio)) <!-- 2023-08-18 16:27:43+00:00 -->
|
||||
|
||||
### DOCUMENTATION
|
||||
|
||||
- [[#1595](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1595)] **incompatible change:** IAM interface refactor ([ludoo](https://github.com/ludoo)) <!-- 2023-08-20 07:44:20+00:00 -->
|
||||
|
||||
### FAST
|
||||
|
||||
- [[#1595](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1595)] **incompatible change:** IAM interface refactor ([ludoo](https://github.com/ludoo)) <!-- 2023-08-20 07:44:20+00:00 -->
|
||||
- [[#1597](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1597)] fix null object exception in bootstrap output when using cloudsource ([sm3142](https://github.com/sm3142)) <!-- 2023-08-17 09:03:23+00:00 -->
|
||||
- [[#1593](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1593)] Fix FAST CI/CD for Gitlab ([ludoo](https://github.com/ludoo)) <!-- 2023-08-15 10:59:31+00:00 -->
|
||||
- [[#1583](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1583)] Fix module path for teams cicd ([ludoo](https://github.com/ludoo)) <!-- 2023-08-09 21:41:57+00:00 -->
|
||||
|
||||
### MODULES
|
||||
|
||||
- [[#1595](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1595)] **incompatible change:** IAM interface refactor ([ludoo](https://github.com/ludoo)) <!-- 2023-08-20 07:44:20+00:00 -->
|
||||
- [[#1600](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1600)] fix(cloud-run): move cpu boost annotation to revision ([LiuVII](https://github.com/LiuVII)) <!-- 2023-08-18 14:46:25+00:00 -->
|
||||
- [[#1599](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1599)] Fixing some typos ([bluPhy](https://github.com/bluPhy)) <!-- 2023-08-18 08:29:26+00:00 -->
|
||||
- [[#1598](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1598)] feat(cloud-run): add startup cpu boost option ([JSchwerberg](https://github.com/JSchwerberg)) <!-- 2023-08-17 22:05:24+00:00 -->
|
||||
- [[#1594](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1594)] Add support for conditions to `iam_members` module variables ([ludoo](https://github.com/ludoo)) <!-- 2023-08-15 14:28:23+00:00 -->
|
||||
- [[#1591](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1591)] feat: 🎸 (modules/cloudsql-instance):add project_id for ssl cert ([erabusi](https://github.com/erabusi)) <!-- 2023-08-14 10:40:25+00:00 -->
|
||||
- [[#1589](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1589)] Add new `iam_members` variable to IAM additive module interfaces ([ludoo](https://github.com/ludoo)) <!-- 2023-08-14 09:54:50+00:00 -->
|
||||
- [[#1588](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1588)] feat: 🎸 (modules/cloudsql-instance): enable require_ssl cert support ([erabusi](https://github.com/erabusi)) <!-- 2023-08-14 09:37:04+00:00 -->
|
||||
|
|
@ -22,6 +38,7 @@ All notable changes to this project will be documented in this file.
|
|||
|
||||
### TOOLS
|
||||
|
||||
- [[#1595](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1595)] **incompatible change:** IAM interface refactor ([ludoo](https://github.com/ludoo)) <!-- 2023-08-20 07:44:20+00:00 -->
|
||||
- [[#1585](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1585)] Print inventory path when a test fails ([juliocc](https://github.com/juliocc)) <!-- 2023-08-11 10:28:08+00:00 -->
|
||||
|
||||
## [25.0.0] - 2023-08-09
|
||||
|
|
|
|||
|
|
@ -5,11 +5,11 @@
|
|||
|
||||
## Status
|
||||
|
||||
Discussed.
|
||||
Implemented in [#1595](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1595).
|
||||
|
||||
## Context
|
||||
|
||||
Our modules IAM interface has evolved organically to progressively support more functionality, resulting in a large variable surface, lack of support for some key features like conditions, and some fragility for specific use cases.
|
||||
The IAM interface in our modules has evolved organically to progressively support more functionality, resulting in a large variable surface, lack of support for some key features like conditions, and some fragility for specific use cases.
|
||||
|
||||
We currently support, with uneven coverage across modules:
|
||||
|
||||
|
|
@ -115,34 +115,16 @@ The proposal above summarizes the state of discussions between the authors, and
|
|||
|
||||
## Consequences
|
||||
|
||||
A few data blueprints that leverage `iam_additive` will need to be refactored to use the new variable, using one of the following patterns:
|
||||
### FAST
|
||||
|
||||
```hcl
|
||||
locals {
|
||||
network_sa_roles = [
|
||||
"roles/compute.orgFirewallPolicyAdmin",
|
||||
"roles/compute.xpnAdmin"
|
||||
]
|
||||
}
|
||||
IAM implementation in the bootstrap stage and matching multitenant bootstrap has radically changed, with the addition of a new [`organization-iam.tf`](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/blob/master/fast/stages/0-bootstrap/organization-iam.tf) file which contains IAM binding definitions in an abstracted format, that is then converted to the specific formats required by the `iam`, `iam_bindings` and `iam_bindings_additive` variables.
|
||||
|
||||
module "organization" {
|
||||
source = "../../../modules/organization"
|
||||
organization_id = "organizations/${var.organization.id}"
|
||||
iam_bindings_additive = merge(
|
||||
# IAM bindings via locals pattern
|
||||
{
|
||||
for r in local.network_sa_roles : "network_sa-${r}" : {
|
||||
member = module.branch-network-sa.iam_email
|
||||
role = r
|
||||
}
|
||||
},
|
||||
# IAM bindings via explicit reference pattern
|
||||
{
|
||||
security_sa = {
|
||||
member = module.branch-security-sa.iam_email
|
||||
role = "roles/accesscontextmanager.policyAdmin"
|
||||
}
|
||||
}
|
||||
)
|
||||
}
|
||||
```
|
||||
This brings several advantages over the previous handling of IAM:
|
||||
|
||||
- authoritative and additive bindings are now grouped by principal in an easy to read and change format that serves as its own documentation
|
||||
- support for IAM conditions has removed the need for standalone resources and made the intent behind those more explicit
|
||||
- some subtle bugs on the intersection of user-specified bindings and internally-specified ones have been addressed
|
||||
|
||||
### Blueprints
|
||||
|
||||
A few data blueprints that leverage `iam_additive` have been refactored to use the new variable. This is most notable in data blueprints, where extra files have been added to the more complex examples like data foundations, to abstract IAM bindings in a way similar to what is described above for FAST.
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
# FAST architectural documents
|
||||
# Fabric modules architectural documents
|
||||
|
||||
This folder contains assorted bits of documentation used to log current architectural choices, or past decisions. Format is inspired by [Michael Nygard's decision record template](https://github.com/joelparkerhenderson/architecture-decision-record/blob/main/templates/decision-record-template-by-michael-nygard/index.md).
|
||||
|
|
|
|||
Loading…
Reference in New Issue