Merge pull request #805 from GoogleCloudPlatform/jccb/project-apis

Change `modules/project` service_config default
2022-09-09 09:54:31 +02:00 · 2022-09-09 09:54:31 +02:00 · c5216c7ec3
parent 8af3f9d45c f8e2fdaf19
commit c5216c7ec3
28 changed files with 14 additions and 106 deletions
--- a/examples/cloud-operations/asset-inventory-feed-remediation/main.tf
+++ b/examples/cloud-operations/asset-inventory-feed-remediation/main.tf
@ -29,10 +29,6 @@ module "project" {
    "cloudfunctions.googleapis.com",
    "compute.googleapis.com"
  ]
-  service_config = {
-    disable_on_destroy         = false,
-    disable_dependent_services = false
-  }
  custom_roles = {
    (local.role_name) = [
      "compute.instances.list",
--- a/examples/cloud-operations/dns-fine-grained-iam/main.tf
+++ b/examples/cloud-operations/dns-fine-grained-iam/main.tf
@ -30,10 +30,6 @@ module "project" {
    "dns.googleapis.com",
    "servicedirectory.googleapis.com"
  ]
-  service_config = {
-    disable_on_destroy         = false,
-    disable_dependent_services = false
-  }
 }

 module "vpc" {
--- a/examples/cloud-operations/dns-shared-vpc/main.tf
+++ b/examples/cloud-operations/dns-shared-vpc/main.tf
@ -29,10 +29,6 @@ module "project" {
  parent          = var.folder_id
  prefix          = var.prefix
  services        = var.project_services
-  service_config = {
-    disable_on_destroy         = false,
-    disable_dependent_services = false
-  }
 }

 module "vpc" {
--- a/examples/cloud-operations/glb_and_armor/main.tf
+++ b/examples/cloud-operations/glb_and_armor/main.tf
@ -33,10 +33,6 @@ module "project" {
  services = [
    "compute.googleapis.com"
  ]
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  project_create = var.project_create != null
 }

--- a/examples/cloud-operations/packer-image-builder/main.tf
+++ b/examples/cloud-operations/packer-image-builder/main.tf
@ -30,10 +30,6 @@ module "project" {
  services = [
    "compute.googleapis.com"
  ]
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
 }

 module "service-account-image-builder" {
--- a/examples/cloud-operations/quota-monitoring/main.tf
+++ b/examples/cloud-operations/quota-monitoring/main.tf
@ -30,10 +30,6 @@ module "project" {
    "compute.googleapis.com",
    "cloudfunctions.googleapis.com"
  ]
-  service_config = {
-    disable_on_destroy         = false,
-    disable_dependent_services = false
-  }
  iam = {
    "roles/monitoring.metricWriter" = [module.cf.service_account_iam_email]
  }
--- a/examples/data-solutions/cloudsql-multiregion/main.tf
+++ b/examples/data-solutions/cloudsql-multiregion/main.tf
@ -77,9 +77,6 @@ module "project" {
    "storage.googleapis.com",
    "storage-component.googleapis.com",
  ]
-  service_config = {
-    disable_on_destroy = false, disable_dependent_services = false
-  }
 }

 module "vpc" {
--- a/examples/data-solutions/data-playground/main.tf
+++ b/examples/data-solutions/data-playground/main.tf
@ -49,11 +49,6 @@ module "project" {
    bq      = [try(local.service_encryption_keys.bq, null)]
    storage = [try(local.service_encryption_keys.storage, null)]
  }
-
-  service_config = {
-    disable_on_destroy         = false,
-    disable_dependent_services = false
-  }
 }

 ###############################################################################
--- a/examples/data-solutions/gcs-to-bq-with-least-privileges/main.tf
+++ b/examples/data-solutions/gcs-to-bq-with-least-privileges/main.tf
@ -129,9 +129,6 @@ module "project" {
    host_project         = local.shared_vpc_project
    service_identity_iam = {}
  }
-  service_config = {
-    disable_on_destroy = false, disable_dependent_services = false
-  }
 }

 resource "google_project_iam_member" "shared_vpc" {
--- a/examples/data-solutions/sqlserver-alwayson/main.tf
+++ b/examples/data-solutions/sqlserver-alwayson/main.tf
@ -53,7 +53,4 @@ module "project" {
    host_project         = var.shared_vpc_project_id
    service_identity_iam = {}
  }
-  service_config = {
-    disable_on_destroy = false, disable_dependent_services = false
-  }
-}
+}
--- a/examples/gke-serverless/multitenant-fleet/main.tf
+++ b/examples/gke-serverless/multitenant-fleet/main.tf
@ -44,10 +44,6 @@ module "gke-project-0" {
    ],
    var.project_services
  )
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  shared_vpc_service_config = {
    attach       = true
    host_project = var.vpc_config.host_project_id
--- a/examples/networking/hub-and-spoke-peering/main.tf
+++ b/examples/networking/hub-and-spoke-peering/main.tf
@ -40,10 +40,6 @@ module "project" {
    "compute.googleapis.com",
    "container.googleapis.com"
  ]
-  service_config = {
-    disable_on_destroy         = false,
-    disable_dependent_services = false
-  }
 }

 ################################################################################
--- a/examples/networking/hub-and-spoke-vpn/README.md
+++ b/examples/networking/hub-and-spoke-vpn/README.md
@ -45,10 +45,6 @@ module "project" {
    "compute.googleapis.com",
    "dns.googleapis.com"
  ]
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
 }

 # tftest skip
--- a/examples/networking/hub-and-spoke-vpn/main.tf
+++ b/examples/networking/hub-and-spoke-vpn/main.tf
@ -28,10 +28,6 @@ module "project" {
    "compute.googleapis.com",
    "dns.googleapis.com"
  ]
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
 }

 # test VM in landing region 1
--- a/examples/networking/ilb-next-hop/main.tf
+++ b/examples/networking/ilb-next-hop/main.tf
@ -31,10 +31,6 @@ module "project" {
    "compute.googleapis.com",
    "dns.googleapis.com",
  ]
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
 }

 module "service-accounts" {
--- a/examples/networking/private-cloud-function-from-onprem/main.tf
+++ b/examples/networking/private-cloud-function-from-onprem/main.tf
@ -24,10 +24,6 @@ module "project" {
  project_create  = var.project_create == null ? false : true
  billing_account = try(var.project_create.billing_account_id, null)
  parent          = try(var.project_create.parent, null)
-  service_config = {
-    disable_dependent_services = false
-    disable_on_destroy         = false
-  }
  services = [
    "cloudfunctions.googleapis.com",
    "cloudbuild.googleapis.com",
--- a/fast/stages/02-networking-nva/landing.tf
+++ b/fast/stages/02-networking-nva/landing.tf
@ -22,10 +22,6 @@ module "landing-project" {
  name            = "prod-net-landing-0"
  parent          = var.folder_ids.networking-prod
  prefix          = var.prefix
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  services = [
    "compute.googleapis.com",
    "dns.googleapis.com",
--- a/fast/stages/02-networking-nva/spoke-dev.tf
+++ b/fast/stages/02-networking-nva/spoke-dev.tf
@ -22,10 +22,6 @@ module "dev-spoke-project" {
  name            = "dev-net-spoke-0"
  parent          = var.folder_ids.networking-dev
  prefix          = var.prefix
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  services = [
    "compute.googleapis.com",
    "dns.googleapis.com",
--- a/fast/stages/02-networking-nva/spoke-prod.tf
+++ b/fast/stages/02-networking-nva/spoke-prod.tf
@ -22,10 +22,6 @@ module "prod-spoke-project" {
  name            = "prod-net-spoke-0"
  parent          = var.folder_ids.networking-prod
  prefix          = var.prefix
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  services = [
    "compute.googleapis.com",
    "dns.googleapis.com",
--- a/fast/stages/02-networking-peering/landing.tf
+++ b/fast/stages/02-networking-peering/landing.tf
@ -22,10 +22,6 @@ module "landing-project" {
  name            = "prod-net-landing-0"
  parent          = var.folder_ids.networking-prod
  prefix          = var.prefix
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  services = [
    "compute.googleapis.com",
    "dns.googleapis.com",
--- a/fast/stages/02-networking-peering/spoke-dev.tf
+++ b/fast/stages/02-networking-peering/spoke-dev.tf
@ -22,10 +22,6 @@ module "dev-spoke-project" {
  name            = "dev-net-spoke-0"
  parent          = var.folder_ids.networking-dev
  prefix          = var.prefix
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  services = [
    "container.googleapis.com",
    "compute.googleapis.com",
--- a/fast/stages/02-networking-peering/spoke-prod.tf
+++ b/fast/stages/02-networking-peering/spoke-prod.tf
@ -22,10 +22,6 @@ module "prod-spoke-project" {
  name            = "prod-net-spoke-0"
  parent          = var.folder_ids.networking-prod
  prefix          = var.prefix
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  services = [
    "container.googleapis.com",
    "compute.googleapis.com",
--- a/fast/stages/02-networking-vpn/landing.tf
+++ b/fast/stages/02-networking-vpn/landing.tf
@ -22,10 +22,6 @@ module "landing-project" {
  name            = "prod-net-landing-0"
  parent          = var.folder_ids.networking-prod
  prefix          = var.prefix
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  services = [
    "compute.googleapis.com",
    "dns.googleapis.com",
--- a/fast/stages/02-networking-vpn/spoke-dev.tf
+++ b/fast/stages/02-networking-vpn/spoke-dev.tf
@ -22,10 +22,6 @@ module "dev-spoke-project" {
  name            = "dev-net-spoke-0"
  parent          = var.folder_ids.networking-dev
  prefix          = var.prefix
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  services = [
    "container.googleapis.com",
    "compute.googleapis.com",
--- a/fast/stages/02-networking-vpn/spoke-prod.tf
+++ b/fast/stages/02-networking-vpn/spoke-prod.tf
@ -22,10 +22,6 @@ module "prod-spoke-project" {
  name            = "prod-net-spoke-0"
  parent          = var.folder_ids.networking-prod
  prefix          = var.prefix
-  service_config = {
-    disable_on_destroy         = false
-    disable_dependent_services = false
-  }
  services = [
    "container.googleapis.com",
    "compute.googleapis.com",
--- a/modules/project/README.md
+++ b/modules/project/README.md
@ -386,7 +386,7 @@ output "compute_robot" {
 | [policy_list](variables.tf#L168) | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | <code title="map&#40;object&#40;&#123;&#10;  inherit_from_parent &#61; bool&#10;  suggested_value     &#61; string&#10;  status              &#61; bool&#10;  values              &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [prefix](variables.tf#L180) | Prefix used to generate project id and name. | <code>string</code> |  | <code>null</code> |
 | [project_create](variables.tf#L186) | Create project. When set to false, uses a data source to reference existing project. | <code>bool</code> |  | <code>true</code> |
-| [service_config](variables.tf#L192) | Configure service API activation. | <code title="object&#40;&#123;&#10;  disable_on_destroy         &#61; bool&#10;  disable_dependent_services &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  disable_on_destroy         &#61; true&#10;  disable_dependent_services &#61; true&#10;&#125;">&#123;&#8230;&#125;</code> |
+| [service_config](variables.tf#L192) | Configure service API activation. | <code title="object&#40;&#123;&#10;  disable_on_destroy         &#61; bool&#10;  disable_dependent_services &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  disable_on_destroy         &#61; false&#10;  disable_dependent_services &#61; false&#10;&#125;">&#123;&#8230;&#125;</code> |
 | [service_encryption_key_ids](variables.tf#L204) | Cloud KMS encryption key in {SERVICE => [KEY_URL]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [service_perimeter_bridges](variables.tf#L211) | Name of VPC-SC Bridge perimeters to add project into. See comment in the variables file for format. | <code>list&#40;string&#41;</code> |  | <code>null</code> |
 | [service_perimeter_standard](variables.tf#L218) | Name of VPC-SC Standard perimeter to add project into. See comment in the variables file for format. | <code>string</code> |  | <code>null</code> |
@ -403,8 +403,8 @@ output "compute_robot" {
 | [custom_roles](outputs.tf#L17) | Ids of the created custom roles. |  |
 | [name](outputs.tf#L25) | Project name. |  |
 | [number](outputs.tf#L38) | Project number. |  |
-| [project_id](outputs.tf#L51) | Project id. |  |
-| [service_accounts](outputs.tf#L70) | Product robot service accounts in project. |  |
-| [sink_writer_identities](outputs.tf#L86) | Writer identities created for each sink. |  |
+| [project_id](outputs.tf#L56) | Project id. |  |
+| [service_accounts](outputs.tf#L76) | Product robot service accounts in project. |  |
+| [sink_writer_identities](outputs.tf#L92) | Writer identities created for each sink. |  |

 <!-- END TFDOC -->
--- a/modules/project/outputs.tf
+++ b/modules/project/outputs.tf
@ -42,9 +42,14 @@ output "number" {
    google_project_organization_policy.boolean,
    google_project_organization_policy.list,
    google_project_service.project_services,
+    google_compute_shared_vpc_host_project.shared_vpc_host,
+    google_compute_shared_vpc_service_project.shared_vpc_service,
    google_compute_shared_vpc_service_project.service_projects,
    google_project_iam_member.shared_vpc_host_robots,
-    google_kms_crypto_key_iam_member.service_identity_cmek
+    google_kms_crypto_key_iam_member.service_identity_cmek,
+    google_project_service_identity.jit_si,
+    google_project_service_identity.servicenetworking,
+    google_project_iam_member.servicenetworking
  ]
 }

@ -62,6 +67,7 @@ output "project_id" {
    google_compute_shared_vpc_service_project.service_projects,
    google_project_iam_member.shared_vpc_host_robots,
    google_kms_crypto_key_iam_member.service_identity_cmek,
+    google_project_service_identity.jit_si,
    google_project_service_identity.servicenetworking,
    google_project_iam_member.servicenetworking
  ]
--- a/modules/project/variables.tf
+++ b/modules/project/variables.tf
@ -196,8 +196,8 @@ variable "service_config" {
    disable_dependent_services = bool
  })
  default = {
-    disable_on_destroy         = true
-    disable_dependent_services = true
+    disable_on_destroy         = false
+    disable_dependent_services = false
  }
 }