Merge branch 'master' into fix_column_families
This commit is contained in:
commit
f0395f9a8d
|
@ -8,6 +8,7 @@ All notable changes to this project will be documented in this file.
|
|||
|
||||
### BLUEPRINTS
|
||||
|
||||
- [[#1063](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1063)] Network dashboard: PSA ranges support, starting with Cloud SQL ([aurelienlegrand](https://github.com/aurelienlegrand)) <!-- 2022-12-22 12:14:42+00:00 -->
|
||||
- [[#1062](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1062)] Fixes for GKE ([wiktorn](https://github.com/wiktorn)) <!-- 2022-12-21 22:14:52+00:00 -->
|
||||
- [[#1060](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1060)] Update src/README.md for Network Dashboard ([aurelienlegrand](https://github.com/aurelienlegrand)) <!-- 2022-12-21 15:30:10+00:00 -->
|
||||
- [[#1020](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1020)] Networking dashboard and discovery tool refactor ([ludoo](https://github.com/ludoo)) <!-- 2022-12-18 09:07:24+00:00 -->
|
||||
|
@ -19,6 +20,8 @@ All notable changes to this project will be documented in this file.
|
|||
|
||||
### MODULES
|
||||
|
||||
- [[#1067](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1067)] Corrected load balancing scheme in backend service ([apichick](https://github.com/apichick)) <!-- 2022-12-22 11:41:06+00:00 -->
|
||||
- [[#1066](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1066)] Refactor GCS module and tests for Terraform 1.3 ([ludoo](https://github.com/ludoo)) <!-- 2022-12-22 11:27:09+00:00 -->
|
||||
- [[#1062](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1062)] Fixes for GKE ([wiktorn](https://github.com/wiktorn)) <!-- 2022-12-21 22:14:52+00:00 -->
|
||||
- [[#1061](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1061)] **incompatible change:** Allow using dynamically generated address in LB modules NEGs ([ludoo](https://github.com/ludoo)) <!-- 2022-12-21 16:04:56+00:00 -->
|
||||
- [[#1059](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1059)] Read ranges from correct fields in firewall factory ([juliocc](https://github.com/juliocc)) <!-- 2022-12-20 09:13:54+00:00 -->
|
||||
|
|
|
@ -24,21 +24,22 @@ import logging
|
|||
from . import HTTPRequest, Level, Resource, register_init, register_discovery
|
||||
from .utils import parse_cai_results
|
||||
|
||||
|
||||
CAI_URL = ('https://content-cloudasset.googleapis.com/v1'
|
||||
'/{root}/assets'
|
||||
'?contentType=RESOURCE&{asset_types}&pageSize=500')
|
||||
LOGGER = logging.getLogger('net-dash.discovery.cai-compute')
|
||||
TYPES = {
|
||||
'addresses': 'Address',
|
||||
'firewall_policies': 'FirewallPolicy',
|
||||
'firewall_rules': 'Firewall',
|
||||
'forwarding_rules': 'ForwardingRule',
|
||||
'instances': 'Instance',
|
||||
'networks': 'Network',
|
||||
'subnetworks': 'Subnetwork',
|
||||
'routers': 'Router',
|
||||
'routes': 'Route',
|
||||
'addresses': 'compute.googleapis.com/Address',
|
||||
'global_addresses': 'compute.googleapis.com/GlobalAddress',
|
||||
'firewall_policies': 'compute.googleapis.com/FirewallPolicy',
|
||||
'firewall_rules': 'compute.googleapis.com/Firewall',
|
||||
'forwarding_rules': 'compute.googleapis.com/ForwardingRule',
|
||||
'instances': 'compute.googleapis.com/Instance',
|
||||
'networks': 'compute.googleapis.com/Network',
|
||||
'subnetworks': 'compute.googleapis.com/Subnetwork',
|
||||
'routers': 'compute.googleapis.com/Router',
|
||||
'routes': 'compute.googleapis.com/Route',
|
||||
'sql_instances': 'sqladmin.googleapis.com/Instance'
|
||||
}
|
||||
NAMES = {v: k for k, v in TYPES.items()}
|
||||
|
||||
|
@ -61,7 +62,8 @@ def _handle_discovery(resources, response, data):
|
|||
'Processes the asset API response and returns parsed resources or next URL.'
|
||||
LOGGER.info('discovery handle request')
|
||||
for result in parse_cai_results(data, 'cai-compute', method='list'):
|
||||
resource = _handle_resource(resources, result['resource'])
|
||||
resource = _handle_resource(
|
||||
resources, result['assetType'], result['resource'])
|
||||
if not resource:
|
||||
continue
|
||||
yield resource
|
||||
|
@ -72,15 +74,18 @@ def _handle_discovery(resources, response, data):
|
|||
yield HTTPRequest(f'{url}&pageToken={page_token}', {}, None)
|
||||
|
||||
|
||||
def _handle_resource(resources, data):
|
||||
def _handle_resource(resources, asset_type, data):
|
||||
'Parses and returns a single resource. Calls resource-level handler.'
|
||||
attrs = data['data']
|
||||
# general attributes shared by all resource types
|
||||
resource_name = NAMES[data['discoveryName']]
|
||||
attrs = data['data']
|
||||
# we use the asset type as the discovery name sometimes does not match
|
||||
# e.g. assetType = GlobalAddress but discoveryName = Address
|
||||
resource_name = NAMES[asset_type]
|
||||
resource = {
|
||||
'id': attrs['id'],
|
||||
'id': attrs.get('id'),
|
||||
'name': attrs['name'],
|
||||
'self_link': _self_link(attrs['selfLink'])
|
||||
'self_link': _self_link(attrs['selfLink']),
|
||||
'assetType': asset_type
|
||||
}
|
||||
# derive parent type and id and skip if parent is not within scope
|
||||
parent_data = _get_parent(data['parent'], resources)
|
||||
|
@ -145,6 +150,19 @@ def _handle_forwarding_rules(resource, data):
|
|||
}
|
||||
|
||||
|
||||
def _handle_global_addresses(resource, data):
|
||||
'Handles GlobalAddress type resource data (ex: PSA ranges).'
|
||||
network = data.get('network')
|
||||
return {
|
||||
'address': data['address'],
|
||||
'prefixLength': data.get('prefixLength') or None,
|
||||
'internal': data.get('addressType') == 'INTERNAL',
|
||||
'purpose': data.get('purpose', ''),
|
||||
'status': data.get('status', ''),
|
||||
'network': None if not network else _self_link(network),
|
||||
}
|
||||
|
||||
|
||||
def _handle_instances(resource, data):
|
||||
'Handles instance type resource data.'
|
||||
if data['status'] != 'RUNNING':
|
||||
|
@ -184,6 +202,18 @@ def _handle_routes(resource, data):
|
|||
return {'next_hop_type': hop[0], 'network': _self_link(data['network'])}
|
||||
|
||||
|
||||
def _handle_sql_instances(resource, data):
|
||||
'Handles cloud sql instance type resource data.'
|
||||
return {
|
||||
'name': data['name'],
|
||||
'self_link': _self_link(data['selfLink']),
|
||||
'ipAddresses': [
|
||||
i['ipAddress'] for i in data['ipAddresses'] if i['type'] == 'PRIVATE'
|
||||
],
|
||||
'region': data['region'],
|
||||
'availabilityType': data['settings']['availabilityType'],
|
||||
}
|
||||
|
||||
def _handle_subnetworks(resource, data):
|
||||
'Handles subnetwork type resource data.'
|
||||
secondary_ranges = [{
|
||||
|
@ -201,14 +231,14 @@ def _handle_subnetworks(resource, data):
|
|||
|
||||
def _self_link(s):
|
||||
'Removes initial part from self links.'
|
||||
return s.removeprefix('https://www.googleapis.com/compute/v1/')
|
||||
return '/'.join(s.split('/')[5:])
|
||||
|
||||
|
||||
def _url(resources):
|
||||
'Returns discovery URL'
|
||||
discovery_root = resources['config:discovery_root']
|
||||
asset_types = '&'.join(
|
||||
f'assetTypes=compute.googleapis.com/{t}' for t in TYPES.values())
|
||||
f'assetTypes={t}' for t in TYPES.values())
|
||||
return CAI_URL.format(root=discovery_root, asset_types=asset_types)
|
||||
|
||||
|
|
@ -0,0 +1,71 @@
|
|||
# Copyright 2022 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
'Prepares descriptors and timeseries for subnetwork-level metrics.'
|
||||
|
||||
import collections
|
||||
import ipaddress
|
||||
import itertools
|
||||
import logging
|
||||
|
||||
from . import MetricDescriptor, TimeSeries, register_timeseries
|
||||
|
||||
DESCRIPTOR_ATTRS = {
|
||||
'addresses_available': 'Address limit per psa range',
|
||||
'addresses_used': 'Addresses used per psa range',
|
||||
'addresses_used_ratio': 'Addresses used ratio per psa range'
|
||||
}
|
||||
LOGGER = logging.getLogger('net-dash.timeseries.psa')
|
||||
|
||||
|
||||
def _sql_addresses(sql_instances):
|
||||
'Returns counts of Cloud SQL instances per PSA range.'
|
||||
for v in sql_instances.values():
|
||||
if not v['ipAddresses']:
|
||||
continue
|
||||
# 1 IP for the instance + 1 IP for the ILB + 1 IP if HA
|
||||
yield v['ipAddresses'][0], 2 if v['availabilityType'] != 'REGIONAL' else 3
|
||||
|
||||
|
||||
@register_timeseries
|
||||
def timeseries(resources):
|
||||
'Returns used/available/ratio timeseries for addresses by PSA ranges.'
|
||||
LOGGER.info('timeseries')
|
||||
for dtype, name in DESCRIPTOR_ATTRS.items():
|
||||
yield MetricDescriptor(f'network/psa/{dtype}', name,
|
||||
('project', 'network', 'subnetwork'),
|
||||
dtype.endswith('ratio'))
|
||||
psa_nets = {
|
||||
k: ipaddress.ip_network('{}/{}'.format(v['address'], v['prefixLength']))
|
||||
for k, v in resources['global_addresses'].items() if v['prefixLength']
|
||||
}
|
||||
psa_counts = {}
|
||||
for address, ip_count in _sql_addresses(resources.get('sql_instances', {})):
|
||||
ip_address = ipaddress.ip_address(address)
|
||||
for k, v in psa_nets.items():
|
||||
if ip_address in v:
|
||||
psa_counts[k] = psa_counts.get(k, 0) + ip_count
|
||||
break
|
||||
|
||||
for k, v in psa_counts.items():
|
||||
max_ips = psa_nets[k].num_addresses - 4
|
||||
psa_range = resources['global_addresses'][k]
|
||||
labels = {
|
||||
'network': psa_range['network'],
|
||||
'project': psa_range['project_id'],
|
||||
'psa_range': psa_range['name']
|
||||
}
|
||||
yield TimeSeries('network/psa/addresses_available', max_ips, labels)
|
||||
yield TimeSeries('network/psa/addresses_used', v, labels)
|
||||
yield TimeSeries('network/psa/addresses_used_ratio',
|
||||
0 if v == 0 else v / max_ips, labels)
|
|
@ -0,0 +1,23 @@
|
|||
|
||||
## 00-bootstrap
|
||||
1. How to handle requests where automation, logging and/or billing export projects are not under organization but in different folders.
|
||||
- Run bootstrap stage and let automation, logging and/or billing projects be created under organization.
|
||||
- Run resource manager stage or any other custom stage which creates the folders where these projects will reside.
|
||||
- Once folders are created add folder ids to varibale "project_parent_ids" in bootstrap stage and run bootstrap stage.
|
||||
- This step will move the projects from organization to the parent folders specificed.
|
||||
|
||||
## cicd
|
||||
1. Why do we need two seperate ServiceAccounts when configuring cicd pipelines (cicd SA and IaC SA)
|
||||
- Having seperate service accounts helps shutdown the pipeline incase of any issues and still keep IaC SA and ability to run terraform plan/apply manually.
|
||||
- A pipeline can only generate a token that can get access to an SA. It cannot directly call a provider file to impersonate IaC SA.
|
||||
- Having providers file that allows impersonation to IaC SA allows flexibility to run terraform manually or from CICD Pipelines.
|
||||
<p align="center">
|
||||
<img src="IaC_SA.png" alt="CICD SA and IaC SA">
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
Binary file not shown.
After Width: | Height: | Size: 17 KiB |
|
@ -180,12 +180,13 @@ module "apigee" {
|
|||
|
||||
| name | description | sensitive |
|
||||
|---|---|:---:|
|
||||
| [envgroups](outputs.tf#L17) | Environment groups. | |
|
||||
| [environments](outputs.tf#L22) | Environment. | |
|
||||
| [instances](outputs.tf#L27) | Instances. | |
|
||||
| [org_id](outputs.tf#L32) | Organization ID. | |
|
||||
| [org_name](outputs.tf#L37) | Organization name. | |
|
||||
| [organization](outputs.tf#L42) | Organization. | |
|
||||
| [service_attachments](outputs.tf#L47) | Service attachments. | |
|
||||
| [endpoint_attachment_hosts](outputs.tf#L17) | Endpoint hosts. | |
|
||||
| [envgroups](outputs.tf#L22) | Environment groups. | |
|
||||
| [environments](outputs.tf#L27) | Environment. | |
|
||||
| [instances](outputs.tf#L32) | Instances. | |
|
||||
| [org_id](outputs.tf#L37) | Organization ID. | |
|
||||
| [org_name](outputs.tf#L42) | Organization name. | |
|
||||
| [organization](outputs.tf#L47) | Organization. | |
|
||||
| [service_attachments](outputs.tf#L52) | Service attachments. | |
|
||||
|
||||
<!-- END TFDOC -->
|
||||
|
|
|
@ -14,6 +14,11 @@
|
|||
* limitations under the License.
|
||||
*/
|
||||
|
||||
output "endpoint_attachment_hosts" {
|
||||
description = "Endpoint hosts."
|
||||
value = { for k, v in google_apigee_endpoint_attachment.endpoint_attachments : k => v.host }
|
||||
}
|
||||
|
||||
output "envgroups" {
|
||||
description = "Environment groups."
|
||||
value = try(google_apigee_envgroup.envgroups, null)
|
||||
|
|
|
@ -1,4 +1,5 @@
|
|||
# Google Cloud Storage Module
|
||||
|
||||
## Example
|
||||
|
||||
```hcl
|
||||
|
@ -41,12 +42,10 @@ module "bucket" {
|
|||
iam = {
|
||||
"roles/storage.admin" = ["group:storage@example.com"]
|
||||
}
|
||||
|
||||
retention_policy = {
|
||||
retention_period = 100
|
||||
is_locked = true
|
||||
}
|
||||
|
||||
logging_config = {
|
||||
log_bucket = var.bucket
|
||||
log_object_prefix = null
|
||||
|
@ -63,32 +62,26 @@ module "bucket" {
|
|||
project_id = "myproject"
|
||||
prefix = "test"
|
||||
name = "my-bucket"
|
||||
|
||||
iam = {
|
||||
"roles/storage.admin" = ["group:storage@example.com"]
|
||||
}
|
||||
|
||||
lifecycle_rule = {
|
||||
action = {
|
||||
type = "SetStorageClass"
|
||||
storage_class = "STANDARD"
|
||||
}
|
||||
condition = {
|
||||
age = 30
|
||||
created_before = null
|
||||
with_state = null
|
||||
matches_storage_class = null
|
||||
num_newer_versions = null
|
||||
custom_time_before = null
|
||||
days_since_custom_time = null
|
||||
days_since_noncurrent_time = null
|
||||
noncurrent_time_before = null
|
||||
lifecycle_rules = {
|
||||
lr-0 = {
|
||||
action = {
|
||||
type = "SetStorageClass"
|
||||
storage_class = "STANDARD"
|
||||
}
|
||||
condition = {
|
||||
age = 30
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
### Minimal example with GCS notifications
|
||||
|
||||
```hcl
|
||||
module "bucket-gcs-notification" {
|
||||
source = "./fabric/modules/gcs"
|
||||
|
@ -112,23 +105,23 @@ module "bucket-gcs-notification" {
|
|||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [name](variables.tf#L89) | Bucket name suffix. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L117) | Bucket project id. | <code>string</code> | ✓ | |
|
||||
| [cors](variables.tf#L17) | CORS configuration for the bucket. Defaults to null. | <code title="object({ origin = list(string) method = list(string) response_header = list(string) max_age_seconds = number })">object({…})</code> | | <code>null</code> |
|
||||
| [name](variables.tf#L116) | Bucket name suffix. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L145) | Bucket project id. | <code>string</code> | ✓ | |
|
||||
| [cors](variables.tf#L17) | CORS configuration for the bucket. Defaults to null. | <code title="object({ origin = optional(list(string)) method = optional(list(string)) response_header = optional(list(string)) max_age_seconds = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [encryption_key](variables.tf#L28) | KMS key that will be used for encryption. | <code>string</code> | | <code>null</code> |
|
||||
| [force_destroy](variables.tf#L34) | Optional map to set force destroy keyed by name, defaults to false. | <code>bool</code> | | <code>false</code> |
|
||||
| [iam](variables.tf#L40) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L46) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [lifecycle_rule](variables.tf#L52) | Bucket lifecycle rule. | <code title="object({ action = object({ type = string storage_class = string }) condition = object({ age = number created_before = string with_state = string matches_storage_class = list(string) num_newer_versions = string custom_time_before = string days_since_custom_time = string days_since_noncurrent_time = string noncurrent_time_before = string }) })">object({…})</code> | | <code>null</code> |
|
||||
| [location](variables.tf#L74) | Bucket location. | <code>string</code> | | <code>"EU"</code> |
|
||||
| [logging_config](variables.tf#L80) | Bucket logging configuration. | <code title="object({ log_bucket = string log_object_prefix = string })">object({…})</code> | | <code>null</code> |
|
||||
| [notification_config](variables.tf#L94) | GCS Notification configuration. | <code title="object({ enabled = bool payload_format = string topic_name = string sa_email = string event_types = list(string) custom_attributes = map(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [prefix](variables.tf#L107) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
||||
| [retention_policy](variables.tf#L122) | Bucket retention policy. | <code title="object({ retention_period = number is_locked = bool })">object({…})</code> | | <code>null</code> |
|
||||
| [storage_class](variables.tf#L131) | Bucket storage class. | <code>string</code> | | <code>"MULTI_REGIONAL"</code> |
|
||||
| [uniform_bucket_level_access](variables.tf#L141) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
||||
| [versioning](variables.tf#L147) | Enable versioning, defaults to false. | <code>bool</code> | | <code>false</code> |
|
||||
| [website](variables.tf#L153) | Bucket website. | <code title="object({ main_page_suffix = string not_found_page = string })">object({…})</code> | | <code>null</code> |
|
||||
| [lifecycle_rules](variables.tf#L52) | Bucket lifecycle rule. | <code title="map(object({ action = object({ type = string storage_class = optional(string) }) condition = object({ age = optional(number) created_before = optional(string) custom_time_before = optional(string) days_since_custom_time = optional(number) days_since_noncurrent_time = optional(number) matches_prefix = optional(list(string)) matches_storage_class = optional(list(string)) # STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY matches_suffix = optional(list(string)) noncurrent_time_before = optional(string) num_newer_versions = optional(number) with_state = optional(string) # "LIVE", "ARCHIVED", "ANY" }) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [location](variables.tf#L101) | Bucket location. | <code>string</code> | | <code>"EU"</code> |
|
||||
| [logging_config](variables.tf#L107) | Bucket logging configuration. | <code title="object({ log_bucket = string log_object_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [notification_config](variables.tf#L121) | GCS Notification configuration. | <code title="object({ enabled = bool payload_format = string topic_name = string sa_email = string event_types = optional(list(string)) custom_attributes = optional(map(string)) object_name_prefix = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [prefix](variables.tf#L135) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
||||
| [retention_policy](variables.tf#L150) | Bucket retention policy. | <code title="object({ retention_period = number is_locked = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [storage_class](variables.tf#L159) | Bucket storage class. | <code>string</code> | | <code>"MULTI_REGIONAL"</code> |
|
||||
| [uniform_bucket_level_access](variables.tf#L169) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
||||
| [versioning](variables.tf#L175) | Enable versioning, defaults to false. | <code>bool</code> | | <code>false</code> |
|
||||
| [website](variables.tf#L181) | Bucket website. | <code title="object({ main_page_suffix = optional(string) not_found_page = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
|
@ -75,22 +75,25 @@ resource "google_storage_bucket" "bucket" {
|
|||
}
|
||||
|
||||
dynamic "lifecycle_rule" {
|
||||
for_each = var.lifecycle_rule == null ? [] : [""]
|
||||
for_each = var.lifecycle_rules
|
||||
iterator = rule
|
||||
content {
|
||||
action {
|
||||
type = var.lifecycle_rule.action["type"]
|
||||
storage_class = var.lifecycle_rule.action["storage_class"]
|
||||
type = rule.value.action.type
|
||||
storage_class = rule.value.action.storage_class
|
||||
}
|
||||
condition {
|
||||
age = var.lifecycle_rule.condition["age"]
|
||||
created_before = var.lifecycle_rule.condition["created_before"]
|
||||
with_state = var.lifecycle_rule.condition["with_state"]
|
||||
matches_storage_class = var.lifecycle_rule.condition["matches_storage_class"]
|
||||
num_newer_versions = var.lifecycle_rule.condition["num_newer_versions"]
|
||||
custom_time_before = var.lifecycle_rule.condition["custom_time_before"]
|
||||
days_since_custom_time = var.lifecycle_rule.condition["days_since_custom_time"]
|
||||
days_since_noncurrent_time = var.lifecycle_rule.condition["days_since_noncurrent_time"]
|
||||
noncurrent_time_before = var.lifecycle_rule.condition["noncurrent_time_before"]
|
||||
age = rule.value.condition.age
|
||||
created_before = rule.value.condition.created_before
|
||||
custom_time_before = rule.value.condition.custom_time_before
|
||||
days_since_custom_time = rule.value.condition.days_since_custom_time
|
||||
days_since_noncurrent_time = rule.value.condition.days_since_noncurrent_time
|
||||
matches_prefix = rule.value.condition.matches_prefix
|
||||
matches_storage_class = rule.value.condition.matches_storage_class
|
||||
matches_suffix = rule.value.condition.matches_suffix
|
||||
noncurrent_time_before = rule.value.condition.noncurrent_time_before
|
||||
num_newer_versions = rule.value.condition.num_newer_versions
|
||||
with_state = rule.value.condition.with_state
|
||||
}
|
||||
}
|
||||
}
|
||||
|
@ -104,15 +107,14 @@ resource "google_storage_bucket_iam_binding" "bindings" {
|
|||
}
|
||||
|
||||
resource "google_storage_notification" "notification" {
|
||||
count = local.notification ? 1 : 0
|
||||
bucket = google_storage_bucket.bucket.name
|
||||
payload_format = var.notification_config.payload_format
|
||||
topic = google_pubsub_topic.topic[0].id
|
||||
event_types = var.notification_config.event_types
|
||||
custom_attributes = var.notification_config.custom_attributes
|
||||
|
||||
depends_on = [google_pubsub_topic_iam_binding.binding]
|
||||
|
||||
count = local.notification ? 1 : 0
|
||||
bucket = google_storage_bucket.bucket.name
|
||||
payload_format = var.notification_config.payload_format
|
||||
topic = google_pubsub_topic.topic[0].id
|
||||
custom_attributes = var.notification_config.custom_attributes
|
||||
event_types = var.notification_config.event_types
|
||||
object_name_prefix = var.notification_config.object_name_prefix
|
||||
depends_on = [google_pubsub_topic_iam_binding.binding]
|
||||
}
|
||||
resource "google_pubsub_topic_iam_binding" "binding" {
|
||||
count = local.notification ? 1 : 0
|
||||
|
|
|
@ -17,10 +17,10 @@
|
|||
variable "cors" {
|
||||
description = "CORS configuration for the bucket. Defaults to null."
|
||||
type = object({
|
||||
origin = list(string)
|
||||
method = list(string)
|
||||
response_header = list(string)
|
||||
max_age_seconds = number
|
||||
origin = optional(list(string))
|
||||
method = optional(list(string))
|
||||
response_header = optional(list(string))
|
||||
max_age_seconds = optional(number)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
@ -49,26 +49,53 @@ variable "labels" {
|
|||
default = {}
|
||||
}
|
||||
|
||||
variable "lifecycle_rule" {
|
||||
variable "lifecycle_rules" {
|
||||
description = "Bucket lifecycle rule."
|
||||
type = object({
|
||||
type = map(object({
|
||||
action = object({
|
||||
type = string
|
||||
storage_class = string
|
||||
storage_class = optional(string)
|
||||
})
|
||||
condition = object({
|
||||
age = number
|
||||
created_before = string
|
||||
with_state = string
|
||||
matches_storage_class = list(string)
|
||||
num_newer_versions = string
|
||||
custom_time_before = string
|
||||
days_since_custom_time = string
|
||||
days_since_noncurrent_time = string
|
||||
noncurrent_time_before = string
|
||||
age = optional(number)
|
||||
created_before = optional(string)
|
||||
custom_time_before = optional(string)
|
||||
days_since_custom_time = optional(number)
|
||||
days_since_noncurrent_time = optional(number)
|
||||
matches_prefix = optional(list(string))
|
||||
matches_storage_class = optional(list(string)) # STANDARD, MULTI_REGIONAL, REGIONAL, NEARLINE, COLDLINE, ARCHIVE, DURABLE_REDUCED_AVAILABILITY
|
||||
matches_suffix = optional(list(string))
|
||||
noncurrent_time_before = optional(string)
|
||||
num_newer_versions = optional(number)
|
||||
with_state = optional(string) # "LIVE", "ARCHIVED", "ANY"
|
||||
})
|
||||
})
|
||||
default = null
|
||||
}))
|
||||
default = {}
|
||||
nullable = false
|
||||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.lifecycle_rules : v.action != null && v.condition != null
|
||||
])
|
||||
error_message = "Lifecycle rules action and condition cannot be null."
|
||||
}
|
||||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.lifecycle_rules : contains(
|
||||
["Delete", "SetStorageClass", "AbortIncompleteMultipartUpload"],
|
||||
v.action.type
|
||||
)
|
||||
])
|
||||
error_message = "Lifecycle rules action type has unsupported value."
|
||||
}
|
||||
validation {
|
||||
condition = alltrue([
|
||||
for k, v in var.lifecycle_rules :
|
||||
v.action.type != "SetStorageClass"
|
||||
||
|
||||
v.action.storage_class != null
|
||||
])
|
||||
error_message = "Lifecycle rules with action type SetStorageClass require a storage class."
|
||||
}
|
||||
}
|
||||
|
||||
variable "location" {
|
||||
|
@ -81,7 +108,7 @@ variable "logging_config" {
|
|||
description = "Bucket logging configuration."
|
||||
type = object({
|
||||
log_bucket = string
|
||||
log_object_prefix = string
|
||||
log_object_prefix = optional(string)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
@ -94,12 +121,13 @@ variable "name" {
|
|||
variable "notification_config" {
|
||||
description = "GCS Notification configuration."
|
||||
type = object({
|
||||
enabled = bool
|
||||
payload_format = string
|
||||
topic_name = string
|
||||
sa_email = string
|
||||
event_types = list(string)
|
||||
custom_attributes = map(string)
|
||||
enabled = bool
|
||||
payload_format = string
|
||||
topic_name = string
|
||||
sa_email = string
|
||||
event_types = optional(list(string))
|
||||
custom_attributes = optional(map(string))
|
||||
object_name_prefix = optional(string)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
@ -123,7 +151,7 @@ variable "retention_policy" {
|
|||
description = "Bucket retention policy."
|
||||
type = object({
|
||||
retention_period = number
|
||||
is_locked = bool
|
||||
is_locked = optional(bool)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
@ -153,8 +181,8 @@ variable "versioning" {
|
|||
variable "website" {
|
||||
description = "Bucket website."
|
||||
type = object({
|
||||
main_page_suffix = string
|
||||
not_found_page = string
|
||||
main_page_suffix = optional(string)
|
||||
not_found_page = optional(string)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
|
|
@ -60,7 +60,7 @@ resource "google_compute_backend_service" "default" {
|
|||
health_checks = length(each.value.health_checks) == 0 ? null : [
|
||||
for k in each.value.health_checks : lookup(local.hc_ids, k, k)
|
||||
]
|
||||
load_balancing_scheme = "EXTERNAL"
|
||||
load_balancing_scheme = var.use_classic_version ? "EXTERNAL" : "EXTERNAL_MANAGED"
|
||||
port_name = (
|
||||
each.value.port_name == null
|
||||
? lower(each.value.protocol == null ? var.protocol : each.value.protocol)
|
||||
|
|
|
@ -0,0 +1,13 @@
|
|||
force_destroy = true
|
||||
labels = { environment = "test" }
|
||||
logging_config = {
|
||||
log_bucket = "foo"
|
||||
}
|
||||
name = "test"
|
||||
project_id = "test-project"
|
||||
retention_policy = {
|
||||
retention_period = 5
|
||||
is_locked = false
|
||||
}
|
||||
storage_class = "MULTI_REGIONAL"
|
||||
versioning = true
|
|
@ -1,29 +0,0 @@
|
|||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
module "test" {
|
||||
source = "../../../../modules/gcs"
|
||||
project_id = "my-project"
|
||||
uniform_bucket_level_access = var.uniform_bucket_level_access
|
||||
force_destroy = var.force_destroy
|
||||
iam = var.iam
|
||||
labels = var.labels
|
||||
logging_config = var.logging_config
|
||||
name = "bucket-a"
|
||||
prefix = var.prefix
|
||||
retention_policy = var.retention_policy
|
||||
versioning = var.versioning
|
||||
}
|
|
@ -1,77 +0,0 @@
|
|||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
variable "uniform_bucket_level_access" {
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "force_destroy" {
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "iam" {
|
||||
type = map(list(string))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "labels" {
|
||||
type = map(string)
|
||||
default = { environment = "test" }
|
||||
}
|
||||
|
||||
variable "logging_config" {
|
||||
type = object({
|
||||
log_bucket = string
|
||||
log_object_prefix = string
|
||||
})
|
||||
default = {
|
||||
log_bucket = "foo"
|
||||
log_object_prefix = null
|
||||
}
|
||||
}
|
||||
|
||||
variable "prefix" {
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "project_id" {
|
||||
type = string
|
||||
default = "my-project"
|
||||
}
|
||||
|
||||
variable "retention_policy" {
|
||||
type = object({
|
||||
retention_period = number
|
||||
is_locked = bool
|
||||
})
|
||||
default = {
|
||||
retention_period = 5
|
||||
is_locked = false
|
||||
}
|
||||
}
|
||||
|
||||
variable "storage_class" {
|
||||
type = string
|
||||
default = "MULTI_REGIONAL"
|
||||
}
|
||||
|
||||
variable "versioning" {
|
||||
type = bool
|
||||
default = true
|
||||
}
|
|
@ -0,0 +1,3 @@
|
|||
iam = {
|
||||
"roles/storage.admin" = ["user:a@example.org"]
|
||||
}
|
|
@ -0,0 +1,30 @@
|
|||
# Copyright 2022 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
values:
|
||||
google_storage_bucket.bucket:
|
||||
name: test
|
||||
|
||||
google_storage_bucket_iam_binding.bindings["roles/storage.admin"]:
|
||||
bucket: test
|
||||
condition: []
|
||||
members:
|
||||
- user:a@example.org
|
||||
role: roles/storage.admin
|
||||
|
||||
counts:
|
||||
google_storage_bucket: 1
|
||||
google_storage_bucket_iam_binding: 1
|
||||
modules: 0
|
||||
resources: 2
|
|
@ -0,0 +1 @@
|
|||
prefix = "foo"
|
|
@ -0,0 +1,44 @@
|
|||
# Copyright 2022 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
values:
|
||||
google_storage_bucket.bucket:
|
||||
force_destroy: true
|
||||
labels:
|
||||
environment: test
|
||||
location: EU
|
||||
logging:
|
||||
- log_bucket: foo
|
||||
name: foo-test
|
||||
project: test-project
|
||||
retention_policy:
|
||||
- is_locked: false
|
||||
retention_period: 5
|
||||
storage_class: MULTI_REGIONAL
|
||||
uniform_bucket_level_access: true
|
||||
versioning:
|
||||
- enabled: true
|
||||
|
||||
counts:
|
||||
google_storage_bucket: 1
|
||||
modules: 0
|
||||
resources: 1
|
||||
|
||||
outputs:
|
||||
bucket: __missing__
|
||||
id: foo-test
|
||||
name: foo-test
|
||||
notification: null
|
||||
topic: null
|
||||
url: __missing__
|
|
@ -1,54 +0,0 @@
|
|||
# Copyright 2022 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
def test_buckets(plan_runner):
|
||||
"Test bucket resources."
|
||||
_, resources = plan_runner()
|
||||
assert len(resources) == 1
|
||||
r = resources[0]
|
||||
assert r['type'] == 'google_storage_bucket'
|
||||
assert r['values']['name'] == 'bucket-a'
|
||||
assert r['values']['project'] == 'my-project'
|
||||
|
||||
|
||||
def test_prefix(plan_runner):
|
||||
"Test bucket name when prefix is set."
|
||||
_, resources = plan_runner(prefix='foo')
|
||||
assert resources[0]['values']['name'] == 'foo-bucket-a'
|
||||
|
||||
|
||||
def test_config_values(plan_runner):
|
||||
"Test that variables set the correct attributes on buckets."
|
||||
variables = dict(
|
||||
uniform_bucket_level_access='true',
|
||||
force_destroy='true',
|
||||
versioning='true'
|
||||
)
|
||||
_, resources = plan_runner(**variables)
|
||||
assert len(resources) == 1
|
||||
r = resources[0]
|
||||
assert r['values']['uniform_bucket_level_access'] is True
|
||||
assert r['values']['force_destroy'] is True
|
||||
assert r['values']['versioning'] == [{'enabled': True}]
|
||||
assert r['values']['logging'] == [{'log_bucket': 'foo'}]
|
||||
assert r['values']['retention_policy'] == [
|
||||
{'is_locked': False, 'retention_period': 5}
|
||||
]
|
||||
|
||||
|
||||
def test_iam(plan_runner):
|
||||
"Test bucket resources with iam roles and members."
|
||||
iam = '{ "roles/storage.admin" = ["user:a@b.com"] }'
|
||||
_, resources = plan_runner(iam=iam)
|
||||
assert len(resources) == 2
|
|
@ -0,0 +1,20 @@
|
|||
# Copyright 2022 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
module: modules/gcs
|
||||
common_tfvars:
|
||||
- common.tfvars
|
||||
tests:
|
||||
prefix:
|
||||
iam:
|
Loading…
Reference in New Issue