* initial import
* fixes
* fixes
* fixes
* red SA roles
* red SA roles
* org-level custom roles var, tenants IAM config
* tfdoc
* allow core SA to write output files to tenant bucket
* README
* implement comments on PR
* show tenant org example
* update example
* Adding dashboard to monitor VPC and VPC peering group quotas
* Adding 1 ressource to the tests (dashboard)
* Adding dashboard and tests for other networking architecture
* Update test
* fixup(project-factory): Use the correct KMS Service Agents attribute name
* Add new KMS bindings to tests
* Update test resource counts
* Update README.md resource count
* Resman - bump GH TF version to coincide with module requirements (#1)
Bootstrap was bumped in #1414
* Bump TF version in all workflow files
* bump TF version in missed workflow file
The Fast stage 2-networking-* currently adds a monitoring dashboard
for VPN metrics. This change adds an additional chart to monitor the
usage of the VPN bandwidth.
This change also adds the following monitoring alerts:
* VPN tunnel established
*
[VPN bandwidth](https://cloud.google.com/network-connectivity/docs/vpn/how-to/viewing-logs-metrics#define-bandwidth-alerts)
To configure the alerts, there is a new `alert_config` variable with
defined default values.
The alerts are created in the stage `b` by default. In the stages a,
c, d, and e, the alerts are created if the user creates the On-prem
VPN.
To disable the creation of alerts, add the following to
`terraform.tfvars`:
```
alert_config = {
vpn_tunnel_established = null
vpn_tunnel_bandwidth = null
}
```
If you have the `project_factory` feature enabled, but not the `sandbox` feature (as it's not a requirement on your org), when doing a `terraform apply` on `1-resman` it raises this errors as it's expecting the wrong feature when creating the sandbox SA
```
│ Error: Invalid index
│
│ on branch-sandbox.tf line 68, in resource "google_organization_iam_member" "org_policy_admin_sandbox":
│ 68: member = module.branch-sandbox-sa.0.iam_email
│ ├────────────────
│ │ module.branch-sandbox-sa is empty tuple
│
│ The given key does not identify an element in this collection value: the collection has no elements.
```
* peering stage implementation
* vpn stage implementation
* tfdoc
* tests
* add most supported google domains
* align all net stages
* add support for factory to DNS response policy module
* use dns policy factory in network stages
* boilerplate
Updating readme so that the provider and terraform variables section is identical to the documentation in the other stages.
Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>
* plugin folder, gitignore, serverless connector example
* add support to fast plugin variables and outputs to tfdoc
* rename folder, READMEs
* add variable description
* show diffs
* check documentation, use multiple files
* debug check doc
* try a different glob
* debug tfdoc names
* more debug
* and even more debug
* fix gitignore
* fix links
* support extra files in tests
* fix fixture, switch stage 2 peering to new tests
* tfdoc
* Allow globs in extra files
---------
Co-authored-by: Julio Castillo <jccb@google.com>
* restrict storage role on outputs bucket for stage SAs
* grant prod project factory SA authority over prod and dev org policies
* network stages delegated grants on dev to prod pf SA
* security grants to prod pf SA on dev
* tfdoc
* tests
The Readme.md files reference the data directory and .sample files, but the code did not allow for their populating. This update enables the copying of the data directory and .sample files, with the data directory being populating as a data.sample directory to prevent overwriting any existing data directory.
Additionally, dependencies have been updated by adding the depends_on section to several resources to ensure that the dependencies are in the correct order. This update addresses some states that were not being handled previously.
There is a minor known issue with Pull Request creation in the current state of the code. The Pull Request is only created after the first run has occurred. A fix for this issue is currently being worked on and will be addressed in a separate Pull Request. However, this issue does not affect the main functionality of the code.
* feat: Add Pull Request support to 0-cicd-github
The cloud-foundation-fabricrepository is continually evolving, and to help keep up with the changes, it would be beneficial to introduce a pull request mechanism to review and approve changes. This feature is 100% backward compatible, and by default, no pull request is created, and changes are committed directly to the main branch. However, an optional variable pull_request_config can be used to configure the title, body, head_ref, and base_ref of the pull request that will be created for the initial population or update of files. To create a pull request, in pull_request_config set the create attribute to true. base_ref defaults to main, and head_ref to the name of the head branch. If the head branch doesn't exist, it will be created from the base_ref branch.
* fix README.md
* fix pull_request_config title
* Replaces 'secondary_ip_range:' with 'secondary_ip_ranges:' in samples
* Replaces 'secondary_ip_range:' with 'secondary_ip_ranges:' in tests/
* reverts previous commit- files in tests/ don't need to be changed
---------
Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>
When running 0-cicd-github multiple times, files that haven't changed are also committed. This change adds an option to skip committing unchanged files to prevent unnecessary commits.
Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>
* Fix Terraform formatting and add module/ prefix to path in 0-cicd-github repository population
fix the formatting of Terraform files and adds the module/ prefix to the module path in 0-cicd-github under repository population. Without proper formatting and module path, generated repositories may show formatting mismatches and examples in the README.md file may not run as expected.
The changes include updating the replace function with a new regular expression pattern to correctly apply the git source for modules and updating the each.value.file attribute to include the module/ prefix in the Terraform file path. This ensures that the examples in the README.md file work as intended and that the generated repositories follow best practices for Terraform code.
* revert modules/ prefix change
* Add module_prefix to modules_config
- Add module_prefix to modules_config
- Add example to Readme.md
- use module_prefix variable to specify the path
* fix tfdoc
* configurable regions
* vpn, tests
* tfdoc
* separate envs
* nva
* test resources
* add new custom role for tenant network service accounts
* allow setting firewall policy name in networking stages
* fix stage links script
* set custom role to tenant networking service account
* rename tenant stage 1 provider files
* remove extra file
* fix peering and vpn
* tfdoc
* fix variable order
* tests