cloud-foundation-fabric/modules/iot-core
Antonio Lopez 7bc10d1039
IoT module (#415)
* added iot-core module folder

* modified iot core readme file

* added initial version of the IoT Platform terraform files

* añadido detalles en README

* Update README.md

fix markup issue

* Update README.md

modified input/output

* deleted provider from main and module services

* pub_sub topic ids used in the registry instead of creating new ones

* variable extra_telemetry_pub_sub_topic_ids modified as default

* included data platform integration use case in the doc

* devices config moved to yaml file

* included example to create device certificates

* added HCL and #tftest to README. Moved project/region to variables

* solved bug with no optional variables for extra topics or devices yaml

* solved bug with no optional variables for extra topics or devices yaml

* added example to send MQTT telemetry to IoT Platform

* modified doc on Data Platform integration

* included diagram

* added Registry / Device creation default configuration into variables. Deleted exammple devices yaml file. Corrected module source path

* solved comments in PR

* applied terraform fmt

* solved bug in boolean (bool) variable

* updated variables in doc

* updated output variable name

* updated #tftest:skip on examples as using yaml input makes resources number variable

* Update README.md

modified input/output

* pub_sub topic ids used in the registry instead of creating new ones

* variable extra_telemetry_pub_sub_topic_ids modified as default

* included data platform integration use case in the doc

* devices config moved to yaml file

* included example to create device certificates

* added HCL and #tftest to README. Moved project/region to variables

* solved bug with no optional variables for extra topics or devices yaml

* solved bug with no optional variables for extra topics or devices yaml

* added example to send MQTT telemetry to IoT Platform

* modified doc on Data Platform integration

* included diagram

* added Registry / Device creation default configuration into variables. Deleted exammple devices yaml file. Corrected module source path

* solved comments in PR

* applied terraform fmt

* solved bug in boolean (bool) variable

* updated variables in doc

* Updated diagram and documentation for decentralized firewall.

* Fixed error with VPC connector. Count was referring to resource attributes that weren't known until after the configuration was applied

* Added Cloud Foundation Fabric logos. (#363)

* Create README.md

* Add logo to readme file

* exclusions for audit in locals in logging_sinks.audit-logs now

* style fix (whitespaces)

* Added dynamic block for dns_cache_config

* Fixed boolean variable condition

* Adding Apigee Environments as output for apigee-organization module

* small var conditional fix

* Added GKE pubsub notifications

* Default creation false

* Updated variable default value

* removed extra lines

* defaulted to false and conditional output

* depend log sinks from IAM roles, fixes #371

* Update README.md

* [#374] Add taint when Windows node pools are created to match the one GKE implicitly adds

* Update README.md

Fixes out of date link on the module usage example

* Update README.md - fixed broken link

* Added subnet id and self_link to outputs (#377)

Adjusted module outputs so that it's easier to consume them when using the factory in a larger codebase.

* net-vpc module: added subnet mini-factory

* Update README.md

* Code cleanup

* Adds support for IAM per-subnet IAM bindings via factory

* Gracefully handle a null secondary_ip_range

* Updated README.md. Added tests.

* Added license boilerplate to subnet yaml data in tests

* Update README.md

* Update README.md

* Removed dead code

* net-vpc-firewall mini rules-factory

* Paying tributes to the linting gods

* Fixed small bug on locals

* Tests for net-vpc-firewall module

* Update CHANGELOG.md

* refactor locals (#382)

* Add support for partitioned tables on Organization sinks (#380)

* Add support for partioned tables on Organization sinks

* Update changelog

* Fix lint

* Fix lint

* Use simple bool instead of block

* fix README

* Fix Readme

* Rename variable

Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>

* Improve PSN support in net-vpc module (#384)

* improve PSN support

* fix variable order

* fix example test

* fix cloudsql example

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update CHANGELOG.md

* Remove location from local.prefix

* Organization module refactor, in-module firewall policy factory for organization and folder (#385)

* move iam and logging to separate files, minimal refactoring

* update README

* fix example

* factory

* tfdoc

* boilerplate

* remove data_folder variable

* tfdoc

* fix default factory name

* add firewall policy to folder module

* add factory example

* Update CHANGELOG.md

* Fix VPC-SC module, add example (#387)

* Update CONTRIBUTING.md

Suggest change of wording related to `terraform format`: should be done from the top, recursively, and after `pytest` step, because fixtures are also going to be checked for linting during PR.

* Add target_node and minor fixes  (#389)

* Add separate BQ tables per asset type

* Add missing BQ location

* Add missing CF region

* Change Scheduler job to non-generic

* Add target_node, pass tests

* Do tfdoc.py

* Do terraform fmt

* Do terraform fmt -recursive for tests' fixtures

* Fix typo in test's variables

* Added support for Stateful Managed Instance Groups (#367)

* First iteration updates

* All tests passing

* Updated README and var descriptions

* Updated README

* Updated example README

* Consolidated stateful vars

* consolidated stateful vars

* Updated README

* Requested changes to try

* Fixed README examples and try

Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>

* SA key uploading and credentials json generation with terraform.

* Fix typo in the SA module readme

* TF fmt

* Update iam-sa docs

* Finalize onprem-sa-ket-mgmt example

* Add basic test for onprem-sa-mgmt example

* Refactoring

* Reorder variables

* Rewording, fix typos

* Bump tftest version

Bump tftest version to 1.6.1 and ensure test runners can update
providers if needed and available.

* Add bq_table_overwrite handling

* Add optional BQ table as a file export config

* Add getattr() to retrieve attribute from format

* Add roles/bigquery.jobUser for CF

* Update test_plan and README

* Change README, add diagram ( gcpdraw a6e4ec4f-7d6c-4796-b63e-ee4ce7b1792f )

* Change README to two diagrams

* Add count to toggle optional modules

* Change README

* Resolve order of variables test

* Linux sysctls configuration and Kubelet config (#388)

* Linux sysctls configuration and Kubelet config

* Fix terraform linting issues

* Updated README.md

* Updated Kubelet config object type

* Update readme

Co-authored-by: Sergio Tejón <stejon@freepik.com>
Co-authored-by: Julio Castillo <jccb@google.com>

* net-address: Added support for PSA ranges

* Update outputs.tf

* Fixes typo

* Resolved merge conflict

* Update CHANGELOG.md

* Add metric scopes support (#397)

* Add metric scopes support

* Fix typo

* new tfdoc block in README

Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>

* fix tfdoc replacement (#398)

* Update CHANGELOG.md

* Ludo hfw fixes (#400)

* fix tfdoc replacement

* ignore changes to rule description

* add folder example, fixes #339

* Update CHANGELOG.md

* Fix ignore changes for hfw rules (#401)

* fix tfdoc replacement

* ignore changes to rule description

* add folder example, fixes #339

* fix ignore changes in org and folder module

* Update CHANGELOG.md

* update documentation check

* backport tfdoc and check doc fixes

* Re-run pydoc

* Redo pydoc + local linting checks

* update tfdoc (#404)

* Org/Folder: Allow for policy association when using rule factory (#405)

* Org/Folder: Allow for policy association when using rule factory

* Fix linting issue

* Update hierarchical firewall resource

This replaces all the `google_compute_organization_security_*`
resources with the newer `google_compute_firewall_*` resources.

* Fix typo.

* Update CHANGELOG.md

* Typo fix

* New vpc-sc module implementation (#406)

* first implementation

* minimal output

* split service perimeters in regular and bridge

* tests and fixes

* new vpc-sc implementation

* remove providers file used for testing

* remove provider used during development

* Update CHANGELOG.md

* Update CHANGELOG.md

* Update README.md

* fix cases where bridge perimeter status resources are null (#408)

* Update CHANGELOG.md

* Copyright bump (#410)

* remove lifecycle block from vpc sc perimeters (#412)

* Update CHANGELOG.md

* Update CHANGELOG.md

* Interpolate access levels by key in vpc sc module (#414)

* interpolate access levels by key

* fix access level reference

* fix num resources in last README test

* Update CHANGELOG.md

* fix ingress policies in vpc sc module

* disable device policy support in vpc-sc module

* depend bridge from regular perimeters in vpc sc module

* Update CONTRIBUTING.md

* add versions to vpc-sc module

* Update CONTRIBUTING.md

* updated output variable name

* updated #tftest:skip on examples as using yaml input makes resources number variable

* changed pub_sub to pubsub

* unified protocol input variable

* changed extra_telemetry_pubsub_topic_ids variable type to: map

* solved issue in README.md

* grouped device configuration variables

* device config is now done individually per each device in the yaml file

* changes on device config yaml processing: 1 single yaml directory, use try() while parsing, example identation corrected

* updated headers to 2022

* removed get-pip.py
2022-02-05 15:54:24 +01:00
..
README.md IoT module (#415) 2022-02-05 15:54:24 +01:00
diagram.png IoT module (#415) 2022-02-05 15:54:24 +01:00
diagram_iot.png IoT module (#415) 2022-02-05 15:54:24 +01:00
main.tf IoT module (#415) 2022-02-05 15:54:24 +01:00
outputs.tf IoT module (#415) 2022-02-05 15:54:24 +01:00
variables.tf IoT module (#415) 2022-02-05 15:54:24 +01:00

README.md

Google Cloud IoT Core Module

This module sets up Cloud IoT Core Registry, registers IoT Devices and configures Pub/Sub topics required in Cloud IoT Core.

To use this module, ensure the following APIs are enabled:

  • pubsub.googleapis.com
  • cloudiot.googleapis.com

Simple Example

Basic example showing how to create an IoT Platform (IoT Core), connected to a set of given Pub/Sub topics and provision IoT devices.

Devices certificates must exist before calling this module. You can generate these certificates using the following command

openssl req -x509 -newkey rsa:2048 -keyout rsa_private.pem -nodes -out rsa_cert.pem -subj "/CN=unused"

And then provision public certificate path, together with the rest of device configuration in a devices yaml file following the following format

device_id: # id of your IoT Device
  is_blocked: # false to allow device connection with IoT Registry
  is_gateway: # true to indicate the device connecting acts as a gateway for other IoT Devices
  log_level: # device logs level
  certificate_file: # public certificate path, generated as explained in the previous step
  certificate_format: # Certificates format values are RSA_PEM, RSA_X509_PEM, ES256_PEM, and ES256_X509_PEM

Example Device config yaml configuration

device_1:
  is_blocked: false
  is_gateway: false
  log_level: INFO
  certificate_file: device_certs/rsa_cert5.pem
  certificate_format: RSA_X509_PEM
device_2:
  is_blocked: true
  is_gateway: false
  log_level: INFO
  certificate_file: device_certs/rsa_cert5.pem
  certificate_format: RSA_X509_PEM
module "iot-platform" {
  source                     = "./modules/iot-core"
  project_id                 = "my_project_id"
  region                     = "europe-west1"
  telemetry_pubsub_topic_id = "telemetry_topic_id"
  status_pubsub_topic_id    = "status_topic_id"
  protocols = {
      http = false,
      mqtt = true
  }
  devices_config_directory = "./devices_config_folder"
}
# tftest:skip

Now, we can test sending telemetry messages from devices to our IoT Platform, for example using the MQTT demo client at https://github.com/googleapis/nodejs-iot/tree/main/samples/mqtt_example

Example with specific PubSub topics for custom MQTT topics

If you need to match specific MQTT topics (eg, /temperature) into specific PubSub topics, you can use extra_telemetry_pubsub_topic_ids for that, as in the following example:

module "iot-platform" {
  source                     = "./modules/iot-core"
  project_id                 = "my_project_id"
  region                     = "europe-west1"
  telemetry_pubsub_topic_id = "telemetry_topic_id"
  status_pubsub_topic_id    = "status_topic_id"
  extra_telemetry_pubsub_topic_ids = {
      "temperature" = "temp_topic_id",
      "humidity" = "hum_topic_id"
  }
  protocols = {
      http = false,
      mqtt = true
  }
  devices_config_directory = "./devices_config_folder"
}
# tftest:skip

Example integrated with Data Foundation Platform

In this example, we will show how to extend the Data Foundations Platform to include IoT Platform as a new source of data.

Target architecture

  1. First, we will setup Environment following instructions in Environment Setup to setup projects and SAs required. Get output variable project_ids.landing as will be used later

  2. Second, execute instructions in Environment Setup to provision PubSub, DataFlow, BQ,... Get variable landing-pubsub as will be used later to create IoT Registry

  3. Now it is time to provision IoT Platform. Modify landing-project-id and landing_pubsub_topic_id with output variables obtained before. Create device certificates as shown in the Simple Example and register them in devices.yaml file together with deviceids.

module "iot-platform" {
  source                     = "./modules/iot-core"
  project_id                 = "landing-project-id"
  region                     = "europe-west1"
  telemetry_pubsub_topic_id = "landing_pubsub_topic_id"
  status_pubsub_topic_id    = "status_pubsub_topic_id"
  protocols = {
      http = false,
      mqtt = true
  }
  devices_config_directory = "./devices_config_folder"
}
# tftest:skip
  1. After that, we can setup the pipeline "PubSub to BigQuery" shown at Pipeline Setup

  2. Finally, instead of testing the pipeline by sending messages to PubSub, we can now test sending telemetry messages from simulated IoT devices to our IoT Platform, for example using the MQTT demo client at https://github.com/googleapis/nodejs-iot/tree/main/samples/mqtt_example . We shall edit the client script cloudiot_mqtt_example_nodejs.js to send messages following the pipeline message format, so they are processed by DataFlow job and inserted in the BigQuery table.

const payload = '{"name": "device4", "surname": "NA", "timestamp":"'+Math.floor(Date.now()/1000)+'"}';

Or even better, create a new BigQuery table with our IoT sensors data columns and modify the DataFlow job to push data to it.

Variables

name description type required default
devices_config_directory Path to folder where devices configs are stored in yaml format. Folder may include subfolders with configuration files. Files suffix must be .yaml. string
project_id Project were resources will be deployed string
region Region were resources will be deployed string
status_pubsub_topic_id pub sub topic for status messages (GCP-->Device) string
telemetry_pubsub_topic_id pub sub topic for telemetry messages (Device-->GCP) string
extra_telemetry_pubsub_topic_ids additional pubsub topics linked to adhoc MQTT topics (Device-->GCP) in the format MQTT_TOPIC: PUBSUB_TOPIC_ID map(string) {}
log_level IoT Registry Log level string "INFO"
protocols IoT protocols (HTTP / MQTT) activation object({…}) { http = true, mqtt = true }
registry_name Name for the IoT Core Registry string "cloudiot-registry"

Outputs

name description sensitive
iot_registry Cloud IoT Core Registry