819894d2ba
* IAM modules refactor proposal * policy * subheading * Update 20230816-iam-refactor.md * log Julio's +1 * data-catalog-policy-tag * dataproc * dataproc * folder * folder * folder * folder * project * better filtering in test examples * project * folder * folder * organization * fix variable descriptions * kms * net-vpc * dataplex-datascan * modules/iam-service-account * modules/source-repository/ * blueprints/cloud-operations/vm-migration/ * blueprints/third-party-solutions/wordpress * dataplex-datascan * blueprints/cloud-operations/workload-identity-federation * blueprints/data-solutions/cloudsql-multiregion/ * blueprints/data-solutions/composer-2 * Update 20230816-iam-refactor.md * Update 20230816-iam-refactor.md * capture discussion in architectural doc * update variable names and refactor proposal * project * blueprints first round * folder * organization * data-catalog-policy-tag * re-enable folder inventory * project module style fix * dataproc * source-repository * source-repository tests * dataplex-datascan * dataplex-datascan tests * net-vpc * net-vpc test examples * iam-service-account * iam-service-account test examples * kms * boilerplate * tfdoc * fix module tests * more blueprint fixes * fix typo in data blueprints * incomplete refactor of data platform foundations * tfdoc * data platform foundation * refactor data platform foundation iam locals * remove redundant example test * shielded folder fix * fix typo * project factory * project factory outputs * tfdoc * test workflow: less verbose tests, fix tf version * re-enable -vv, shorter traceback, fix action version * ignore github extension warning, re-enable action version * fast bootstrap IAM, untested * bootstrap stage IAM fixes * stage 0 tests * fast stage 1 * tenant stage 1 * minor changes to fast stage 0 and 1 * fast security stage * fast mt stage 0 * fast mt stage 0 * fast pf |
||
---|---|---|
.. | ||
README.md | ||
iam.tf | ||
main.tf | ||
outputs.tf | ||
variables.tf | ||
versions.tf |
README.md
Google Cloud Source Repository Module
This module allows managing a single Cloud Source Repository, including IAM bindings and basic Cloud Build triggers.
Examples
Repository with IAM
module "repo" {
source = "./fabric/modules/source-repository"
project_id = "my-project"
name = "my-repo"
iam = {
"roles/source.reader" = ["user:foo@example.com"]
}
iam_bindings_additive = {
am1-reader = {
member = "user:am1@example.com"
role = "roles/source.reader"
}
}
}
# tftest modules=1 resources=3 inventory=simple.yaml
Repository with Cloud Build trigger
module "repo" {
source = "./fabric/modules/source-repository"
project_id = "my-project"
name = "my-repo"
triggers = {
foo = {
filename = "ci/workflow-foo.yaml"
included_files = ["**/*tf"]
service_account = null
substitutions = {
BAR = 1
}
template = {
branch_name = "main"
project_id = null
tag_name = null
}
}
}
}
# tftest modules=1 resources=2 inventory=trigger.yaml
Files
name | description | resources |
---|---|---|
iam.tf | IAM resources. | google_sourcerepo_repository_iam_binding · google_sourcerepo_repository_iam_member |
main.tf | Module-level locals and resources. | google_cloudbuild_trigger · google_sourcerepo_repository |
outputs.tf | Module outputs. | |
variables.tf | Module variables. | |
versions.tf | Version pins. |
Variables
name | description | type | required | default |
---|---|---|---|---|
name | Repository name. | string |
✓ | |
project_id | Project used for resources. | string |
✓ | |
group_iam | Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the iam variable. |
map(list(string)) |
{} |
|
iam | IAM bindings in {ROLE => [MEMBERS]} format. | map(list(string)) |
{} |
|
iam_bindings | Authoritative IAM bindings in {ROLE => {members = [], condition = {}}}. | map(object({…})) |
{} |
|
iam_bindings_additive | Individual additive IAM bindings. Keys are arbitrary. | map(object({…})) |
{} |
|
triggers | Cloud Build triggers. | map(object({…})) |
{} |
Outputs
name | description | sensitive |
---|---|---|
id | Fully qualified repository id. | |
name | Repository name. | |
url | Repository URL. |