185 lines
16 KiB
Markdown
185 lines
16 KiB
Markdown
# Tenant resource management
|
|
|
|
This stage is run for a specific tenant after [tenant bootstrap](../0-bootstrap-tenant/) has successfully created initial resources for the tenant, which is then decoupled from the organization.
|
|
|
|
It is logically equivalent and almost identical in code to the corresponding [organization resource management stage](../../stages/1-resman/), with a few notable differences:
|
|
|
|
- the hierarchy is rooted in the tenant top-level folder instead of the organization
|
|
- there's no management of tag values and keys since they organization-level resources (it could be implemented for tenant-specific tags if the need arises)
|
|
- automation service accounts for subsequent stages are configured but not created here (tenant-level bootstrap creates them and assigns organization-level permissions)
|
|
|
|
The stage runs with a dedicated service account for the tenant, which has no permissions at the organization level except for billing and organization policies, constrained by a condition on the tenant tag.
|
|
|
|
The following diagram is a high level reference of what this stage manages, showing one hypothetical tenant (additional tenants require additional instances of this stage being deployed):
|
|
|
|
```mermaid
|
|
%%{init: {'theme':'base'}}%%
|
|
classDiagram
|
|
Tenant_root~📁~ -- tn0_automation
|
|
Tenant_root~📁~ -- Networking~📁~
|
|
Tenant_root~📁~ -- Security~📁~
|
|
Tenant_root~📁~ -- Data_Platform~📁~
|
|
Data_Platform~📁~ -- DP_Dev~📁~
|
|
Data_Platform~📁~ -- DP_Prod~📁~
|
|
Tenant_root~📁~ -- GKE~📁~
|
|
GKE~📁~ -- GKE_Dev~📁~
|
|
GKE~📁~ -- GKE_Prod~📁~
|
|
Tenant_root~📁~ -- Teams~📁~
|
|
Teams~📁~ -- Team_0~📁~
|
|
Team_0~📁~ -- Team_0_Dev~📁~
|
|
Team_0~📁~ -- Team_0_Prod~📁~
|
|
Tenant_root~📁~ -- Sandbox~📁~
|
|
class Tenant_root~📁~ {
|
|
- IAM bindings()
|
|
- org policies()
|
|
}
|
|
class tn0_automation {
|
|
- GCS buckets
|
|
- IAM bindings()
|
|
}
|
|
class Data_Platform~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class DP_Dev~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class DP_Prod~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class GKE~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class GKE_Dev~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class GKE_Prod~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class Networking~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class Security~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class Sandbox~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class Teams~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class Team_0~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class Team_0_Dev~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
class Team_0_Prod~📁~ {
|
|
- IAM bindings()
|
|
- tag bindings()
|
|
}
|
|
```
|
|
|
|
As most of the features of this stage follow the same design and configurations of the [organization-level resource management stage](../../stages/1-resman/), we will only focus on the tenant-specific configuration in this document.
|
|
|
|
## How to run this stage
|
|
|
|
As mentioned above this stage is decoupled from organization-level stages: it uses a service account and state bucket from the tenant-specific automation project, and its tfvars and provider files are also tenant-specific.
|
|
|
|
The `stage-links.sh` script can be used to get the commands needed for the provider and output files, just set the variable for the tenant shortname (the same one specified in the tenant bootstrap stage) and pass a single argument with your FAST output files folder path, or GCS bucket URI:
|
|
|
|
```bash
|
|
TENANT=tn0 ../../stage-links.sh ~/fast-config
|
|
```
|
|
|
|
The script output can be copy/pasted to a terminal:
|
|
|
|
```bash
|
|
# copy and paste the following commands for '1-resman-tenant'
|
|
|
|
ln -s ~/fast-config/tenants/tn0/providers/1-resman-tenant-providers.tf ./
|
|
ln -s ~/fast-config/tenants/tn0/tfvars/0-bootstrap-tenant.auto.tfvars.json ./
|
|
```
|
|
|
|
Once that is done, stage-level configuration variables are the same as the corresponding organization-level stage.
|
|
|
|
### Running the stage
|
|
|
|
Once the configuration is done just go through the usual `init/apply` cycle. On successful apply, a tfvars file specific for this tenant and a set of provider files will be created.
|
|
|
|
<!-- TFDOC OPTS files:1 show_extra:1 -->
|
|
<!-- BEGIN TFDOC -->
|
|
|
|
## Files
|
|
|
|
| name | description | modules | resources |
|
|
|---|---|---|---|
|
|
| [branch-data-platform.tf](./branch-data-platform.tf) | Data Platform stages resources. | <code>folder</code> · <code>gcs</code> · <code>iam-service-account</code> | |
|
|
| [branch-gke.tf](./branch-gke.tf) | GKE multitenant stage resources. | <code>folder</code> · <code>gcs</code> · <code>iam-service-account</code> | |
|
|
| [branch-networking.tf](./branch-networking.tf) | Networking stage resources. | <code>folder</code> · <code>gcs</code> · <code>iam-service-account</code> | |
|
|
| [branch-project-factory.tf](./branch-project-factory.tf) | Project factory stage resources. | <code>gcs</code> · <code>iam-service-account</code> | |
|
|
| [branch-sandbox.tf](./branch-sandbox.tf) | Sandbox stage resources. | <code>folder</code> · <code>gcs</code> | |
|
|
| [branch-security.tf](./branch-security.tf) | Security stage resources. | <code>folder</code> · <code>gcs</code> · <code>iam-service-account</code> | |
|
|
| [branch-teams.tf](./branch-teams.tf) | Team stage resources. | <code>folder</code> · <code>gcs</code> · <code>iam-service-account</code> | |
|
|
| [cicd-data-platform.tf](./cicd-data-platform.tf) | CI/CD resources for the data platform branch. | <code>iam-service-account</code> · <code>source-repository</code> | |
|
|
| [cicd-gke.tf](./cicd-gke.tf) | CI/CD resources for the data platform branch. | <code>iam-service-account</code> · <code>source-repository</code> | |
|
|
| [cicd-networking.tf](./cicd-networking.tf) | CI/CD resources for the networking branch. | <code>iam-service-account</code> · <code>source-repository</code> | |
|
|
| [cicd-project-factory.tf](./cicd-project-factory.tf) | CI/CD resources for the teams branch. | <code>iam-service-account</code> · <code>source-repository</code> | |
|
|
| [cicd-security.tf](./cicd-security.tf) | CI/CD resources for the security branch. | <code>iam-service-account</code> · <code>source-repository</code> | |
|
|
| [main.tf](./main.tf) | Module-level locals and resources. | | |
|
|
| [outputs-files.tf](./outputs-files.tf) | Output files persistence to local filesystem. | | <code>local_file</code> |
|
|
| [outputs-gcs.tf](./outputs-gcs.tf) | Output files persistence to automation GCS bucket. | | <code>google_storage_bucket_object</code> |
|
|
| [outputs.tf](./outputs.tf) | Module outputs. | | |
|
|
| [root_node.tf](./root_node.tf) | Tenant root folder configuration. | <code>folder</code> | |
|
|
| [variables.tf](./variables.tf) | Module variables. | | |
|
|
|
|
## Variables
|
|
|
|
| name | description | type | required | default | producer |
|
|
|---|---|:---:|:---:|:---:|:---:|
|
|
| [automation](variables.tf#L20) | Automation resources created by the bootstrap stage. | <code title="object({ outputs_bucket = string project_id = string project_number = string federated_identity_pools = list(string) federated_identity_providers = map(object({ issuer = string issuer_uri = string name = string principal_tpl = string principalset_tpl = string })) service_accounts = object({ networking = string resman = string security = string dp-dev = optional(string) dp-prod = optional(string) gke-dev = optional(string) gke-prod = optional(string) pf-dev = optional(string) pf-prod = optional(string) sandbox = optional(string) teams = optional(string) }) })">object({…})</code> | ✓ | | <code>0-bootstrap</code> |
|
|
| [billing_account](variables.tf#L51) | Billing account id. If billing account is not part of the same org set `is_org_level` to false. | <code title="object({ id = string is_org_level = optional(bool, true) })">object({…})</code> | ✓ | | <code>0-bootstrap</code> |
|
|
| [organization](variables.tf#L206) | Organization details. | <code title="object({ domain = string id = number customer_id = string })">object({…})</code> | ✓ | | <code>0-bootstrap</code> |
|
|
| [prefix](variables.tf#L228) | Prefix used for resources that need unique names. Use 9 characters or less. | <code>string</code> | ✓ | | <code>0-bootstrap</code> |
|
|
| [root_node](variables.tf#L239) | Root folder node for the tenant, in folders/nnnnnn format. | <code>string</code> | ✓ | | |
|
|
| [short_name](variables.tf#L244) | Short name used to identify the tenant. | <code>string</code> | ✓ | | |
|
|
| [tags](variables.tf#L249) | Resource management tags. | <code title="object({ keys = object({ context = string environment = string tenant = string }) names = object({ context = string environment = string tenant = string }) values = map(string) })">object({…})</code> | ✓ | | |
|
|
| [cicd_repositories](variables.tf#L64) | CI/CD repository configuration. Identity providers reference keys in the `automation.federated_identity_providers` variable. Set to null to disable, or set individual repositories to null if not needed. | <code title="object({ data_platform_dev = object({ branch = string identity_provider = string name = string type = string }) data_platform_prod = object({ branch = string identity_provider = string name = string type = string }) gke_dev = object({ branch = string identity_provider = string name = string type = string }) gke_prod = object({ branch = string identity_provider = string name = string type = string }) networking = object({ branch = string identity_provider = string name = string type = string }) project_factory_dev = object({ branch = string identity_provider = string name = string type = string }) project_factory_prod = object({ branch = string identity_provider = string name = string type = string }) security = object({ branch = string identity_provider = string name = string type = string }) })">object({…})</code> | | <code>null</code> | |
|
|
| [custom_roles](variables.tf#L146) | Custom roles defined at the org level, in key => id format. | <code title="object({ service_project_network_admin = string })">object({…})</code> | | <code>null</code> | <code>0-bootstrap</code> |
|
|
| [data_dir](variables.tf#L155) | Relative path for the folder storing configuration data. | <code>string</code> | | <code>"data"</code> | |
|
|
| [fast_features](variables.tf#L161) | Selective control for top-level FAST features. | <code title="object({ data_platform = optional(bool, false) gke = optional(bool, false) project_factory = optional(bool, false) sandbox = optional(bool, false) teams = optional(bool, false) })">object({…})</code> | | <code>{}</code> | <code>0-0-bootstrap</code> |
|
|
| [groups](variables.tf#L175) | Group names to grant organization-level permissions. | <code title="object({ gcp-devops = optional(string) gcp-network-admins = optional(string) gcp-security-admins = optional(string) })">object({…})</code> | | <code>{}</code> | <code>0-bootstrap</code> |
|
|
| [locations](variables.tf#L188) | Optional locations for GCS, BigQuery, and logging buckets created here. | <code title="object({ bq = string gcs = string logging = string pubsub = list(string) })">object({…})</code> | | <code title="{ bq = "EU" gcs = "EU" logging = "global" pubsub = [] }">{…}</code> | <code>0-bootstrap</code> |
|
|
| [organization_policy_data_path](variables.tf#L216) | Path for the data folder used by the organization policies factory. | <code>string</code> | | <code>null</code> | |
|
|
| [outputs_location](variables.tf#L222) | Enable writing provider, tfvars and CI/CD workflow files to local filesystem. Leave null to disable. | <code>string</code> | | <code>null</code> | |
|
|
| [team_folders](variables.tf#L267) | Team folders to be created. Format is described in a code comment. | <code title="map(object({ descriptive_name = string group_iam = map(list(string)) impersonation_groups = list(string) }))">map(object({…}))</code> | | <code>null</code> | |
|
|
| [test_skip_data_sources](variables.tf#L277) | Used when testing to bypass data sources. | <code>bool</code> | | <code>false</code> | |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive | consumers |
|
|
|---|---|:---:|---|
|
|
| [cicd_repositories](outputs.tf#L189) | WIF configuration for CI/CD repositories. | | |
|
|
| [dataplatform](outputs.tf#L203) | Data for the Data Platform stage. | | |
|
|
| [gke_multitenant](outputs.tf#L219) | Data for the GKE multitenant stage. | | <code>03-gke-multitenant</code> |
|
|
| [networking](outputs.tf#L240) | Data for the networking stage. | | |
|
|
| [project_factories](outputs.tf#L249) | Data for the project factories stage. | | |
|
|
| [providers](outputs.tf#L264) | Terraform provider files for this stage and dependent stages. | ✓ | <code>02-networking</code> · <code>02-security</code> · <code>03-dataplatform</code> · <code>xx-sandbox</code> · <code>xx-teams</code> |
|
|
| [sandbox](outputs.tf#L271) | Data for the sandbox stage. | | <code>xx-sandbox</code> |
|
|
| [security](outputs.tf#L285) | Data for the networking stage. | | <code>02-security</code> |
|
|
| [teams](outputs.tf#L295) | Data for the teams stage. | | |
|
|
| [tfvars](outputs.tf#L307) | Terraform variable files for the following stages. | ✓ | |
|
|
|
|
<!-- END TFDOC -->
|