-
Notifications
You must be signed in to change notification settings - Fork 4
/
main.tf
306 lines (259 loc) · 12 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
/**
* Copyright 2019 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
locals {
cloudbuild_project_id = var.project_id != "" ? var.project_id : format("%s-%s", var.project_prefix, "cloudbuild")
gar_repo_name = var.gar_repo_name != "" ? var.gar_repo_name : format("%s-%s", var.project_prefix, "tf-runners")
cloudbuild_apis = ["cloudbuild.googleapis.com", "sourcerepo.googleapis.com", "cloudkms.googleapis.com", "artifactregistry.googleapis.com"]
impersonation_enabled_count = var.sa_enable_impersonation == true ? 1 : 0
activate_apis = distinct(concat(var.activate_apis, local.cloudbuild_apis))
apply_branches_regex = "^(${join("|", var.terraform_apply_branches)})$"
gar_name = split("/", google_artifact_registry_repository.tf-image-repo.name)[length(split("/", google_artifact_registry_repository.tf-image-repo.name)) - 1]
impersonate_service_account = var.impersonate_service_account != "" ? "--impersonate-service-account=${var.impersonate_service_account}" : ""
}
resource "random_id" "suffix" {
byte_length = 2
}
/******************************************
Cloudbuild project
*******************************************/
module "cloudbuild_project" {
source = "terraform-google-modules/project-factory/google"
version = "~> 14.0"
name = local.cloudbuild_project_id
random_project_id = var.random_suffix
disable_services_on_destroy = false
folder_id = var.folder_id
org_id = var.org_id
billing_account = var.billing_account
activate_apis = local.activate_apis
labels = var.project_labels
}
/******************************************
Cloudbuild IAM for terraform SA
*******************************************/
// See https://cloud.google.com/build/docs/securing-builds/configure-user-specified-service-accounts
// for details regarding the configuration of the Terraform service account to run Cloud Build
resource "google_project_iam_member" "terraform_sa_log_writer" {
project = module.cloudbuild_project.project_id
role = "roles/logging.logWriter"
member = "serviceAccount:${var.terraform_sa_email}"
}
resource "google_artifact_registry_repository_iam_member" "terraform_sa_artifact_registry_reader" {
provider = google-beta
project = module.cloudbuild_project.project_id
location = google_artifact_registry_repository.tf-image-repo.location
repository = google_artifact_registry_repository.tf-image-repo.name
role = "roles/artifactregistry.reader"
member = "serviceAccount:${var.terraform_sa_email}"
}
resource "google_service_account_iam_member" "terraform_sa_self_impersonate" {
service_account_id = var.terraform_sa_name
role = "roles/iam.serviceAccountUser"
member = "serviceAccount:${var.terraform_sa_email}"
}
resource "google_service_account_iam_member" "terraform_sa_self_impersonate_token" {
service_account_id = var.terraform_sa_name
role = "roles/iam.serviceAccountTokenCreator"
member = "serviceAccount:${var.terraform_sa_email}"
}
resource "google_storage_bucket_iam_member" "terraform_sa_artifacts_iam" {
bucket = google_storage_bucket.cloudbuild_artifacts.name
role = "roles/storage.objectCreator"
member = "serviceAccount:${var.terraform_sa_email}"
}
resource "google_storage_bucket_iam_member" "terraform_sa_logs_iam" {
bucket = google_storage_bucket.cloudbuild_logs.name
role = "roles/storage.admin"
member = "serviceAccount:${var.terraform_sa_email}"
}
resource "google_service_account_iam_member" "cloud_build_service_agent_sa_impersonate" {
service_account_id = var.terraform_sa_name
role = "roles/iam.serviceAccountTokenCreator"
member = "serviceAccount:service-${module.cloudbuild_project.project_number}@gcp-sa-cloudbuild.iam.gserviceaccount.com"
}
resource "time_sleep" "impersonate_propagation" {
create_duration = "60s"
depends_on = [
google_service_account_iam_member.cloud_build_service_agent_sa_impersonate
]
}
/******************************************
Cloudbuild IAM for admins
*******************************************/
resource "google_project_iam_member" "org_admins_cloudbuild_editor" {
project = module.cloudbuild_project.project_id
role = "roles/cloudbuild.builds.editor"
member = "group:${var.group_org_admins}"
}
resource "google_project_iam_member" "org_admins_cloudbuild_viewer" {
project = module.cloudbuild_project.project_id
role = "roles/viewer"
member = "group:${var.group_org_admins}"
}
/******************************************
Cloudbuild Logs bucket
*******************************************/
resource "google_storage_bucket" "cloudbuild_logs" {
project = module.cloudbuild_project.project_id
name = format("%s-%s-%s", module.cloudbuild_project.project_id, "cloudbuild-logs", random_id.suffix.hex)
location = var.default_region
labels = var.storage_bucket_labels
uniform_bucket_level_access = true
}
/******************************************
Cloudbuild Artifact bucket
*******************************************/
resource "google_storage_bucket" "cloudbuild_artifacts" {
project = module.cloudbuild_project.project_id
name = format("%s-%s-%s", var.project_prefix, "cloudbuild-artifacts", random_id.suffix.hex)
location = var.default_region
labels = var.storage_bucket_labels
uniform_bucket_level_access = true
versioning {
enabled = true
}
}
/******************************************
Create Cloud Source Repos
*******************************************/
resource "google_sourcerepo_repository" "gcp_repo" {
for_each = var.create_cloud_source_repos ? toset(var.cloud_source_repos) : []
project = module.cloudbuild_project.project_id
name = each.value
}
/******************************************
Cloud Source Repo IAM
*******************************************/
resource "google_project_iam_member" "org_admins_source_repo_admin" {
count = var.create_cloud_source_repos ? 1 : 0
project = module.cloudbuild_project.project_id
role = "roles/source.admin"
member = "group:${var.group_org_admins}"
}
/***********************************************
Cloud Build - Main branch triggers
***********************************************/
resource "google_cloudbuild_trigger" "main_trigger" {
for_each = var.create_cloud_source_repos ? toset(var.cloud_source_repos) : []
project = module.cloudbuild_project.project_id
description = "${each.value} - terraform apply."
service_account = var.terraform_sa_name
trigger_template {
branch_name = local.apply_branches_regex
repo_name = each.value
}
substitutions = {
_ORG_ID = var.org_id
_BILLING_ID = var.billing_account
_DEFAULT_REGION = var.default_region
_GAR_REPOSITORY = local.gar_name
_TF_SA_EMAIL = var.terraform_sa_email
_STATE_BUCKET_NAME = var.terraform_state_bucket
_ARTIFACT_BUCKET_NAME = google_storage_bucket.cloudbuild_artifacts.name
_LOGS_BUCKET_NAME = google_storage_bucket.cloudbuild_logs.name
_TF_ACTION = "apply"
}
filename = var.cloudbuild_apply_filename
depends_on = [
google_sourcerepo_repository.gcp_repo,
google_service_account_iam_member.org_admin_terraform_sa_impersonate,
time_sleep.impersonate_propagation
]
}
/***********************************************
Cloud Build - Non Main branch triggers
***********************************************/
resource "google_cloudbuild_trigger" "non_main_trigger" {
for_each = var.create_cloud_source_repos ? toset(var.cloud_source_repos) : []
project = module.cloudbuild_project.project_id
description = "${each.value} - terraform plan."
service_account = var.terraform_sa_name
trigger_template {
invert_regex = true
branch_name = local.apply_branches_regex
repo_name = each.value
}
substitutions = {
_ORG_ID = var.org_id
_BILLING_ID = var.billing_account
_DEFAULT_REGION = var.default_region
_GAR_REPOSITORY = local.gar_name
_TF_SA_EMAIL = var.terraform_sa_email
_STATE_BUCKET_NAME = var.terraform_state_bucket
_ARTIFACT_BUCKET_NAME = google_storage_bucket.cloudbuild_artifacts.name
_LOGS_BUCKET_NAME = google_storage_bucket.cloudbuild_logs.name
_TF_ACTION = "plan"
}
filename = var.cloudbuild_plan_filename
depends_on = [
google_sourcerepo_repository.gcp_repo,
google_service_account_iam_member.org_admin_terraform_sa_impersonate,
time_sleep.impersonate_propagation
]
}
/***********************************************
Cloud Build - Terraform Image Repo
***********************************************/
resource "google_artifact_registry_repository" "tf-image-repo" {
provider = google-beta
project = module.cloudbuild_project.project_id
location = var.default_region
repository_id = local.gar_repo_name
description = "Docker repository for Terraform runner images used by Cloud Build"
format = "DOCKER"
}
/***********************************************
Cloud Build - Terraform builder
***********************************************/
resource "null_resource" "cloudbuild_terraform_builder" {
triggers = {
project_id_cloudbuild_project = module.cloudbuild_project.project_id
terraform_version_sha256sum = var.terraform_version_sha256sum
terraform_version = var.terraform_version
gar_name = local.gar_name
gar_location = google_artifact_registry_repository.tf-image-repo.location
}
provisioner "local-exec" {
command = <<EOT
gcloud ${local.impersonate_service_account} builds submit ${path.module}/cloudbuild_builder/ --project ${module.cloudbuild_project.project_id} --config=${path.module}/cloudbuild_builder/cloudbuild.yaml --substitutions=_GCLOUD_VERSION=${var.gcloud_version},_TERRAFORM_VERSION=${var.terraform_version},_TERRAFORM_VERSION_SHA256SUM=${var.terraform_version_sha256sum},_REGION=${google_artifact_registry_repository.tf-image-repo.location},_REPOSITORY=${local.gar_name}
EOT
}
depends_on = [
google_artifact_registry_repository_iam_member.terraform-image-iam
]
}
/***********************************************
Cloud Build - IAM
***********************************************/
resource "google_storage_bucket_iam_member" "cloudbuild_artifacts_iam" {
bucket = google_storage_bucket.cloudbuild_artifacts.name
role = "roles/storage.admin"
member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
}
resource "google_artifact_registry_repository_iam_member" "terraform-image-iam" {
provider = google-beta
project = module.cloudbuild_project.project_id
location = google_artifact_registry_repository.tf-image-repo.location
repository = google_artifact_registry_repository.tf-image-repo.name
role = "roles/artifactregistry.writer"
member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
}
resource "google_service_account_iam_member" "org_admin_terraform_sa_impersonate" {
count = local.impersonation_enabled_count
service_account_id = var.terraform_sa_name
role = "roles/iam.serviceAccountUser"
member = "group:${var.group_org_admins}"
}