Skip to content

Commit 0cade7f

Browse files
authored
feat(TPG >5.22)!: added vpc sc dry run mode option (#894)
1 parent 0787fa9 commit 0cade7f

10 files changed

+59
-16
lines changed

README.md

+8-6
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ To include G Suite integration for creating groups and adding Service Accounts i
1212

1313
## Compatibility
1414

15-
This module is meant for use with Terraform 0.13+ and tested using Terraform 1.0+. If you find incompatibilities using Terraform >=0.13, please open an issue.
15+
This module is meant for use with Terraform 0.13+ and tested using Terraform 1.3+. If you find incompatibilities using Terraform >=0.13, please open an issue.
1616
If you haven't
1717
[upgraded][terraform-0.13-upgrade] and need a Terraform
1818
0.12.x-compatible version of this module, the last released version
@@ -29,7 +29,7 @@ There are multiple examples included in the [examples](./examples/) folder but s
2929
```hcl
3030
module "project-factory" {
3131
source = "terraform-google-modules/project-factory/google"
32-
version = "~> 14.5"
32+
version = "~> 15.0"
3333
3434
name = "pf-test-1"
3535
random_project_id = true
@@ -161,7 +161,8 @@ determining that location is as follows:
161161
| tag\_binding\_values | Tag values to bind the project to. | `list(string)` | `[]` | no |
162162
| usage\_bucket\_name | Name of a GCS bucket to store GCE usage reports in (optional) | `string` | `""` | no |
163163
| usage\_bucket\_prefix | Prefix in the GCS bucket to store GCE usage reports in (optional) | `string` | `""` | no |
164-
| vpc\_service\_control\_attach\_enabled | Whether the project will be attached to a VPC Service Control Perimeter | `bool` | `false` | no |
164+
| vpc\_service\_control\_attach\_dry\_run | Whether the project will be attached to a VPC Service Control Perimeter in Dry Run Mode. vpc\_service\_control\_attach\_enabled should be false for this to be true | `bool` | `false` | no |
165+
| vpc\_service\_control\_attach\_enabled | Whether the project will be attached to a VPC Service Control Perimeter in ENFORCED MODE. vpc\_service\_control\_attach\_dry\_run should be false for this to be true | `bool` | `false` | no |
165166
| vpc\_service\_control\_perimeter\_name | The name of a VPC Service Control Perimeter to add the created project to | `string` | `null` | no |
166167
| vpc\_service\_control\_sleep\_duration | The duration to sleep in seconds before adding the project to a shared VPC after the project is added to the VPC Service Control Perimeter. VPC-SC is eventually consistent. | `string` | `"5s"` | no |
167168

@@ -187,6 +188,7 @@ determining that location is as follows:
187188
| service\_account\_name | The fully-qualified name of the default service account |
188189
| service\_account\_unique\_id | The unique id of the default service account |
189190
| tag\_bindings | Tag bindings |
191+
| usage\_report\_export\_bucket | GCE usage reports bucket |
190192

191193
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
192194

@@ -197,9 +199,9 @@ determining that location is as follows:
197199
- [gcloud sdk](https://cloud.google.com/sdk/install) >= 269.0.0
198200
- [jq](https://stedolan.github.io/jq/) >= 1.6
199201
- [Terraform](https://www.terraform.io/downloads.html) >= 0.13.0
200-
- [terraform-provider-google] plugin ~> 4.11
201-
- [terraform-provider-google-beta] plugin ~> 4.11
202-
- [terraform-provider-gsuite] plugin 0.1.x if GSuite functionality is desired
202+
- [terraform-provider-google] plugin >= 5.22
203+
- [terraform-provider-google-beta] plugin >= 5.22
204+
- [terraform-provider-gsuite] plugin ~> 0.1.x if GSuite functionality is desired
203205

204206
### Permissions
205207

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Upgrading to Project Factory v15.0
2+
3+
The v15.0 release of Project Factory is a backwards incompatible release.
4+
5+
### Google Cloud Platform Provider upgrade
6+
7+
The Project Factory module now requires version 5.22 or higher of the Google Cloud Platform Provider and 5.22 or higher of
8+
the Google Cloud Platform Beta Provider.

main.tf

+1
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ module "project-factory" {
6565
default_service_account = var.default_service_account
6666
disable_dependent_services = var.disable_dependent_services
6767
vpc_service_control_attach_enabled = var.vpc_service_control_attach_enabled
68+
vpc_service_control_attach_dry_run = var.vpc_service_control_attach_dry_run
6869
vpc_service_control_perimeter_name = var.vpc_service_control_perimeter_name
6970
vpc_service_control_sleep_duration = var.vpc_service_control_sleep_duration
7071
default_network_tier = var.default_network_tier

modules/core_project_factory/main.tf

+13-3
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ module "project_services" {
109109
Shared VPC configuration
110110
*****************************************/
111111
resource "time_sleep" "wait_5_seconds" { #TODO rename resource in the next breaking change.
112-
count = var.vpc_service_control_attach_enabled ? 1 : 0
112+
count = var.vpc_service_control_attach_enabled || var.vpc_service_control_attach_dry_run ? 1 : 0
113113
depends_on = [google_access_context_manager_service_perimeter_resource.service_perimeter_attachment[0], google_project_service.enable_access_context_manager[0]]
114114
create_duration = var.vpc_service_control_sleep_duration
115115
}
@@ -345,7 +345,7 @@ resource "google_storage_bucket_iam_member" "api_s_account_storage_admin_on_proj
345345
}
346346

347347
/******************************************
348-
Attachment to VPC Service Control Perimeter
348+
Attachment to VPC Service Control Perimeter in Enforce Mode
349349
*****************************************/
350350
resource "google_access_context_manager_service_perimeter_resource" "service_perimeter_attachment" {
351351
count = var.vpc_service_control_attach_enabled ? 1 : 0
@@ -354,11 +354,21 @@ resource "google_access_context_manager_service_perimeter_resource" "service_per
354354
resource = "projects/${google_project.main.number}"
355355
}
356356

357+
/******************************************
358+
Attachment to VPC Service Control Perimeter in Dry Run Mode
359+
*****************************************/
360+
resource "google_access_context_manager_service_perimeter_dry_run_resource" "service_perimeter_attachment_dry_run" {
361+
count = var.vpc_service_control_attach_dry_run && !var.vpc_service_control_attach_enabled ? 1 : 0
362+
depends_on = [google_service_account.default_service_account]
363+
perimeter_name = var.vpc_service_control_perimeter_name
364+
resource = "projects/${google_project.main.number}"
365+
}
366+
357367
/******************************************
358368
Enable Access Context Manager API
359369
*****************************************/
360370
resource "google_project_service" "enable_access_context_manager" {
361-
count = var.vpc_service_control_attach_enabled ? 1 : 0
371+
count = var.vpc_service_control_attach_enabled || var.vpc_service_control_attach_dry_run ? 1 : 0
362372
project = google_project.main.number
363373
service = "accesscontextmanager.googleapis.com"
364374
}

modules/core_project_factory/outputs.tf

+5
Original file line numberDiff line numberDiff line change
@@ -100,3 +100,8 @@ output "tag_bindings" {
100100
description = "Tag bindings"
101101
value = google_tags_tag_binding.bindings
102102
}
103+
104+
output "usage_report_export_bucket" {
105+
description = "GCE usage reports bucket"
106+
value = try(google_project_usage_export_bucket.usage_report_export[0], null)
107+
}

modules/core_project_factory/variables.tf

+8-2
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ variable "activate_apis" {
111111
variable "activate_api_identities" {
112112
description = <<EOF
113113
The list of service identities (Google Managed service account for the API) to force-create for the project (e.g. in order to grant additional roles).
114-
APIs in this list will automatically be appended to `activate_apis`.
114+
APIs in this list will automatically be appended to `activate_apis`. Use for services supported by `gcloud beta services identity create`
115115
Not including the API in this list will follow the default behaviour for identity creation (which is usually when the first resource using the API is created).
116116
Any roles (e.g. service agent role) must be explicitly listed. See https://cloud.google.com/iam/docs/understanding-roles#service-agent-roles-roles for a list of related roles.
117117
EOF
@@ -230,7 +230,13 @@ variable "enable_shared_vpc_host_project" {
230230
}
231231

232232
variable "vpc_service_control_attach_enabled" {
233-
description = "Whether the project will be attached to a VPC Service Control Perimeter"
233+
description = "Whether the project will be attached to a VPC Service Control Perimeter in ENFORCED MODE. vpc_service_control_attach_dry_run should be false for this to be true"
234+
type = bool
235+
default = false
236+
}
237+
238+
variable "vpc_service_control_attach_dry_run" {
239+
description = "Whether the project will be attached to a VPC Service Control Perimeter in Dry Run Mode. vpc_service_control_attach_enabled should be false for this to be true"
234240
type = bool
235241
default = false
236242
}

modules/core_project_factory/versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,11 @@ terraform {
2020
required_providers {
2121
google = {
2222
source = "hashicorp/google"
23-
version = ">= 3.64, < 6"
23+
version = ">= 5.22, < 6"
2424
}
2525
google-beta = {
2626
source = "hashicorp/google-beta"
27-
version = ">= 3.64, < 6"
27+
version = ">= 5.22, < 6"
2828
}
2929
null = {
3030
source = "hashicorp/null"

outputs.tf

+5
Original file line numberDiff line numberDiff line change
@@ -103,3 +103,8 @@ output "tag_bindings" {
103103
description = "Tag bindings"
104104
value = module.project-factory.tag_bindings
105105
}
106+
107+
output "usage_report_export_bucket" {
108+
description = "GCE usage reports bucket"
109+
value = module.project-factory.usage_report_export_bucket
110+
}

variables.tf

+7-1
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,13 @@ variable "budget_custom_period_end_date" {
289289
}
290290

291291
variable "vpc_service_control_attach_enabled" {
292-
description = "Whether the project will be attached to a VPC Service Control Perimeter"
292+
description = "Whether the project will be attached to a VPC Service Control Perimeter in ENFORCED MODE. vpc_service_control_attach_dry_run should be false for this to be true"
293+
type = bool
294+
default = false
295+
}
296+
297+
variable "vpc_service_control_attach_dry_run" {
298+
description = "Whether the project will be attached to a VPC Service Control Perimeter in Dry Run Mode. vpc_service_control_attach_enabled should be false for this to be true"
293299
type = bool
294300
default = false
295301
}

versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@ terraform {
1919
required_providers {
2020
google = {
2121
source = "hashicorp/google"
22-
version = ">= 4.28, < 6"
22+
version = ">= 5.22, < 6"
2323
}
2424
google-beta = {
2525
source = "hashicorp/google-beta"
26-
version = ">= 4.28, < 6"
26+
version = ">= 5.22, < 6"
2727
}
2828
}
2929
provider_meta "google" {

0 commit comments

Comments
 (0)