Skip to content

Commit 5a9a7b7

Browse files
committed
feat: vpc user to run/functions + soft deletion policy
1 parent ac03859 commit 5a9a7b7

File tree

6 files changed

+53
-4
lines changed

6 files changed

+53
-4
lines changed

README.md

+1
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ determining that location is as follows:
157157
| random\_project\_id\_length | Sets the length of `random_project_id` to the provided length, and uses a `random_string` for a larger collusion domain. Recommended for use with CI. | `number` | `null` | no |
158158
| sa\_role | A role to give the default Service Account for the project (defaults to none) | `string` | `""` | no |
159159
| shared\_vpc\_subnets | List of subnets fully qualified subnet IDs (ie. projects/$project\_id/regions/$region/subnetworks/$subnet\_id) | `list(string)` | `[]` | no |
160+
| soft\_delete\_policy | Soft delete policies to apply | <pre>object({<br> retention_duration_seconds = optional(number)<br> })</pre> | `{}` | no |
160161
| svpc\_host\_project\_id | The ID of the host project which hosts the shared VPC | `string` | `""` | no |
161162
| tag\_binding\_values | Tag values to bind the project to. | `list(string)` | `[]` | no |
162163
| usage\_bucket\_name | Name of a GCS bucket to store GCE usage reports in (optional) | `string` | `""` | no |

main.tf

+1
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ module "project-factory" {
6060
bucket_force_destroy = var.bucket_force_destroy
6161
bucket_ula = var.bucket_ula
6262
bucket_pap = var.bucket_pap
63+
soft_delete_policy = var.soft_delete_policy
6364
auto_create_network = var.auto_create_network
6465
disable_services_on_destroy = var.disable_services_on_destroy
6566
default_service_account = var.default_service_account

modules/core_project_factory/main.tf

+7
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,13 @@ resource "google_storage_bucket" "project_bucket" {
302302
uniform_bucket_level_access = var.bucket_ula
303303
public_access_prevention = var.bucket_pap
304304

305+
dynamic "soft_delete_policy" {
306+
for_each = var.soft_delete_policy == {} ? [] : [var.soft_delete_policy]
307+
content {
308+
retention_duration_seconds = lookup(soft_delete_policy.value, "retention_duration_seconds", null)
309+
}
310+
}
311+
305312
versioning {
306313
enabled = var.bucket_versioning
307314
}

modules/core_project_factory/variables.tf

+8
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,14 @@ variable "bucket_pap" {
194194
default = "inherited"
195195
}
196196

197+
variable "soft_delete_policy" {
198+
description = "Soft delete policies to apply"
199+
type = object({
200+
retention_duration_seconds = optional(number)
201+
})
202+
default = {}
203+
}
204+
197205
variable "auto_create_network" {
198206
description = "Create the default network"
199207
type = bool

modules/shared_vpc_access/main.tf

+28-4
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,12 @@ locals {
3131
"notebooks.googleapis.com" : format("service-%s@gcp-sa-notebooks.iam.gserviceaccount.com", local.service_project_number)
3232
"networkconnectivity.googleapis.com" : format("service-%s@gcp-sa-networkconnectivity.iam.gserviceaccount.com", local.service_project_number)
3333
}
34-
gke_shared_vpc_enabled = contains(var.active_apis, "container.googleapis.com")
35-
composer_shared_vpc_enabled = contains(var.active_apis, "composer.googleapis.com")
36-
datastream_shared_vpc_enabled = contains(var.active_apis, "datastream.googleapis.com")
37-
active_apis = [for api in keys(local.apis) : api if contains(var.active_apis, api)]
34+
gke_shared_vpc_enabled = contains(var.active_apis, "container.googleapis.com")
35+
composer_shared_vpc_enabled = contains(var.active_apis, "composer.googleapis.com")
36+
datastream_shared_vpc_enabled = contains(var.active_apis, "datastream.googleapis.com")
37+
run_vpc_serverless_enabled = contains(var.active_apis, "vpcaccess.googleapis.com") && contains(var.active_apis, "run.googleapis.com")
38+
functions_vpc_serverless_enabled = contains(var.active_apis, "vpcaccess.googleapis.com") && contains(var.active_apis, "cloudfunctions.googleapis.com")
39+
active_apis = [for api in keys(local.apis) : api if contains(var.active_apis, api)]
3840
# Can't use setproduct due to https://github.com/terraform-google-modules/terraform-google-project-factory/issues/635
3941
subnetwork_api = length(var.shared_vpc_subnets) != 0 ? flatten([
4042
for i, api in local.active_apis : [for i, subnet in var.shared_vpc_subnets : "${api},${subnet}"]
@@ -146,6 +148,28 @@ resource "google_project_iam_member" "gke_security_admin" {
146148
member = format("serviceAccount:%s", local.apis["container.googleapis.com"])
147149
}
148150

151+
/******************************************
152+
roles/vpcaccess.user role granted to Cloud Run Service Agent for Run on shared VPC host project
153+
See: https://cloud.google.com/run/docs/configuring/shared-vpc-host-project
154+
*****************************************/
155+
resource "google_project_iam_member" "cloud_run_vpc_access" {
156+
count = local.run_vpc_serverless_enabled ? 1 : 0
157+
project = var.host_project_id
158+
role = "roles/vpcaccess.user"
159+
member = format("serviceAccount:service-%s@serverless-robot-prod.iam.gserviceaccount.com", local.service_project_number)
160+
}
161+
162+
/******************************************
163+
roles/vpcaccess.user role granted to Cloud Functions Service Agent for Functions on shared VPC host project
164+
See: https://cloud.google.com/functions/docs/networking/shared-vpc-host-project
165+
*****************************************/
166+
resource "google_project_iam_member" "functions_run_vpc_access" {
167+
count = local.functions_vpc_serverless_enabled ? 1 : 0
168+
project = var.host_project_id
169+
role = "roles/vpcaccess.user"
170+
member = format("serviceAccount:service-%s@gcf-admin-robot.iam.gserviceaccount.com", local.service_project_number)
171+
}
172+
149173
/******************************************
150174
roles/compute.networkAdmin role granted to Datastream's service account for datastream connectivity configuration on shared VPC host project
151175
See: https://cloud.google.com/datastream/docs/create-a-private-connectivity-configuration

variables.tf

+8
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,14 @@ variable "bucket_pap" {
194194
default = "inherited"
195195
}
196196

197+
variable "soft_delete_policy" {
198+
description = "Soft delete policies to apply"
199+
type = object({
200+
retention_duration_seconds = optional(number)
201+
})
202+
default = {}
203+
}
204+
197205
variable "auto_create_network" {
198206
description = "Create the default network"
199207
type = bool

0 commit comments

Comments
 (0)