Skip to content

Commit 7ec34ef

Browse files
kwraith05kwraith05
authored
feat: Add support for attaching projects to a VPC Service Controls perimeter (#428)
1 parent 3b48a73 commit 7ec34ef

File tree

31 files changed

+430
-64
lines changed

31 files changed

+430
-64
lines changed

‎.kitchen.yml

+5
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ suites:
3232
name: terraform
3333
command_timeout: 1800
3434
root_module_directory: test/fixtures/minimal
35+
- name: vpc_sc_project
36+
driver:
37+
name: terraform
38+
command_timeout: 1800
39+
root_module_directory: test/fixtures/vpc_sc_project
3540
- name: fabric_project
3641
driver:
3742
name: terraform

‎README.md

+2
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,8 @@ determining that location is as follows:
148148
| usage\_bucket\_name | Name of a GCS bucket to store GCE usage reports in (optional) | string | `""` | no |
149149
| usage\_bucket\_prefix | Prefix in the GCS bucket to store GCE usage reports in (optional) | string | `""` | no |
150150
| use\_tf\_google\_credentials\_env\_var | Use GOOGLE_CREDENTIALS environment variable to run gcloud auth activate-service-account with. | bool | `"false"` | no |
151+
| vpc\_service\_control\_attach\_enabled | Whether the project will be attached to a VPC Service Control Perimeter | bool | `"false"` | no |
152+
| vpc\_service\_control\_perimeter\_name | The name of a VPC Service Control Perimeter to add the created project to | string | `"null"` | no |
151153

152154
## Outputs
153155

‎build/int.cloudbuild.yaml

+8-2
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,19 @@ steps:
2828
args: ['/bin/bash', '-c', 'ln -s /root/.terraform.d/plugins ~/.terraform.d/plugins && source /usr/local/bin/task_helper_functions.sh && kitchen_do create']
2929
- id: converge
3030
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
31-
args: ['/bin/bash', '-c', 'ln -s /root/.terraform.d/plugins ~/.terraform.d/plugins && source /usr/local/bin/task_helper_functions.sh && kitchen_do converge']
31+
args: ['/bin/bash', '-c', 'ln -s /root/.terraform.d/plugins ~/.terraform.d/plugins && source /usr/local/bin/task_helper_functions.sh && export TF_VAR_policy_id=$(gcloud access-context-manager policies list --organization="${TF_VAR_org_id:?}" --format="value(name)") && kitchen_do converge']
32+
env:
33+
- 'TF_VAR_org_id=$_ORG_ID'
34+
- 'TF_VAR_domain=test.infra.cft.tips.'
3235
- id: verify
3336
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
3437
args: ['/bin/bash', '-c', 'ln -s /root/.terraform.d/plugins ~/.terraform.d/plugins && source /usr/local/bin/task_helper_functions.sh && kitchen_do verify']
3538
- id: destroy
3639
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
37-
args: ['/bin/bash', '-c', 'ln -s /root/.terraform.d/plugins ~/.terraform.d/plugins && source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy']
40+
args: ['/bin/bash', '-c', 'ln -s /root/.terraform.d/plugins ~/.terraform.d/plugins && source /usr/local/bin/task_helper_functions.sh && export TF_VAR_policy_id=$(gcloud access-context-manager policies list --organization="${TF_VAR_org_id:?}" --format="value(name)") && kitchen_do destroy']
41+
env:
42+
- 'TF_VAR_org_id=$_ORG_ID'
43+
- 'TF_VAR_domain=test.infra.cft.tips.'
3844
tags:
3945
- 'ci'
4046
- 'integration'

‎examples/app_engine/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
*/
1616

1717
provider "google" {
18-
version = "~> 3.6.0"
18+
version = "~> 3.30"
1919
}
2020

2121
provider "google-beta" {
22-
version = "~> 3.6.0"
22+
version = "~> 3.30"
2323
}
2424

2525
provider "null" {

‎examples/budget_project/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
*/
1616

1717
provider "google" {
18-
version = "~> 3.6.0"
18+
version = "~> 3.30"
1919
}
2020

2121
provider "google-beta" {
22-
version = "~> 3.6.0"
22+
version = "~> 3.30"
2323
}
2424

2525
provider "null" {

‎examples/fabric_project/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
*/
1616

1717
provider "google" {
18-
version = "~> 3.6.0"
18+
version = "~> 3.30"
1919
}
2020

2121
provider "random" {

‎examples/gke_shared_vpc/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ locals {
2020

2121
provider "google" {
2222
credentials = file(local.credentials_file_path)
23-
version = "~> 3.6.0"
23+
version = "~> 3.30"
2424
}
2525

2626
provider "google-beta" {
2727
credentials = file(local.credentials_file_path)
28-
version = "~> 3.6.0"
28+
version = "~> 3.30"
2929
}
3030

3131
provider "null" {

‎examples/group_project/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,12 @@ locals {
2323
*****************************************/
2424
provider "google" {
2525
credentials = file(local.credentials_file_path)
26-
version = "~> 3.6.0"
26+
version = "~> 3.30"
2727
}
2828

2929
provider "google-beta" {
3030
credentials = file(local.credentials_file_path)
31-
version = "~> 3.6.0"
31+
version = "~> 3.30"
3232
}
3333

3434
provider "gsuite" {

‎examples/project-hierarchy/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,12 @@ locals {
2323
*****************************************/
2424
provider "google" {
2525
credentials = file(local.credentials_file_path)
26-
version = "~> 3.6.0"
26+
version = "~> 3.30"
2727
}
2828

2929
provider "google-beta" {
3030
credentials = file(local.credentials_file_path)
31-
version = "~> 3.6.0"
31+
version = "~> 3.30"
3232
}
3333

3434
provider "gsuite" {

‎examples/project_services/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
Provider configuration
1919
*****************************************/
2020
provider "google" {
21-
version = "~> 3.6.0"
21+
version = "~> 3.30"
2222
}
2323

2424
module "project-services" {

‎examples/shared_vpc/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@ locals {
2323
Provider configuration
2424
*****************************************/
2525
provider "google" {
26-
version = "~> 3.6.0"
26+
version = "~> 3.30"
2727
}
2828

2929
provider "google-beta" {
30-
version = "~> 3.6.0"
30+
version = "~> 3.30"
3131
}
3232

3333
provider "null" {

‎examples/simple_project/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,12 @@ locals {
2323
*****************************************/
2424
provider "google" {
2525
credentials = file(local.credentials_file_path)
26-
version = "~> 3.6.0"
26+
version = "~> 3.30"
2727
}
2828

2929
provider "google-beta" {
3030
credentials = file(local.credentials_file_path)
31-
version = "~> 3.6.0"
31+
version = "~> 3.30"
3232
}
3333

3434
provider "null" {

‎main.tf

+33-31
Original file line numberDiff line numberDiff line change
@@ -28,37 +28,39 @@ module "gsuite_group" {
2828
module "project-factory" {
2929
source = "./modules/core_project_factory"
3030

31-
group_email = module.gsuite_group.email
32-
group_role = var.group_role
33-
lien = var.lien
34-
manage_group = var.group_name != "" ? "true" : "false"
35-
random_project_id = var.random_project_id
36-
org_id = var.org_id
37-
name = var.name
38-
project_id = var.project_id
39-
shared_vpc = var.shared_vpc
40-
shared_vpc_enabled = var.shared_vpc != ""
41-
billing_account = var.billing_account
42-
folder_id = var.folder_id
43-
sa_role = var.sa_role
44-
activate_apis = var.activate_apis
45-
usage_bucket_name = var.usage_bucket_name
46-
usage_bucket_prefix = var.usage_bucket_prefix
47-
credentials_path = var.credentials_path
48-
impersonate_service_account = var.impersonate_service_account
49-
shared_vpc_subnets = var.shared_vpc_subnets
50-
labels = var.labels
51-
bucket_project = var.bucket_project
52-
bucket_name = var.bucket_name
53-
bucket_location = var.bucket_location
54-
auto_create_network = var.auto_create_network
55-
disable_services_on_destroy = var.disable_services_on_destroy
56-
default_service_account = var.default_service_account
57-
disable_dependent_services = var.disable_dependent_services
58-
python_interpreter_path = var.python_interpreter_path
59-
pip_executable_path = var.pip_executable_path
60-
use_tf_google_credentials_env_var = var.use_tf_google_credentials_env_var
61-
skip_gcloud_download = var.skip_gcloud_download
31+
group_email = module.gsuite_group.email
32+
group_role = var.group_role
33+
lien = var.lien
34+
manage_group = var.group_name != "" ? "true" : "false"
35+
random_project_id = var.random_project_id
36+
org_id = var.org_id
37+
name = var.name
38+
project_id = var.project_id
39+
shared_vpc = var.shared_vpc
40+
shared_vpc_enabled = var.shared_vpc != ""
41+
billing_account = var.billing_account
42+
folder_id = var.folder_id
43+
sa_role = var.sa_role
44+
activate_apis = var.activate_apis
45+
usage_bucket_name = var.usage_bucket_name
46+
usage_bucket_prefix = var.usage_bucket_prefix
47+
credentials_path = var.credentials_path
48+
impersonate_service_account = var.impersonate_service_account
49+
shared_vpc_subnets = var.shared_vpc_subnets
50+
labels = var.labels
51+
bucket_project = var.bucket_project
52+
bucket_name = var.bucket_name
53+
bucket_location = var.bucket_location
54+
auto_create_network = var.auto_create_network
55+
disable_services_on_destroy = var.disable_services_on_destroy
56+
default_service_account = var.default_service_account
57+
disable_dependent_services = var.disable_dependent_services
58+
python_interpreter_path = var.python_interpreter_path
59+
pip_executable_path = var.pip_executable_path
60+
use_tf_google_credentials_env_var = var.use_tf_google_credentials_env_var
61+
skip_gcloud_download = var.skip_gcloud_download
62+
vpc_service_control_attach_enabled = var.vpc_service_control_attach_enabled
63+
vpc_service_control_perimeter_name = var.vpc_service_control_perimeter_name
6264
}
6365

6466
/******************************************

‎modules/core_project_factory/main.tf

+18
Original file line numberDiff line numberDiff line change
@@ -471,3 +471,21 @@ resource "google_project_iam_member" "gke_host_agent" {
471471
module.project_services,
472472
]
473473
}
474+
475+
/******************************************
476+
Attachment to VPC Service Control Perimeter
477+
*****************************************/
478+
resource "google_access_context_manager_service_perimeter_resource" "service_perimeter_attachment" {
479+
count = var.vpc_service_control_attach_enabled ? 1 : 0
480+
perimeter_name = var.vpc_service_control_perimeter_name
481+
resource = "projects/${google_project.main.number}"
482+
}
483+
484+
/******************************************
485+
Enable Access Context Manager API
486+
*****************************************/
487+
resource "google_project_service" "enable_access_context_manager" {
488+
count = var.vpc_service_control_attach_enabled ? 1 : 0
489+
project = google_project.main.number
490+
service = "accesscontextmanager.googleapis.com"
491+
}

‎modules/core_project_factory/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -195,3 +195,15 @@ variable "skip_gcloud_download" {
195195
type = bool
196196
default = false
197197
}
198+
199+
variable "vpc_service_control_attach_enabled" {
200+
description = "Whether the project will be attached to a VPC Service Control Perimeter"
201+
type = bool
202+
default = false
203+
}
204+
205+
variable "vpc_service_control_perimeter_name" {
206+
description = "The name of a VPC Service Control Perimeter to add the created project to"
207+
type = string
208+
default = null
209+
}

‎modules/core_project_factory/versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ terraform {
1818
required_version = "~> 0.12.6"
1919

2020
required_providers {
21-
google = ">= 2.1, < 4.0"
22-
google-beta = ">= 2.1, < 4.0"
21+
google = ">= 3.8, < 4.0"
22+
google-beta = ">= 3.8, < 4.0"
2323
null = "~> 2.1"
2424
random = "~> 2.2"
2525
}

‎test/fixtures/full/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
*/
1616

1717
provider "google" {
18-
version = "~> 3.6.0"
18+
version = "~> 3.30"
1919
}
2020

2121
provider "google-beta" {
22-
version = "~> 3.6.0"
22+
version = "~> 3.30"
2323
}
2424

2525
provider "gsuite" {

‎test/fixtures/minimal/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
*/
1616

1717
provider "google" {
18-
version = "~> 3.6.0"
18+
version = "~> 3.30"
1919
}
2020

2121
provider "google-beta" {
22-
version = "~> 3.6.0"
22+
version = "~> 3.30"
2323
}
2424

2525
provider "null" {

‎test/fixtures/shared_vpc_no_subnets/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
*/
1616

1717
provider "google" {
18-
version = "~> 3.6.0"
18+
version = "~> 3.30"
1919
}
2020

2121
provider "google-beta" {
22-
version = "~> 3.6.0"
22+
version = "~> 3.30"
2323
}
2424

2525
provider "gsuite" {

‎test/fixtures/vpc_sc_project/.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
terraform.tfvars

0 commit comments

Comments
 (0)