Skip to content

Commit 9652b15

Browse files
morgantemorgante
authored
Merge branch 'master' into feat/add-pre-commit
2 parents 1754dd0 + a7037c4 commit 9652b15

File tree

21 files changed

+523
-26
lines changed

21 files changed

+523
-26
lines changed

‎.kitchen.yml

+17
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,20 @@ suites:
3838
name: terraform
3939
command_timeout: 1800
4040
root_module_directory: test/fixtures/minimal
41+
42+
- name: "shared_vpc_no_subnets"
43+
driver:
44+
name: "terraform"
45+
command_timeout: 1800
46+
root_module_directory: test/fixtures/shared_vpc_no_subnets/
47+
verifier:
48+
name: terraform
49+
systems:
50+
- name: inspec-gcp
51+
backend: gcp
52+
controls:
53+
- gcp
54+
- name: local
55+
backend: local
56+
controls:
57+
- gcloud

‎CHANGELOG.md

+29-1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,27 @@ Extending the adopted spec, each change should have a link to its corresponding
88

99
## [Unreleased]
1010

11+
## [2.1.3] - 2019-04-03
12+
13+
### Fixed
14+
15+
- Unconditional check for optional
16+
`resourcemanager.organization.get` permission in preconditions script.
17+
[#178]
18+
- The `project_id` output depends on project service activation. [#180]
19+
20+
## [2.1.2] - 2019-04-01
21+
22+
### Fixed
23+
24+
- Error when verifying billing account permissions [#175]
25+
26+
## [2.1.1] - 2019-03-25
27+
28+
### Fixed
29+
30+
- Removed requirement of `roles/resourcemanager.organizationViewer` when `var.domain` is provided. [#172]
31+
1132
## [2.1.0] - 2019-03-11
1233

1334
### ADDED
@@ -91,7 +112,10 @@ Extending the adopted spec, each change should have a link to its corresponding
91112
### ADDED
92113
- This is the initial release of the Project Factory Module.
93114

94-
[Unreleased]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v2.1.0...HEAD
115+
[Unreleased]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v2.1.3...HEAD
116+
[2.1.3]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v2.1.2...v2.1.3
117+
[2.1.2]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v2.1.1...v2.1.2
118+
[2.1.1]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v2.1.0...v2.1.1
95119
[2.1.0]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v2.0.0...v2.1.0
96120
[2.0.0]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v1.2.0...v2.0.0
97121
[1.2.0]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v1.1.2...v1.2.0
@@ -105,6 +129,10 @@ Extending the adopted spec, each change should have a link to its corresponding
105129
[0.2.1]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v0.2.0...v0.2.1
106130
[0.2.0]: https://github.com/terraform-google-modules/terraform-google-project-factory/compare/v0.1.0...v0.2.0
107131

132+
[#180]: https://github.com/terraform-google-modules/terraform-google-project-factory/pull/180
133+
[#178]: https://github.com/terraform-google-modules/terraform-google-project-factory/pull/178
134+
[#175]: https://github.com/terraform-google-modules/terraform-google-project-factory/pull/175
135+
[#172]: https://github.com/terraform-google-modules/terraform-google-project-factory/pull/172
108136
[#164]: https://github.com/terraform-google-modules/terraform-google-project-factory/pull/164
109137
[#154]: https://github.com/terraform-google-modules/terraform-google-project-factory/pull/154
110138
[#153]: https://github.com/terraform-google-modules/terraform-google-project-factory/pull/153

‎examples/shared_vpc/README.md

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Shared VPC Host Project
2+
3+
This example illustrates how to create a [Shared VPC](https://cloud.google.com/vpc/docs/shared-vpc) host project.
4+
5+
It includes creating the host project and using the [network module](https://github.com/terraform-google-modules/terraform-google-network) to create network.
6+
7+
[^]: (autogen_docs_start)
8+
9+
## Inputs
10+
11+
| Name | Description | Type | Default | Required |
12+
|------|-------------|:----:|:-----:|:-----:|
13+
| billing\_account | The ID of the billing account to associate this project with | string | - | yes |
14+
| credentials\_path | Path to a Service Account credentials file with permissions documented in the readme | string | - | yes |
15+
| host\_project\_name | Name for Shared VPC host project | string | `shared-vpc-host` | no |
16+
| network\_name | Name for Shared VPC network | string | `shared-network` | no |
17+
| organization\_id | The organization id for the associated services | string | - | yes |
18+
19+
## Outputs
20+
21+
| Name | Description |
22+
|------|-------------|
23+
| host\_project\_id | The ID of the created project |
24+
| network\_name | The name of the VPC being created |
25+
| network\_self\_link | The URI of the VPC being created |
26+
27+
[^]: (autogen_docs_end)

‎examples/shared_vpc/main.tf

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
credentials_file_path = "${var.credentials_path}"
19+
subnet_01 = "${var.network_name}-subnet-01"
20+
subnet_02 = "${var.network_name}-subnet-02"
21+
}
22+
23+
/******************************************
24+
Provider configuration
25+
*****************************************/
26+
provider "google" {
27+
credentials = "${file(local.credentials_file_path)}"
28+
version = "~> 1.19"
29+
}
30+
31+
provider "google-beta" {
32+
credentials = "${file(local.credentials_file_path)}"
33+
version = "~> 1.19"
34+
}
35+
36+
/******************************************
37+
Host Project Creation
38+
*****************************************/
39+
module "host-project" {
40+
source = "../../"
41+
random_project_id = "true"
42+
name = "${var.host_project_name}"
43+
org_id = "${var.organization_id}"
44+
billing_account = "${var.billing_account}"
45+
credentials_path = "${local.credentials_file_path}"
46+
}
47+
48+
/******************************************
49+
Network Creation
50+
*****************************************/
51+
module "vpc" {
52+
source = "terraform-google-modules/network/google"
53+
version = "0.6.0"
54+
55+
project_id = "${module.host-project.project_id}"
56+
network_name = "${var.network_name}"
57+
58+
delete_default_internet_gateway_routes = "true"
59+
shared_vpc_host = "true"
60+
61+
subnets = [
62+
{
63+
subnet_name = "${local.subnet_01}"
64+
subnet_ip = "10.10.10.0/24"
65+
subnet_region = "us-west1"
66+
},
67+
{
68+
subnet_name = "${local.subnet_02}"
69+
subnet_ip = "10.10.20.0/24"
70+
subnet_region = "us-west1"
71+
subnet_private_access = "true"
72+
subnet_flow_logs = "true"
73+
},
74+
]
75+
76+
secondary_ranges = {
77+
"${local.subnet_01}" = []
78+
"${local.subnet_02}" = []
79+
}
80+
}

‎examples/shared_vpc/outputs.tf

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "host_project_id" {
18+
value = "${module.host-project.project_id}"
19+
description = "The ID of the created project"
20+
}
21+
22+
output "network_name" {
23+
value = "${module.vpc.network_name}"
24+
description = "The name of the VPC being created"
25+
}
26+
27+
output "network_self_link" {
28+
value = "${module.vpc.network_self_link}"
29+
description = "The URI of the VPC being created"
30+
}

‎examples/shared_vpc/variables.tf

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "organization_id" {
18+
description = "The organization id for the associated services"
19+
}
20+
21+
variable "billing_account" {
22+
description = "The ID of the billing account to associate this project with"
23+
}
24+
25+
variable "credentials_path" {
26+
description = "Path to a Service Account credentials file with permissions documented in the readme"
27+
}
28+
29+
variable "host_project_name" {
30+
description = "Name for Shared VPC host project"
31+
default = "shared-vpc-host"
32+
}
33+
34+
variable "network_name" {
35+
description = "Name for Shared VPC network"
36+
default = "shared-network"
37+
}

‎modules/core_project_factory/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ output "project_name" {
1919
}
2020

2121
output "project_id" {
22-
value = "${google_project.main.project_id}"
22+
value = "${element(concat(google_project_service.project_services.*.project, list(google_project.main.project_id)), 0)}"
2323
}
2424

2525
output "project_number" {

‎modules/core_project_factory/scripts/preconditions/preconditions.py

+15-12
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,7 @@ def asdict(self):
7171

7272
class OrgPermissions:
7373
# Permissions that the service account must have for any organization
74-
ALL_PERMISSIONS = [
75-
# Typically granted with `roles/resourcemanager.organizationViewer`
76-
"resourcemanager.organizations.get",
77-
]
74+
ALL_PERMISSIONS = []
7875

7976
# Permissions required when the service account is attaching a new project
8077
# to a shared VPC
@@ -115,14 +112,23 @@ def __init__(self, org_id, shared_vpc=False, parent=False):
115112
self.permissions += self.PARENT_PERMISSIONS
116113

117114
def validate(self, credentials):
115+
body = {"permissions": self.permissions}
116+
resource = "organizations/" + self.org_id
117+
118+
# no permissions to validate
119+
if len(self.permissions) == 0:
120+
return {
121+
"type": "Service account permissions on organization",
122+
"name": resource,
123+
"satisfied": [],
124+
"unsatisfied": []
125+
}
126+
118127
service = discovery.build(
119128
'cloudresourcemanager', 'v1',
120129
credentials=credentials
121130
)
122131

123-
body = {"permissions": self.permissions}
124-
resource = "organizations/" + self.org_id
125-
126132
request = service.organizations().testIamPermissions(
127133
resource=resource,
128134
body=body)
@@ -286,16 +292,13 @@ def validate(self, credentials):
286292
request = service.billingAccounts().testIamPermissions(
287293
resource=resource,
288294
body=body)
289-
try:
290-
response = request.execute()
291-
except errors.HttpError:
292-
response = {"permissions": []}
295+
response = request.execute()
293296

294297
req = Requirements(
295298
"Service account permissions on billing account",
296299
resource,
297300
self.REQUIRED_PERMISSIONS,
298-
response["permissions"],
301+
response.get("permissions", []),
299302
)
300303

301304
return req.asdict()

‎modules/gsuite_group/main.tf

+4-2
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,15 @@
1515
*/
1616

1717
locals {
18-
domain = "${var.domain != "" ? var.domain : data.google_organization.org.domain}"
19-
email = "${format("%s@%s", var.name, local.domain)}"
18+
domain_list = "${concat(data.google_organization.org.*.domain, list("dummy"))}"
19+
domain = "${var.domain == "" ? element(local.domain_list, 0) : var.domain}"
20+
email = "${format("%s@%s", var.name, local.domain)}"
2021
}
2122

2223
/*****************************************
2324
Organization info retrieval
2425
*****************************************/
2526
data "google_organization" "org" {
27+
count = "${var.domain == "" ? 1 : 0}"
2628
organization = "${var.org_id}"
2729
}

‎test/fixtures/full/extra_outputs.tf

+8
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,11 @@
1717
output "extra_service_account_email" {
1818
value = "${google_service_account.extra_service_account.email}"
1919
}
20+
21+
output "shared_vpc_subnet_name" {
22+
value = "${local.shared_vpc_subnet_name}"
23+
}
24+
25+
output "shared_vpc_subnet_region" {
26+
value = "${local.shared_vpc_subnet_region}"
27+
}

‎test/fixtures/full/main.tf

+4-2
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,10 @@ provider "gsuite" {
3737
}
3838

3939
locals {
40-
shared_vpc_subnets = ["projects/${var.shared_vpc}/regions/${module.vpc.subnets_regions[0]}/subnetworks/${module.vpc.subnets_names[0]}"]
41-
subnet_name = "pf-test-subnet-${var.random_string_for_testing}"
40+
subnet_name = "pf-test-subnet-${var.random_string_for_testing}"
41+
shared_vpc_subnet_name = "${module.vpc.subnets_names[0]}"
42+
shared_vpc_subnet_region = "${module.vpc.subnets_regions[0]}"
43+
shared_vpc_subnets = ["projects/${var.shared_vpc}/regions/${local.shared_vpc_subnet_region}/subnetworks/${local.shared_vpc_subnet_name}"]
4244
}
4345

4446
module "vpc" {

‎test/fixtures/shared_vpc_no_subnets/extra_variables.tf

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "credentials_path" {
18+
description = "Path to a service account credentials file with rights to run the Project Factory."
19+
default = ""
20+
}

0 commit comments

Comments
 (0)