Skip to content

Commit e4c9b03

Browse files
bharathkkbbharathkkb
authored
fix: remove unused vars, add upgrade guide (#596)
BREAKING CHANGE: Some unused variables were removed. See the upgrade guide for details. BREAKING CHANGE: Buckets now enable uniform bucket-level access by default. See the upgrade guide for details.
1 parent 64461a2 commit e4c9b03

File tree

24 files changed

+41
-121
lines changed

24 files changed

+41
-121
lines changed

‎README.md

-2
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,6 @@ determining that location is as follows:
126126
| budget\_monitoring\_notification\_channels | A list of monitoring notification channels in the form `[projects/{project_id}/notificationChannels/{channel_id}]`. A maximum of 5 channels are allowed. | `list(string)` | `[]` | no |
127127
| consumer\_quotas | The quotas configuration you want to override for the project. | <pre>list(object({<br> service = string,<br> metric = string,<br> limit = string,<br> value = string,<br> }))</pre> | `[]` | no |
128128
| create\_project\_sa | Whether the default service account for the project shall be created | `bool` | `true` | no |
129-
| credentials\_path | Path to a service account credentials file with rights to run the Project Factory. If this file is absent Terraform will fall back to Application Default Credentials. | `string` | `""` | no |
130129
| default\_service\_account | Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`. | `string` | `"disable"` | no |
131130
| disable\_dependent\_services | Whether services that are enabled and which depend on this service should also be disabled when this service is destroyed. | `bool` | `true` | no |
132131
| disable\_services\_on\_destroy | Whether project services will be disabled when the resources are destroyed | `bool` | `true` | no |
@@ -136,7 +135,6 @@ determining that location is as follows:
136135
| grant\_services\_security\_admin\_role | Whether or not to grant Kubernetes Engine Service Agent the Security Admin role on the host project so it can manage firewall rules | `bool` | `false` | no |
137136
| group\_name | A group to control the project by being assigned group\_role (defaults to project editor) | `string` | `""` | no |
138137
| group\_role | The role to give the controlling group (group\_name) over the project (defaults to project editor) | `string` | `"roles/editor"` | no |
139-
| impersonate\_service\_account | An optional service account to impersonate. This cannot be used with credentials\_path. If this service account is not specified and credentials\_path is absent, the module will use Application Default Credentials. | `string` | `""` | no |
140138
| labels | Map of labels for project | `map(string)` | `{}` | no |
141139
| lien | Add a lien on the project to prevent accidental deletion | `bool` | `false` | no |
142140
| name | The name for the project | `string` | n/a | yes |

‎docs/upgrading_to_project_factory_v11.0.md

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Upgrading to Project Factory v11.0
2+
3+
The v11.0 release of Project Factory is a backwards incompatible release.
4+
5+
## Migration Instructions
6+
7+
### Unused variables have been removed
8+
9+
Variables `credentials_path` and `impersonate_service_account` have been removed as we have removed the need for gcloud and local-execs in [v10.0](https://github.com/terraform-google-modules/terraform-google-project-factory/blob/master/docs/upgrading_to_project_factory_v10.0.md). This change should be no-op.
10+
11+
```diff
12+
module "project-factory" {
13+
source = "terraform-google-modules/project-factory/google"
14+
- version = "~> 10.0"
15+
+ version = "~> 11.0"
16+
17+
name = "pf-test-1"
18+
random_project_id = "true"
19+
org_id = "1234567890"
20+
usage_bucket_name = "pf-test-1-usage-report-bucket"
21+
usage_bucket_prefix = "pf/test/1/integration"
22+
billing_account = "ABCDEF-ABCDEF-ABCDEF"
23+
- credentials_path = "..."
24+
- impersonate_service_account = "..."
25+
}
26+
```
27+
28+
### Uniform Bucket Level Access is enabled by default
29+
30+
Uniform Bucket Level Access is enabled by default and controlled by the `bucket_ula` variable.
31+
32+
If you want to keep Uniform Bucket Level Access disabled, this variable should be set to false.

‎examples/gke_shared_vpc/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ More information about GKE with Shared VPC can be found here: https://cloud.goog
2929
| Name | Description | Type | Default | Required |
3030
|------|-------------|------|---------|:--------:|
3131
| billing\_account | billing account | `any` | n/a | yes |
32-
| credentials\_path | Path to a Service Account credentials file with permissions documented in the readme | `any` | n/a | yes |
3332
| org\_id | organization id | `any` | n/a | yes |
3433
| shared\_vpc | The ID of the host project which hosts the shared VPC | `any` | n/a | yes |
3534
| shared\_vpc\_subnets | List of subnets fully qualified subnet IDs (ie. projects/$PROJECT\_ID/regions/$REGION/subnetworks/$SUBNET\_ID) | `list(string)` | `[]` | no |

‎examples/gke_shared_vpc/main.tf

+2-9
Original file line numberDiff line numberDiff line change
@@ -14,18 +14,12 @@
1414
* limitations under the License.
1515
*/
1616

17-
locals {
18-
credentials_file_path = var.credentials_path
19-
}
20-
2117
provider "google" {
22-
credentials = file(local.credentials_file_path)
23-
version = "~> 3.30"
18+
version = "~> 3.30"
2419
}
2520

2621
provider "google-beta" {
27-
credentials = file(local.credentials_file_path)
28-
version = "~> 3.30"
22+
version = "~> 3.30"
2923
}
3024

3125
provider "null" {
@@ -44,6 +38,5 @@ module "project-factory" {
4438
billing_account = var.billing_account
4539
svpc_host_project_id = var.shared_vpc
4640
activate_apis = ["compute.googleapis.com", "container.googleapis.com", "cloudbilling.googleapis.com"]
47-
credentials_path = local.credentials_file_path
4841
shared_vpc_subnets = var.shared_vpc_subnets
4942
}

‎examples/gke_shared_vpc/variables.tf

-4
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,6 @@
1414
* limitations under the License.
1515
*/
1616

17-
variable "credentials_path" {
18-
description = "Path to a Service Account credentials file with permissions documented in the readme"
19-
}
20-
2117
variable "org_id" {
2218
description = "organization id"
2319
}

‎examples/group_project/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ Expected variables:
2222
| admin\_email | Admin user email on Gsuite. This should be a user account, not a service account. | `any` | n/a | yes |
2323
| api\_sa\_group | An existing G Suite group email to place the Google APIs Service Account for the project in | `any` | n/a | yes |
2424
| billing\_account | The ID of the billing account to associate this project with | `any` | n/a | yes |
25-
| credentials\_file\_path | Service account json auth path | `any` | n/a | yes |
2625
| organization\_id | The organization id for the associated services | `any` | n/a | yes |
2726
| project\_group\_name | The name of a G Suite group to create for controlling the project | `any` | n/a | yes |
2827

‎examples/group_project/main.tf

+2-10
Original file line numberDiff line numberDiff line change
@@ -14,25 +14,18 @@
1414
* limitations under the License.
1515
*/
1616

17-
locals {
18-
credentials_file_path = var.credentials_file_path
19-
}
20-
2117
/******************************************
2218
Provider configuration
2319
*****************************************/
2420
provider "google" {
25-
credentials = file(local.credentials_file_path)
26-
version = "~> 3.30"
21+
version = "~> 3.30"
2722
}
2823

2924
provider "google-beta" {
30-
credentials = file(local.credentials_file_path)
31-
version = "~> 3.30"
25+
version = "~> 3.30"
3226
}
3327

3428
provider "gsuite" {
35-
credentials = file(local.credentials_file_path)
3629
impersonated_user_email = var.admin_email
3730

3831
oauth_scopes = [
@@ -57,7 +50,6 @@ module "project-factory" {
5750
name = "group-sample-project"
5851
org_id = var.organization_id
5952
billing_account = var.billing_account
60-
credentials_path = local.credentials_file_path
6153
create_group = true
6254
group_name = var.project_group_name
6355
api_sa_group = var.api_sa_group

‎examples/group_project/variables.tf

-4
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,6 @@ variable "admin_email" {
1818
description = "Admin user email on Gsuite. This should be a user account, not a service account."
1919
}
2020

21-
variable "credentials_file_path" {
22-
description = "Service account json auth path"
23-
}
24-
2521
variable "organization_id" {
2622
description = "The organization id for the associated services"
2723
}

‎examples/project-hierarchy/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ Expected variables:
2727
|------|-------------|------|---------|:--------:|
2828
| admin\_email | Admin user email on Gsuite | `any` | n/a | yes |
2929
| billing\_account | The ID of the billing account to associate this project with | `any` | n/a | yes |
30-
| credentials\_path | Path to a service account credentials file with rights to run the Project Factory. If this file is absent Terraform will fall back to Application Default Credentials. | `string` | `""` | no |
3130
| organization\_id | The organization id for the associated services | `any` | n/a | yes |
3231

3332
## Outputs

‎examples/project-hierarchy/main.tf

+2-11
Original file line numberDiff line numberDiff line change
@@ -14,25 +14,18 @@
1414
* limitations under the License.
1515
*/
1616

17-
locals {
18-
credentials_file_path = var.credentials_path
19-
}
20-
2117
/******************************************
2218
Provider configuration
2319
*****************************************/
2420
provider "google" {
25-
credentials = file(local.credentials_file_path)
26-
version = "~> 3.30"
21+
version = "~> 3.30"
2722
}
2823

2924
provider "google-beta" {
30-
credentials = file(local.credentials_file_path)
31-
version = "~> 3.30"
25+
version = "~> 3.30"
3226
}
3327

3428
provider "gsuite" {
35-
credentials = file(local.credentials_file_path)
3629
impersonated_user_email = var.admin_email
3730

3831
oauth_scopes = [
@@ -63,7 +56,6 @@ module "project-prod-gke" {
6356
org_id = var.organization_id
6457
billing_account = var.billing_account
6558
folder_id = google_folder.prod.id
66-
credentials_path = local.credentials_file_path
6759
}
6860

6961
module "project-factory" {
@@ -73,5 +65,4 @@ module "project-factory" {
7365
org_id = var.organization_id
7466
billing_account = var.billing_account
7567
folder_id = google_folder.prod.id
76-
credentials_path = local.credentials_file_path
7768
}

‎examples/project-hierarchy/variables.tf

-5
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,3 @@ variable "billing_account" {
2626
description = "The ID of the billing account to associate this project with"
2727
}
2828

29-
variable "credentials_path" {
30-
description = "Path to a service account credentials file with rights to run the Project Factory. If this file is absent Terraform will fall back to Application Default Credentials."
31-
default = ""
32-
}
33-

‎examples/simple_project/README.md

-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ Expected variables:
1414
| Name | Description | Type | Default | Required |
1515
|------|-------------|------|---------|:--------:|
1616
| billing\_account | The ID of the billing account to associate this project with | `any` | n/a | yes |
17-
| credentials\_path | Path to a service account credentials file with rights to run the Project Factory. If this file is absent Terraform will fall back to Application Default Credentials. | `string` | `""` | no |
1817
| organization\_id | The organization id for the associated services | `any` | n/a | yes |
1918

2019
## Outputs

‎examples/simple_project/main.tf

+2-9
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,15 @@
1414
* limitations under the License.
1515
*/
1616

17-
locals {
18-
credentials_file_path = var.credentials_path
19-
}
20-
2117
/******************************************
2218
Provider configuration
2319
*****************************************/
2420
provider "google" {
25-
credentials = file(local.credentials_file_path)
26-
version = "~> 3.30"
21+
version = "~> 3.30"
2722
}
2823

2924
provider "google-beta" {
30-
credentials = file(local.credentials_file_path)
31-
version = "~> 3.38"
25+
version = "~> 3.38"
3226
}
3327

3428
provider "null" {
@@ -45,7 +39,6 @@ module "project-factory" {
4539
name = "simple-sample-project"
4640
org_id = var.organization_id
4741
billing_account = var.billing_account
48-
credentials_path = local.credentials_file_path
4942
default_service_account = "deprivilege"
5043

5144
activate_api_identities = [{

‎examples/simple_project/variables.tf

-5
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,3 @@ variable "organization_id" {
2121
variable "billing_account" {
2222
description = "The ID of the billing account to associate this project with"
2323
}
24-
25-
variable "credentials_path" {
26-
description = "Path to a service account credentials file with rights to run the Project Factory. If this file is absent Terraform will fall back to Application Default Credentials."
27-
default = ""
28-
}

‎main.tf

-2
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,6 @@ module "project-factory" {
4848
activate_api_identities = var.activate_api_identities
4949
usage_bucket_name = var.usage_bucket_name
5050
usage_bucket_prefix = var.usage_bucket_prefix
51-
credentials_path = var.credentials_path
52-
impersonate_service_account = var.impersonate_service_account
5351
shared_vpc_subnets = var.shared_vpc_subnets
5452
labels = var.labels
5553
bucket_project = var.bucket_project

‎modules/core_project_factory/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ locals {
4242
"%s@cloudservices.gserviceaccount.com",
4343
google_project.main.number,
4444
)
45-
activate_apis = var.impersonate_service_account != "" ? concat(var.activate_apis, ["iamcredentials.googleapis.com"]) : var.activate_apis
45+
activate_apis = var.activate_apis
4646
api_s_account_fmt = format("serviceAccount:%s", local.api_s_account)
4747
project_bucket_name = var.bucket_name != "" ? var.bucket_name : format("%s-state", local.temp_project_id)
4848
create_bucket = var.bucket_project != "" ? true : false

‎modules/core_project_factory/variables.tf

-12
Original file line numberDiff line numberDiff line change
@@ -127,18 +127,6 @@ variable "usage_bucket_prefix" {
127127
default = ""
128128
}
129129

130-
variable "credentials_path" {
131-
description = "Path to a service account credentials file with rights to run the Project Factory. If this file is absent Terraform will fall back to Application Default Credentials."
132-
type = string
133-
default = ""
134-
}
135-
136-
variable "impersonate_service_account" {
137-
description = "An optional service account to impersonate. If this service account is not specified, Terraform will fall back to credential file or Application Default Credentials."
138-
type = string
139-
default = ""
140-
}
141-
142130
variable "shared_vpc_subnets" {
143131
description = "List of subnets fully qualified subnet IDs (ie. projects/$project_id/regions/$region/subnetworks/$subnet_id)"
144132
type = list(string)

‎modules/gsuite_enabled/README.md

-3
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ module "project-factory" {
1414
1515
billing_account = "ABCDEF-ABCDEF-ABCDEF"
1616
create_group = true
17-
credentials_path = "${local.credentials_file_path}"
1817
group_name = "test_sa_group"
1918
group_role = "roles/editor"
2019
name = "pf-test-1"
@@ -73,7 +72,6 @@ The roles granted are specifically:
7372
| consumer\_quotas | The quotas configuration you want to override for the project. | <pre>list(object({<br> service = string,<br> metric = string,<br> limit = string,<br> value = string,<br> }))</pre> | `[]` | no |
7473
| create\_group | Whether to create the group or not | `bool` | `false` | no |
7574
| create\_project\_sa | Whether the default service account for the project shall be created | `bool` | `true` | no |
76-
| credentials\_path | Path to a service account credentials file with rights to run the Project Factory. If this file is absent Terraform will fall back to Application Default Credentials. | `string` | `""` | no |
7775
| default\_service\_account | Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`. | `string` | `"disable"` | no |
7876
| disable\_dependent\_services | Whether services that are enabled and which depend on this service should also be disabled when this service is destroyed. | `bool` | `true` | no |
7977
| disable\_services\_on\_destroy | Whether project services will be disabled when the resources are destroyed | `bool` | `true` | no |
@@ -83,7 +81,6 @@ The roles granted are specifically:
8381
| folder\_id | The ID of a folder to host this project | `string` | `""` | no |
8482
| group\_name | A group to control the project by being assigned group\_role - defaults to ${project\_name}-editors | `string` | `""` | no |
8583
| group\_role | The role to give the controlling group (group\_name) over the project (defaults to project editor) | `string` | `"roles/editor"` | no |
86-
| impersonate\_service\_account | An optional service account to impersonate. If this service account is not specified, Terraform will fall back to credential file or Application Default Credentials. | `string` | `""` | no |
8784
| labels | Map of labels for project | `map(string)` | `{}` | no |
8885
| lien | Add a lien on the project to prevent accidental deletion | `bool` | `false` | no |
8986
| name | The name for the project | `any` | n/a | yes |

‎modules/gsuite_enabled/main.tf

-2
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,6 @@ module "project-factory" {
8989
activate_apis = var.activate_apis
9090
usage_bucket_name = var.usage_bucket_name
9191
usage_bucket_prefix = var.usage_bucket_prefix
92-
credentials_path = var.credentials_path
93-
impersonate_service_account = var.impersonate_service_account
9492
shared_vpc_subnets = var.shared_vpc_subnets
9593
labels = var.labels
9694
bucket_project = var.bucket_project

‎modules/gsuite_enabled/variables.tf

-11
Original file line numberDiff line numberDiff line change
@@ -112,17 +112,6 @@ variable "usage_bucket_prefix" {
112112
default = ""
113113
}
114114

115-
variable "credentials_path" {
116-
description = "Path to a service account credentials file with rights to run the Project Factory. If this file is absent Terraform will fall back to Application Default Credentials."
117-
default = ""
118-
}
119-
120-
variable "impersonate_service_account" {
121-
description = "An optional service account to impersonate. If this service account is not specified, Terraform will fall back to credential file or Application Default Credentials."
122-
type = string
123-
default = ""
124-
}
125-
126115
variable "shared_vpc_subnets" {
127116
description = "List of subnets fully qualified subnet IDs (ie. projects/$project_id/regions/$region/subnetworks/$subnet_id)"
128117
type = list(string)

‎modules/svpc_service_project/README.md

-2
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@ module "service-project" {
4444
| budget\_amount | The amount to use for a budget alert | `number` | `null` | no |
4545
| budget\_monitoring\_notification\_channels | A list of monitoring notification channels in the form `[projects/{project_id}/notificationChannels/{channel_id}]`. A maximum of 5 channels are allowed. | `list(string)` | `[]` | no |
4646
| create\_project\_sa | Whether the default service account for the project shall be created | `bool` | `true` | no |
47-
| credentials\_path | Path to a service account credentials file with rights to run the Project Factory. If this file is absent Terraform will fall back to Application Default Credentials. | `string` | `""` | no |
4847
| default\_service\_account | Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`. | `string` | `"disable"` | no |
4948
| disable\_dependent\_services | Whether services that are enabled and which depend on this service should also be disabled when this service is destroyed. | `bool` | `true` | no |
5049
| disable\_services\_on\_destroy | Whether project services will be disabled when the resources are destroyed | `bool` | `true` | no |
@@ -53,7 +52,6 @@ module "service-project" {
5352
| grant\_services\_security\_admin\_role | Whether or not to grant Kubernetes Engine Service Agent the Security Admin role on the host project so it can manage firewall rules | `bool` | `false` | no |
5453
| group\_name | A group to control the project by being assigned group\_role (defaults to project editor) | `string` | `""` | no |
5554
| group\_role | The role to give the controlling group (group\_name) over the project (defaults to project editor) | `string` | `"roles/editor"` | no |
56-
| impersonate\_service\_account | An optional service account to impersonate. This cannot be used with credentials\_path. If this service account is not specified and credentials\_path is absent, the module will use Application Default Credentials. | `string` | `""` | no |
5755
| labels | Map of labels for project | `map(string)` | `{}` | no |
5856
| lien | Add a lien on the project to prevent accidental deletion | `bool` | `false` | no |
5957
| name | The name for the project | `string` | n/a | yes |

‎modules/svpc_service_project/main.tf

-2
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,6 @@ module "project-factory" {
4848
usage_bucket_name = var.usage_bucket_name
4949
usage_bucket_prefix = var.usage_bucket_prefix
5050
bucket_versioning = var.bucket_versioning
51-
credentials_path = var.credentials_path
52-
impersonate_service_account = var.impersonate_service_account
5351
shared_vpc_subnets = var.shared_vpc_subnets
5452
labels = var.labels
5553
bucket_project = var.bucket_project

0 commit comments

Comments
 (0)