osinfra-io / google-cloud-hierarchy Goto Github PK
View Code? Open in Web Editor NEWInfrastructure as Code (IaC) example for Google Cloud Platform Hierarchy.
Home Page: https://www.osinfra.io
License: GNU General Public License v2.0
Infrastructure as Code (IaC) example for Google Cloud Platform Hierarchy.
Home Page: https://www.osinfra.io
License: GNU General Public License v2.0
Manage group memberships through Terraform resource: google_cloud_identity_group_membership
Google has an example here: https://github.com/terraform-google-modules/terraform-google-group/blob/main/main.tf
Terraform documentation: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_identity_group_membership
platform-contributors
No response
No response
Should have full ownership over the Testing
folder.
We want to allow GitHub actions backend service accounts to manage billing budgets. This will allow us to set up a budget in the project module and have the GitHub actions backend service account manage the budget.
The testing folder is specific to the Kitchen, and the Terraform folder is for the backend. Clarity around folder names would be good.
Kitchen Testing
folderTerraform Backend
folderCan we use a data source or output to get the folder IDs for use in the folder IAM policies?
Let's align the coding conventions here with other repositories.
Platform - Landing Zone/Testing
No response
platform-registry-readers, platform-registry-writers
No response
No response
No response
security
No response
No response
No response
No response
The resource:
resource "google_folder" "environment" {
for_each = { for folder in local.environments : "${folder.system}.${folder.environment}" => folder }
display_name = each.value.environment
parent = google_folder.folder_system[each.value.system].name
}
Generates some funky resource names using `"${folder.system}.${folder.environment}" what can we do to improve on this?
Example:
# google_folder.environment["system_2.Non-Production"] will be created
+ resource "google_folder" "environment" {
+ create_time = (known after apply)
+ display_name = "Non-Production"
+ folder_id = (known after apply)
+ id = (known after apply)
+ lifecycle_state = (known after apply)
+ name = (known after apply)
+ parent = (known after apply)
}
We will need a group for Terraform backend service accounts. For example, each backend service account created will require IAM roles to solve this problem:
Error: Request `Create IAM Members roles/logging.bucketWriter serviceAccount:[email protected] for project "shared-logs01-tf3521-sb"` returned error: Error retrieving IAM policy for project "shared-logs01-tf3521-sb": googleapi: Error 403: The caller does not have permission, forbidden
In this example, we have a service account creating a new project and resource for google_logging_project_sink, which requires project IAM admin in the logging project. This isn't ideal from a security perspective, but I'm not sure there is another way around it if we set up logging buckets this way.
google_logging_project_sink
resourcehttps://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/logging_project_sink
Also, note the service account for the terraform backend will need to be a manager in the group.
As part of osinfra-io/terraform-google-project#53, project creators can set project-level budgets. It would be useful if organizational-level and team-level (folder) budgets were also available.
Suppose you want a GKE cluster in a service project to create and manage the firewall resources in your host project. In that case, the service project's GKE service account must be granted the appropriate IAM permissions. We went with the finer-grained approach.
Since we are using the key as the folder name when we change names resources are destroyed.
Looks like it's an issue out here too: terraform-google-modules/terraform-google-folders#41
╷
│ Error: Duplicate object key
│
│ on locals.tf line 71, in locals:
│ 51: owners = { for owner in flatten([
│ 52: # This will iterate over the identity_groups map and return a list of maps based of the values of the owners
│ 53: # that includes the group key.
│ 54: for identity_group_key, group in var.identity_groups : [
│ 55: for owner in group.owners : {
│ 56: group = identity_group_key
│ 57: owner = owner
│ 58: # Split Function
│ 59: # https://developer.hashicorp.com/terraform/language/functions/split
│ 60: # This will split the owner string into a list of strings based on the @ symbol.
│ 61: # We do this because the owner string is an email address and we want to use the
│ 62: # the group plus the first part of the email address as resource name key.
│ 63: owner_split = split("@", owner)
│ 64: }
│ 65: ]
│ 66: ]) : "${owner.group}-${owner.owner_split[0]}" => owner }
│ ├────────────────
│ │ owner.group is "backstage"
│ │ owner.owner_split[0] is "plt-backstage-github"
│
│ Two different items produced the key "backstage-plt-backstage-github" in this 'for' expression. If duplicates are expected, use the ellipsis (...) after the value expression
│ to enable grouping by key.
╵
container.deployer
Kubernetes Engine Deployer
Access to deploy Kubernetes resources
compute.addresses.create compute.addresses.delete compute.addresses.get compute.addresses.list compute.globalAddresses.create compute.globalAddresses.delete compute.globalAddresses.get compute.globalAddresses.list compute.instanceGroupManagers.get container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoles.delete container.clusters.get container.clusters.list container.customResourceDefinitions.list resourcemanager.projects.get resourcemanager.projects.list
No response
Platform Teams/Kubernetes
No response
Cluster Administrators should leverage G Suite Groups and Cloud IAM to assign Kubernetes user roles to a collection of users instead of individual emails using only Cloud IAM.
This is related to: osinfra-io/terraform-google-kubernetes-engine#14
We ultimately need the onboarding code to create and manage nested groups under
Documentation:
To ensure proper access, teams must assign IAM roles to folders based on cloud identity groups. This allows developers to view and perform console-level activities as needed.
Manually added service account to testing sandbox for Shared VPC Admin.
billing-users
No response
No response
No response
role: roles/billing.costsManager
Add a service interface for creating a custom role.
I'd like to pull more complex for_each expressions out of main.tf in the spirit of keeping the main.tf simple so we can better assign good first issues to new developers.
main.tf
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.