osinfra-io/google-cloud-hierarchy

Infrastructure as Code (IaC) example for Google Cloud Platform Hierarchy.

google-cloud-hierarchy's Issues

Support for Cloud Identity group memberships

Description

Manage group memberships through Terraform resource: google_cloud_identity_group_membership

Acceptance

• Group memberships defined as code
• All roles should be supported
• Keep code reasonably DRY but not to the extent where code is hard to read for beginners

Implementation Notes

Google has an example here: https://github.com/terraform-google-modules/terraform-google-group/blob/main/main.tf

Terraform documentation: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_identity_group_membership

Additional Context

Add service accounts for Terraform backend

Add support for groups as nested groups to the gke-security-groups

https://cloud.google.com/kubernetes-engine/docs/how-to/google-groups-rbac

Tasks

Beta Give feedback

1. Interface for adding cluster developers and cluster administrators groups for team based clusters

Update to align with audit logging name changes

Add or update identity group

Email address:

[email protected]

Identity group name:

platform-contributors

Owners:

[email protected]

Managers:

No response

Members:

No response

Additional comments:

Should have full ownership over the Testing folder.

GitHub actions backend service accounts should be able to manage billing budgets

We want to allow GitHub actions backend service accounts to manage billing budgets. This will allow us to set up a budget in the project module and have the GitHub actions backend service account manage the budget.

Tasks

Beta Give feedback

1. roles/billing.costsManager added to billing users group

Rename Testing and Terraform folders for clarity

Description

The testing folder is specific to the Kitchen, and the Terraform folder is for the backend. Clarity around folder names would be good.

Acceptance

• Kitchen Testing folder
• Terraform Backend folder

Implementation Notes

Additional Context

Folder IAM policies have a dependency on unknown folder IDs

Can we use a data source or output to get the folder IDs for use in the folder IAM policies?

Align coding conventions

Description

Let's align the coding conventions here with other repositories.

Acceptance

• Align coding conventions with other repositories

Implementation Notes

Additional Context

Add or update folder

Email address:

[email protected]

Google folder path:

Platform - Landing Zone/Testing

Additional comments:

No response

Add or update identity group

Developer notes:

Email address:

[email protected]

Identity group name:

platform-registry-readers, platform-registry-writers

Owners:

[email protected]

Managers:

No response

Members:

No response

GKE security groups:

• Add as a nested group to GKE security groups

Additional comments:

No response

Add or update identity group

Email address:

[email protected]

Identity group name:

security

Owners:

No response

Managers:

No response

Members:

No response

Additional comments:

No response

Improve resource name for `resource "google_folder" "environment"`

Description

The resource:

resource "google_folder" "environment" {
  for_each = { for folder in local.environments : "${folder.system}.${folder.environment}" => folder }

  display_name = each.value.environment
  parent       = google_folder.folder_system[each.value.system].name
}

Generates some funky resource names using `"${folder.system}.${folder.environment}" what can we do to improve on this?

Acceptance

• Ideally, we can do something without adding a new value
• Resource names normalized

Implementation Notes

Example:

  # google_folder.environment["system_2.Non-Production"] will be created
  + resource "google_folder" "environment" {
      + create_time     = (known after apply)
      + display_name    = "Non-Production"
      + folder_id       = (known after apply)
      + id              = (known after apply)
      + lifecycle_state = (known after apply)
      + name            = (known after apply)
      + parent          = (known after apply)
    }

Additional Context

#21 #22

Group for Terraform backend service accounts

Description

We will need a group for Terraform backend service accounts. For example, each backend service account created will require IAM roles to solve this problem:

Error: Request `Create IAM Members roles/logging.bucketWriter serviceAccount:[email protected] for project "shared-logs01-tf3521-sb"` returned error: Error retrieving IAM policy for project "shared-logs01-tf3521-sb": googleapi: Error 403: The caller does not have permission, forbidden

In this example, we have a service account creating a new project and resource for google_logging_project_sink, which requires project IAM admin in the logging project. This isn't ideal from a security perspective, but I'm not sure there is another way around it if we set up logging buckets this way.

Acceptance

• Terraform backend service accounts should be able to create the google_logging_project_sink resource

Implementation Notes

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/logging_project_sink

Additional Context

Also, note the service account for the terraform backend will need to be a manager in the group.

Cleanup README.md

Configure workflows

Support for billing budgets at an organizational and folder level

As part of osinfra-io/terraform-google-project#53, project creators can set project-level budgets. It would be useful if organizational-level and team-level (folder) budgets were also available.

Tasks

Beta Give feedback

1. Can create organizational-level billing budgets
2. Can create team-level (folder) billing budgets

• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/billing_budget.html
• https://cloud.google.com/billing/docs/how-to/budgets

Custom IAM role for GKE firewall resources

Suppose you want a GKE cluster in a service project to create and manage the firewall resources in your host project. In that case, the service project's GKE service account must be granted the appropriate IAM permissions. We went with the finer-grained approach.

Create a custom IAM role that includes only the following permissions

Beta Give feedback

1. compute.networks.updatePolicy
2. compute.firewalls.list
3. compute.firewalls.get
4. compute.firewalls.create
5. compute.firewalls.update
6. compute.firewalls.delete

Folder hierarchy should support a name change without destruction

Description

Since we are using the key as the folder name when we change names resources are destroyed.

Acceptance

• Folders support name changes without destroying resources

Implementation Notes

Looks like it's an issue out here too: terraform-google-modules/terraform-google-folders#41

Additional Context

Duplicate object key on identity groups when service account name is the same

╷
│ Error: Duplicate object key
│ 
│   on locals.tf line 71, in locals:
│   51:   owners = { for owner in flatten([
│   52:     # This will iterate over the identity_groups map and return a list of maps based of the values of the owners
│   53:     # that includes the group key.
│   54:     for identity_group_key, group in var.identity_groups : [
│   55:       for owner in group.owners : {
│   56:         group = identity_group_key
│   57:         owner = owner
│   58:         # Split Function
│   59:         # https://developer.hashicorp.com/terraform/language/functions/split
│   60:         # This will split the owner string into a list of strings based on the @ symbol.
│   61:         # We do this because the owner string is an email address and we want to use the
│   62:         # the group plus the first part of the email address as resource name key.
│   63:         owner_split = split("@", owner)
│   64:       }
│   65:     ]
│   66:   ]) : "${owner.group}-${owner.owner_split[0]}" => owner }
│     ├────────────────
│     │ owner.group is "backstage"
│     │ owner.owner_split[0] is "plt-backstage-github"
│ 
│ Two different items produced the key "backstage-plt-backstage-github" in this 'for' expression. If duplicates are expected, use the ellipsis (...) after the value expression
│ to enable grouping by key.
╵

Add or update custom IAM role

Developer notes:

Email address:

[email protected]

Role ID:

container.deployer

Role title:

Kubernetes Engine Deployer

Role description:

Access to deploy Kubernetes resources

Role permissions:

compute.addresses.create compute.addresses.delete compute.addresses.get compute.addresses.list compute.globalAddresses.create compute.globalAddresses.delete compute.globalAddresses.get compute.globalAddresses.list compute.instanceGroupManagers.get container.clusterRoleBindings.delete container.clusterRoleBindings.get container.clusterRoles.delete container.clusters.get container.clusters.list container.customResourceDefinitions.list resourcemanager.projects.get resourcemanager.projects.list

Additional comments:

No response

Add or update folder

Email address:

[email protected]

Google folder path:

Platform Teams/Kubernetes

Additional comments:

No response

Update folder names to align with Team Topologies four fundamental topologies

Add `gke-security-groups` Google Group for Kubernetes RBAC

Cluster Administrators should leverage G Suite Groups and Cloud IAM to assign Kubernetes user roles to a collection of users instead of individual emails using only Cloud IAM.

This is related to: osinfra-io/terraform-google-kubernetes-engine#14

We ultimately need the onboarding code to create and manage nested groups under

Tasks

Beta Give feedback

1. Group created
2. Can manage nested groups
3. Modify issue template to include a checkbox for nested GKE security groups

Documentation:

• https://cloud.google.com/kubernetes-engine/docs/how-to/google-groups-rbac

Support for google_folder_iam_policy at team, service and environment folders

To ensure proper access, teams must assign IAM roles to folders based on cloud identity groups. This allows developers to view and perform console-level activities as needed.

Tasks

Beta Give feedback

1. Teams can create identity groups and tie those groups with IAM roles to a team, service, or environment folder

Manually added service account to testing sandbox for Shared VPC Admin.

Add or update identity group

Email address:

[email protected]

Identity group name:

billing-users

Owners:

No response

Managers:

No response

Members:

No response

Additional comments:

role: roles/billing.costsManager

Issue template for custom IAM roles

Add a service interface for creating a custom role.

Tasks

Beta Give feedback

1. Can request a custom role via a service interface

Refactor for_each expressions

Description

I'd like to pull more complex for_each expressions out of main.tf in the spirit of keeping the main.tf simple so we can better assign good first issues to new developers.

Acceptance

• Follow coding conventions from https://github.com/osinfra-io/github-organization-management
• Simplify main.tf

Implementation Notes

Additional Context