This repository contains Terraform modules and example configurations to enable Google Cloud customers to quickly deploy a secure CI/CD pipeline, implementing many of the functions outlined in the Shifting Left on Security report.
The Terraform modules in this repository provide an opinionated architecture that incorporates and documents best practices for secure application delivery architecture.
Basic usage of this module is as follows:
# Secure-CI
module "ci_pipeline" {
source = "GoogleCloudPlatform/terraform-google-secure-cicd//secure-ci"
project_id = var.project_id
primary_location = "us-central1"
attestor_names_prefix = ["build", "security", "quality"]
app_build_trigger_yaml = "cloudbuild-ci.yaml"
runner_build_folder = "../../../examples/app_cicd/cloud-build-builder"
build_image_config_yaml = "cloudbuild-skaffold-build-image.yaml"
trigger_branch_name = ".*"
}
# Secure-CD
module "cd_pipeline" {
source = "GoogleCloudPlatform/terraform-google-secure-cicd//secure-cd"
project_id = var.project_id
primary_location = "us-central1"
gar_repo_name = module.ci_pipeline.app_artifact_repo
cloudbuild_cd_repo = "cloudbuild-cd-config-pc"
deploy_branch_clusters = {
dev = {
cluster = "dev-cluster",
project_id = "gke-proj-dev",
location = "us-central1",
required_attestations = ["projects/${var.project_id}/attestors/build-attestor"]
env_attestation = "projects/${var.project_id}/attestors/security-attestor"
next_env = "qa"
},
qa = {
cluster = "qa-cluster",
project_id = "gke-proj-prod",
location = "us-central1",
required_attestations = ["projects/${var.project_id}/attestors/security-attestor", "projects/${var.project_id}/attestors/build-attestor"]
env_attestation = "projects/${var.project_id}/attestors/quality-attestor"
next_env = "prod"
},
prod = {
cluster = "prod-cluster",
project_id = "gke-proj-prod",
location = "us-central1",
required_attestations = ["projects/${var.project_id}/attestors/quality-attestor", "projects/${var.project_id}/attestors/security-attestor", "projects/${var.project_id}/attestors/build-attestor"]
env_attestation = ""
next_env = ""
},
}
app_deploy_trigger_yaml = "cloudbuild-cd.yaml"
cache_bucket_name = module.ci_pipeline.cache_bucket_name
depends_on = [
module.ci_pipeline
]
}
Functional examples are included in the examples directory.
Example Cloud Build configuration files are located in the Build folder. Push the cloudbuild-ci.yaml
configuration to the application source code repository. Push the cloudbuild-cd.yaml
configuration to the wet manifest repository. These build configurations offer a baseline for adhering to S3C application delivery practices within this blueprint, and are customizable as needed.
These sections describe requirements for using this module.
The following dependencies must be available:
- Google Cloud SDK version 357.0.0 or later
- Terraform v1.0
- Terraform Provider for GCP plugin v4.3.0
A service account with the following roles must be used to provision the resources of this blueprint:
- Project level:
- CI/CD project
roles/storage.admin
roles/artifactregistry.admin
roles/binaryauthorization.attestorsAdmin
roles/cloudbuild.builds.builder
roles/cloudbuild.workerPoolOwner
roles/cloudkms.admin
roles/cloudkms.publicKeyViewer
roles/containeranalysis.notes.editor
roles/compute.networkAdmin
roles/serviceusage.serviceUsageAdmin
roles/source.admin
roles/resourcemanager.projectIamAdmin
roles/viewer
- GKE projects
roles/compute.networkAdmin
roles/binaryauthorization.policyEditor
roles/resourcemanager.projectIamAdmin
roles/serviceusage.serviceUsageViewer
roles/iam.serviceAccountUser
- CI/CD project
The Project Factory module and the IAM module may be used in combination to provision a service account with the necessary roles applied.
Projects with the following APIs enabled must be used to host the resources of this module:
CI/CD Project
- Cloud Resource Manager API
cloudresourcemanager.googleapis.com
- Cloud Billing API
cloudbilling.googleapis.com
- Storage API
storage-api.googleapis.com
- Service Usage API
serviceusage.googleapis.com
- Cloud Build API
cloudbuild.googleapis.com
- Cloud Deploy API
clouddeploy.googleapis.com
- Pub/Sub API
pubsub.googleapis.com
- Container Registry API
containerregistry.googleapis.com
- IAM Credentials API
iamcredentials.googleapis.com
- Cloud Source Repositories API
sourcerepo.googleapis.com
- Artifact Registry API
artifactregistry.googleapis.com
- Container Analysis API
containeranalysis.googleapis.com
- Cloud KMS API
cloudkms.googleapis.com
- Binary Authorization API
binaryauthorization.googleapis.com
- Container Scanning API
containerscanning.googleapis.com
GKE Projects:
- Cloud Resource Manager API
cloudresourcemanager.googleapis.com
- Cloud Billing API
cloudbilling.googleapis.com
- Storage API
storage-api.googleapis.com
- Service Usage API
serviceusage.googleapis.com
- Container Registry API
containerregistry.googleapis.com
- IAM Credentials API
iamcredentials.googleapis.com
- Artifact Registry API
artifactregistry.googleapis.com
- Container Analysis API
containeranalysis.googleapis.com
- Cloud KMS API
cloudkms.googleapis.com
- Binary Authorization API
binaryauthorization.googleapis.com
- Container Scanning API
containerscanning.googleapis.com
- Kubernetes Engine API
container.googleapis.com
- Cloud Trace API
cloudtrace.googleapis.com
- Cloud Monitoring API
monitoring.googleapis.com
- Coud Logging API
logging.googleapis.com
The Project Factory module can be used to provision a project with the necessary APIs enabled.
Refer to the contribution guidelines for information on contributing to this module.