Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Features] Create project as SVPC host project #465

Merged
merged 8 commits into from
Oct 2, 2020
Merged

[Features] Create project as SVPC host project #465

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b0b1043
Updates README in root directory
thiagonache Oct 2, 2020
64b52cb
Adds new variable `enable_shared_vpc_host_project` and pass it to cor…
thiagonache Oct 2, 2020
faf8124
Updates shared_vpc example
thiagonache Oct 2, 2020
3f1c9b2
Renames shared_vpc_enabled by enable_shared_vpc_service_project in co…
thiagonache Oct 2, 2020
932390b
Updates parameter passed to core project factory keeping the same var…
thiagonache Oct 2, 2020
db8e35a
Updates parameter passed to core project factory in shared_vpc module
thiagonache Oct 2, 2020
4e51484
Pin terraform google provider version to avoid issues
thiagonache Oct 2, 2020
0851c2e
Exposes variable "enable_shared_vpc_host_project" on the gsuite submo…
thiagonache Oct 2, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,7 @@ determining that location is as follows:
| disable\_dependent\_services | Whether services that are enabled and which depend on this service should also be disabled when this service is destroyed. | bool | `"true"` | no |
| disable\_services\_on\_destroy | Whether project services will be disabled when the resources are destroyed | string | `"true"` | no |
| domain | The domain name (optional). | string | `""` | no |
| enable\_shared\_vpc\_host\_project | If this project is a shared VPC host project. If true, you must *not* set shared_vpc variable. Default is false. | bool | `"false"` | no |
| folder\_id | The ID of a folder to host this project | string | `""` | no |
| group\_name | A group to control the project by being assigned group_role (defaults to project editor) | string | `""` | no |
| group\_role | The role to give the controlling group (group_name) over the project (defaults to project editor) | string | `"roles/editor"` | no |
Expand Down
25 changes: 12 additions & 13 deletions examples/shared_vpc/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,13 +42,14 @@ provider "random" {
Host Project Creation
*****************************************/
module "host-project" {
source = "../../"
random_project_id = true
name = var.host_project_name
org_id = var.organization_id
folder_id = var.folder_id
billing_account = var.billing_account
skip_gcloud_download = true
source = "../../"
random_project_id = true
name = var.host_project_name
org_id = var.organization_id
folder_id = var.folder_id
billing_account = var.billing_account
skip_gcloud_download = true
enable_shared_vpc_host_project = true
}

/******************************************
Expand All @@ -58,11 +59,9 @@ module "vpc" {
source = "terraform-google-modules/network/google"
version = "~> 2.1.0"

project_id = module.host-project.project_id
network_name = var.network_name

project_id = module.host-project.project_id
network_name = var.network_name
delete_default_internet_gateway_routes = true
shared_vpc_host = true

subnets = [
{
Expand Down Expand Up @@ -114,7 +113,7 @@ module "service-project" {
billing_account = var.billing_account
shared_vpc_enabled = true

shared_vpc = module.vpc.project_id
shared_vpc = module.host-project.project_id
shared_vpc_subnets = module.vpc.subnets_self_links

activate_apis = [
Expand Down Expand Up @@ -142,7 +141,7 @@ module "service-project-b" {
billing_account = var.billing_account
shared_vpc_enabled = true

shared_vpc = module.vpc.project_id
shared_vpc = module.host-project.project_id

activate_apis = [
"compute.googleapis.com",
Expand Down
3 changes: 2 additions & 1 deletion main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,8 @@ module "project-factory" {
name = var.name
project_id = var.project_id
shared_vpc = var.shared_vpc
shared_vpc_enabled = var.shared_vpc != ""
enable_shared_vpc_service_project = var.shared_vpc != ""
enable_shared_vpc_host_project = var.enable_shared_vpc_host_project
billing_account = var.billing_account
folder_id = var.folder_id
sa_role = var.sa_role
Expand Down
16 changes: 11 additions & 5 deletions modules/core_project_factory/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ module "project_services" {
Shared VPC configuration
*****************************************/
resource "google_compute_shared_vpc_service_project" "shared_vpc_attachment" {
count = var.shared_vpc_enabled ? 1 : 0
count = var.enable_shared_vpc_service_project ? 1 : 0

host_project = var.shared_vpc
service_project = google_project.main.project_id
Expand All @@ -137,6 +137,12 @@ resource "google_compute_shared_vpc_service_project" "shared_vpc_attachment" {
]
}

resource "google_compute_shared_vpc_host_project" "shared_vpc_host" {
count = var.enable_shared_vpc_host_project ? 1 : 0
project = google_project.main.project_id
depends_on = [module.project_services]
}

/******************************************
Default compute service account retrieval
*****************************************/
Expand Down Expand Up @@ -278,7 +284,7 @@ resource "google_service_account_iam_member" "service_account_grant_to_group" {
compute.networkUser role granted to G Suite group, APIs Service account, and Project Service Account
*****************************************************************************************************************/
resource "google_project_iam_member" "controlling_group_vpc_membership" {
count = var.shared_vpc_enabled && length(var.shared_vpc_subnets) == 0 ? local.shared_vpc_users_length : 0
count = var.enable_shared_vpc_service_project && length(var.shared_vpc_subnets) == 0 ? local.shared_vpc_users_length : 0

project = var.shared_vpc
role = "roles/compute.networkUser"
Expand All @@ -294,7 +300,7 @@ resource "google_project_iam_member" "controlling_group_vpc_membership" {
*************************************************************************************/
resource "google_compute_subnetwork_iam_member" "service_account_role_to_vpc_subnets" {
provider = google-beta
count = var.shared_vpc_enabled && length(var.shared_vpc_subnets) > 0 ? length(var.shared_vpc_subnets) : 0
count = var.enable_shared_vpc_service_project && length(var.shared_vpc_subnets) > 0 ? length(var.shared_vpc_subnets) : 0

subnetwork = element(
split("/", var.shared_vpc_subnets[count.index]),
Expand All @@ -318,7 +324,7 @@ resource "google_compute_subnetwork_iam_member" "service_account_role_to_vpc_sub
resource "google_compute_subnetwork_iam_member" "group_role_to_vpc_subnets" {
provider = google-beta

count = var.shared_vpc_enabled && length(var.shared_vpc_subnets) > 0 && var.manage_group ? length(var.shared_vpc_subnets) : 0
count = var.enable_shared_vpc_service_project && length(var.shared_vpc_subnets) > 0 && var.manage_group ? length(var.shared_vpc_subnets) : 0
subnetwork = element(
split("/", var.shared_vpc_subnets[count.index]),
index(
Expand All @@ -341,7 +347,7 @@ resource "google_compute_subnetwork_iam_member" "group_role_to_vpc_subnets" {
resource "google_compute_subnetwork_iam_member" "apis_service_account_role_to_vpc_subnets" {
provider = google-beta

count = var.shared_vpc_enabled && length(var.shared_vpc_subnets) > 0 ? length(var.shared_vpc_subnets) : 0
count = var.enable_shared_vpc_service_project && length(var.shared_vpc_subnets) > 0 ? length(var.shared_vpc_subnets) : 0
subnetwork = element(
split("/", var.shared_vpc_subnets[count.index]),
index(
Expand Down
3 changes: 2 additions & 1 deletion modules/core_project_factory/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@ output "project_id" {
concat(
[module.project_services.project_id],
[google_project.main.project_id],
[var.shared_vpc_enabled ? google_compute_shared_vpc_service_project.shared_vpc_attachment[0].id : ""],
[var.enable_shared_vpc_service_project ? google_compute_shared_vpc_service_project.shared_vpc_attachment[0].id : ""],
[var.enable_shared_vpc_host_project ? google_compute_shared_vpc_host_project.shared_vpc_host[0].id : ""],
),
0,
)
Expand Down
10 changes: 8 additions & 2 deletions modules/core_project_factory/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,11 +182,17 @@ variable "disable_dependent_services" {
type = bool
}

variable "shared_vpc_enabled" {
description = "If shared VPC should be used"
variable "enable_shared_vpc_service_project" {
description = "If this project should be attached to a shared VPC. If true, you must set shared_vpc variable."
type = bool
}

variable "enable_shared_vpc_host_project" {
description = "If this project is a shared VPC host project. If true, you must *not* set shared_vpc variable. Default is false."
type = bool
default = false
}

variable "python_interpreter_path" {
description = "Python interpreter path for precondition check script."
type = string
Expand Down
1 change: 1 addition & 0 deletions modules/gsuite_enabled/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,7 @@ The roles granted are specifically:
| disable\_dependent\_services | Whether services that are enabled and which depend on this service should also be disabled when this service is destroyed. | string | `"true"` | no |
| disable\_services\_on\_destroy | Whether project services will be disabled when the resources are destroyed | string | `"true"` | no |
| domain | The domain name (optional). | string | `""` | no |
| enable\_shared\_vpc\_host\_project | If this project is a shared VPC host project. If true, you must *not* set shared_vpc variable. Default is false. | bool | `"false"` | no |
| folder\_id | The ID of a folder to host this project | string | `""` | no |
| group\_name | A group to control the project by being assigned group_role - defaults to $${project_name}-editors | string | `""` | no |
| group\_role | The role to give the controlling group (group_name) over the project (defaults to project editor) | string | `"roles/editor"` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/gsuite_enabled/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,8 @@ module "project-factory" {
name = var.name
project_id = var.project_id
shared_vpc = var.shared_vpc
shared_vpc_enabled = var.shared_vpc_enabled
enable_shared_vpc_service_project = var.shared_vpc_enabled
enable_shared_vpc_host_project = var.enable_shared_vpc_host_project
billing_account = var.billing_account
folder_id = var.folder_id
sa_role = var.sa_role
Expand Down
6 changes: 6 additions & 0 deletions modules/gsuite_enabled/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,12 @@ variable "shared_vpc_enabled" {
default = false
}

variable "enable_shared_vpc_host_project" {
description = "If this project is a shared VPC host project. If true, you must *not* set shared_vpc variable. Default is false."
type = bool
default = false
}

variable "python_interpreter_path" {
description = "Python interpreter path for precondition check script."
type = string
Expand Down
2 changes: 1 addition & 1 deletion modules/shared_vpc/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ module "project-factory" {
name = var.name
project_id = var.project_id
shared_vpc = var.shared_vpc
shared_vpc_enabled = true
enable_shared_vpc_service_project = true
billing_account = var.billing_account
folder_id = var.folder_id
sa_role = var.sa_role
Expand Down
5 changes: 5 additions & 0 deletions test/fixtures/full/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,9 @@

terraform {
required_version = ">=0.12.6, <0.14"
required_providers {
google = {
version = "3.40.0"
}
}
}
6 changes: 6 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,12 @@ variable "shared_vpc" {
default = ""
}

variable "enable_shared_vpc_host_project" {
description = "If this project is a shared VPC host project. If true, you must *not* set shared_vpc variable. Default is false."
type = bool
default = false
}

variable "billing_account" {
description = "The ID of the billing account to associate this project with"
type = string
Expand Down