Merge branch 'master' into master

GoogleCloudPlatform · Sep 12, 2022 · 4d83dcf · 4d83dcf
2 parents f8c9717 + 6253df7
commit 4d83dcf
Show file tree

Hide file tree

Showing 2 changed files with 73 additions and 105 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,10 +4,12 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+
 ## [18.0.0] - 2022-09-09
 
-<!-- None < 2022-06-06 13:42:51+00:00 -->
+<!-- 2022-09-09 18:02:15+00:00 < 2022-06-06 13:42:51+00:00 -->
 
+- [[#808](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/808)] Rename examples to blueprints ([juliocc](https://github.com/juliocc)) <!-- 2022-09-09 15:14:19+00:00 -->
 
 ###  FAST
 
@@ -50,6 +52,8 @@ All notable changes to this project will be documented in this file.
 
 ### EXAMPLES
 
+- [[#801](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/801)] Update Cloud SQL example ([lcaggio](https://github.com/lcaggio)) <!-- 2022-09-09 14:02:07+00:00 -->
+- [[#802](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/802)] Fix Data Platform example ([lcaggio](https://github.com/lcaggio)) <!-- 2022-09-09 07:19:28+00:00 -->
 - [[#790](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/790)] Cloud Identity Group factory ([lcaggio](https://github.com/lcaggio)) <!-- 2022-09-01 13:30:58+00:00 -->
 - [[#740](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/740)] Update to multiple READMEs  ([bluPhy](https://github.com/bluPhy)) <!-- 2022-08-11 07:40:55+00:00 -->
 - [[#738](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/738)] Improve Data Playground example ([lcaggio](https://github.com/lcaggio)) <!-- 2022-08-09 13:56:39+00:00 -->
@@ -65,6 +69,7 @@ All notable changes to this project will be documented in this file.
 
 ### MODULES
 
+- [[#805](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/805)] Change `modules/project` service_config default ([juliocc](https://github.com/juliocc)) <!-- 2022-09-09 07:54:31+00:00 -->
 - [[#787](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/787)] Support manager role in cloud identity group module ([lcaggio](https://github.com/lcaggio)) <!-- 2022-08-31 10:29:05+00:00 -->
 - [[#786](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/786)] Secret manager flag sensitive output ([ddaluka](https://github.com/ddaluka)) <!-- 2022-08-29 11:22:52+00:00 -->
 - [[#775](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/775)] net-glb: Added support for regional external HTTP(s) load balancing ([rosmo](https://github.com/rosmo)) <!-- 2022-08-27 20:58:11+00:00 -->
@@ -107,7 +112,7 @@ All notable changes to this project will be documented in this file.
 ### TOOLS
 
 - [[#796](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/796)] Remove duplicate path component from doc_examples test names. ([juliocc](https://github.com/juliocc)) <!-- 2022-09-07 09:37:19+00:00 -->
-- [[#794](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/794)] Test documentation examples in the `blueprints/` folder ([juliocc](https://github.com/juliocc)) <!-- 2022-09-06 19:38:26+00:00 -->
+- [[#794](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/794)] Test documentation examples in the `examples/` folder ([juliocc](https://github.com/juliocc)) <!-- 2022-09-06 19:38:26+00:00 -->
 - [[#788](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/788)] fix yaml quotes for merge-pr workflow ([drebes](https://github.com/drebes)) <!-- 2022-08-31 13:47:33+00:00 -->
 - [[#763](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/763)] Changelog generator ([ludoo](https://github.com/ludoo)) <!-- 2022-08-02 09:45:06+00:00 -->
 - [[#762](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/762)] Update changelog on pull request merge ([ludoo](https://github.com/ludoo)) <!-- 2022-07-30 17:04:00+00:00 -->
@@ -672,4 +677,4 @@ All notable changes to this project will be documented in this file.
 [1.3.0]: https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/compare/v1.2.0...v1.3.0
 [1.2.0]: https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/compare/v1.1.0...v1.2.0
 [1.1.0]: https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/compare/v1.0.0...v1.1.0
-[1.0.0]: https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/compare/v0.1...v1.0.0
+[1.0.0]: https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/compare/v0.1...v1.0.0
diff --git a/fast/assets/templates/workflow-gitlab.yaml b/fast/assets/templates/workflow-gitlab.yaml
@@ -13,145 +13,108 @@
 # limitations under the License.
 
 default:
-  image:
-    name: registry.gitlab.com/gitlab-org/terraform-images/releases/1.1
   before_script:
-    - |
-      ssh-agent -a $SSH_AUTH_SOCK > /dev/null
-      echo "$CICD_MODULES_KEY" | base64 -d | tr -d '\r' | ssh-add - > /dev/null
-      mkdir -p ~/.ssh
-      ssh-keyscan -H 'gitlab.com' >> ~/.ssh/known_hosts
-      ssh-keyscan gitlab.com | sort -u - ~/.ssh/known_hosts -o ~/.ssh/known_hosts
-      cd "$${TF_ROOT}"
-      cp -R .tf-setup/. .
+    - echo "${CI_JOB_JWT_V2}" > token.txt
+  image:
+    name: hashicorp/terraform
+    entrypoint:
+      - "/usr/bin/env"
+      - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 
 variables:
+  GOOGLE_CREDENTIALS: cicd-sa-credentials.json
   FAST_OUTPUTS_BUCKET: ${outputs_bucket}
   FAST_SERVICE_ACCOUNT: ${service_account}
   FAST_WIF_PROVIDER: ${identity_provider}
   SSH_AUTH_SOCK: /tmp/ssh_agent.sock
   TF_PROVIDERS_FILE: ${tf_providers_file}
   TF_VAR_FILES: ${tf_var_files == [] ? "''" : join("\n    ", tf_var_files)}
-  TF_VERSION: 1.1.7
-  TF_ROOT: $${CI_PROJECT_DIR}  # The relative path to the root directory of the Terraform project
 
 stages:
   - gcp-auth
-  - tf-setup
-  - tf-init
-  - tf-validate
+  - tf-files
   - tf-plan
   - tf-apply
 
 cache:
-  key: "$${TF_ROOT}"
+  key: gcp-auth
   paths:
-    - $${TF_ROOT}/.terraform/
-    - $${TF_ROOT}/.tf-setup/
+    - cicd-sa-credentials.json
+    - .tf-setup
 
-# Configure GCP Auth with Access Token
 gcp-auth:
+  image:
+    name: google/cloud-sdk:slim
   stage: gcp-auth
-  before_script: []
-  script:
-    - |
-      PAYLOAD="$(cat <<EOF
-      {
-        "audience": "//iam.googleapis.com/$${FAST_WIF_PROVIDER}",
-        "grantType": "urn:ietf:params:oauth:grant-type:token-exchange",
-        "requestedTokenType": "urn:ietf:params:oauth:token-type:access_token",
-        "scope": "https://www.googleapis.com/auth/cloud-platform",
-        "subjectTokenType": "urn:ietf:params:oauth:token-type:jwt",
-        "subjectToken": "$${CI_JOB_JWT_V2}"
-      }
-      EOF
-      )"
-
-      FEDERATED_TOKEN="$(curl --silent "https://sts.googleapis.com/v1/token" \
-        --header "Accept: application/json" \
-        --header "Content-Type: application/json" \
-        --data "$${PAYLOAD}" \
-        | jq -r '.access_token'
-      )"
-
-      GOOGLE_OAUTH_ACCESS_TOKEN="$(curl --silent --show-error --fail "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/$${FAST_SERVICE_ACCOUNT}:generateAccessToken" \
-        --header "Accept: application/json" \
-        --header "Content-Type: application/json" \
-        --header "Authorization: Bearer $${FEDERATED_TOKEN}" \
-        --data '{"scope": ["https://www.googleapis.com/auth/cloud-platform"]}' \
-        | jq -r '.accessToken'
-      )"
-
-      echo "GOOGLE_OAUTH_ACCESS_TOKEN=$GOOGLE_OAUTH_ACCESS_TOKEN" >> gcp-auth.env
-
-      if [ -z "$GOOGLE_OAUTH_ACCESS_TOKEN" ]; then exit 1; fi
-# WIP - will have to find a better way of doing this
-  artifacts:
-    reports:
-      dotenv: gcp-auth.env
-
-# Downloading from bucket into cache
-tf-setup:
-  stage: tf-setup
-  before_script: []
   script:
     - |
-      mkdir -p .tf-setup
-      curl -X GET \
-        -H "Authorization: Bearer $GOOGLE_OAUTH_ACCESS_TOKEN" \
-        -o ".tf-setup/$${TF_PROVIDERS_FILE}" \
-        "https://storage.googleapis.com/$${FAST_OUTPUTS_BUCKET}/providers/$${TF_PROVIDERS_FILE}"
-      for f in $TF_VAR_FILES; do
-        curl -X GET \
-          -H "Authorization: Bearer $GOOGLE_OAUTH_ACCESS_TOKEN" \
-          -o ".tf-setup/$f" \
-          "https://storage.googleapis.com/$${FAST_OUTPUTS_BUCKET}/tfvars/$f"
-      done
+      gcloud iam workload-identity-pools create-cred-config \
+        ${FAST_WIF_PROVIDER} \
+        --service-account=${FAST_SERVICE_ACCOUNT} \
+        --service-account-token-lifetime-seconds=3600 \
+        --output-file=${GOOGLE_CREDENTIALS} \
+        --credential-source-file=token.txt
+tf-files:
   dependencies:
     - gcp-auth
-
-# Terraform Init
-tf-init:
-  stage: tf-init
+  image:
+    name: google/cloud-sdk:slim
+  stage: tf-files
   script:
+    # - gcloud components install -q alpha
+    - gcloud config set auth/credential_file_override ${GOOGLE_CREDENTIALS}
+    - mkdir -p .tf-setup
     - |
-      gitlab-terraform init
-  dependencies:
-    - gcp-auth
-
-# Terraform Validate
-tf-validate:
-  stage: tf-validate
-  script:
+      gcloud alpha storage cp -r \
+        "gs://${FAST_OUTPUTS_BUCKET}/providers/${TF_PROVIDERS_FILE}" .tf-setup/
     - |
-      gitlab-terraform validate
-  dependencies:
-    - gcp-auth
+      gcloud alpha storage cp -r \
+        "gs://${FAST_OUTPUTS_BUCKET}/tfvars" .tf-setup/
 
-# Terraform Plan
 tf-plan:
+  # uncomment the following lines and set the SSH key secret for private modules repo
+  # before_script:
+  #   - |
+  #     ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+  #     echo "$CICD_MODULES_KEY" | base64 -d | tr -d '\r' | ssh-add - > /dev/null
+  #     mkdir -p ~/.ssh
+  #     ssh-keyscan -H 'gitlab.com' >> ~/.ssh/known_hosts
+  #     ssh-keyscan gitlab.com | sort -u - ~/.ssh/known_hosts -o ~/.ssh/known_hosts
   stage: tf-plan
   script:
-  - |
-    gitlab-terraform plan
-    gitlab-terraform plan-json
+    - cp .tf-setup/${TF_PROVIDERS_FILE} ./
+    - |
+      for f in ${TF_VAR_FILES}; do
+        ln -s ".tf-setup/tfvars/$f" ./
+      done
+    - terraform init
+    - terraform validate
+    - terraform plan
   dependencies:
-    - gcp-auth
-  artifacts:
-    paths:
-      - $${TF_ROOT}/plan.cache
-    reports:
-      terraform: $${TF_ROOT}/plan.json
+    - tf-files
 
-# Terraform Apply
 tf-apply:
+  # uncomment the following lines and set the SSH key secret for private modules repo
+  # before_script:
+  #   - |
+  #     ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+  #     echo "$CICD_MODULES_KEY" | base64 -d | tr -d '\r' | ssh-add - > /dev/null
+  #     mkdir -p ~/.ssh
+  #     ssh-keyscan -H 'gitlab.com' >> ~/.ssh/known_hosts
+  #     ssh-keyscan gitlab.com | sort -u - ~/.ssh/known_hosts -o ~/.ssh/known_hosts
   stage: tf-apply
   script:
-    - cd "$${TF_ROOT}"
-    - gitlab-terraform apply
+    - cp .tf-setup/${TF_PROVIDERS_FILE} ./
+    - |
+      for f in ${TF_VAR_FILES}; do
+        ln -s ".tf-setup/tfvars/$f" ./
+      done
+    - terraform init
+    - terraform validate
+    - terraform apply -input=false -auto-approve
+  dependencies:
+    - tf-files
   when: manual
   only:
     variables:
       - $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-  dependencies:
-    - gcp-auth