Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for quotas to project module #2210

Merged
merged 9 commits into from
Apr 10, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions fast/stages/0-bootstrap/automation.tf
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,7 @@ module "automation-project" {
"cloudasset.googleapis.com",
"cloudbilling.googleapis.com",
"cloudkms.googleapis.com",
"cloudquotas.googleapis.com",
"cloudresourcemanager.googleapis.com",
"essentialcontacts.googleapis.com",
"iam.googleapis.com",
Expand Down
46 changes: 41 additions & 5 deletions modules/project/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ This module implements the creation and management of one GCP project including
- [Project-scoped Tags](#project-scoped-tags)
- [Custom Roles](#custom-roles)
- [Custom Roles Factory](#custom-roles-factory)
- [Quotas](#quotas)
- [Outputs](#outputs)
- [Managing project related configuration without creating it](#managing-project-related-configuration-without-creating-it)
- [Files](#files)
Expand Down Expand Up @@ -797,6 +798,36 @@ includedPermissions:
- resourcemanager.projects.list
```

## Quotas

Project and regional quotas can be managed via the `quotas` variable.

```hcl
module "project" {
source = "./fabric/modules/project"
name = "project"
billing_account = var.billing_account_id
parent = var.folder_id
prefix = var.prefix
quotas = {
cpus-ew8 = {
service = "compute.googleapis.com"
quota_id = "CPUS-per-project-region"
contact_email = "[email protected]"
preferred_value = 321
dimensions = {
region = "europe-west8"
}
}
}
services = [
"cloudquotas.googleapis.com",
"compute.googleapis.com"
]
}
# tftest modules=1 resources=4 e2e
```

## Outputs

Most of this module's outputs depend on its resources, to allow Terraform to compute all dependencies required for the project to be correctly configured. This allows you to reference outputs like `project_id` in other modules or resources without having to worry about setting `depends_on` blocks manually.
Expand Down Expand Up @@ -1044,10 +1075,12 @@ module "bucket" {
| [main.tf](./main.tf) | Module-level locals and resources. | <code>google_compute_project_metadata_item</code> · <code>google_essential_contacts_contact</code> · <code>google_monitoring_monitored_project</code> · <code>google_project</code> · <code>google_project_service</code> · <code>google_resource_manager_lien</code> |
| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
| [outputs.tf](./outputs.tf) | Module outputs. | |
| [quotas.tf](./quotas.tf) | None | <code>google_cloud_quotas_quota_preference</code> |
| [service-accounts.tf](./service-accounts.tf) | Service identities and supporting resources. | <code>google_kms_crypto_key_iam_member</code> · <code>google_project_default_service_accounts</code> · <code>google_project_iam_member</code> · <code>google_project_service_identity</code> |
| [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> · <code>google_compute_subnetwork_iam_member</code> · <code>google_project_iam_member</code> |
| [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> · <code>google_tags_tag_key</code> · <code>google_tags_tag_key_iam_binding</code> · <code>google_tags_tag_value</code> · <code>google_tags_tag_value_iam_binding</code> |
| [variables-iam.tf](./variables-iam.tf) | None | |
| [variables-quotas.tf](./variables-quotas.tf) | None | |
| [variables-tags.tf](./variables-tags.tf) | None | |
| [variables.tf](./variables.tf) | Module variables. | |
| [versions.tf](./versions.tf) | Version pins. | |
Expand Down Expand Up @@ -1081,6 +1114,7 @@ module "bucket" {
| [parent](variables.tf#L184) | Parent folder or organization in 'folders/folder_id' or 'organizations/org_id' format. | <code>string</code> | | <code>null</code> |
| [prefix](variables.tf#L194) | Optional prefix used to generate project id and name. | <code>string</code> | | <code>null</code> |
| [project_create](variables.tf#L204) | Create project. When set to false, uses a data source to reference existing project. | <code>bool</code> | | <code>true</code> |
| [quotas](variables-quotas.tf#L17) | Service quota configuration. | <code title="map&#40;object&#40;&#123;&#10; service &#61; string&#10; quota_id &#61; string&#10; preferred_value &#61; number&#10; dimensions &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; justification &#61; optional&#40;string&#41;&#10; contact_email &#61; optional&#40;string&#41;&#10; annotations &#61; optional&#40;map&#40;string&#41;&#41;&#10; ignore_safety_checks &#61; optional&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [service_config](variables.tf#L210) | Configure service API activation. | <code title="object&#40;&#123;&#10; disable_on_destroy &#61; bool&#10; disable_dependent_services &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; disable_on_destroy &#61; false&#10; disable_dependent_services &#61; false&#10;&#125;">&#123;&#8230;&#125;</code> |
| [service_encryption_key_ids](variables.tf#L222) | Cloud KMS encryption key in {SERVICE => [KEY_URL]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [service_perimeter_bridges](variables.tf#L229) | Name of VPC-SC Bridge perimeters to add project into. See comment in the variables file for format. | <code>list&#40;string&#41;</code> | | <code>null</code> |
Expand All @@ -1102,9 +1136,11 @@ module "bucket" {
| [name](outputs.tf#L51) | Project name. | |
| [number](outputs.tf#L63) | Project number. | |
| [project_id](outputs.tf#L82) | Project id. | |
| [service_accounts](outputs.tf#L101) | Product robot service accounts in project. | |
| [services](outputs.tf#L117) | Service APIs to enabled in the project. | |
| [sink_writer_identities](outputs.tf#L126) | Writer identities created for each sink. | |
| [tag_keys](outputs.tf#L133) | Tag key resources. | |
| [tag_values](outputs.tf#L142) | Tag value resources. | |
| [quota_configs](outputs.tf#L101) | Quota configurations. | |
| [quotas](outputs.tf#L112) | Quota resources. | |
| [service_accounts](outputs.tf#L117) | Product robot service accounts in project. | |
| [services](outputs.tf#L133) | Service APIs to enabled in the project. | |
| [sink_writer_identities](outputs.tf#L142) | Writer identities created for each sink. | |
| [tag_keys](outputs.tf#L149) | Tag key resources. | |
| [tag_values](outputs.tf#L158) | Tag value resources. | |
<!-- END TFDOC -->
16 changes: 16 additions & 0 deletions modules/project/outputs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,22 @@ output "project_id" {
]
}

output "quota_configs" {
description = "Quota configurations."
value = {
for k, v in google_cloud_quotas_quota_preference.default :
k => {
granted = v.quota_config.0.granted_value
preferred = v.quota_config.0.preferred_value
}
}
}

output "quotas" {
description = "Quota resources."
value = google_cloud_quotas_quota_preference.default
}

output "service_accounts" {
description = "Product robot service accounts in project."
value = {
Expand Down
34 changes: 34 additions & 0 deletions modules/project/quotas.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

resource "google_cloud_quotas_quota_preference" "default" {
for_each = var.quotas
parent = "projects/${local.project.project_id}"
name = each.key
service = each.value.service
dimensions = each.value.dimensions
quota_id = each.value.quota_id
contact_email = each.value.contact_email
justification = each.value.justification
quota_config {
preferred_value = each.value.preferred_value
annotations = each.value.annotations
}
ignore_safety_checks = each.value.ignore_safety_checks
depends_on = [
google_project_service.project_services
]
}
44 changes: 44 additions & 0 deletions modules/project/variables-quotas.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

variable "quotas" {
description = "Service quota configuration."
type = map(object({
service = string
quota_id = string
preferred_value = number
dimensions = optional(map(string), {})
justification = optional(string)
contact_email = optional(string)
annotations = optional(map(string))
ignore_safety_checks = optional(string)
}))
nullable = false
default = {}
validation {
condition = alltrue([
for k, v in var.quotas :
v.ignore_safety_checks == null || contains(
[
"QUOTA_DECREASE_BELOW_USAGE",
"QUOTA_DECREASE_PERCENTAGE_TOO_HIGH",
"QUOTA_SAFETY_CHECK_UNSPECIFIED"
],
coalesce(v.ignore_safety_checks, "-")
)])
error_message = "Invalid value for ignore safety checks."
}
}
4 changes: 2 additions & 2 deletions tests/fast/stages/s0_bootstrap/checklist.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -369,7 +369,7 @@ counts:
google_project: 3
google_project_iam_binding: 19
google_project_iam_member: 6
google_project_service: 30
google_project_service: 31
google_project_service_identity: 4
google_service_account: 4
google_service_account_iam_binding: 2
Expand All @@ -381,4 +381,4 @@ counts:
google_tags_tag_key: 1
google_tags_tag_value: 1
modules: 17
resources: 195
resources: 196
4 changes: 2 additions & 2 deletions tests/fast/stages/s0_bootstrap/simple.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ counts:
google_project: 3
google_project_iam_binding: 19
google_project_iam_member: 6
google_project_service: 30
google_project_service: 31
google_project_service_identity: 4
google_service_account: 4
google_service_account_iam_binding: 2
Expand All @@ -61,7 +61,7 @@ counts:
google_tags_tag_value: 1
local_file: 7
modules: 16
resources: 186
resources: 187

outputs:
custom_roles:
Expand Down
Loading