Support customizable resource names in FAST stage 0

.github/workflows/linting.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Set up Terraform
         uses: hashicorp/setup-terraform@v3
         with:
-          terraform_version: 1.7.4
+          terraform_version: 1.10.2
 
       - uses: terraform-linters/setup-tflint@v4
         name: Setup TFLint

.github/workflows/tests.yml

@@ -14,8 +14,6 @@
 
 name: "Tests"
 on:
-  # schedule:
-  #   - cron: "45 2 * * *"
   push:
     branches:
       - master
@@ -29,7 +27,7 @@ on:
       terraform_version:
         description: "Use '1.5.7' to test last MPLv2 Terraform version"
         required: true
-        default: 1.7.4
+        default: 1.10.2
         type: string
 
 env:
@@ -39,7 +37,7 @@ env:
   TF_PLUGIN_CACHE_DIR: "/home/runner/.terraform.d/plugin-cache"
   TFTEST_COPY: 1
   DEFAULT_TERRAFORM_FLAVOUR: terraform
-  DEFAULT_TERRAFORM_VERSION: ${{ inputs.terraform_version || '1.7.4' }}
+  DEFAULT_TERRAFORM_VERSION: ${{ inputs.terraform_version || '1.10.2' }}
   DEFAULT_TOFU_VERSION: "1.7.2"
 
 jobs:

blueprints/gke/patterns/autopilot-cluster/versions.tf

@@ -15,7 +15,7 @@
 # Fabric release: v36.0.1
 
 terraform {
-  required_version = ">= 1.7.4"
+  required_version = ">= 1.10.2"
   required_providers {
     google = {
       source  = "hashicorp/google"

blueprints/gke/patterns/batch/versions.tf

@@ -15,7 +15,7 @@
 # Fabric release: v36.0.1
 
 terraform {
-  required_version = ">= 1.7.4"
+  required_version = ">= 1.10.2"
   required_providers {
     google = {
       source  = "hashicorp/google"

blueprints/gke/patterns/kafka/versions.tf

@@ -15,7 +15,7 @@
 # Fabric release: v36.0.1
 
 terraform {
-  required_version = ">= 1.7.4"
+  required_version = ">= 1.10.2"
   required_providers {
     google = {
       source  = "hashicorp/google"

blueprints/gke/patterns/kong-cloudrun/versions.tf

@@ -15,7 +15,7 @@
 # Fabric release: v36.0.1
 
 terraform {
-  required_version = ">= 1.7.4"
+  required_version = ">= 1.10.2"
   required_providers {
     google = {
       source  = "hashicorp/google"

blueprints/gke/patterns/mysql/versions.tf

@@ -15,7 +15,7 @@
 # Fabric release: v36.0.1
 
 terraform {
-  required_version = ">= 1.7.4"
+  required_version = ">= 1.10.2"
   required_providers {
     google = {
       source  = "hashicorp/google"

blueprints/gke/patterns/redis-cluster/versions.tf

@@ -15,7 +15,7 @@
 # Fabric release: v36.0.1
 
 terraform {
-  required_version = ">= 1.7.4"
+  required_version = ">= 1.10.2"
   required_providers {
     google = {
       source  = "hashicorp/google"

blueprints/secops/secops-gke-forwarder/versions.tf

@@ -15,7 +15,7 @@
 # Fabric release: v36.0.1
 
 terraform {
-  required_version = ">= 1.7.4"
+  required_version = ">= 1.10.2"
   required_providers {
     google = {
       source  = "hashicorp/google"

default-versions.tf

@@ -15,7 +15,7 @@
 # Fabric release: v36.0.1
 
 terraform {
-  required_version = ">= 1.7.4"
+  required_version = ">= 1.10.2"
   required_providers {
     google = {
       source  = "hashicorp/google"

fast/stages/0-bootstrap/automation.tf

@@ -28,11 +28,11 @@ locals {
 module "automation-project" {
   source          = "../../../modules/project"
   billing_account = var.billing_account.id
-  name            = "iac-core-0"
+  name            = var.resource_names["project-automation"]
   parent = coalesce(
     var.project_parent_ids.automation, "organizations/${var.organization.id}"
   )
-  prefix = local.prefix
+  prefix = var.prefix
   contacts = (
     var.bootstrap_user != null || var.essential_contacts == null
     ? {}
@@ -192,8 +192,8 @@ module "automation-project" {
 module "automation-tf-output-gcs" {
   source     = "../../../modules/gcs"
   project_id = module.automation-project.project_id
-  name       = "iac-core-outputs-0"
-  prefix     = local.prefix
+  name       = var.resource_names["gcs-outputs"]
+  prefix     = var.prefix
   location   = local.locations.gcs
   versioning = true
   depends_on = [module.organization]
@@ -204,8 +204,8 @@ module "automation-tf-output-gcs" {
 module "automation-tf-bootstrap-gcs" {
   source     = "../../../modules/gcs"
   project_id = module.automation-project.project_id
-  name       = "iac-core-bootstrap-0"
-  prefix     = local.prefix
+  name       = var.resource_names["gcs-bootstrap"]
+  prefix     = var.prefix
   location   = local.locations.gcs
   versioning = true
   depends_on = [module.organization]
@@ -214,9 +214,9 @@ module "automation-tf-bootstrap-gcs" {
 module "automation-tf-bootstrap-sa" {
   source       = "../../../modules/iam-service-account"
   project_id   = module.automation-project.project_id
-  name         = "bootstrap-0"
+  name         = var.resource_names["sa-bootstrap"]
   display_name = "Terraform organization bootstrap service account."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   iam = {
     "roles/iam.serviceAccountTokenCreator" = compact([
@@ -231,9 +231,9 @@ module "automation-tf-bootstrap-sa" {
 module "automation-tf-bootstrap-r-sa" {
   source       = "../../../modules/iam-service-account"
   project_id   = module.automation-project.project_id
-  name         = "bootstrap-0r"
+  name         = var.resource_names["sa-bootstrap_ro"]
   display_name = "Terraform organization bootstrap service account (read-only)."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   iam = {
     "roles/iam.serviceAccountTokenCreator" = compact([
@@ -258,8 +258,8 @@ module "automation-tf-bootstrap-r-sa" {
 module "automation-tf-resman-gcs" {
   source     = "../../../modules/gcs"
   project_id = module.automation-project.project_id
-  name       = "iac-core-resman-0"
-  prefix     = local.prefix
+  name       = var.resource_names["gcs-resman"]
+  prefix     = var.prefix
   location   = local.locations.gcs
   versioning = true
   iam = {
@@ -272,9 +272,9 @@ module "automation-tf-resman-gcs" {
 module "automation-tf-resman-sa" {
   source       = "../../../modules/iam-service-account"
   project_id   = module.automation-project.project_id
-  name         = "resman-0"
+  name         = var.resource_names["sa-resman"]
   display_name = "Terraform stage 1 resman service account."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
   iam_bindings_additive = merge(
@@ -299,9 +299,9 @@ module "automation-tf-resman-sa" {
 module "automation-tf-resman-r-sa" {
   source       = "../../../modules/iam-service-account"
   project_id   = module.automation-project.project_id
-  name         = "resman-0r"
+  name         = var.resource_names["sa-resman_ro"]
   display_name = "Terraform stage 1 resman service account (read-only)."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
   iam_bindings_additive = merge(
@@ -336,8 +336,8 @@ module "automation-tf-resman-r-sa" {
 module "automation-tf-vpcsc-gcs" {
   source     = "../../../modules/gcs"
   project_id = module.automation-project.project_id
-  name       = "iac-core-vpcsc-0"
-  prefix     = local.prefix
+  name       = var.resource_names["gcs-vpcsc"]
+  prefix     = var.prefix
   location   = local.locations.gcs
   versioning = true
   iam = {
@@ -350,9 +350,9 @@ module "automation-tf-vpcsc-gcs" {
 module "automation-tf-vpcsc-sa" {
   source       = "../../../modules/iam-service-account"
   project_id   = module.automation-project.project_id
-  name         = "vpcsc-0"
+  name         = var.resource_names["sa-vpcsc"]
   display_name = "Terraform stage 1 vpcsc service account."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
   iam_bindings_additive = merge(
@@ -377,9 +377,9 @@ module "automation-tf-vpcsc-sa" {
 module "automation-tf-vpcsc-r-sa" {
   source       = "../../../modules/iam-service-account"
   project_id   = module.automation-project.project_id
-  name         = "vpcsc-0r"
+  name         = var.resource_names["sa-vpcsc_ro"]
   display_name = "Terraform stage 1 vpcsc service account (read-only)."
-  prefix       = local.prefix
+  prefix       = var.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
   iam_bindings_additive = local.cicd_vpcsc_r_sa == "" ? {} : {

fast/stages/0-bootstrap/billing.tf

@@ -43,11 +43,11 @@ module "billing-export-project" {
     local.billing_mode == "org" || var.billing_account.force_create.project == true ? 1 : 0
   )
   billing_account = var.billing_account.id
-  name            = "billing-exp-0"
+  name            = var.resource_names["project-billing"]
   parent = coalesce(
     var.project_parent_ids.billing, "organizations/${var.organization.id}"
   )
-  prefix = local.prefix
+  prefix = var.prefix
   contacts = (
     var.bootstrap_user != null || var.essential_contacts == null
     ? {}
@@ -73,7 +73,7 @@ module "billing-export-dataset" {
     local.billing_mode == "org" || var.billing_account.force_create.dataset == true ? 1 : 0
   )
   project_id    = module.billing-export-project[0].project_id
-  id            = "billing_export"
+  id            = var.resource_names["bq-billing"]
   friendly_name = "Billing export."
   location      = local.locations.bq
 }

fast/stages/0-bootstrap/cicd.tf

@@ -76,12 +76,14 @@ locals {
 # SAs used by CI/CD workflows to impersonate automation SAs
 
 module "automation-tf-cicd-sa" {
-  source       = "../../../modules/iam-service-account"
-  for_each     = local.cicd_repositories
-  project_id   = module.automation-project.project_id
-  name         = "${each.key}-1"
+  source     = "../../../modules/iam-service-account"
+  for_each   = local.cicd_repositories
+  project_id = module.automation-project.project_id
+  name = templatestring(
+    var.resource_names["sa-cicd_template"], { key = each.key }
+  )
   display_name = "Terraform CI/CD ${each.key} service account."
-  prefix       = local.prefix
+  prefix       = var.prefix
   iam = {
     "roles/iam.workloadIdentityUser" = [
       each.value.branch == null
@@ -107,12 +109,14 @@ module "automation-tf-cicd-sa" {
 }
 
 module "automation-tf-cicd-r-sa" {
-  source       = "../../../modules/iam-service-account"
-  for_each     = local.cicd_repositories
-  project_id   = module.automation-project.project_id
-  name         = "${each.key}-1r"
+  source     = "../../../modules/iam-service-account"
+  for_each   = local.cicd_repositories
+  project_id = module.automation-project.project_id
+  name = templatestring(
+    var.resource_names["sa-cicd_template_ro"], { key = each.key }
+  )
   display_name = "Terraform CI/CD ${each.key} service account (read-only)."
-  prefix       = local.prefix
+  prefix       = var.prefix
   iam = {
     "roles/iam.workloadIdentityUser" = [
       format(

fast/stages/0-bootstrap/identity-providers.tf

@@ -32,10 +32,12 @@ locals {
 }
 
 resource "google_iam_workforce_pool" "default" {
-  count             = length(local.workforce_identity_providers) > 0 ? 1 : 0
-  parent            = "organizations/${var.organization.id}"
-  location          = "global"
-  workforce_pool_id = "${var.prefix}-bootstrap"
+  count    = length(local.workforce_identity_providers) > 0 ? 1 : 0
+  parent   = "organizations/${var.organization.id}"
+  location = "global"
+  workforce_pool_id = templatestring(
+    var.resource_names["wf-bootstrap"], { prefix = var.prefix }
+  )
 }
 
 resource "google_iam_workforce_pool_provider" "default" {
@@ -46,18 +48,23 @@ resource "google_iam_workforce_pool_provider" "default" {
   disabled            = each.value.disabled
   display_name        = each.value.display_name
   location            = google_iam_workforce_pool.default[0].location
-  provider_id         = "${var.prefix}-bootstrap-${each.key}"
-  workforce_pool_id   = google_iam_workforce_pool.default[0].workforce_pool_id
+  provider_id = templatestring(var.resource_names["wf-provider_template"], {
+    prefix = var.prefix
+    key    = each.key
+  })
+  workforce_pool_id = google_iam_workforce_pool.default[0].workforce_pool_id
   saml {
     idp_metadata_xml = each.value.saml.idp_metadata_xml
   }
 }
 
 resource "google_iam_workload_identity_pool" "default" {
-  provider                  = google-beta
-  count                     = length(local.workload_identity_providers) > 0 ? 1 : 0
-  project                   = module.automation-project.project_id
-  workload_identity_pool_id = "${var.prefix}-bootstrap"
+  provider = google-beta
+  count    = length(local.workload_identity_providers) > 0 ? 1 : 0
+  project  = module.automation-project.project_id
+  workload_identity_pool_id = templatestring(
+    var.resource_names["wif-bootstrap"], { prefix = var.prefix }
+  )
 }
 
 resource "google_iam_workload_identity_pool_provider" "default" {
@@ -67,9 +74,13 @@ resource "google_iam_workload_identity_pool_provider" "default" {
   workload_identity_pool_id = (
     google_iam_workload_identity_pool.default[0].workload_identity_pool_id
   )
-  workload_identity_pool_provider_id = "${var.prefix}-bootstrap-${each.key}"
-  attribute_condition                = each.value.attribute_condition
-  attribute_mapping                  = each.value.attribute_mapping
+  workload_identity_pool_provider_id = templatestring(
+    var.resource_names["wif-provider_template"], {
+      prefix = var.prefix
+      key    = each.key
+  })
+  attribute_condition = each.value.attribute_condition
+  attribute_mapping   = each.value.attribute_mapping
   oidc {
     # Setting an empty list configures allowed_audiences to the url of the provider
     allowed_audiences = each.value.custom_settings.audiences