diff --git a/README.md b/README.md index 2eed5d8925..b4711da73e 100644 --- a/README.md +++ b/README.md @@ -41,4 +41,4 @@ For more information and usage examples see each module's README file. ## End-to-end blueprints -The [blueprints](./blueprints/) in this repository are split in several main sections: **[foundational blueprints](./blueprints/foundations/)** that bootstrap the organizational hierarchy and automation prerequisites, **[networking blueprints](./blueprints/networking/)** that implement core patterns or features, **[data solutions blueprints](./blueprints/data-solutions/)** that demonstrate how to integrate data services in complete scenarios, **[cloud operations blueprints](./blueprints/cloud-operations/)** that leverage specific products to meet specific operational needs and **[factories](./blueprints/factories/)** that implement resource factories for the repetitive creation of specific resources. +The [blueprints](./blueprints/) in this repository are split in several main sections: **[networking blueprints](./blueprints/networking/)** that implement core patterns or features, **[data solutions blueprints](./blueprints/data-solutions/)** that demonstrate how to integrate data services in complete scenarios, **[cloud operations blueprints](./blueprints/cloud-operations/)** that leverage specific products to meet specific operational needs and **[factories](./blueprints/factories/)** that implement resource factories for the repetitive creation of specific resources, and finally **[GKE](./blueprints/gke)** and **[serverless](./blueprints/serverless)** design blueprints. diff --git a/blueprints/README.md b/blueprints/README.md index 5c2705c7bc..b38370bb4a 100644 --- a/blueprints/README.md +++ b/blueprints/README.md @@ -1,14 +1,15 @@ # Terraform end-to-end blueprints for Google Cloud -This section contains **[foundational blueprints](./foundations/)** that bootstrap the organizational hierarchy and automation prerequisites, **[networking blueprints](./networking/)** that implement core patterns or features, **[data solutions blueprints](./data-solutions/)** that demonstrate how to integrate data services in complete scenarios, **[cloud operations blueprints](./cloud-operations/)** that leverage specific products to meet specific operational needs and **[factories](./factories/)** that implement resource factories for the repetitive creation of specific resources. +This section **[networking blueprints](./networking/)** that implement core patterns or features, **[data solutions blueprints](./data-solutions/)** that demonstrate how to integrate data services in complete scenarios, **[cloud operations blueprints](./cloud-operations/)** that leverage specific products to meet specific operational needs, **[GKE](./gke/)** and **[Serverless](./serverless/)** blueprints, and **[factories](./factories/)** that implement resource factories for the repetitive creation of specific resources. Currently available blueprints: - **cloud operations** - [Resource tracking and remediation via Cloud Asset feeds](./cloud-operations/asset-inventory-feed-remediation), [Granular Cloud DNS IAM via Service Directory](./cloud-operations/dns-fine-grained-iam), [Granular Cloud DNS IAM for Shared VPC](./cloud-operations/dns-shared-vpc), [Compute Engine quota monitoring](./cloud-operations/quota-monitoring), [Scheduled Cloud Asset Inventory Export to Bigquery](./cloud-operations/scheduled-asset-inventory-export-bq), [Packer image builder](./cloud-operations/packer-image-builder), [On-prem SA key management](./cloud-operations/onprem-sa-key-management), [TCP healthcheck for unmanaged GCE instances](./cloud-operations/unmanaged-instances-healthcheck), [HTTP Load Balancer with Cloud Armor](./cloud-operations/glb_and_armor) - **data solutions** - [GCE/GCS CMEK via centralized Cloud KMS](./data-solutions/gcs-to-bq-with-least-privileges/), [Cloud Storage to Bigquery with Cloud Dataflow with least privileges](./data-solutions/gcs-to-bq-with-least-privileges/), [Data Platform Foundations](./data-solutions/data-platform-foundations/), [SQL Server AlwaysOn availability groups blueprint](./data-solutions/sqlserver-alwayson), [Cloud SQL instance with multi-region read replicas](./data-solutions/cloudsql-multiregion/) - **factories** - [The why and the how of resource factories](./factories/README.md) -- **foundations** - [single level hierarchy](./foundations/environments/) (environments), [multiple level hierarchy](./foundations/business-units/) (business units + environments) +- **GKE** - [GKE multitenant fleet](./gke/multitenant-fleet/), [Shared VPC with GKE support](./networking/shared-vpc-gke/), [Binary Authorization Pipeline](./gke/binauthz/), [Multi-cluster mesh on GKE (fleet API)](./gke/multi-cluster-mesh-gke-fleet-api/) - **networking** - [hub and spoke via peering](./networking/hub-and-spoke-peering/), [hub and spoke via VPN](./networking/hub-and-spoke-vpn/), [DNS and Google Private Access for on-premises](./networking/onprem-google-access-dns/), [Shared VPC with GKE support](./networking/shared-vpc-gke/), [ILB as next hop](./networking/ilb-next-hop), [PSC for on-premises Cloud Function invocation](./networking/private-cloud-function-from-onprem/), [decentralized firewall](./networking/decentralized-firewall) +- **serverless** - [Multi-region deployments for API Gateway](./serverless/api-gateway/) - **third party solutions** - [OpenShift cluster on Shared VPC](./third-party-solutions/openshift) -For more information see the README files in the [foundations](./foundations/), [networking](./networking/), [data solutions](./data-solutions/), [cloud operations](./cloud-operations/) and [factories](./factories/) folders. +For more information see the individual README files in each section. diff --git a/blueprints/foundations/README.md b/blueprints/foundations/README.md deleted file mode 100644 index b31645783d..0000000000 --- a/blueprints/foundations/README.md +++ /dev/null @@ -1,48 +0,0 @@ -# Cloud foundation blueprints - -The blueprints in this folder deal with cloud foundations: the set of resources used to **create the organizational hierarchy** (folders and specific IAM roles), **implement top-level initial best practices** (audit log exports, policies) and **bootstrap infrastructure automation** (GCS buckets, service accounts and IAM roles). - -The blueprints are derived from actual production use cases, and are meant to be used as-is, or extended to create more complex hierarchies. The guiding principles they implement are: - -- divide the hierarchy in separate partitions along environment/organization boundaries, to enforce separation of duties and decouple organization admin permissions from the day-to-day running of infrastructure -- keep top-level Terraform code minimal and encapsulate complexity in modules, to ensure readability and allow using code as high level documentation - -## Blueprints - -### Environment Hierarchy - - This [blueprint](./environments/) implements a simple one-level organizational layout, which is commonly used to bootstrap small infrastructures, or in situations where lower level folders are managed with separate, more granular Terraform setups. - -One authoritative service account, one bucket and one folder are created for each environment, together with top-level shared resources. This blueprint's simplicity makes it a good starting point to understand and prototype foundational design. - -
- -### Business Unit / Environment Hierarchy - - This [blueprint](./business-units/) implements a two-level organizational layout, with a first level usually mapped to business units, and a second level implementing identical environments (prod, test, etc.) under each first-level folder. - -This approach maps well to medium sized infrastructures, and can be used as a starting point for more complex scenarios. Separate Terraform stages are then usually implemented for each business unit, implementing fine-grained project and service account creation for individual application teams. -
- -## Operational considerations - -These blueprints are always used manually, as they require very high-level permissions and are updated infrequently. - -The IAM roles needed are: - -- Project Creator, Folder Administrator, Logging Administrator on the root node (org or folder) -- Billing Account Administrator on the billing account or org -- Organization Administrator if Shared VPC roles have to be granted to the automation service accounts created for each scope - -State is local on the first run, then it should be moved to the GCS bucket created by the blueprints for this specific purpose: - -```bash -# first apply -terraform apply -# create backend file -cp backend.tf.sample backend.tf -# edit backend.tf and use bootstrap_tf_gcs_bucket output for GCS bucket name -vi backend.tf -# once done, move local state to GCS bucket -terraform init -``` diff --git a/blueprints/foundations/business-units/README.md b/blueprints/foundations/business-units/README.md deleted file mode 100644 index f75d44f954..0000000000 --- a/blueprints/foundations/business-units/README.md +++ /dev/null @@ -1,59 +0,0 @@ -# Business-units based organizational sample - -This sample creates an organizational layout with two folder levels, where the first level is usually mapped to one business unit or team (infra, data, analytics) and the second level represents environments (prod, test). It also sets up all prerequisites for automation (GCS state buckets, service accounts, etc.), and the correct roles on those to enforce separation of duties at the environment level. - -This layout is well suited for medium-sized infrastructures managed by different sets of teams, and in cases where the core infrastructure is managed centrally, as the top-level automation service accounts for each environment allow cross-team management of the base resources (projects, IAM, etc.). - -![High-level diagram](diagram.png "High-level diagram") - -Refer to the [section-level README](../README.md) for general considerations about this type of samples, and usage instructions. - -## Managed resources and services - -This sample creates several distinct groups of resources: - -- one top-level folder per business unit/team -- one top-level folder for shared services -- one second-level folder for each environment in all the business unit top-level folders -- one project in the shared folder to hold Terraform-related resources -- one project in the shared folder to set up and host centralized audit log exports -- one project in the shared folder to hold services used across environments like GCS, GCR, KMS, Cloud Build, etc. - -The number of resources in this sample is kept to a minimum so as to make it generally applicable, more resources can be easily added by leveraging other [modules from our bundle](../../../modules/), or from other sources like the [CFT suite](https://github.com/terraform-google-modules). - -## Shared services - -This sample uses a top-level folder to encapsulate projects that host resources that are not specific to a single environment. If no shared services are needed,the Terraform and audit modules can be easily attached to the root node, and the shared services folder and project removed from `main.tf`. - - -## Variables - -| name | description | type | required | default | -|---|---|:---:|:---:|:---:| -| [billing_account_id](variables.tf#L27) | Billing account id used as default for new projects. | string | ✓ | | -| [organization_id](variables.tf#L69) | Organization id in organizations/nnnnnnn format. | string | ✓ | | -| [prefix](variables.tf#L74) | Prefix used for resources that need unique names. | string | ✓ | | -| [root_node](variables.tf#L88) | Root node for the new hierarchy, either 'organizations/org_id' or 'folders/folder_id'. | string | ✓ | | -| [audit_filter](variables.tf#L17) | Audit log filter used for the log sink. | string | | … | -| [environments](variables.tf#L32) | Environment short names. | map(string) | | {…} | -| [gcs_defaults](variables.tf#L42) | Defaults use for the state GCS buckets. | map(string) | | {…} | -| [iam_audit_viewers](variables.tf#L51) | Audit project viewers, in IAM format. | list(string) | | [] | -| [iam_shared_owners](variables.tf#L57) | Shared services project owners, in IAM format. | list(string) | | [] | -| [iam_terraform_owners](variables.tf#L63) | Terraform project owners, in IAM format. | list(string) | | [] | -| [project_services](variables.tf#L79) | Service APIs enabled by default in new projects. | list(string) | | […] | - -## Outputs - -| name | description | sensitive | -|---|---|:---:| -| [audit_logs_project](outputs.tf#L17) | Project that holds the audit logs export resources. | | -| [bootstrap_tf_gcs_bucket](outputs.tf#L22) | GCS bucket used for the bootstrap Terraform state. | | -| [bu_business_intelligence](outputs.tf#L27) | Business Intelligence attributes. | | -| [bu_business_intelligence_keys](outputs.tf#L37) | Business Intelligence service account keys. | ✓ | -| [bu_machine_learning](outputs.tf#L43) | Machine Learning attributes. | | -| [bu_machine_learning_keys](outputs.tf#L53) | Machine Learning service account keys. | ✓ | -| [shared_folder_id](outputs.tf#L59) | Shared folder id. | | -| [shared_resources_project](outputs.tf#L64) | Project that holdes resources shared across business units. | | -| [terraform_project](outputs.tf#L69) | Project that holds the base Terraform resources. | | - - diff --git a/blueprints/foundations/business-units/backend.tf.sample b/blueprints/foundations/business-units/backend.tf.sample deleted file mode 100644 index 065cd071e0..0000000000 --- a/blueprints/foundations/business-units/backend.tf.sample +++ /dev/null @@ -1,22 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -terraform { - backend "gcs" { - # once initial apply has completed, copy this file to `backend.tf` then - # set the `bucket` value to the `bootstrap_tf_gcs_bucket` output, then - # run apply again to transfer state - bucket = "" - } -} diff --git a/blueprints/foundations/business-units/diagram.png b/blueprints/foundations/business-units/diagram.png deleted file mode 100644 index 5692b1d4ac..0000000000 Binary files a/blueprints/foundations/business-units/diagram.png and /dev/null differ diff --git a/blueprints/foundations/business-units/main.tf b/blueprints/foundations/business-units/main.tf deleted file mode 100644 index 0e1535bb30..0000000000 --- a/blueprints/foundations/business-units/main.tf +++ /dev/null @@ -1,175 +0,0 @@ -/** - * Copyright 2022 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -locals { - logging_sinks = { - audit-logs = { - type = "bigquery" - destination = module.audit-dataset.id - filter = var.audit_filter - iam = true - include_children = true - } - } - root_node_type = split("/", var.root_node)[0] -} - -############################################################################### -# Terraform top-level resources # -############################################################################### - -# Shared folder - -module "shared-folder" { - source = "../../../modules/folder" - parent = var.root_node - name = "shared" -} - -# Terraform project - -module "tf-project" { - source = "../../../modules/project" - name = "terraform" - parent = module.shared-folder.id - prefix = var.prefix - billing_account = var.billing_account_id - iam_additive = { - for name in var.iam_terraform_owners : (name) => ["roles/owner"] - } - services = var.project_services -} - -# Bootstrap Terraform state GCS bucket - -module "tf-gcs-bootstrap" { - source = "../../../modules/gcs" - project_id = module.tf-project.project_id - name = "tf-bootstrap" - prefix = "${var.prefix}-tf" - location = var.gcs_defaults.location -} - -############################################################################### -# Business units # -############################################################################### - -module "bu-business-intelligence" { - source = "../../../modules/folders-unit" - name = "Business Intelligence" - short_name = "bi" - automation_project_id = module.tf-project.project_id - billing_account_id = var.billing_account_id - environments = var.environments - gcs_defaults = var.gcs_defaults - organization_id = var.organization_id - root_node = var.root_node - prefix = var.prefix - # extra variables from the folders-unit module can be used here to grant - # IAM roles to the bu users, configure the automation service accounts, etc. - # iam_roles = ["viewer"] - # iam_members = { viewer = ["user:user@example.com"] } -} - -module "bu-machine-learning" { - source = "../../../modules/folders-unit" - name = "Machine Learning" - short_name = "ml" - automation_project_id = module.tf-project.project_id - billing_account_id = var.billing_account_id - environments = var.environments - gcs_defaults = var.gcs_defaults - organization_id = var.organization_id - root_node = var.root_node - prefix = var.prefix - # extra variables from the folders-unit module can be used here to grant - # IAM roles to the bu users, configure the automation service accounts, etc. -} - -############################################################################### -# Audit log exports # -############################################################################### - -# Audit logs project - -module "audit-project" { - source = "../../../modules/project" - name = "audit" - parent = module.shared-folder.id - prefix = var.prefix - billing_account = var.billing_account_id - iam = { - "roles/viewer" = var.iam_audit_viewers - } - services = concat(var.project_services, [ - "bigquery.googleapis.com", - ]) -} - -# audit logs dataset and sink - -module "audit-dataset" { - source = "../../../modules/bigquery-dataset" - project_id = module.audit-project.project_id - id = "audit_export" - friendly_name = "Audit logs export." - # disable delete on destroy for actual use - options = { - default_table_expiration_ms = null - default_partition_expiration_ms = null - delete_contents_on_destroy = true - } -} - -# uncomment the next two modules to create the logging sinks - -# module "root_org" { -# count = local.root_node_type == "organizations" ? 1 : 0 -# source = "../../../modules/organization" -# organization_id = var.root_node -# logging_sinks = local.logging_sinks -# exclusions = {} -# } - -# module "root_folder" { -# count = local.root_node_type == "folders" ? 1 : 0 -# source = "../../../modules/folder" -# id = var.root_node -# folder_create = false -# logging_sinks = local.logging_sinks -# exclusions = {} -# } - -############################################################################### -# Shared resources (GCR, GCS, KMS, etc.) # -############################################################################### - -# Shared resources project - -module "shared-project" { - source = "../../../modules/project" - name = "shared" - parent = module.shared-folder.id - prefix = var.prefix - billing_account = var.billing_account_id - iam_additive = { - for name in var.iam_shared_owners : (name) => ["roles/owner"] - } - services = var.project_services -} - -# Add further modules here for resources that are common to all business units -# like GCS buckets (used to hold shared assets), Container Registry, KMS, etc. diff --git a/blueprints/foundations/business-units/outputs.tf b/blueprints/foundations/business-units/outputs.tf deleted file mode 100644 index 4456123a07..0000000000 --- a/blueprints/foundations/business-units/outputs.tf +++ /dev/null @@ -1,75 +0,0 @@ -/** - * Copyright 2022 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -output "audit_logs_project" { - description = "Project that holds the audit logs export resources." - value = module.audit-project.project_id -} - -output "bootstrap_tf_gcs_bucket" { - description = "GCS bucket used for the bootstrap Terraform state." - value = module.tf-gcs-bootstrap.name -} - -output "bu_business_intelligence" { - description = "Business Intelligence attributes." - value = { - unit_folder = module.bu-business-intelligence.unit_folder, - env_gcs_buckets = module.bu-business-intelligence.env_gcs_buckets - env_folders = module.bu-business-intelligence.env_folders - env_service_accounts = module.bu-business-intelligence.env_service_accounts - } -} - -output "bu_business_intelligence_keys" { - description = "Business Intelligence service account keys." - sensitive = true - value = module.bu-business-intelligence.env_sa_keys -} - -output "bu_machine_learning" { - description = "Machine Learning attributes." - value = { - unit_folder = module.bu-machine-learning.unit_folder, - env_gcs_buckets = module.bu-machine-learning.env_gcs_buckets - env_folders = module.bu-machine-learning.env_folders - env_service_accounts = module.bu-machine-learning.env_service_accounts - } -} - -output "bu_machine_learning_keys" { - description = "Machine Learning service account keys." - sensitive = true - value = module.bu-machine-learning.env_sa_keys -} - -output "shared_folder_id" { - description = "Shared folder id." - value = module.shared-folder.id -} - -output "shared_resources_project" { - description = "Project that holdes resources shared across business units." - value = module.shared-project.project_id -} - -output "terraform_project" { - description = "Project that holds the base Terraform resources." - value = module.tf-project.project_id -} - -# Add further outputs here for the additional modules that manage shared -# resources, like GCR, GCS buckets, KMS, etc. diff --git a/blueprints/foundations/business-units/terraform.tfvars.sample b/blueprints/foundations/business-units/terraform.tfvars.sample deleted file mode 100644 index 7036b9697d..0000000000 --- a/blueprints/foundations/business-units/terraform.tfvars.sample +++ /dev/null @@ -1,19 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -billing_account_id = "014617-19UCBC-AF02D9" -organization_id= "500001140800" -prefix = "xyz" -root_node = "folders/9572793983696" -generate_keys = true diff --git a/blueprints/foundations/business-units/variables.tf b/blueprints/foundations/business-units/variables.tf deleted file mode 100644 index 69f5ac3b22..0000000000 --- a/blueprints/foundations/business-units/variables.tf +++ /dev/null @@ -1,91 +0,0 @@ -/** - * Copyright 2022 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -variable "audit_filter" { - description = "Audit log filter used for the log sink." - type = string - default = < - -## Variables - -| name | description | type | required | default | -|---|---|:---:|:---:|:---:| -| [billing_account_id](variables.tf#L25) | Billing account id used as to create projects. | string | ✓ | | -| [environments](variables.tf#L30) | Environment short names. | set(string) | ✓ | | -| [organization_id](variables.tf#L94) | Organization id in organizations/nnnnnnnn format. | string | ✓ | | -| [prefix](variables.tf#L99) | Prefix used for resources that need unique names. | string | ✓ | | -| [root_node](variables.tf#L113) | Root node for the new hierarchy, either 'organizations/org_id' or 'folders/folder_id'. | string | ✓ | | -| [audit_filter](variables.tf#L15) | Audit log filter used for the log sink. | string | | … | -| [gcs_location](variables.tf#L35) | GCS bucket location. | string | | "EU" | -| [iam_audit_viewers](variables.tf#L41) | Audit project viewers, in IAM format. | list(string) | | [] | -| [iam_billing_config](variables.tf#L47) | Control granting billing user role to service accounts. Target the billing account by default. | object({…}) | | {…} | -| [iam_folder_roles](variables.tf#L59) | List of roles granted to each service account on its respective folder (excluding XPN roles). | list(string) | | […] | -| [iam_shared_owners](variables.tf#L70) | Shared services project owners, in IAM format. | list(string) | | [] | -| [iam_terraform_owners](variables.tf#L76) | Terraform project owners, in IAM format. | list(string) | | [] | -| [iam_xpn_config](variables.tf#L82) | Control granting Shared VPC creation roles to service accounts. Target the root node by default. | object({…}) | | {…} | -| [project_services](variables.tf#L104) | Service APIs enabled by default in new projects. | list(string) | | […] | -| [service_account_keys](variables.tf#L118) | Generate and store service account keys in the state file. | bool | | true | - -## Outputs - -| name | description | sensitive | -|---|---|:---:| -| [audit_logs_bq_dataset](outputs.tf#L15) | Bigquery dataset for the audit logs export. | | -| [audit_logs_project](outputs.tf#L20) | Project that holds the audit logs export resources. | | -| [bootstrap_tf_gcs_bucket](outputs.tf#L25) | GCS bucket used for the bootstrap Terraform state. | | -| [environment_folders](outputs.tf#L30) | Top-level environment folders. | | -| [environment_service_account_keys](outputs.tf#L35) | Service account keys used to run each environment Terraform modules. | ✓ | -| [environment_service_accounts](outputs.tf#L40) | Service accounts used to run each environment Terraform modules. | | -| [environment_tf_gcs_buckets](outputs.tf#L45) | GCS buckets used for each environment Terraform state. | | -| [shared_services_project](outputs.tf#L50) | Project that holdes resources shared across environments. | | -| [terraform_project](outputs.tf#L55) | Project that holds the base Terraform resources. | | - - diff --git a/blueprints/foundations/environments/backend.tf.sample b/blueprints/foundations/environments/backend.tf.sample deleted file mode 100644 index 4232a96eb9..0000000000 --- a/blueprints/foundations/environments/backend.tf.sample +++ /dev/null @@ -1,23 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - - -terraform { - backend "gcs" { - # once initial apply has completed, copy this file to `backend.tf` then - # set the `bucket` value to the `bootstrap_tf_gcs_bucket` output, then - # run apply again to transfer state - bucket = "" - } -} diff --git a/blueprints/foundations/environments/diagram.png b/blueprints/foundations/environments/diagram.png deleted file mode 100644 index ac6d79364a..0000000000 Binary files a/blueprints/foundations/environments/diagram.png and /dev/null differ diff --git a/blueprints/foundations/environments/locals.tf b/blueprints/foundations/environments/locals.tf deleted file mode 100644 index f6c9ae0bac..0000000000 --- a/blueprints/foundations/environments/locals.tf +++ /dev/null @@ -1,50 +0,0 @@ -/** - * Copyright 2022 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -locals { - folder_roles = concat(var.iam_folder_roles, local.sa_xpn_folder_role) - organization_id = element(split("/", var.organization_id), 1) - sa_billing_account_role = ( - var.iam_billing_config.target_org ? [] : ["roles/billing.user"] - ) - sa_billing_org_role = ( - !var.iam_billing_config.target_org ? [] : ["roles/billing.user"] - ) - sa_xpn_folder_role = ( - local.sa_xpn_target_org ? [] : ["roles/compute.xpnAdmin"] - ) - sa_xpn_org_roles = ( - local.sa_xpn_target_org - ? ["roles/compute.xpnAdmin", "roles/resourcemanager.organizationViewer"] - : ["roles/resourcemanager.organizationViewer"] - ) - sa_xpn_target_org = ( - var.iam_xpn_config.target_org - || - substr(var.root_node, 0, 13) == "organizations" - ) - logging_sinks = { - audit-logs = { - type = "bigquery" - destination = module.audit-dataset.id - filter = var.audit_filter - iam = true - include_children = true - exclusions = {} - } - } - root_node_type = split("/", var.root_node)[0] -} diff --git a/blueprints/foundations/environments/main.tf b/blueprints/foundations/environments/main.tf deleted file mode 100644 index 00b623259b..0000000000 --- a/blueprints/foundations/environments/main.tf +++ /dev/null @@ -1,168 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -############################################################################### -# Terraform top-level resources # -############################################################################### - -# Terraform project - -module "tf-project" { - source = "../../../modules/project" - name = "terraform" - parent = var.root_node - prefix = var.prefix - billing_account = var.billing_account_id - iam_additive = { - "roles/owner" = var.iam_terraform_owners - } - services = var.project_services -} - -# per-environment service accounts - -module "tf-service-accounts" { - source = "../../../modules/iam-service-account" - for_each = var.environments - project_id = module.tf-project.project_id - name = each.value - prefix = var.prefix - iam_billing_roles = { - (var.billing_account_id) = ( - var.iam_billing_config.grant ? local.sa_billing_account_role : [] - ) - } - # folder roles are set in the folders module using authoritative bindings - iam_organization_roles = { - (local.organization_id) = concat( - var.iam_billing_config.grant ? local.sa_billing_org_role : [], - var.iam_xpn_config.grant ? local.sa_xpn_org_roles : [] - ) - } - generate_key = var.service_account_keys -} - -# bootstrap Terraform state GCS bucket - -module "tf-gcs-bootstrap" { - source = "../../../modules/gcs" - project_id = module.tf-project.project_id - name = "tf-bootstrap" - prefix = "${var.prefix}-tf" - location = var.gcs_location -} - -# per-environment Terraform state GCS buckets - -module "tf-gcs-environments" { - source = "../../../modules/gcs" - for_each = var.environments - project_id = module.tf-project.project_id - name = each.value - prefix = "${var.prefix}-tf" - location = var.gcs_location - iam = { - "roles/storage.objectAdmin" = [module.tf-service-accounts[each.value].iam_email] - } -} - -############################################################################### -# Top-level folders # -############################################################################### - -module "environment-folders" { - source = "../../../modules/folder" - for_each = var.environments - parent = var.root_node - name = each.value - iam = { - for role in local.folder_roles : - (role) => [module.tf-service-accounts[each.value].iam_email] - } -} - -############################################################################### -# Audit log exports # -############################################################################### - -# audit logs project - -module "audit-project" { - source = "../../../modules/project" - name = "audit" - parent = var.root_node - prefix = var.prefix - billing_account = var.billing_account_id - iam = { - "roles/viewer" = var.iam_audit_viewers - } - services = concat(var.project_services, [ - "bigquery.googleapis.com", - ]) -} - -# audit logs dataset and sink - -module "audit-dataset" { - source = "../../../modules/bigquery-dataset" - project_id = module.audit-project.project_id - id = "audit_export" - friendly_name = "Audit logs export." - # disable delete on destroy for actual use - options = { - default_table_expiration_ms = null - default_partition_expiration_ms = null - delete_contents_on_destroy = true - } -} - -# uncomment the next two modules to create the logging sinks - -# module "root_org" { -# count = local.root_node_type == "organizations" ? 1 : 0 -# source = "../../../modules/organization" -# organization_id = var.root_node -# logging_sinks = local.logging_sinks -# } - -# module "root_folder" { -# count = local.root_node_type == "folders" ? 1 : 0 -# source = "../../../modules/folder" -# id = var.root_node -# folder_create = false -# logging_sinks = local.logging_sinks -# } - - -############################################################################### -# Shared resources (GCR, GCS, KMS, etc.) # -############################################################################### - -# shared resources project -# see the README file for additional options on managing shared services - -module "sharedsvc-project" { - source = "../../../modules/project" - name = "sharedsvc" - parent = var.root_node - prefix = var.prefix - billing_account = var.billing_account_id - iam_additive = { - "roles/owner" = var.iam_shared_owners - } - services = var.project_services -} - -# Add further modules here for resources that are common to all environments -# like GCS buckets (used to hold shared assets), Container Registry, KMS, etc. diff --git a/blueprints/foundations/environments/outputs.tf b/blueprints/foundations/environments/outputs.tf deleted file mode 100644 index 4d5f9d4c25..0000000000 --- a/blueprints/foundations/environments/outputs.tf +++ /dev/null @@ -1,61 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -output "audit_logs_bq_dataset" { - description = "Bigquery dataset for the audit logs export." - value = module.audit-dataset.id -} - -output "audit_logs_project" { - description = "Project that holds the audit logs export resources." - value = module.audit-project.project_id -} - -output "bootstrap_tf_gcs_bucket" { - description = "GCS bucket used for the bootstrap Terraform state." - value = module.tf-gcs-bootstrap.name -} - -output "environment_folders" { - description = "Top-level environment folders." - value = { for folder in module.environment-folders : folder.name => folder.id } -} - -output "environment_service_account_keys" { - description = "Service account keys used to run each environment Terraform modules." - sensitive = true - value = { for env, sa in module.tf-service-accounts : env => sa.key } -} -output "environment_service_accounts" { - description = "Service accounts used to run each environment Terraform modules." - value = { for env, sa in module.tf-service-accounts : env => sa.email } -} - -output "environment_tf_gcs_buckets" { - description = "GCS buckets used for each environment Terraform state." - value = { for env, bucket in module.tf-gcs-environments : env => bucket.name } -} - -output "shared_services_project" { - description = "Project that holdes resources shared across environments." - value = module.sharedsvc-project.project_id -} - -output "terraform_project" { - description = "Project that holds the base Terraform resources." - value = module.tf-project.project_id -} - -# Add further outputs here for the additional modules that manage shared -# resources, like GCR, GCS buckets, KMS, etc. diff --git a/blueprints/foundations/environments/variables.tf b/blueprints/foundations/environments/variables.tf deleted file mode 100644 index 3b38a8ca2a..0000000000 --- a/blueprints/foundations/environments/variables.tf +++ /dev/null @@ -1,122 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -variable "audit_filter" { - description = "Audit log filter used for the log sink." - type = string - default = < This [blueprint](./multitenant-fleet/) allows simple centralized management of similar sets of GKE clusters and their nodepools in a single project, and optional fleet management via GKE Hub templated configurations. -
diff --git a/blueprints/gke/README.md b/blueprints/gke/README.md new file mode 100644 index 0000000000..a2c4807134 --- /dev/null +++ b/blueprints/gke/README.md @@ -0,0 +1,29 @@ +# GKE blueprints + +The blueprints in this folder show implement **end-to-end scenarios** for GKE topologies that show how to automate common configurations or leverage specific products. + +They are meant to be used as minimal but complete starting points to create actual infrastructure, and as playgrounds to experiment with Google Cloud features. + +## Blueprints + +### Multitenant GKE fleet + + This [blueprint](./multitenant-fleet/) allows simple centralized management of similar sets of GKE clusters and their nodepools in a single project, and optional fleet management via GKE Hub templated configurations. +
+ +### Shared VPC with GKE and per-subnet support + + This [blueprint](../networking/shared-vpc-gke/) shows how to configure a Shared VPC, including the specific IAM configurations needed for GKE, and to give different level of access to the VPC subnets to different identities. + +It is meant to be used as a starting point for most Shared VPC configurations, and to be integrated to the above blueprints where Shared VPC is needed in more complex network topologies. +
+ +### Binary Authorization Pipeline + + This [blueprint](../gke/binauthz/) shows how to create a CI and a CD pipeline in Cloud Build for the deployment of an application to a private GKE cluster with unrestricted access to a public endpoint. The blueprint enables a Binary Authorization policy in the project so only images that have been attested can be deployed to the cluster. The attestations are created using a cryptographic key pair that has been provisioned in KMS. +
+ +### Multi-cluster mesh on GKE (fleet API) + + This [blueprint](../gke/multi-cluster-mesh-gke-fleet-api/) shows how to create a multi-cluster mesh for two private clusters on GKE. Anthos Service Mesh with automatic control plane management is set up for clusters using the Fleet API. This can only be done if the clusters are in a single project and in the same VPC. In this particular case both clusters having being deployed to different subnets in a shared VPC. +
diff --git a/blueprints/cloud-operations/binauthz/README.md b/blueprints/gke/binauthz/README.md similarity index 99% rename from blueprints/cloud-operations/binauthz/README.md rename to blueprints/gke/binauthz/README.md index 5197e6e24f..dad6dd8af5 100644 --- a/blueprints/cloud-operations/binauthz/README.md +++ b/blueprints/gke/binauthz/README.md @@ -1,4 +1,4 @@ -# Binary Authorization +# Binary Authorization Pipeline Blueprint The following blueprint shows to how to create a CI and a CD pipeline in Cloud Build for the deployment of an application to a private GKE cluster with unrestricted access to a public endpoint. The blueprint enables a Binary Authorization policy in the project so only images that have been attested can be deployed to the cluster. The attestations are created using a cryptographic key pair that has been provisioned in KMS. diff --git a/blueprints/cloud-operations/binauthz/app/clobuild.yaml b/blueprints/gke/binauthz/app/clobuild.yaml similarity index 100% rename from blueprints/cloud-operations/binauthz/app/clobuild.yaml rename to blueprints/gke/binauthz/app/clobuild.yaml diff --git a/blueprints/cloud-operations/binauthz/diagram.png b/blueprints/gke/binauthz/diagram.png similarity index 100% rename from blueprints/cloud-operations/binauthz/diagram.png rename to blueprints/gke/binauthz/diagram.png diff --git a/blueprints/cloud-operations/binauthz/image/.dockerignore b/blueprints/gke/binauthz/image/.dockerignore similarity index 100% rename from blueprints/cloud-operations/binauthz/image/.dockerignore rename to blueprints/gke/binauthz/image/.dockerignore diff --git a/blueprints/cloud-operations/binauthz/image/.gitignore b/blueprints/gke/binauthz/image/.gitignore similarity index 100% rename from blueprints/cloud-operations/binauthz/image/.gitignore rename to blueprints/gke/binauthz/image/.gitignore diff --git a/blueprints/cloud-operations/binauthz/image/Dockerfile b/blueprints/gke/binauthz/image/Dockerfile similarity index 100% rename from blueprints/cloud-operations/binauthz/image/Dockerfile rename to blueprints/gke/binauthz/image/Dockerfile diff --git a/blueprints/cloud-operations/binauthz/image/README.md b/blueprints/gke/binauthz/image/README.md similarity index 100% rename from blueprints/cloud-operations/binauthz/image/README.md rename to blueprints/gke/binauthz/image/README.md diff --git a/blueprints/cloud-operations/binauthz/image/cloudbuild.yaml b/blueprints/gke/binauthz/image/cloudbuild.yaml similarity index 100% rename from blueprints/cloud-operations/binauthz/image/cloudbuild.yaml rename to blueprints/gke/binauthz/image/cloudbuild.yaml diff --git a/blueprints/cloud-operations/binauthz/image/index.js b/blueprints/gke/binauthz/image/index.js similarity index 100% rename from blueprints/cloud-operations/binauthz/image/index.js rename to blueprints/gke/binauthz/image/index.js diff --git a/blueprints/cloud-operations/binauthz/image/package-lock.json b/blueprints/gke/binauthz/image/package-lock.json similarity index 100% rename from blueprints/cloud-operations/binauthz/image/package-lock.json rename to blueprints/gke/binauthz/image/package-lock.json diff --git a/blueprints/cloud-operations/binauthz/image/package.json b/blueprints/gke/binauthz/image/package.json similarity index 100% rename from blueprints/cloud-operations/binauthz/image/package.json rename to blueprints/gke/binauthz/image/package.json diff --git a/blueprints/cloud-operations/binauthz/main.tf b/blueprints/gke/binauthz/main.tf similarity index 100% rename from blueprints/cloud-operations/binauthz/main.tf rename to blueprints/gke/binauthz/main.tf diff --git a/blueprints/cloud-operations/binauthz/outputs.tf b/blueprints/gke/binauthz/outputs.tf similarity index 100% rename from blueprints/cloud-operations/binauthz/outputs.tf rename to blueprints/gke/binauthz/outputs.tf diff --git a/blueprints/cloud-operations/binauthz/templates/app.yaml.tpl b/blueprints/gke/binauthz/templates/app.yaml.tpl similarity index 100% rename from blueprints/cloud-operations/binauthz/templates/app.yaml.tpl rename to blueprints/gke/binauthz/templates/app.yaml.tpl diff --git a/blueprints/cloud-operations/binauthz/templates/tenant-setup.yaml.tpl b/blueprints/gke/binauthz/templates/tenant-setup.yaml.tpl similarity index 100% rename from blueprints/cloud-operations/binauthz/templates/tenant-setup.yaml.tpl rename to blueprints/gke/binauthz/templates/tenant-setup.yaml.tpl diff --git a/blueprints/cloud-operations/binauthz/variables.tf b/blueprints/gke/binauthz/variables.tf similarity index 100% rename from blueprints/cloud-operations/binauthz/variables.tf rename to blueprints/gke/binauthz/variables.tf diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/.gitignore b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/.gitignore similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/.gitignore rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/.gitignore diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/README.md b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/README.md similarity index 99% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/README.md rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/README.md index 9cac15be7f..484e6b13ab 100644 --- a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/README.md +++ b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/README.md @@ -4,7 +4,7 @@ The following blueprint shows how to create a multi-cluster mesh for two private The diagram below depicts the architecture of the blueprint. -![Architecture](architecture.png) +![Architecture diagram](diagram.png) Terraform is used to provision the required infrastructure, create the IAM binding and register the clusters to the fleet. diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/ansible.cfg b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/ansible.cfg similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/ansible.cfg rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/ansible.cfg diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/inventory/hosts.ini b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/inventory/hosts.ini similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/inventory/hosts.ini rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/inventory/hosts.ini diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/playbook.yaml b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/playbook.yaml similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/playbook.yaml rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/playbook.yaml diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/endpoint-discovery-config.yaml b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/endpoint-discovery-config.yaml similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/endpoint-discovery-config.yaml rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/endpoint-discovery-config.yaml diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/install.yaml b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/install.yaml similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/install.yaml rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/install.yaml diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/main.yaml b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/main.yaml similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/main.yaml rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/install/tasks/main.yaml diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/prerequisites/tasks/main.yaml b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/prerequisites/tasks/main.yaml similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/prerequisites/tasks/main.yaml rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/prerequisites/tasks/main.yaml diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/test/tasks/main.yaml b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/test/tasks/main.yaml similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/test/tasks/main.yaml rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/test/tasks/main.yaml diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/test/tasks/test.yaml b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/test/tasks/test.yaml similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/ansible/roles/test/tasks/test.yaml rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible/roles/test/tasks/test.yaml diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/architecture.png b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/diagram.png similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/architecture.png rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/diagram.png diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/main.tf b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/main.tf similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/main.tf rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/main.tf diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/templates/gssh.sh.tpl b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/templates/gssh.sh.tpl similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/templates/gssh.sh.tpl rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/templates/gssh.sh.tpl diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/templates/vars.yaml.tpl b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/templates/vars.yaml.tpl similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/templates/vars.yaml.tpl rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/templates/vars.yaml.tpl diff --git a/blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/variables.tf b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/variables.tf similarity index 100% rename from blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api/variables.tf rename to blueprints/gke/multi-cluster-mesh-gke-fleet-api/variables.tf diff --git a/blueprints/gke-serverless/multitenant-fleet/README.md b/blueprints/gke/multitenant-fleet/README.md similarity index 98% rename from blueprints/gke-serverless/multitenant-fleet/README.md rename to blueprints/gke/multitenant-fleet/README.md index dd6d97ff78..68909b82b0 100644 --- a/blueprints/gke-serverless/multitenant-fleet/README.md +++ b/blueprints/gke/multitenant-fleet/README.md @@ -45,7 +45,7 @@ The following example shows how to deploy a single cluster and a single node poo ```hcl module "gke" { - source = "./fabric/blueprints/gke-serverless/multitenant-fleet/" + source = "./fabric/blueprints/gke/multitenant-fleet/" project_id = var.project_id billing_account_id = var.billing_account_id folder_id = var.folder_id @@ -106,10 +106,9 @@ The first cluster `cluster-euw1` defines the mandatory configuration parameters On the other hand, the second cluster (`cluster-euw3`) defines its own configuration by providing a value to the `overrides` key. - ```hcl module "gke" { - source = "./fabric/blueprints/gke-serverless/multitenant-fleet/" + source = "./fabric/blueprints/gke/multitenant-fleet/" project_id = var.project_id billing_account_id = var.billing_account_id folder_id = var.folder_id @@ -200,7 +199,7 @@ This example deploys two clusters and configures several GKE Fleet features: ```hcl module "gke" { - source = "./fabric/blueprints/gke-serverless/multitenant-fleet/" + source = "./fabric/blueprints/gke/multitenant-fleet/" project_id = var.project_id billing_account_id = var.billing_account_id folder_id = var.folder_id diff --git a/blueprints/gke-serverless/multitenant-fleet/diagram.png b/blueprints/gke/multitenant-fleet/diagram.png similarity index 100% rename from blueprints/gke-serverless/multitenant-fleet/diagram.png rename to blueprints/gke/multitenant-fleet/diagram.png diff --git a/blueprints/gke-serverless/multitenant-fleet/gke-clusters.tf b/blueprints/gke/multitenant-fleet/gke-clusters.tf similarity index 100% rename from blueprints/gke-serverless/multitenant-fleet/gke-clusters.tf rename to blueprints/gke/multitenant-fleet/gke-clusters.tf diff --git a/blueprints/gke-serverless/multitenant-fleet/gke-hub.tf b/blueprints/gke/multitenant-fleet/gke-hub.tf similarity index 100% rename from blueprints/gke-serverless/multitenant-fleet/gke-hub.tf rename to blueprints/gke/multitenant-fleet/gke-hub.tf diff --git a/blueprints/gke-serverless/multitenant-fleet/gke-nodepools.tf b/blueprints/gke/multitenant-fleet/gke-nodepools.tf similarity index 100% rename from blueprints/gke-serverless/multitenant-fleet/gke-nodepools.tf rename to blueprints/gke/multitenant-fleet/gke-nodepools.tf diff --git a/blueprints/gke-serverless/multitenant-fleet/main.tf b/blueprints/gke/multitenant-fleet/main.tf similarity index 100% rename from blueprints/gke-serverless/multitenant-fleet/main.tf rename to blueprints/gke/multitenant-fleet/main.tf diff --git a/blueprints/gke-serverless/multitenant-fleet/outputs.tf b/blueprints/gke/multitenant-fleet/outputs.tf similarity index 100% rename from blueprints/gke-serverless/multitenant-fleet/outputs.tf rename to blueprints/gke/multitenant-fleet/outputs.tf diff --git a/blueprints/gke-serverless/multitenant-fleet/variables.tf b/blueprints/gke/multitenant-fleet/variables.tf similarity index 100% rename from blueprints/gke-serverless/multitenant-fleet/variables.tf rename to blueprints/gke/multitenant-fleet/variables.tf diff --git a/blueprints/gke/shared-vpc-gke b/blueprints/gke/shared-vpc-gke new file mode 120000 index 0000000000..e7fc85e67b --- /dev/null +++ b/blueprints/gke/shared-vpc-gke @@ -0,0 +1 @@ +../networking/shared-vpc-gke \ No newline at end of file diff --git a/blueprints/serverless/README.md b/blueprints/serverless/README.md new file mode 100644 index 0000000000..44f39f0f66 --- /dev/null +++ b/blueprints/serverless/README.md @@ -0,0 +1,12 @@ +# Serverless blueprints + +The blueprints in this folder show implement **end-to-end scenarios** for Serveless topologies that show how to automate common configurations or leverage specific products. + +They are meant to be used as minimal but complete starting points to create actual infrastructure, and as playgrounds to experiment with Google Cloud features. + +## Blueprints + +### Multi-region deployments for API Gateway + + This [blueprint](./api-gateway/) shows how to configure a load balancer to enable multi-region deployments for API Gateway. For more details on how this set up work have a look at the article [here](https://cloud.google.com/api-gateway/docs/multi-region-deployment) +
diff --git a/blueprints/serverless/api-gateway/README.md b/blueprints/serverless/api-gateway/README.md index fa350efb38..9e17b11e92 100644 --- a/blueprints/serverless/api-gateway/README.md +++ b/blueprints/serverless/api-gateway/README.md @@ -4,7 +4,7 @@ This tutorial shows you how to configure an HTTP(S) load balancer to enable mult The diagram below depicts the architecture that this blueprint sets up. -![Architecture](architecture.png) +![Architecture diagram](diagram.png) # Running the blueprint diff --git a/blueprints/serverless/api-gateway/architecture.png b/blueprints/serverless/api-gateway/diagram.png similarity index 100% rename from blueprints/serverless/api-gateway/architecture.png rename to blueprints/serverless/api-gateway/diagram.png diff --git a/fast/stages/03-gke-multitenant/README.md b/fast/stages/03-gke-multitenant/README.md index c420659ec5..f08910c834 100644 --- a/fast/stages/03-gke-multitenant/README.md +++ b/fast/stages/03-gke-multitenant/README.md @@ -6,4 +6,4 @@ The Terraform code follows the same general approach used for the [project facto The [`dev` folder](./dev/) contains an example setup for a generic development environment, and can be used as-is or cloned to implement other environments, or more specialized setups -Refer to [the `dev` documentation](./dev/README.md) configuration details, and to [the `gke-serverless` documentation](../../../blueprints/gke-serverless/multitenant-fleet) for the architectural design and decisions taken. +Refer to [the `dev` documentation](./dev/README.md) configuration details, and to [the `gke-serverless` documentation](../../../blueprints/gke/multitenant-fleet) for the architectural design and decisions taken. diff --git a/fast/stages/03-gke-multitenant/dev/README.md b/fast/stages/03-gke-multitenant/dev/README.md index af46cade71..9221facf2a 100644 --- a/fast/stages/03-gke-multitenant/dev/README.md +++ b/fast/stages/03-gke-multitenant/dev/README.md @@ -10,7 +10,7 @@ The following diagram illustrates the high-level design of created resources, wh ## Design overview and choices -> The detailed architecture of the underlying resources is explained in the documentation of [GKE multitenant module](../../../../blueprints/gke-serverless/multitenant-fleet/README.md). +> The detailed architecture of the underlying resources is explained in the documentation of [GKE multitenant module](../../../../blueprints/gke/multitenant-fleet/README.md). This stage creates a project containing and as many clusters and node pools as requested by the user through the [variables](#variables) explained below. The GKE clusters are created with the with the following setup: @@ -37,7 +37,6 @@ This stage creates a project containing and as many clusters and node pools as r - [Use of the GCE persistent disk CSI driver](https://cloud.google.com/kubernetes-engine/docs/how-to/persistent-volumes/gce-pd-csi-driver) - Node [auto-upgrade](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-upgrades) and [auto-repair](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-repair) for all node pools - ## How to run this stage This stage is meant to be executed after "foundational stages" (i.e., stages [`00-bootstrap`](../../00-bootstrap), [`01-resman`](../../01-resman), 02-networking (either [VPN](../../02-networking-vpn) or [NVA](../../02-networking-nva)) and [`02-security`](../../02-security)) have been run. diff --git a/fast/stages/03-gke-multitenant/dev/main.tf b/fast/stages/03-gke-multitenant/dev/main.tf index a6ed3d4722..db4fe092c6 100644 --- a/fast/stages/03-gke-multitenant/dev/main.tf +++ b/fast/stages/03-gke-multitenant/dev/main.tf @@ -17,7 +17,7 @@ # tfdoc:file:description GKE multitenant for development environment. module "gke-multitenant" { - source = "../../../../blueprints/gke-serverless/multitenant-fleet" + source = "../../../../blueprints/gke/multitenant-fleet" billing_account_id = var.billing_account.id folder_id = var.folder_ids.gke-dev project_id = "gke-clusters-0" diff --git a/tests/blueprints/foundations/business_units/fixture/main.tf b/tests/blueprints/foundations/business_units/fixture/main.tf deleted file mode 100644 index 2609c1c960..0000000000 --- a/tests/blueprints/foundations/business_units/fixture/main.tf +++ /dev/null @@ -1,23 +0,0 @@ -/** - * Copyright 2022 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -module "test" { - source = "../../../../../blueprints/foundations/business-units" - billing_account_id = var.billing_account_id - organization_id = var.organization_id - prefix = var.prefix - root_node = var.root_node -} diff --git a/tests/blueprints/foundations/business_units/fixture/variables.tf b/tests/blueprints/foundations/business_units/fixture/variables.tf deleted file mode 100644 index a89975953d..0000000000 --- a/tests/blueprints/foundations/business_units/fixture/variables.tf +++ /dev/null @@ -1,35 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -variable "billing_account_id" { - type = string - default = "1234-5678-9012" -} - -variable "organization_id" { - type = string - default = "organizations/1234567890" -} - -variable "prefix" { - description = "Prefix used for resources that need unique names." - type = string - default = "test" -} - -variable "root_node" { - description = "Root node for the new hierarchy, either 'organizations/org_id' or 'folders/folder_id'." - type = string - default = "folders/1234567890" -} diff --git a/tests/blueprints/foundations/environments/fixture/main.tf b/tests/blueprints/foundations/environments/fixture/main.tf deleted file mode 100644 index 21832e9db9..0000000000 --- a/tests/blueprints/foundations/environments/fixture/main.tf +++ /dev/null @@ -1,28 +0,0 @@ -/** - * Copyright 2022 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -module "test" { - source = "../../../../../blueprints/foundations/environments" - billing_account_id = var.billing_account_id - environments = var.environments - iam_audit_viewers = var.iam_audit_viewers - iam_shared_owners = var.iam_shared_owners - iam_terraform_owners = var.iam_terraform_owners - iam_xpn_config = var.iam_xpn_config - organization_id = var.organization_id - prefix = var.prefix - root_node = var.root_node -} diff --git a/tests/blueprints/foundations/environments/fixture/variables.tf b/tests/blueprints/foundations/environments/fixture/variables.tf deleted file mode 100644 index 48ce5fde73..0000000000 --- a/tests/blueprints/foundations/environments/fixture/variables.tf +++ /dev/null @@ -1,66 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -variable "billing_account_id" { - type = string - default = "1234-5678-9012" -} - -variable "environments" { - type = list(string) - default = ["test", "prod"] -} - -variable "iam_audit_viewers" { - type = list(string) - default = ["user:audit-1@example.org", "user:audit2@example.org"] -} - -variable "iam_shared_owners" { - type = list(string) - default = ["user:shared-1@example.org", "user:shared-2@example.org"] -} - -variable "iam_terraform_owners" { - type = list(string) - default = ["user:tf-1@example.org", "user:tf-2@example.org"] -} - -variable "iam_xpn_config" { - type = object({ - grant = bool - target_org = bool - }) - default = { - grant = true - target_org = false - } -} - -variable "organization_id" { - type = string - default = "" -} - -variable "prefix" { - description = "Prefix used for resources that need unique names." - type = string - default = "test" -} - -variable "root_node" { - description = "Root node for the new hierarchy, either 'organizations/org_id' or 'folders/folder_id'." - type = string - default = "folders/1234567890" -} diff --git a/tests/blueprints/foundations/environments/test_plan.py b/tests/blueprints/foundations/environments/test_plan.py deleted file mode 100644 index 7e8762df48..0000000000 --- a/tests/blueprints/foundations/environments/test_plan.py +++ /dev/null @@ -1,51 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - - -def test_folder_roles(e2e_plan_runner): - "Test folder roles." - modules, _ = e2e_plan_runner(refresh=False) - for env in ['test', 'prod']: - resources = modules[f'module.test.module.environment-folders["{env}"]'] - folders = [r for r in resources if r['type'] == 'google_folder'] - assert len(folders) == 1 - folder = folders[0] - assert folder['values']['display_name'] == env - - bindings = [r['index'] - for r in resources if r['type'] == 'google_folder_iam_binding'] - assert len(bindings) == 5 - - -def test_org_roles(e2e_plan_runner): - "Test folder roles." - tf_vars = { - 'organization_id': 'organizations/123', - 'iam_xpn_config': '{grant = true, target_org = true}' - } - modules, _ = e2e_plan_runner(refresh=False, **tf_vars) - for env in ['test', 'prod']: - resources = modules[f'module.test.module.environment-folders["{env}"]'] - folder_bindings = [r['index'] - for r in resources if r['type'] == 'google_folder_iam_binding'] - assert len(folder_bindings) == 4 - - resources = modules[f'module.test.module.tf-service-accounts["{env}"]'] - org_bindings = [r for r in resources - if r['type'] == 'google_organization_iam_member'] - assert len(org_bindings) == 2 - assert {b['values']['role'] for b in org_bindings} == { - 'roles/resourcemanager.organizationViewer', - 'roles/compute.xpnAdmin' - } diff --git a/tests/blueprints/cloud_operations/binauthz/__init__.py b/tests/blueprints/gke/__init__.py similarity index 100% rename from tests/blueprints/cloud_operations/binauthz/__init__.py rename to tests/blueprints/gke/__init__.py diff --git a/tests/blueprints/cloud_operations/multi_cluster_mesh_gke_fleet_api/__init__.py b/tests/blueprints/gke/binauthz/__init__.py similarity index 100% rename from tests/blueprints/cloud_operations/multi_cluster_mesh_gke_fleet_api/__init__.py rename to tests/blueprints/gke/binauthz/__init__.py diff --git a/tests/blueprints/cloud_operations/binauthz/fixture/main.tf b/tests/blueprints/gke/binauthz/fixture/main.tf similarity index 90% rename from tests/blueprints/cloud_operations/binauthz/fixture/main.tf rename to tests/blueprints/gke/binauthz/fixture/main.tf index c815e658c4..eefdacc8ba 100644 --- a/tests/blueprints/cloud_operations/binauthz/fixture/main.tf +++ b/tests/blueprints/gke/binauthz/fixture/main.tf @@ -15,7 +15,7 @@ */ module "test" { - source = "../../../../../blueprints/cloud-operations/binauthz" + source = "../../../../../blueprints/gke/binauthz" project_create = var.project_create project_id = var.project_id } diff --git a/tests/blueprints/cloud_operations/binauthz/fixture/variables.tf b/tests/blueprints/gke/binauthz/fixture/variables.tf similarity index 100% rename from tests/blueprints/cloud_operations/binauthz/fixture/variables.tf rename to tests/blueprints/gke/binauthz/fixture/variables.tf diff --git a/tests/blueprints/cloud_operations/binauthz/test_plan.py b/tests/blueprints/gke/binauthz/test_plan.py similarity index 100% rename from tests/blueprints/cloud_operations/binauthz/test_plan.py rename to tests/blueprints/gke/binauthz/test_plan.py diff --git a/tests/blueprints/foundations/__init__.py b/tests/blueprints/gke/multi_cluster_mesh_gke_fleet_api/__init__.py similarity index 100% rename from tests/blueprints/foundations/__init__.py rename to tests/blueprints/gke/multi_cluster_mesh_gke_fleet_api/__init__.py diff --git a/tests/blueprints/cloud_operations/multi_cluster_mesh_gke_fleet_api/fixture/main.tf b/tests/blueprints/gke/multi_cluster_mesh_gke_fleet_api/fixture/main.tf similarity index 90% rename from tests/blueprints/cloud_operations/multi_cluster_mesh_gke_fleet_api/fixture/main.tf rename to tests/blueprints/gke/multi_cluster_mesh_gke_fleet_api/fixture/main.tf index 3db317d93c..47524fa526 100644 --- a/tests/blueprints/cloud_operations/multi_cluster_mesh_gke_fleet_api/fixture/main.tf +++ b/tests/blueprints/gke/multi_cluster_mesh_gke_fleet_api/fixture/main.tf @@ -15,7 +15,7 @@ */ module "test" { - source = "../../../../../blueprints/cloud-operations/multi-cluster-mesh-gke-fleet-api" + source = "../../../../../blueprints/gke/multi-cluster-mesh-gke-fleet-api" billing_account_id = var.billing_account_id parent = var.parent host_project_id = var.host_project_id diff --git a/tests/blueprints/cloud_operations/multi_cluster_mesh_gke_fleet_api/fixture/variables.tf b/tests/blueprints/gke/multi_cluster_mesh_gke_fleet_api/fixture/variables.tf similarity index 100% rename from tests/blueprints/cloud_operations/multi_cluster_mesh_gke_fleet_api/fixture/variables.tf rename to tests/blueprints/gke/multi_cluster_mesh_gke_fleet_api/fixture/variables.tf diff --git a/tests/blueprints/cloud_operations/multi_cluster_mesh_gke_fleet_api/test_plan.py b/tests/blueprints/gke/multi_cluster_mesh_gke_fleet_api/test_plan.py similarity index 100% rename from tests/blueprints/cloud_operations/multi_cluster_mesh_gke_fleet_api/test_plan.py rename to tests/blueprints/gke/multi_cluster_mesh_gke_fleet_api/test_plan.py diff --git a/tests/blueprints/foundations/business_units/__init__.py b/tests/blueprints/gke/multitenant_fleet/__init__.py similarity index 100% rename from tests/blueprints/foundations/business_units/__init__.py rename to tests/blueprints/gke/multitenant_fleet/__init__.py diff --git a/tests/blueprints/gke/multitenant_fleet/fixture/main.tf b/tests/blueprints/gke/multitenant_fleet/fixture/main.tf new file mode 100644 index 0000000000..a57db5d9fc --- /dev/null +++ b/tests/blueprints/gke/multitenant_fleet/fixture/main.tf @@ -0,0 +1,54 @@ +/** + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +module "test" { + source = "../../../../../blueprints/gke/multitenant-fleet" + project_id = "test-prj" + billing_account_id = "ABCDEF-0123456-ABCDEF" + folder_id = "folders/1234567890" + prefix = "test" + vpc_config = { + host_project_id = "my-host-project-id" + vpc_self_link = "projects/my-host-project-id/global/networks/my-network" + } + clusters = { + mycluster = { + cluster_autoscaling = null + description = "My cluster" + dns_domain = null + location = "europe-west1" + labels = {} + net = { + master_range = "172.17.16.0/28" + pods = "pods" + services = "services" + subnet = "projects/my-host-project-id/regions/europe-west1/subnetworks/mycluster-subnet" + } + overrides = null + } + } + nodepools = { + mycluster = { + mynodepool = { + initial_node_count = 1 + node_count = 1 + node_type = "n2-standard-4" + overrides = null + spot = false + } + } + } +} diff --git a/tests/blueprints/foundations/business_units/test_plan.py b/tests/blueprints/gke/multitenant_fleet/test_plan.py similarity index 92% rename from tests/blueprints/foundations/business_units/test_plan.py rename to tests/blueprints/gke/multitenant_fleet/test_plan.py index 816d514b6b..faafa5aaf6 100644 --- a/tests/blueprints/foundations/business_units/test_plan.py +++ b/tests/blueprints/gke/multitenant_fleet/test_plan.py @@ -12,8 +12,9 @@ # See the License for the specific language governing permissions and # limitations under the License. + def test_resources(e2e_plan_runner): "Test that plan works and the numbers of resources is as expected." modules, resources = e2e_plan_runner() - assert len(modules) == 8 - assert len(resources) == 83 + assert len(modules) == 4 + assert len(resources) == 24 diff --git a/tests/fast/conftest.py b/tests/fast/conftest.py index d96af5dcfe..976637eb48 100644 --- a/tests/fast/conftest.py +++ b/tests/fast/conftest.py @@ -11,7 +11,6 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. - "Shared fixtures" import inspect @@ -21,28 +20,39 @@ import pytest import tftest - BASEDIR = os.path.dirname(os.path.dirname(__file__)) @pytest.fixture(scope='session') def fast_e2e_plan_runner(_plan_runner): "Plan runner for end-to-end root module, returns modules and resources." + def run_plan(fixture_path=None, targets=None, refresh=True, include_bare_resources=False, compute_sums=True, **tf_vars): "Runs Terraform plan on a root module using defaults, returns data." plan = _plan_runner(fixture_path, targets=targets, refresh=refresh, **tf_vars) root_module = plan.root_module['child_modules'][0] - modules = { - m['address'].removeprefix(root_module['address'])[1:]: m['resources'] - for m in root_module['child_modules'] - } + + # Count all modules and resources up to 2 levels deep. We include + # the second level to account for wrapper modules used by stages 3 + modules = {} + for m in root_module['child_modules']: + key = m['address'].removeprefix(root_module['address'])[1:] + modules[key] = m.get('resources', []) + if m.get('child_modules'): + for m2 in m['child_modules']: + key2 = m2['address'].removeprefix(root_module['address'])[1:] + modules[key2] = m2.get('resources', []) + resources = [r for m in modules.values() for r in m] if include_bare_resources: bare_resources = root_module['resources'] resources.extend(bare_resources) if compute_sums: - return len(modules), len(resources), {k: len(v) for k, v in modules.items()} + return len(modules), len(resources), { + k: len(v) for k, v in modules.items() + } return modules, resources + return run_plan diff --git a/tests/blueprints/foundations/environments/__init__.py b/tests/fast/stages/s03_gke_multitenant/__init__.py similarity index 100% rename from tests/blueprints/foundations/environments/__init__.py rename to tests/fast/stages/s03_gke_multitenant/__init__.py diff --git a/tests/fast/stages/s03_gke_multitenant/fixture/main.tf b/tests/fast/stages/s03_gke_multitenant/fixture/main.tf new file mode 100644 index 0000000000..2ee6e4f375 --- /dev/null +++ b/tests/fast/stages/s03_gke_multitenant/fixture/main.tf @@ -0,0 +1,65 @@ +/** + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc: Data platform stage test + +module "stage" { + source = "../../../../../fast/stages/03-gke-multitenant/dev/" + automation = { + outputs_bucket = "test" + } + billing_account = { + id = "012345-67890A-BCDEF0", + organization_id = 123456 + } + clusters = { + mycluster = { + cluster_autoscaling = null + description = "My cluster" + dns_domain = null + location = "europe-west1" + labels = {} + net = { + master_range = "172.17.16.0/28" + pods = "pods" + services = "services" + subnet = "projects/my-host-project-id/regions/europe-west1/subnetworks/mycluster-subnet" + } + overrides = null + } + } + nodepools = { + mycluster = { + mynodepool = { + initial_node_count = 1 + node_count = 1 + node_type = "n2-standard-4" + overrides = null + spot = false + } + } + } + folder_ids = { + gke-dev = "folders/12345678" + } + host_project_ids = { + dev-spoke-0 = "fast-dev-net-spoke-0" + } + prefix = "fast" + vpc_self_links = { + dev-spoke-0 = "projects/fast-dev-net-spoke-0/global/networks/dev-spoke-0" + } +} diff --git a/tests/fast/stages/s03_data_platform/fixture/__init__.py b/tests/fast/stages/s03_gke_multitenant/test_plan.py similarity index 70% rename from tests/fast/stages/s03_data_platform/fixture/__init__.py rename to tests/fast/stages/s03_gke_multitenant/test_plan.py index 6d6d1266c3..6189f62e3c 100644 --- a/tests/fast/stages/s03_data_platform/fixture/__init__.py +++ b/tests/fast/stages/s03_gke_multitenant/test_plan.py @@ -11,3 +11,10 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. + + +def test_counts(fast_e2e_plan_runner): + "Test stage." + num_modules, num_resources, _ = fast_e2e_plan_runner() + # TODO: to re-enable per-module resource count check print _, then test + assert num_modules > 0 and num_resources > 0