Add tag_bindings to Artifact Registry and Secret Manager modules. (#3220)
* Add `tag_bindings` to Artifact Registry and Secret Manager modules. * Fix linting * Fix README
This commit is contained in:
Julio Castillo
@@ -313,6 +313,7 @@ module "additive_iam" {
|
||||
| [iam_bindings_additive](variables-iam.tf#L58) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_by_principals](variables-iam.tf#L73) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L206) | Labels to be attached to the registry. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [tag_bindings](variables.tf#L227) | Tag bindings for this repository, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2024 Google LLC
|
||||
* Copyright 2025 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -217,3 +217,10 @@ resource "google_artifact_registry_repository" "registry" {
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
resource "google_tags_location_tag_binding" "binding" {
|
||||
for_each = var.tag_bindings
|
||||
parent = "//artifactregistry.googleapis.com/${google_artifact_registry_repository.registry.id}"
|
||||
location = var.location
|
||||
tag_value = each.value
|
||||
}
|
||||
|
||||
@@ -223,3 +223,10 @@ variable "project_id" {
|
||||
description = "Registry project id."
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "tag_bindings" {
|
||||
description = "Tag bindings for this repository, in key => tag value id format."
|
||||
type = map(string)
|
||||
nullable = false
|
||||
default = {}
|
||||
}
|
||||
|
||||
@@ -192,8 +192,9 @@ module "secret-manager" {
|
||||
| [project_id](variables.tf#L29) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
|
||||
| [iam](variables.tf#L17) | IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format. | <code>map(map(list(string)))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L23) | Optional labels for each secret. | <code>map(map(string))</code> | | <code>{}</code> |
|
||||
| [secrets](variables.tf#L34) | Map of secrets to manage, their optional expire time, version destroy ttl, locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | <code title="map(object({ expire_time = optional(string) locations = optional(list(string)) keys = optional(map(string)) version_destroy_ttl = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [versions](variables.tf#L45) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | <code title="map(map(object({ enabled = bool data = string })))">map(map(object({…})))</code> | | <code>{}</code> |
|
||||
| [project_number](variables.tf#L34) | Project number of var.project_id. Set this to avoid permadiffs when creating tag bindings. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L40) | Map of secrets to manage, their optional expire time, version destroy ttl, locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | <code title="map(object({ expire_time = optional(string) locations = optional(list(string)) keys = optional(map(string)) tag_bindings = optional(map(string)) version_destroy_ttl = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [versions](variables.tf#L52) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | <code title="map(map(object({ enabled = bool data = string })))">map(map(object({…})))</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2025 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -25,6 +25,15 @@ locals {
|
||||
}
|
||||
]
|
||||
])
|
||||
tag_bindings = merge([
|
||||
for k, v in var.secrets : {
|
||||
for kk, vv in v.tag_bindings : "${k}/${kk}" => {
|
||||
parent = "//secretmanager.googleapis.com/projects/${coalesce(var.project_number, var.project_id)}/secrets/${google_secret_manager_secret.default[k].secret_id}"
|
||||
tag_value = vv
|
||||
}
|
||||
}
|
||||
if v.tag_bindings != null
|
||||
]...)
|
||||
version_pairs = flatten([
|
||||
for secret, versions in var.versions : [
|
||||
for name, attrs in versions : merge(attrs, { name = name, secret = secret })
|
||||
@@ -96,3 +105,9 @@ resource "google_secret_manager_secret_iam_binding" "default" {
|
||||
secret_id = google_secret_manager_secret.default[each.value.secret].id
|
||||
members = each.value.members
|
||||
}
|
||||
|
||||
resource "google_tags_tag_binding" "binding" {
|
||||
for_each = local.tag_bindings
|
||||
parent = each.value.parent
|
||||
tag_value = each.value.tag_value
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2025 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -31,12 +31,19 @@ variable "project_id" {
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "project_number" {
|
||||
description = "Project number of var.project_id. Set this to avoid permadiffs when creating tag bindings."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "secrets" {
|
||||
description = "Map of secrets to manage, their optional expire time, version destroy ttl, locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set."
|
||||
type = map(object({
|
||||
expire_time = optional(string)
|
||||
locations = optional(list(string))
|
||||
keys = optional(map(string))
|
||||
tag_bindings = optional(map(string))
|
||||
version_destroy_ttl = optional(string)
|
||||
}))
|
||||
default = {}
|
||||
|
||||
Reference in New Issue
Block a user