kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secure source manager (#2569)

Browse Source 
* Added secure-source-manager-instance module

* Fixes after review
This commit is contained in:
apichick
2024-09-19 12:29:01 +02:00
committed by GitHub
parent 7a90f497e9
commit 0f28d266dd
15 changed files with 762 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

179
modules/secure-source-manager-instance/README.md Normal file
View File

@@ -0,0 +1,179 @@
# Secure Source Manager
This module allows to create a Secure Source Manager instance and repositories in it. Additionally it allows creating instance IAM bindings and repository IAM bindings.
## Examples
<!-- BEGIN TOC -->
- [Examples](#examples)
- [Public instance](#public-instance)
- [Public instance with CMEK](#public-instance-with-cmek)
- [Private instance](#private-instance)
- [IAM](#iam)
- [Variables](#variables)
- [Outputs](#outputs)
<!-- END TOC -->
### Public instance
```hcl
module "ssm_instance" {
source = "./fabric/modules/secure-source-manager-instance"
project_id = var.project_id
instance_id = "my-instance"
location = var.region
repositories = {
my-repository = {
location = var.region
}
}
}
# tftest modules=1 resources=2 inventory=public-instance.yaml
```
### Public instance with CMEK
```hcl
module "ssm_instance" {
source = "./fabric/modules/secure-source-manager-instance"
project_id = var.project_id
instance_id = "my-instance"
location = var.region
kms_key = "projects/another-project-id/locations/${var.region}/keyRings/my-key-ring/cryptoKeys/my-key"
repositories = {
my-repository = {
location = var.region
}
}
}
# tftest modules=1 resources=2 inventory=public-instance-with-cmek.yaml
```
### Private instance
```hcl
module "ssm_instance" {
source = "./fabric/modules/secure-source-manager-instance"
project_id = var.project_id
instance_id = "my-instance"
location = var.region
ca_pool = "projects/another-project/locations/${var.region}/caPools/my-ca-pool"
repositories = {
my-repository = {
location = var.region
}
}
}
# tftest modules=1 resources=2 inventory=private-instance.yaml
```
### IAM
```hcl
module "ssm_instance" {
source = "./fabric/modules/secure-source-manager-instance"
project_id = var.project_id
instance_id = "my-instance"
location = var.region
iam = {
"roles/securesourcemanager.instanceOwner" = [
"group:my-instance-admins@myorg.com"
]
}
repositories = {
my-repository = {
location = var.region
iam = {
"roles/securesourcemanager.repoAdmin" = [
"group:my-repo-admins@myorg.com"
]
}
}
}
}
# tftest modules=1 resources=4 inventory=iam.yaml
```
```hcl
module "ssm_instance" {
source = "./fabric/modules/secure-source-manager-instance"
project_id = var.project_id
instance_id = "my-instance"
location = var.region
iam_bindings_additive = {
my-instance-admin = {
role = "roles/securesourcemanager.instanceOwner"
member = "group:my-instance-admins@myorg.com"
}
}
repositories = {
my-repository = {
location = var.region
iam_bindings_additive = {
my-repository-admin = {
role = "roles/securesourcemanager.repoAdmin"
member = "group:my-repo-admins@myorg.com"
}
}
}
}
}
# tftest modules=1 resources=4 inventory=iam-bindings.yaml
```
```hcl
module "ssm_instance" {
source = "./fabric/modules/secure-source-manager-instance"
project_id = var.project_id
instance_id = "my-instance"
location = var.region
iam_bindings = {
my-instance-admin = {
role = "roles/securesourcemanager.instanceOwner"
members = [
"group:my-instance-admins@myorg.com"
]
}
}
repositories = {
my-repository = {
location = var.region
iam_bindings = {
my-repository-admin = {
role = "roles/securesourcemanager.repoAdmin"
members = [
"group:my-repo-admins@myorg.com"
]
}
}
}
}
}
# tftest modules=1 resources=4 inventory=iam-bindings-additive.yaml
```
<!-- BEGIN TFDOC -->
## Variables
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [instance_id](variables.tf#L23) | Instance ID. | <code>string</code> | ✓ | |
| [location](variables.tf#L40) | Location. | <code>string</code> | ✓ | |
| [project_id](variables.tf#L45) | Project ID. | <code>string</code> | ✓ | |
| [repositories](variables.tf#L50) | Repositories. | <code title="map&#40;object&#40;&#123;&#10; description &#61; optional&#40;string&#41;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; member &#61; string&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; initial_config &#61; optional&#40;object&#40;&#123;&#10; default_branch &#61; optional&#40;string&#41;&#10; gitignores &#61; optional&#40;string&#41;&#10; license &#61; optional&#40;string&#41;&#10; readme &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; location &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | ✓ | |
| [ca_pool](variables.tf#L17) | CA pool. | <code>string</code> | | <code>null</code> |
| [iam](variables-iam.tf#L17) | IAM bindings. | <code>map&#40;list&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [iam_bindings](variables-iam.tf#L23) | IAM bindings. | <code title="map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [iam_bindings_additive](variables-iam.tf#L32) | IAM bindings. | <code title="map&#40;object&#40;&#123;&#10; role &#61; string&#10; member &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [kms_key](variables.tf#L28) | KMS key. | <code>string</code> | | <code>null</code> |
| [labels](variables.tf#L34) | Instance labels. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
## Outputs
| name | description | sensitive |
|---|---|:---:|
| [instance](outputs.tf#L17) | Instance. | |
| [instance_id](outputs.tf#L22) | Instance id. | |
| [repositories](outputs.tf#L27) | Repositories. | |
| [repository_ids](outputs.tf#L32) | Repository ids. | |
<!-- END TFDOC -->

80
modules/secure-source-manager-instance/iam.tf Normal file
View File

@@ -0,0 +1,80 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
locals {
repository_iam = merge([for k1, v1 in var.repositories : { for k2, v2 in v1.iam :
"${k1}.${k2}" => {
repository = k1
role = k2
members = v2
} }]...)
repository_iam_bindings = merge([for k1, v1 in var.repositories : { for k2, v2 in v1.iam_bindings :
"${k1}.${k2}" => merge(v2, {
repository = k1
}) }]...)
repository_iam_bindings_additive = merge([for k1, v1 in var.repositories : { for k2, v2 in v1.iam_bindings_additive :
"${k1}.${k2}" => merge(v2, {
repository = k1
}) }]...)
}
resource "google_secure_source_manager_instance_iam_binding" "authoritative" {
for_each = var.iam
project = google_secure_source_manager_instance.instance.project
instance_id = google_secure_source_manager_instance.instance.instance_id
role = each.key
members = each.value
}
resource "google_secure_source_manager_instance_iam_binding" "bindings" {
for_each = var.iam_bindings
project = google_secure_source_manager_instance.instance.project
instance_id = google_secure_source_manager_instance.instance.instance_id
role = each.value.role
members = each.value.members
}
resource "google_secure_source_manager_instance_iam_member" "bindings" {
for_each = var.iam_bindings_additive
project = google_secure_source_manager_instance.instance.project
instance_id = google_secure_source_manager_instance.instance.instance_id
role = each.value.role
member = each.value.member
}
resource "google_secure_source_manager_repository_iam_binding" "authoritative" {
for_each = local.repository_iam
project = google_secure_source_manager_repository.repositories[each.value.repository].project
repository_id = google_secure_source_manager_repository.repositories[each.value.repository].repository_id
role = each.value.role
members = each.value.members
}
resource "google_secure_source_manager_repository_iam_binding" "bindings" {
for_each = local.repository_iam_bindings
project = google_secure_source_manager_repository.repositories[each.value.repository].project
repository_id = google_secure_source_manager_repository.repositories[each.value.repository].repository_id
role = each.value.role
members = each.value.members
}
resource "google_secure_source_manager_repository_iam_member" "bindings" {
for_each = local.repository_iam_bindings_additive
project = google_secure_source_manager_repository.repositories[each.value.repository].project
repository_id = google_secure_source_manager_repository.repositories[each.value.repository].repository_id
role = each.value.role
member = each.value.member
}

47
modules/secure-source-manager-instance/main.tf Normal file
View File

@@ -0,0 +1,47 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
resource "google_secure_source_manager_instance" "instance" {
instance_id = var.instance_id
project = var.project_id
location = var.location
labels = var.labels
kms_key = var.kms_key
dynamic "private_config" {
for_each = var.ca_pool == null ? [] : [""]
content {
is_private = true
ca_pool = var.ca_pool
}
}
}
resource "google_secure_source_manager_repository" "repositories" {
for_each = var.repositories
repository_id = each.key
instance = google_secure_source_manager_instance.instance.name
project = var.project_id
location = each.value.location
dynamic "initial_config" {
for_each = each.value.initial_config == null ? [] : [""]
content {
default_branch = each.value.initial_config.default_branch
gitignores = each.value.initial_config.gitignores
license = each.value.initial_config.license
readme = each.value.initial_config.readme
}
}
}

35
modules/secure-source-manager-instance/outputs.tf Normal file
View File

@@ -0,0 +1,35 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
output "instance" {
description = "Instance."
value = google_secure_source_manager_instance.instance
}
output "instance_id" {
description = "Instance id."
value = google_secure_source_manager_instance.instance.id
}
output "repositories" {
description = "Repositories."
value = google_secure_source_manager_repository.repositories
}
output "repository_ids" {
description = "Repository ids."
value = { for k, v in google_secure_source_manager_repository.repositories : k => v.id }
}

39
modules/secure-source-manager-instance/variables-iam.tf Normal file
View File

@@ -0,0 +1,39 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
variable "iam" {
description = "IAM bindings."
type = map(list(string))
default = {}
}
variable "iam_bindings" {
description = "IAM bindings."
type = map(object({
role = string
members = list(string)
}))
default = {}
}
variable "iam_bindings_additive" {
description = "IAM bindings."
type = map(object({
role = string
member = string
}))
default = {}
}

71
modules/secure-source-manager-instance/variables.tf Normal file
View File

@@ -0,0 +1,71 @@
/**
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
variable "ca_pool" {
description = "CA pool."
type = string
default = null
}
variable "instance_id" {
description = "Instance ID."
type = string
}
variable "kms_key" {
description = "KMS key."
type = string
default = null
}
variable "labels" {
description = "Instance labels."
type = map(string)
default = {}
}
variable "location" {
description = "Location."
type = string
}
variable "project_id" {
description = "Project ID."
type = string
}
variable "repositories" {
description = "Repositories."
type = map(object({
description = optional(string)
iam = optional(map(list(string)), {})
iam_bindings = optional(map(object({
role = string
members = list(string)
})), {})
iam_bindings_additive = optional(map(object({
role = string
member = string
})), {})
initial_config = optional(object({
default_branch = optional(string)
gitignores = optional(string)
license = optional(string)
readme = optional(string)
}))
location = string
}))
}

29
modules/secure-source-manager-instance/versions.tf Normal file
View File

@@ -0,0 +1,29 @@
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Fabric release: v35.0.0
terraform {
required_version = ">= 1.7.4"
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.1.0, < 7.0.0" # tftest
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.1.0, < 7.0.0" # tftest
}
}
}