kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for dynamic tags (#3897)

Browse Source 
* Allow creation of dynamic tags

* Extend project factory and related modules to support dynamic values

* Extend folder and organization modules

* project and organization readme

* Simplify dynamic tag support and remove unnecessary restrictions

  • Schemas & Validations: Removed the restriction that forbade combining IAM fields with  allowed_values_regex  on tags. Updated validations in  project  and  organization  modules, and
  simplified all relevant JSON schemas.
  • Module Tag Bindings: Simplified the  tag_value  assignment in  folder ,  project ,  gcs ,  bigquery-dataset , and  kms  modules by removing the defensive  can(regex(...))  check and
  calling  templatestring  directly.
  • Outputs: Removed the  tags_dynamic  output from  project  and  organization  modules, as the same information is now available in  tag_keys .
  • Project Factory: Updated  tag_vars_projects  in  projects.tf  to use the native  namespaced_name  attribute and filtered manually for dynamic tags.

* fix(organization, project): fix linting and tests for dynamic tag support

- Align allowed_values_regex and description extraction in _tags_merged
  locals to use lookup() for consistency with other fields.
- Fix spacing in project context variable (alphabetical ordering).
- Update organization tags test to include the new cost_center tag key
  with allowed_values_regex.
- Update project tags test to include the new cost_center tag key and
  reflect the resolved allowed_values_regex on environment.

* refactor(gcs): refine tag bindings and fix context test

- Add _tag_bindings local to pre-resolve context references, enabling
  templatestring to receive a direct map reference (required by Terraform).
- Use var.context.tag_vars instead of the non-existent local.ctx.tag_vars.
- Fix HCL syntax in context.tfvars (escaped inner quotes).
- Update context test inventory to reflect 3 tag bindings including a
  dynamic value resolved via templatestring.

* refactor: align modules with tag binding context pattern

- Add _tag_bindings local + templatestring dance to cloud-run-v2,
  compute-vm, folder, kms modules (bigquery-dataset already had it)
- Exclude tag_vars from local.ctx in cloud-run-v2, compute-vm, folder,
  kms, project modules (bigquery-dataset already had it)
- Add tag_vars to context variable in cloud-run-v2, compute-vm modules
  (others already had it)
- Update all context tests with dynamic tag binding values using
  var.context.tag_vars

* docs: add module-level tftest.yaml test instructions to GEMINI.md

* docs: regenerate READMEs after tag-regex alignment

- Regenerate variable tables in 7 module READMEs to reflect
  line number shifts from prior tag-regex changes
- Add tag_vars exclusion to gcs ctx local
- Fix whitespace alignment in iam-service-account and
  project-factory tag_vars blocks
- Update tftest resource counts for organization and project
- Remove tags_dynamic from organization/project output tables

* fix(project-factory): update test inventory for tag_bindings module split

- Move tag binding address from folder-2 to folder-2-iam in test
  inventory (tag_bindings moved from creation to IAM modules)
- Update module instance count from 34 to 35
- Regenerate README tables after terraform fmt line shifts
- Apply terraform fmt to variables.tf

* refactor(project-factory): remove unnecessary depends_on from folder-iam modules

Folder IAM modules depend on their own folder creation modules, not
on module.projects. The explicit depends_on was leftover from an
earlier design.

* FAST stages

* Address review comments.

- FAST Stages:
  - Added tag_keys to output-files.tf in 0-org-setup to pass org tags via tfvars.
  - Sorted tag_keys and tag_values in output-files.tf.
  - Updated project-factory, networking, and security stages to use tag_keys.
  - Filtered tag_keys for dynamic tags only.
- Modules:
  - Excluded tag_vars from local.ctx in iam-service-account and organization.
  - Simplified tag_value in iam-service-account.
- Tests:
  - Updated test inventories for 0-org-setup and project-factory.

* Fix tf format

* Fix tfdoc

* docs: add ADR for templatestring vars convention and update status of base path ADR

* More tfdoc

* Update schemas

* Use endswith in context loop

* Address review

* Update FAST readmes

* Update last modules

* Terraform fmt

* Revert alloydb

* Fix whitespace

---------

Co-authored-by: Ludovico Magnocavallo <ludo@qix.it>
This commit is contained in:
Julio Castillo
2026-04-24 22:45:45 +02:00
committed by GitHub
parent fb33752d8d
commit 2eaa0d5e27
118 changed files with 1018 additions and 378 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
fast/stages/0-org-setup/output-files.tf
View File

@@ -40,6 +40,7 @@ locals {
module.factory.project_ids
)
storage_buckets = module.factory.storage_buckets
tag_keys = module.organization[0].tag_keys
tag_values = merge(
local.ctx.tag_values,
local.org_tag_values
@@ -125,6 +126,7 @@ locals {
subnet_self_links = {
for k, v in module.vpcs.vpcs : k => v.subnet_ids
}
tag_keys = local.of_ctx.tag_keys
tag_values = local.of_ctx.tag_values
vpc_self_links = {
for k, v in module.vpcs.vpcs : k => v.id

18
fast/stages/0-org-setup/schemas/defaults.schema.json
View File

@@ -748,6 +748,24 @@
"type": "string"
}
},
"tag_vars": {
"type": "object",
"additionalProperties": false,
"properties": {
"projects": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
},
"organization": {
"type": "string"
}
}
},
"vpc_host_projects": {
"type": "object",
"additionalProperties": {

5
fast/stages/0-org-setup/schemas/defaults.schema.md
View File

@@ -220,6 +220,11 @@
<br>*additional properties: string*
- **tag_values**: *object*
<br>*additional properties: string*
- **tag_vars**: *object*
<br>*additional properties: false*
- **projects**: *object*
<br>*additional properties: object*
- **organization**: *string*
- **vpc_host_projects**: *object*
<br>*additional properties: string*
- **vpc_sc_perimeters**: *object*

21
fast/stages/0-org-setup/schemas/project.schema.json
View File

@@ -834,6 +834,9 @@
"type": "object",
"additionalProperties": false,
"properties": {
"allowed_values_regex": {
"type": "string"
},
"description": {
"type": "string"
},
@@ -873,7 +876,23 @@
}
}
}
}
},
"allOf": [
{
"if": {
"required": [
"allowed_values_regex"
]
},
"then": {
"not": {
"required": [
"values"
]
}
}
}
]
}
},
"tag_bindings": {

19
fast/stages/0-org-setup/schemas/tags.schema.json
View File

@@ -4,6 +4,9 @@
"type": "object",
"additionalProperties": false,
"properties": {
"allowed_values_regex": {
"type": "string"
},
"name": {
"type": "string"
},
@@ -56,6 +59,22 @@
}
}
},
"allOf": [
{
"if": {
"required": [
"allowed_values_regex"
]
},
"then": {
"not": {
"required": [
"values"
]
}
}
}
],
"$defs": {
"iam": {
"type": "object",

1
fast/stages/0-org-setup/schemas/tags.schema.md
View File

@@ -6,6 +6,7 @@
*additional properties: false*
- **allowed_values_regex**: *string*
- **name**: *string*
- **description**: *string*
- **id**: *string*

6
fast/stages/2-networking/README.md
View File

@@ -392,9 +392,9 @@ Internally created resources are mapped to context namespaces, and use specific
| [project_ids](variables-fast.tf#L85) | Projects created in the bootstrap stage. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
| [service_accounts](variables-fast.tf#L93) | Service accounts created in the bootstrap stage. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
| [storage_buckets](variables-fast.tf#L101) | Storage buckets created in the bootstrap stage. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
| [tag_keys](variables-fast.tf#L109) | FAST-managed resource manager tag keys. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
| [tag_values](variables-fast.tf#L117) | FAST-managed resource manager tag values. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
| [universe](variables-fast.tf#L125) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
| [tag_keys](variables-fast.tf#L109) | FAST-managed resource manager tag keys. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [tag_values](variables-fast.tf#L120) | FAST-managed resource manager tag values. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
| [universe](variables-fast.tf#L128) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
## Outputs

17
fast/stages/2-networking/main.tf
View File

@@ -42,11 +42,18 @@ locals {
},
local._ctx.iam_principals
)
kms_keys = merge(var.kms_keys, local._ctx.kms_keys)
project_ids = merge(var.project_ids, local._ctx.project_ids)
storage_buckets = merge(var.storage_buckets, local._ctx.storage_buckets)
tag_keys = merge(var.tag_keys, local._ctx.tag_keys)
tag_values = merge(var.tag_values, local._ctx.tag_values)
kms_keys = merge(var.kms_keys, local._ctx.kms_keys)
project_ids = merge(var.project_ids, local._ctx.project_ids)
storage_buckets = merge(var.storage_buckets, local._ctx.storage_buckets)
tag_keys = merge(var.tag_keys, local._ctx.tag_keys)
tag_values = merge(var.tag_values, local._ctx.tag_values)
tag_vars = {
projects = try(local._ctx.tag_vars.projects, {})
organization = merge({
for k, v in var.tag_keys : k => v.namespaced_name
if v.allowed_values_regex != null
}, try(local._ctx.tag_vars.organization, {}))
}
vpc_sc_perimeters = merge(var.perimeters, local._ctx.vpc_sc_perimeters)
})
# normalize defaults

18
fast/stages/2-networking/schemas/defaults.schema.json
View File

@@ -710,6 +710,24 @@
"type": "string"
}
},
"tag_vars": {
"type": "object",
"additionalProperties": false,
"properties": {
"projects": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
},
"organization": {
"type": "string"
}
}
},
"vpc_sc_perimeters": {
"type": "object",
"additionalProperties": {

5
fast/stages/2-networking/schemas/defaults.schema.md
View File

@@ -212,6 +212,11 @@
<br>*additional properties: string*
- **tag_values**: *object*
<br>*additional properties: string*
- **tag_vars**: *object*
<br>*additional properties: false*
- **projects**: *object*
<br>*additional properties: object*
- **organization**: *string*
- **vpc_sc_perimeters**: *object*
<br>*additional properties: string*
- **output_files**: *object*

21
fast/stages/2-networking/schemas/project.schema.json
View File

@@ -834,6 +834,9 @@
"type": "object",
"additionalProperties": false,
"properties": {
"allowed_values_regex": {
"type": "string"
},
"description": {
"type": "string"
},
@@ -873,7 +876,23 @@
}
}
}
}
},
"allOf": [
{
"if": {
"required": [
"allowed_values_regex"
]
},
"then": {
"not": {
"required": [
"values"
]
}
}
}
]
}
},
"tag_bindings": {

9
fast/stages/2-networking/variables-fast.tf
View File

@@ -109,9 +109,12 @@ variable "storage_buckets" {
variable "tag_keys" {
# tfdoc:variable:source 0-org-setup
description = "FAST-managed resource manager tag keys."
type = map(string)
nullable = false
default = {}
type = map(object({
namespaced_name = string
allowed_values_regex = optional(string)
}))
default = {}
nullable = false
}
variable "tag_values" {

3
fast/stages/2-project-factory/README.md
View File

@@ -497,8 +497,9 @@ Pattern-based files make specific assumptions:
| [service_accounts](variables-fast.tf#L110) | Service accounts created in the bootstrap stage. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [stage_name](variables.tf#L58) | FAST stage name. Used to separate output files across different factories. | <code>string</code> | | <code>&#34;2-project-factory&#34;</code> | |
| [subnet_self_links](variables-fast.tf#L118) | Shared VPC subnet IDs. | <code>map&#40;map&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> | <code>2-networking</code> |
| [tag_keys](variables-fast.tf#L134) | FAST-managed resource manager tag keys. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [tag_values](variables-fast.tf#L126) | FAST-managed resource manager tag values. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [universe](variables-fast.tf#L134) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | <code>0-globals</code> |
| [universe](variables-fast.tf#L145) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | <code>0-globals</code> |
## Outputs

9
fast/stages/2-project-factory/main.tf
View File

@@ -102,7 +102,14 @@ module "factory" {
project_ids = merge(
var.project_ids, var.host_project_ids, local.context.project_ids
)
tag_values = merge(var.tag_values, local.context.tag_values)
tag_values = merge(var.tag_values, local.context.tag_values)
tag_vars = {
projects = try(local.context.tag_vars.projects, {})
organization = merge({
for k, v in var.tag_keys : k => v.namespaced_name
if v.allowed_values_regex != null
}, try(local.context.tag_vars.organization, {}))
}
vpc_sc_perimeters = merge(var.perimeters, local.context.vpc_sc_perimeters)
}
data_defaults = local.project_defaults.defaults

18
fast/stages/2-project-factory/schemas/defaults.schema.json
View File

@@ -542,6 +542,24 @@
"type": "string"
}
},
"tag_vars": {
"type": "object",
"additionalProperties": false,
"properties": {
"projects": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
},
"organization": {
"type": "string"
}
}
},
"vpc_host_projects": {
"type": "object",
"additionalProperties": {

5
fast/stages/2-project-factory/schemas/defaults.schema.md
View File

@@ -153,6 +153,11 @@
<br>*additional properties: string*
- **tag_values**: *object*
<br>*additional properties: string*
- **tag_vars**: *object*
<br>*additional properties: false*
- **projects**: *object*
<br>*additional properties: object*
- **organization**: *string*
- **vpc_host_projects**: *object*
<br>*additional properties: string*
- **vpc_sc_perimeters**: *object*

21
fast/stages/2-project-factory/schemas/project.schema.json
View File

@@ -834,6 +834,9 @@
"type": "object",
"additionalProperties": false,
"properties": {
"allowed_values_regex": {
"type": "string"
},
"description": {
"type": "string"
},
@@ -873,7 +876,23 @@
}
}
}
}
},
"allOf": [
{
"if": {
"required": [
"allowed_values_regex"
]
},
"then": {
"not": {
"required": [
"values"
]
}
}
}
]
}
},
"tag_bindings": {

11
fast/stages/2-project-factory/variables-fast.tf
View File

@@ -131,6 +131,17 @@ variable "tag_values" {
default = {}
}
variable "tag_keys" {
# tfdoc:variable:source 0-org-setup
description = "FAST-managed resource manager tag keys."
type = map(object({
namespaced_name = string
allowed_values_regex = optional(string)
}))
default = {}
nullable = false
}
variable "universe" {
# tfdoc:variable:source 0-globals
description = "GCP universe where to deploy projects. The prefix will be prepended to the project id."

6
fast/stages/2-security/README.md
View File

@@ -198,9 +198,9 @@ A reference Certificate Authority Services (CAS) is also part of this stage, all
| [project_ids](variables-fast.tf#L67) | Projects created in the bootstrap stage. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [service_accounts](variables-fast.tf#L75) | Service accounts created in the bootstrap stage. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [storage_buckets](variables-fast.tf#L83) | Storage buckets created in the bootstrap stage. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [tag_keys](variables-fast.tf#L91) | FAST-managed resource manager tag keys. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [tag_values](variables-fast.tf#L99) | FAST-managed resource manager tag values. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [universe](variables-fast.tf#L107) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | <code>0-org-setup</code> |
| [tag_keys](variables-fast.tf#L91) | FAST-managed resource manager tag keys. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [tag_values](variables-fast.tf#L102) | FAST-managed resource manager tag values. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> | <code>0-org-setup</code> |
| [universe](variables-fast.tf#L110) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> | <code>0-org-setup</code> |
## Outputs

15
fast/stages/2-security/main.tf
View File

@@ -38,10 +38,17 @@ locals {
},
local._ctx.iam_principals
)
project_ids = merge(var.project_ids, local._ctx.project_ids)
storage_buckets = merge(var.storage_buckets, local._ctx.storage_buckets)
tag_keys = merge(var.tag_keys, local._ctx.tag_keys)
tag_values = merge(var.tag_values, local._ctx.tag_values)
project_ids = merge(var.project_ids, local._ctx.project_ids)
storage_buckets = merge(var.storage_buckets, local._ctx.storage_buckets)
tag_keys = merge(var.tag_keys, local._ctx.tag_keys)
tag_values = merge(var.tag_values, local._ctx.tag_values)
tag_vars = {
projects = try(local._ctx.tag_vars.projects, {})
organization = merge({
for k, v in var.tag_keys : k => v.namespaced_name
if v.allowed_values_regex != null
}, try(local._ctx.tag_vars.organization, {}))
}
vpc_sc_perimeters = merge(var.perimeters, local._ctx.vpc_sc_perimeters)
})
# normalize defaults

18
fast/stages/2-security/schemas/defaults.schema.json
View File

@@ -495,6 +495,24 @@
"type": "string"
}
},
"tag_vars": {
"type": "object",
"additionalProperties": false,
"properties": {
"projects": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
},
"organization": {
"type": "string"
}
}
},
"vpc_host_projects": {
"type": "object",
"additionalProperties": {

5
fast/stages/2-security/schemas/defaults.schema.md
View File

@@ -144,6 +144,11 @@
<br>*additional properties: string*
- **tag_values**: *object*
<br>*additional properties: string*
- **tag_vars**: *object*
<br>*additional properties: false*
- **projects**: *object*
<br>*additional properties: object*
- **organization**: *string*
- **vpc_host_projects**: *object*
<br>*additional properties: string*
- **vpc_sc_perimeters**: *object*

21
fast/stages/2-security/schemas/project.schema.json
View File

@@ -834,6 +834,9 @@
"type": "object",
"additionalProperties": false,
"properties": {
"allowed_values_regex": {
"type": "string"
},
"description": {
"type": "string"
},
@@ -873,7 +876,23 @@
}
}
}
}
},
"allOf": [
{
"if": {
"required": [
"allowed_values_regex"
]
},
"then": {
"not": {
"required": [
"values"
]
}
}
}
]
}
},
"tag_bindings": {

9
fast/stages/2-security/variables-fast.tf
View File

@@ -91,9 +91,12 @@ variable "storage_buckets" {
variable "tag_keys" {
# tfdoc:variable:source 0-org-setup
description = "FAST-managed resource manager tag keys."
type = map(string)
nullable = false
default = {}
type = map(object({
namespaced_name = string
allowed_values_regex = optional(string)
}))
default = {}
nullable = false
}
variable "tag_values" {