Add support for dynamic tags (#3897)
* Allow creation of dynamic tags * Extend project factory and related modules to support dynamic values * Extend folder and organization modules * project and organization readme * Simplify dynamic tag support and remove unnecessary restrictions • Schemas & Validations: Removed the restriction that forbade combining IAM fields with allowed_values_regex on tags. Updated validations in project and organization modules, and simplified all relevant JSON schemas. • Module Tag Bindings: Simplified the tag_value assignment in folder , project , gcs , bigquery-dataset , and kms modules by removing the defensive can(regex(...)) check and calling templatestring directly. • Outputs: Removed the tags_dynamic output from project and organization modules, as the same information is now available in tag_keys . • Project Factory: Updated tag_vars_projects in projects.tf to use the native namespaced_name attribute and filtered manually for dynamic tags. * fix(organization, project): fix linting and tests for dynamic tag support - Align allowed_values_regex and description extraction in _tags_merged locals to use lookup() for consistency with other fields. - Fix spacing in project context variable (alphabetical ordering). - Update organization tags test to include the new cost_center tag key with allowed_values_regex. - Update project tags test to include the new cost_center tag key and reflect the resolved allowed_values_regex on environment. * refactor(gcs): refine tag bindings and fix context test - Add _tag_bindings local to pre-resolve context references, enabling templatestring to receive a direct map reference (required by Terraform). - Use var.context.tag_vars instead of the non-existent local.ctx.tag_vars. - Fix HCL syntax in context.tfvars (escaped inner quotes). - Update context test inventory to reflect 3 tag bindings including a dynamic value resolved via templatestring. * refactor: align modules with tag binding context pattern - Add _tag_bindings local + templatestring dance to cloud-run-v2, compute-vm, folder, kms modules (bigquery-dataset already had it) - Exclude tag_vars from local.ctx in cloud-run-v2, compute-vm, folder, kms, project modules (bigquery-dataset already had it) - Add tag_vars to context variable in cloud-run-v2, compute-vm modules (others already had it) - Update all context tests with dynamic tag binding values using var.context.tag_vars * docs: add module-level tftest.yaml test instructions to GEMINI.md * docs: regenerate READMEs after tag-regex alignment - Regenerate variable tables in 7 module READMEs to reflect line number shifts from prior tag-regex changes - Add tag_vars exclusion to gcs ctx local - Fix whitespace alignment in iam-service-account and project-factory tag_vars blocks - Update tftest resource counts for organization and project - Remove tags_dynamic from organization/project output tables * fix(project-factory): update test inventory for tag_bindings module split - Move tag binding address from folder-2 to folder-2-iam in test inventory (tag_bindings moved from creation to IAM modules) - Update module instance count from 34 to 35 - Regenerate README tables after terraform fmt line shifts - Apply terraform fmt to variables.tf * refactor(project-factory): remove unnecessary depends_on from folder-iam modules Folder IAM modules depend on their own folder creation modules, not on module.projects. The explicit depends_on was leftover from an earlier design. * FAST stages * Address review comments. - FAST Stages: - Added tag_keys to output-files.tf in 0-org-setup to pass org tags via tfvars. - Sorted tag_keys and tag_values in output-files.tf. - Updated project-factory, networking, and security stages to use tag_keys. - Filtered tag_keys for dynamic tags only. - Modules: - Excluded tag_vars from local.ctx in iam-service-account and organization. - Simplified tag_value in iam-service-account. - Tests: - Updated test inventories for 0-org-setup and project-factory. * Fix tf format * Fix tfdoc * docs: add ADR for templatestring vars convention and update status of base path ADR * More tfdoc * Update schemas * Use endswith in context loop * Address review * Update FAST readmes * Update last modules * Terraform fmt * Revert alloydb * Fix whitespace --------- Co-authored-by: Ludovico Magnocavallo <ludo@qix.it>
This commit is contained in:
Julio Castillo
@@ -198,9 +198,9 @@ A reference Certificate Authority Services (CAS) is also part of this stage, all
|
||||
| [project_ids](variables-fast.tf#L67) | Projects created in the bootstrap stage. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [service_accounts](variables-fast.tf#L75) | Service accounts created in the bootstrap stage. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [storage_buckets](variables-fast.tf#L83) | Storage buckets created in the bootstrap stage. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [tag_keys](variables-fast.tf#L91) | FAST-managed resource manager tag keys. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [tag_values](variables-fast.tf#L99) | FAST-managed resource manager tag values. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [universe](variables-fast.tf#L107) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code>object({…})</code> | | <code>null</code> | <code>0-org-setup</code> |
|
||||
| [tag_keys](variables-fast.tf#L91) | FAST-managed resource manager tag keys. | <code>map(object({…}))</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [tag_values](variables-fast.tf#L102) | FAST-managed resource manager tag values. | <code>map(string)</code> | | <code>{}</code> | <code>0-org-setup</code> |
|
||||
| [universe](variables-fast.tf#L110) | GCP universe where to deploy projects. The prefix will be prepended to the project id. | <code>object({…})</code> | | <code>null</code> | <code>0-org-setup</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -38,10 +38,17 @@ locals {
|
||||
},
|
||||
local._ctx.iam_principals
|
||||
)
|
||||
project_ids = merge(var.project_ids, local._ctx.project_ids)
|
||||
storage_buckets = merge(var.storage_buckets, local._ctx.storage_buckets)
|
||||
tag_keys = merge(var.tag_keys, local._ctx.tag_keys)
|
||||
tag_values = merge(var.tag_values, local._ctx.tag_values)
|
||||
project_ids = merge(var.project_ids, local._ctx.project_ids)
|
||||
storage_buckets = merge(var.storage_buckets, local._ctx.storage_buckets)
|
||||
tag_keys = merge(var.tag_keys, local._ctx.tag_keys)
|
||||
tag_values = merge(var.tag_values, local._ctx.tag_values)
|
||||
tag_vars = {
|
||||
projects = try(local._ctx.tag_vars.projects, {})
|
||||
organization = merge({
|
||||
for k, v in var.tag_keys : k => v.namespaced_name
|
||||
if v.allowed_values_regex != null
|
||||
}, try(local._ctx.tag_vars.organization, {}))
|
||||
}
|
||||
vpc_sc_perimeters = merge(var.perimeters, local._ctx.vpc_sc_perimeters)
|
||||
})
|
||||
# normalize defaults
|
||||
|
||||
@@ -495,6 +495,24 @@
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
"tag_vars": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"projects": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"organization": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"vpc_host_projects": {
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
|
||||
@@ -144,6 +144,11 @@
|
||||
<br>*additional properties: string*
|
||||
- **tag_values**: *object*
|
||||
<br>*additional properties: string*
|
||||
- **tag_vars**: *object*
|
||||
<br>*additional properties: false*
|
||||
- **projects**: *object*
|
||||
<br>*additional properties: object*
|
||||
- **organization**: *string*
|
||||
- **vpc_host_projects**: *object*
|
||||
<br>*additional properties: string*
|
||||
- **vpc_sc_perimeters**: *object*
|
||||
|
||||
@@ -834,6 +834,9 @@
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"allowed_values_regex": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": {
|
||||
"type": "string"
|
||||
},
|
||||
@@ -873,7 +876,23 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"allOf": [
|
||||
{
|
||||
"if": {
|
||||
"required": [
|
||||
"allowed_values_regex"
|
||||
]
|
||||
},
|
||||
"then": {
|
||||
"not": {
|
||||
"required": [
|
||||
"values"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"tag_bindings": {
|
||||
|
||||
@@ -91,9 +91,12 @@ variable "storage_buckets" {
|
||||
variable "tag_keys" {
|
||||
# tfdoc:variable:source 0-org-setup
|
||||
description = "FAST-managed resource manager tag keys."
|
||||
type = map(string)
|
||||
nullable = false
|
||||
default = {}
|
||||
type = map(object({
|
||||
namespaced_name = string
|
||||
allowed_values_regex = optional(string)
|
||||
}))
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "tag_values" {
|
||||
|
||||
Reference in New Issue
Block a user