Add support for dynamic tags (#3897)
* Allow creation of dynamic tags * Extend project factory and related modules to support dynamic values * Extend folder and organization modules * project and organization readme * Simplify dynamic tag support and remove unnecessary restrictions • Schemas & Validations: Removed the restriction that forbade combining IAM fields with allowed_values_regex on tags. Updated validations in project and organization modules, and simplified all relevant JSON schemas. • Module Tag Bindings: Simplified the tag_value assignment in folder , project , gcs , bigquery-dataset , and kms modules by removing the defensive can(regex(...)) check and calling templatestring directly. • Outputs: Removed the tags_dynamic output from project and organization modules, as the same information is now available in tag_keys . • Project Factory: Updated tag_vars_projects in projects.tf to use the native namespaced_name attribute and filtered manually for dynamic tags. * fix(organization, project): fix linting and tests for dynamic tag support - Align allowed_values_regex and description extraction in _tags_merged locals to use lookup() for consistency with other fields. - Fix spacing in project context variable (alphabetical ordering). - Update organization tags test to include the new cost_center tag key with allowed_values_regex. - Update project tags test to include the new cost_center tag key and reflect the resolved allowed_values_regex on environment. * refactor(gcs): refine tag bindings and fix context test - Add _tag_bindings local to pre-resolve context references, enabling templatestring to receive a direct map reference (required by Terraform). - Use var.context.tag_vars instead of the non-existent local.ctx.tag_vars. - Fix HCL syntax in context.tfvars (escaped inner quotes). - Update context test inventory to reflect 3 tag bindings including a dynamic value resolved via templatestring. * refactor: align modules with tag binding context pattern - Add _tag_bindings local + templatestring dance to cloud-run-v2, compute-vm, folder, kms modules (bigquery-dataset already had it) - Exclude tag_vars from local.ctx in cloud-run-v2, compute-vm, folder, kms, project modules (bigquery-dataset already had it) - Add tag_vars to context variable in cloud-run-v2, compute-vm modules (others already had it) - Update all context tests with dynamic tag binding values using var.context.tag_vars * docs: add module-level tftest.yaml test instructions to GEMINI.md * docs: regenerate READMEs after tag-regex alignment - Regenerate variable tables in 7 module READMEs to reflect line number shifts from prior tag-regex changes - Add tag_vars exclusion to gcs ctx local - Fix whitespace alignment in iam-service-account and project-factory tag_vars blocks - Update tftest resource counts for organization and project - Remove tags_dynamic from organization/project output tables * fix(project-factory): update test inventory for tag_bindings module split - Move tag binding address from folder-2 to folder-2-iam in test inventory (tag_bindings moved from creation to IAM modules) - Update module instance count from 34 to 35 - Regenerate README tables after terraform fmt line shifts - Apply terraform fmt to variables.tf * refactor(project-factory): remove unnecessary depends_on from folder-iam modules Folder IAM modules depend on their own folder creation modules, not on module.projects. The explicit depends_on was leftover from an earlier design. * FAST stages * Address review comments. - FAST Stages: - Added tag_keys to output-files.tf in 0-org-setup to pass org tags via tfvars. - Sorted tag_keys and tag_values in output-files.tf. - Updated project-factory, networking, and security stages to use tag_keys. - Filtered tag_keys for dynamic tags only. - Modules: - Excluded tag_vars from local.ctx in iam-service-account and organization. - Simplified tag_value in iam-service-account. - Tests: - Updated test inventories for 0-org-setup and project-factory. * Fix tf format * Fix tfdoc * docs: add ADR for templatestring vars convention and update status of base path ADR * More tfdoc * Update schemas * Use endswith in context loop * Address review * Update FAST readmes * Update last modules * Terraform fmt * Revert alloydb * Fix whitespace --------- Co-authored-by: Ludovico Magnocavallo <ludo@qix.it>
This commit is contained in:
Julio Castillo
@@ -417,42 +417,42 @@ module "bucket" {
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [name](variables.tf#L224) | Bucket name suffix. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L228) | Bucket name suffix. | <code>string</code> | ✓ | |
|
||||
| [autoclass](variables.tf#L17) | Enable autoclass to automatically transition objects to appropriate storage classes based on their access pattern. If set to true, storage_class must be set to STANDARD. Defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [bucket_create](variables.tf#L23) | Create bucket. | <code>bool</code> | | <code>true</code> |
|
||||
| [context](variables.tf#L30) | Context-specific interpolations. | <code>object({…})</code> | | <code>{}</code> |
|
||||
| [cors](variables.tf#L46) | CORS configuration for the bucket. Defaults to null. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [custom_placement_config](variables.tf#L57) | The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated as REGIONAL or MULTI_REGIONAL, the parameters are empty. | <code>list(string)</code> | | <code>null</code> |
|
||||
| [default_event_based_hold](variables.tf#L63) | Enable event based hold to new objects added to specific bucket, defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [enable_hierarchical_namespace](variables.tf#L69) | Enables hierarchical namespace. | <code>bool</code> | | <code>null</code> |
|
||||
| [enable_object_retention](variables.tf#L75) | Enables object retention on a storage bucket. | <code>bool</code> | | <code>null</code> |
|
||||
| [encryption_key](variables.tf#L81) | KMS key that will be used for encryption. | <code>string</code> | | <code>null</code> |
|
||||
| [force_destroy](variables.tf#L87) | Optional map to set force destroy keyed by name, defaults to false. | <code>bool</code> | | <code>false</code> |
|
||||
| [cors](variables.tf#L50) | CORS configuration for the bucket. Defaults to null. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [custom_placement_config](variables.tf#L61) | The bucket's custom location configuration, which specifies the individual regions that comprise a dual-region bucket. If the bucket is designated as REGIONAL or MULTI_REGIONAL, the parameters are empty. | <code>list(string)</code> | | <code>null</code> |
|
||||
| [default_event_based_hold](variables.tf#L67) | Enable event based hold to new objects added to specific bucket, defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [enable_hierarchical_namespace](variables.tf#L73) | Enables hierarchical namespace. | <code>bool</code> | | <code>null</code> |
|
||||
| [enable_object_retention](variables.tf#L79) | Enables object retention on a storage bucket. | <code>bool</code> | | <code>null</code> |
|
||||
| [encryption_key](variables.tf#L85) | KMS key that will be used for encryption. | <code>string</code> | | <code>null</code> |
|
||||
| [force_destroy](variables.tf#L91) | Optional map to set force destroy keyed by name, defaults to false. | <code>bool</code> | | <code>false</code> |
|
||||
| [iam](variables-iam.tf#L17) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables-iam.tf#L23) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables-iam.tf#L38) | Individual additive IAM bindings. Keys are arbitrary. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_by_principals](variables-iam.tf#L53) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ip_filter](variables.tf#L93) | The bucket's IP filter configuration. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [kms_autokeys](variables.tf#L104) | KMS Autokey key handles. If location is not specified the bucket location will be used. Key handle names will be added to the kms_keys context with an `autokeys/` prefix. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L122) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [lifecycle_rules](variables.tf#L128) | Bucket lifecycle rule. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [location](variables.tf#L177) | Bucket location. | <code>string</code> | | <code>null</code> |
|
||||
| [logging_config](variables.tf#L187) | Bucket logging configuration. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [managed_folders](variables.tf#L196) | Managed folders to create within the bucket in {PATH => CONFIG} format. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [notification_config](variables.tf#L229) | GCS Notification configuration. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [objects_to_upload](variables.tf#L247) | Objects to be uploaded to bucket. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L273) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
||||
| [project_id](variables.tf#L283) | Bucket project id. Only required when creating buckets, or notification config topics. | <code>string</code> | | <code>null</code> |
|
||||
| [public_access_prevention](variables.tf#L302) | Prevents public access to the bucket. | <code>string</code> | | <code>null</code> |
|
||||
| [requester_pays](variables.tf#L312) | Enables Requester Pays on a storage bucket. | <code>bool</code> | | <code>null</code> |
|
||||
| [retention_policy](variables.tf#L318) | Bucket retention policy. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [rpo](variables.tf#L327) | Bucket recovery point objective. | <code>string</code> | | <code>null</code> |
|
||||
| [soft_delete_retention](variables.tf#L337) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | <code>number</code> | | <code>null</code> |
|
||||
| [storage_class](variables.tf#L343) | Bucket storage class. | <code>string</code> | | <code>"STANDARD"</code> |
|
||||
| [tag_bindings](variables.tf#L353) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [uniform_bucket_level_access](variables.tf#L360) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
||||
| [versioning](variables.tf#L366) | Enable versioning, defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [website](variables.tf#L372) | Bucket website. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [ip_filter](variables.tf#L97) | The bucket's IP filter configuration. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [kms_autokeys](variables.tf#L108) | KMS Autokey key handles. If location is not specified the bucket location will be used. Key handle names will be added to the kms_keys context with an `autokeys/` prefix. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L126) | Labels to be attached to all buckets. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [lifecycle_rules](variables.tf#L132) | Bucket lifecycle rule. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [location](variables.tf#L181) | Bucket location. | <code>string</code> | | <code>null</code> |
|
||||
| [logging_config](variables.tf#L191) | Bucket logging configuration. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [managed_folders](variables.tf#L200) | Managed folders to create within the bucket in {PATH => CONFIG} format. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [notification_config](variables.tf#L233) | GCS Notification configuration. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [objects_to_upload](variables.tf#L251) | Objects to be uploaded to bucket. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L277) | Optional prefix used to generate the bucket name. | <code>string</code> | | <code>null</code> |
|
||||
| [project_id](variables.tf#L287) | Bucket project id. Only required when creating buckets, or notification config topics. | <code>string</code> | | <code>null</code> |
|
||||
| [public_access_prevention](variables.tf#L306) | Prevents public access to the bucket. | <code>string</code> | | <code>null</code> |
|
||||
| [requester_pays](variables.tf#L316) | Enables Requester Pays on a storage bucket. | <code>bool</code> | | <code>null</code> |
|
||||
| [retention_policy](variables.tf#L322) | Bucket retention policy. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [rpo](variables.tf#L331) | Bucket recovery point objective. | <code>string</code> | | <code>null</code> |
|
||||
| [soft_delete_retention](variables.tf#L341) | The duration in seconds that soft-deleted objects in the bucket will be retained and cannot be permanently deleted. Set to 0 to override the default and disable. | <code>number</code> | | <code>null</code> |
|
||||
| [storage_class](variables.tf#L347) | Bucket storage class. | <code>string</code> | | <code>"STANDARD"</code> |
|
||||
| [tag_bindings](variables.tf#L357) | Tag bindings for this folder, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [uniform_bucket_level_access](variables.tf#L364) | Allow using object ACLs (false) or not (true, this is the recommended behavior) , defaults to true (which is the recommended practice, but not the behavior of storage API). | <code>bool</code> | | <code>true</code> |
|
||||
| [versioning](variables.tf#L370) | Enable versioning, defaults to false. | <code>bool</code> | | <code>null</code> |
|
||||
| [website](variables.tf#L376) | Bucket website. | <code>object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
Reference in New Issue
Block a user