From 02a9bdfe2be560bd91a2311698067db24496ffdc Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Mon, 7 Jul 2025 18:21:54 +0200 Subject: [PATCH 1/2] Add `tag_bindings` to Artifact Registry and Secret Manager modules. (#3220) * Add `tag_bindings` to Artifact Registry and Secret Manager modules. * Fix linting * Fix README --- modules/artifact-registry/README.md | 1 + modules/artifact-registry/main.tf | 9 ++++++++- modules/artifact-registry/variables.tf | 7 +++++++ modules/secret-manager/README.md | 5 +++-- modules/secret-manager/main.tf | 17 ++++++++++++++++- modules/secret-manager/variables.tf | 9 ++++++++- 6 files changed, 43 insertions(+), 5 deletions(-) diff --git a/modules/artifact-registry/README.md b/modules/artifact-registry/README.md index 96638798f..fcadbe8df 100644 --- a/modules/artifact-registry/README.md +++ b/modules/artifact-registry/README.md @@ -313,6 +313,7 @@ module "additive_iam" { | [iam_bindings_additive](variables-iam.tf#L58) | Individual additive IAM bindings. Keys are arbitrary. | map(object({…})) | | {} | | [iam_by_principals](variables-iam.tf#L73) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | map(list(string)) | | {} | | [labels](variables.tf#L206) | Labels to be attached to the registry. | map(string) | | {} | +| [tag_bindings](variables.tf#L227) | Tag bindings for this repository, in key => tag value id format. | map(string) | | {} | ## Outputs diff --git a/modules/artifact-registry/main.tf b/modules/artifact-registry/main.tf index aa47cbbbe..7a3d31d28 100644 --- a/modules/artifact-registry/main.tf +++ b/modules/artifact-registry/main.tf @@ -1,5 +1,5 @@ /** - * Copyright 2024 Google LLC + * Copyright 2025 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -217,3 +217,10 @@ resource "google_artifact_registry_repository" "registry" { } } + +resource "google_tags_location_tag_binding" "binding" { + for_each = var.tag_bindings + parent = "//artifactregistry.googleapis.com/${google_artifact_registry_repository.registry.id}" + location = var.location + tag_value = each.value +} diff --git a/modules/artifact-registry/variables.tf b/modules/artifact-registry/variables.tf index 102b8374a..2d979eee1 100644 --- a/modules/artifact-registry/variables.tf +++ b/modules/artifact-registry/variables.tf @@ -223,3 +223,10 @@ variable "project_id" { description = "Registry project id." type = string } + +variable "tag_bindings" { + description = "Tag bindings for this repository, in key => tag value id format." + type = map(string) + nullable = false + default = {} +} diff --git a/modules/secret-manager/README.md b/modules/secret-manager/README.md index 59806f3d4..489517ad8 100644 --- a/modules/secret-manager/README.md +++ b/modules/secret-manager/README.md @@ -192,8 +192,9 @@ module "secret-manager" { | [project_id](variables.tf#L29) | Project id where the keyring will be created. | string | ✓ | | | [iam](variables.tf#L17) | IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format. | map(map(list(string))) | | {} | | [labels](variables.tf#L23) | Optional labels for each secret. | map(map(string)) | | {} | -| [secrets](variables.tf#L34) | Map of secrets to manage, their optional expire time, version destroy ttl, locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | map(object({…})) | | {} | -| [versions](variables.tf#L45) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | map(map(object({…}))) | | {} | +| [project_number](variables.tf#L34) | Project number of var.project_id. Set this to avoid permadiffs when creating tag bindings. | string | | null | +| [secrets](variables.tf#L40) | Map of secrets to manage, their optional expire time, version destroy ttl, locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | map(object({…})) | | {} | +| [versions](variables.tf#L52) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | map(map(object({…}))) | | {} | ## Outputs diff --git a/modules/secret-manager/main.tf b/modules/secret-manager/main.tf index ecd96808c..a81d9ba53 100644 --- a/modules/secret-manager/main.tf +++ b/modules/secret-manager/main.tf @@ -1,5 +1,5 @@ /** - * Copyright 2023 Google LLC + * Copyright 2025 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,6 +25,15 @@ locals { } ] ]) + tag_bindings = merge([ + for k, v in var.secrets : { + for kk, vv in v.tag_bindings : "${k}/${kk}" => { + parent = "//secretmanager.googleapis.com/projects/${coalesce(var.project_number, var.project_id)}/secrets/${google_secret_manager_secret.default[k].secret_id}" + tag_value = vv + } + } + if v.tag_bindings != null + ]...) version_pairs = flatten([ for secret, versions in var.versions : [ for name, attrs in versions : merge(attrs, { name = name, secret = secret }) @@ -96,3 +105,9 @@ resource "google_secret_manager_secret_iam_binding" "default" { secret_id = google_secret_manager_secret.default[each.value.secret].id members = each.value.members } + +resource "google_tags_tag_binding" "binding" { + for_each = local.tag_bindings + parent = each.value.parent + tag_value = each.value.tag_value +} diff --git a/modules/secret-manager/variables.tf b/modules/secret-manager/variables.tf index 8008809eb..3ed8d5761 100644 --- a/modules/secret-manager/variables.tf +++ b/modules/secret-manager/variables.tf @@ -1,5 +1,5 @@ /** - * Copyright 2023 Google LLC + * Copyright 2025 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -31,12 +31,19 @@ variable "project_id" { type = string } +variable "project_number" { + description = "Project number of var.project_id. Set this to avoid permadiffs when creating tag bindings." + type = string + default = null +} + variable "secrets" { description = "Map of secrets to manage, their optional expire time, version destroy ttl, locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set." type = map(object({ expire_time = optional(string) locations = optional(list(string)) keys = optional(map(string)) + tag_bindings = optional(map(string)) version_destroy_ttl = optional(string) })) default = {} From 2fc3413b970b2e506bc2b11e08b7065a27f0daae Mon Sep 17 00:00:00 2001 From: Javier Roger <7475510+javiroger@users.noreply.github.com> Date: Tue, 8 Jul 2025 17:10:54 +0200 Subject: [PATCH 2/2] feat: add support for regional instance templates (#3224) --- modules/compute-vm/README.md | 2 +- modules/compute-vm/outputs.tf | 12 ++++++++++-- modules/compute-vm/template.tf | 7 ------- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/modules/compute-vm/README.md b/modules/compute-vm/README.md index 962ddabb0..2fa6303d7 100644 --- a/modules/compute-vm/README.md +++ b/modules/compute-vm/README.md @@ -991,7 +991,7 @@ module "sole-tenancy" { | [service_account_email](outputs.tf#L73) | Service account email. | | | [service_account_iam_email](outputs.tf#L78) | Service account email. | | | [template](outputs.tf#L87) | Template resource. | | -| [template_name](outputs.tf#L92) | Template name. | | +| [template_name](outputs.tf#L96) | Template name. | | ## Fixtures diff --git a/modules/compute-vm/outputs.tf b/modules/compute-vm/outputs.tf index dc5a80266..79551b84a 100644 --- a/modules/compute-vm/outputs.tf +++ b/modules/compute-vm/outputs.tf @@ -86,10 +86,18 @@ output "service_account_iam_email" { output "template" { description = "Template resource." - value = try(google_compute_instance_template.default[0], null) + value = ( + local.template_regional + ? try(google_compute_region_instance_template.default[0], null) + : try(google_compute_instance_template.default[0], null) + ) } output "template_name" { description = "Template name." - value = try(google_compute_instance_template.default[0].name, null) + value = ( + local.template_regional + ? try(google_compute_region_instance_template.default[0].name, null) + : try(google_compute_instance_template.default[0].name, null) + ) } diff --git a/modules/compute-vm/template.tf b/modules/compute-vm/template.tf index 5e5bc2fc5..c1f548c19 100644 --- a/modules/compute-vm/template.tf +++ b/modules/compute-vm/template.tf @@ -332,13 +332,6 @@ resource "google_compute_region_instance_template" "default" { } } - dynamic "network_interface" { - for_each = var.network_attached_interfaces - content { - network_attachment = network_interface.value - } - } - scheduling { automatic_restart = !var.options.spot instance_termination_action = local.termination_action