From 7be3288cc7434a90a2736a9cac3cf63603052933 Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Wed, 16 Nov 2022 23:03:29 +0100 Subject: [PATCH] Add tests for factory examples --- .../iam-delegated-role-grants/README.md | 5 ++-- .../data-platform-foundations/README.md | 4 +-- .../factories/bigquery-factory/README.md | 2 +- .../networking/hub-and-spoke-vpn/README.md | 2 +- .../net-dns-policy-address/README.md | 2 +- modules/endpoints/README.md | 4 +-- modules/folder/README.md | 6 ++--- modules/kms/README.md | 2 +- modules/net-vpc-firewall/README.md | 12 ++++----- modules/net-vpc/README.md | 2 +- modules/organization/README.md | 18 ++++++------- .../org-policy-custom-constraints.tf | 4 +-- modules/project/README.md | 8 +++--- modules/projects-data-source/README.md | 4 +-- .../configs/custom-constraints/dataproc.yaml | 10 +++++++ .../configs/custom-constraints/gke.yaml | 18 +++++++++++++ tests/examples/configs/endpoints/openapi.yaml | 1 + .../configs/firewall-policies/cidrs.yaml | 4 +++ .../configs/firewall-policies/rules.yaml | 23 ++++++++++++++++ .../configs/firewall/cidr_template.yaml | 5 ++++ .../firewall/rules/laod_balancers.yaml | 10 +++++++ .../configs/org-policies/boolean.yaml | 12 +++++++++ tests/examples/configs/org-policies/list.yaml | 26 +++++++++++++++++++ .../examples/configs/subnets/subnet-name.yaml | 14 ++++++++++ tests/examples/test_plan.py | 7 +++-- 25 files changed, 163 insertions(+), 42 deletions(-) create mode 100644 tests/examples/configs/custom-constraints/dataproc.yaml create mode 100644 tests/examples/configs/custom-constraints/gke.yaml create mode 100644 tests/examples/configs/endpoints/openapi.yaml create mode 100644 tests/examples/configs/firewall-policies/cidrs.yaml create mode 100644 tests/examples/configs/firewall-policies/rules.yaml create mode 100644 tests/examples/configs/firewall/cidr_template.yaml create mode 100644 tests/examples/configs/firewall/rules/laod_balancers.yaml create mode 100644 tests/examples/configs/org-policies/boolean.yaml create mode 100644 tests/examples/configs/org-policies/list.yaml create mode 100644 tests/examples/configs/subnets/subnet-name.yaml diff --git a/blueprints/cloud-operations/iam-delegated-role-grants/README.md b/blueprints/cloud-operations/iam-delegated-role-grants/README.md index dae32ef9b..4c4d227da 100644 --- a/blueprints/cloud-operations/iam-delegated-role-grants/README.md +++ b/blueprints/cloud-operations/iam-delegated-role-grants/README.md @@ -27,13 +27,12 @@ By changing the `restricted_role_grant`, the blueprint can be used to grant admi You can easily configure the blueprint for this use case: -```hcl +```tfvars # terraform.tfvars delegated_role_grants = ["roles/compute.networkUser"] -direct_role_grants = [] +direct_role_grants = [] restricted_role_grant = "roles/compute.networkAdmin" -# tftest skip ``` This diagram shows the resources and expected behaviour: diff --git a/blueprints/data-solutions/data-platform-foundations/README.md b/blueprints/data-solutions/data-platform-foundations/README.md index 51545d58e..b7fcc806a 100644 --- a/blueprints/data-solutions/data-platform-foundations/README.md +++ b/blueprints/data-solutions/data-platform-foundations/README.md @@ -135,7 +135,6 @@ service_encryption_keys = { storage = "KEY_URL_MULTIREGIONAL" pubsub = "KEY_URL_MULTIREGIONAL" } -# tftest skip ``` This step is optional and depends on customer policies and security best practices. @@ -198,8 +197,7 @@ billing_account_id = "111111-222222-333333" older_id = "folders/123456789012" organization_domain = "domain.com" prefix = "myco" -# tftest skip` -`` +``` For more fine details check variables on [`variables.tf`](./variables.tf) and update according to the desired configuration. Remember to create team groups described [below](#groups). diff --git a/blueprints/factories/bigquery-factory/README.md b/blueprints/factories/bigquery-factory/README.md index 01c098bec..11767ab17 100644 --- a/blueprints/factories/bigquery-factory/README.md +++ b/blueprints/factories/bigquery-factory/README.md @@ -24,7 +24,7 @@ module "bq" { views = try(each.value.views, null) tables = try(each.value.tables, null) } -# tftest skip +# tftest modules=1 resources= ``` ### Configuration Structure diff --git a/blueprints/networking/hub-and-spoke-vpn/README.md b/blueprints/networking/hub-and-spoke-vpn/README.md index 20fb2c518..2ba3a86ad 100644 --- a/blueprints/networking/hub-and-spoke-vpn/README.md +++ b/blueprints/networking/hub-and-spoke-vpn/README.md @@ -35,7 +35,7 @@ You can easily create such a project by commenting turning on project creation i ```hcl module "project" { - source = "../../..//modules/project" + source = "../../../modules/project" name = var.project_id # comment or remove this line to enable project creation # project_create = false diff --git a/modules/__experimental/net-dns-policy-address/README.md b/modules/__experimental/net-dns-policy-address/README.md index 3dbabdac3..7044ef2ec 100644 --- a/modules/__experimental/net-dns-policy-address/README.md +++ b/modules/__experimental/net-dns-policy-address/README.md @@ -12,7 +12,7 @@ module "dns-policy-addresses" { project_id = "myproject" regions = ["europe-west1", "europe-west3"] } -# tftest skip +# tftest skip (uses data sources) ``` The output is a map with lists of addresses of type `DNS_RESOLVER` for each region specified in variables. diff --git a/modules/endpoints/README.md b/modules/endpoints/README.md index 0d85961dc..a000e2b05 100644 --- a/modules/endpoints/README.md +++ b/modules/endpoints/README.md @@ -11,14 +11,14 @@ module "endpoint" { source = "./fabric/modules/endpoints" project_id = "my-project" service_name = "YOUR-API.endpoints.YOUR-PROJECT-ID.cloud.goog" - openapi_config = { "yaml_path" = "openapi.yaml" } + openapi_config = { "yaml_path" = "configs/endpoints/openapi.yaml" } iam = { "servicemanagement.serviceController" = [ "serviceAccount:123456890-compute@developer.gserviceaccount.com" ] } } -# tftest skip +# tftest modules=1 resources=2 ``` [Here](https://github.com/GoogleCloudPlatform/python-docs-samples/blob/master/endpoints/getting-started/openapi.yaml) you can find an example of an openapi.yaml file. Once created the endpoint, remember to activate the service at project level. diff --git a/modules/folder/README.md b/modules/folder/README.md index 1943882d0..7169776ea 100644 --- a/modules/folder/README.md +++ b/modules/folder/README.md @@ -89,15 +89,15 @@ module "folder" { parent = "organizations/1234567890" name = "Folder name" firewall_policy_factory = { - cidr_file = "data/cidrs.yaml" + cidr_file = "configs/firewall-policies/cidrs.yaml" policy_name = null - rules_file = "data/rules.yaml" + rules_file = "configs/firewall-policies/rules.yaml" } firewall_policy_association = { factory-policy = module.folder.firewall_policy_id["factory"] } } -# tftest skip +# tftest modules=1 resources=5 ``` ```yaml diff --git a/modules/kms/README.md b/modules/kms/README.md index cfaa822a9..4fe748578 100644 --- a/modules/kms/README.md +++ b/modules/kms/README.md @@ -23,7 +23,7 @@ module "kms" { keyring_create = false keys = { key-a = null, key-b = null, key-c = null } } -# tftest skip +# tftest skip (uses data sources) ``` ### Keyring creation and crypto key rotation and IAM roles diff --git a/modules/net-vpc-firewall/README.md b/modules/net-vpc-firewall/README.md index 6b36edd93..877b15e7d 100644 --- a/modules/net-vpc-firewall/README.md +++ b/modules/net-vpc-firewall/README.md @@ -138,16 +138,16 @@ module "firewall" { project_id = "my-project" network = "my-network" factories_config = { - rules_folder = "config/firewall" - cidr_tpl_file = "config/cidr_template.yaml" + rules_folder = "configs/firewal/rules" + cidr_tpl_file = "configs/firewal/cidr_template.yaml" } } -# tftest skip +# tftest modules=1 resources=3 ``` ```yaml -# ./config/firewall/load_balancers.yaml +# ./configs/firewall/rules/load_balancers.yaml allow-healthchecks: description: Allow ingress from healthchecks. ranges: @@ -161,13 +161,13 @@ allow-healthchecks: ``` ```yaml -# ./config/cidr_template.yaml +# ./configs/firewall/cidr_template.yaml healthchecks: - 35.191.0.0/16 + - 130.211.0.0/22 - 209.85.152.0/22 - 209.85.204.0/22 - ``` diff --git a/modules/net-vpc/README.md b/modules/net-vpc/README.md index 0d6a231e1..6b08c3b08 100644 --- a/modules/net-vpc/README.md +++ b/modules/net-vpc/README.md @@ -233,7 +233,7 @@ module "vpc" { name = "my-network" data_folder = "config/subnets" } -# tftest skip +# tftest modules=1 resources=1 ``` ```yaml diff --git a/modules/organization/README.md b/modules/organization/README.md index d2e8ef319..ce4958630 100644 --- a/modules/organization/README.md +++ b/modules/organization/README.md @@ -137,14 +137,13 @@ module "org" { source = "./fabric/modules/organization" organization_id = var.organization_id - org_policy_custom_constraints_data_path = "/my/path" - + org_policy_custom_constraints_data_path = "configs/custom-constraints" } -# tftest skip +# tftest modules=1 resources=3 ``` ```yaml -# /my/path/gke.yaml +# configs/custom-constraints/gke.yaml custom.gkeEnableLogging: resource_types: - container.googleapis.com/Cluster @@ -166,9 +165,8 @@ custom.gkeEnableAutoUpgrade: ``` ```yaml -# /my/path/dataproc.yaml - -custom.dataprocNoMoreThan10Workers +# configs/custom-constraints/dataproc.yaml +custom.dataprocNoMoreThan10Workers: resource_types: - dataproc.googleapis.com/Cluster method_types: @@ -228,15 +226,15 @@ module "org" { source = "./fabric/modules/organization" organization_id = var.organization_id firewall_policy_factory = { - cidr_file = "data/cidrs.yaml" + cidr_file = "configs/firewall-policies/cidrs.yaml" policy_name = null - rules_file = "data/rules.yaml" + rules_file = "configs/firewall-policies/rules.yaml" } firewall_policy_association = { factory-policy = module.org.firewall_policy_id["factory"] } } -# tftest skip +# tftest modules=1 resources=4 ``` ```yaml diff --git a/modules/organization/org-policy-custom-constraints.tf b/modules/organization/org-policy-custom-constraints.tf index bfc2de1bc..b6414641b 100644 --- a/modules/organization/org-policy-custom-constraints.tf +++ b/modules/organization/org-policy-custom-constraints.tf @@ -18,10 +18,10 @@ locals { _custom_constraints_factory_data_raw = ( var.org_policy_custom_constraints_data_path == null ? tomap({}) - : tomap(merge([ + : merge([ for f in fileset(var.org_policy_custom_constraints_data_path, "*.yaml") : yamldecode(file("${var.org_policy_custom_constraints_data_path}/${f}")) - ]...)) + ]...) ) _custom_constraints_factory_data = { diff --git a/modules/project/README.md b/modules/project/README.md index 03ea00a19..f5277cd04 100644 --- a/modules/project/README.md +++ b/modules/project/README.md @@ -224,13 +224,13 @@ module "folder" { source = "./fabric/modules/folder" parent = "organizations/1234567890" name = "Folder name" - org_policies_data_path = "/my/path" + org_policies_data_path = "configs/org-policies/" } -# tftest skip +# tftest modules=1 resources=6 ``` ```yaml -# /my/path/boolean.yaml +# configs/org-policies/boolean.yaml iam.disableServiceAccountKeyCreation: enforce: true @@ -246,7 +246,7 @@ iam.disableServiceAccountKeyUpload: ``` ```yaml -# /my/path/list.yaml +# configs/org-policies/list.yaml compute.vmExternalIpAccess: deny: all: true diff --git a/modules/projects-data-source/README.md b/modules/projects-data-source/README.md index 35c5df561..617a01dbd 100644 --- a/modules/projects-data-source/README.md +++ b/modules/projects-data-source/README.md @@ -22,7 +22,7 @@ output "folders" { value = module.my-org.folders } -# tftest skip +# tftest skip (uses data sources) ``` ### My dev projects based on parent and label @@ -42,7 +42,7 @@ output "dev-folders" { value = module.my-dev.folders } -# tftest skip +# tftest skip (uses data sources) ``` diff --git a/tests/examples/configs/custom-constraints/dataproc.yaml b/tests/examples/configs/custom-constraints/dataproc.yaml new file mode 100644 index 000000000..05a8d2b86 --- /dev/null +++ b/tests/examples/configs/custom-constraints/dataproc.yaml @@ -0,0 +1,10 @@ +custom.dataprocNoMoreThan10Workers: + resource_types: + - dataproc.googleapis.com/Cluster + method_types: + - CREATE + - UPDATE + condition: resource.config.workerConfig.numInstances + resource.config.secondaryWorkerConfig.numInstances > 10 + action_type: DENY + display_name: Total number of worker instances cannot be larger than 10 + description: Cluster cannot have more than 10 workers, including primary and secondary workers. diff --git a/tests/examples/configs/custom-constraints/gke.yaml b/tests/examples/configs/custom-constraints/gke.yaml new file mode 100644 index 000000000..d80a20059 --- /dev/null +++ b/tests/examples/configs/custom-constraints/gke.yaml @@ -0,0 +1,18 @@ +custom.gkeEnableLogging: + resource_types: + - container.googleapis.com/Cluster + method_types: + - CREATE + - UPDATE + condition: resource.loggingService == "none" + action_type: DENY + display_name: Do not disable Cloud Logging +custom.gkeEnableAutoUpgrade: + resource_types: + - container.googleapis.com/NodePool + method_types: + - CREATE + condition: resource.management.autoUpgrade == true + action_type: ALLOW + display_name: Enable node auto-upgrade + description: All node pools must have node auto-upgrade enabled. diff --git a/tests/examples/configs/endpoints/openapi.yaml b/tests/examples/configs/endpoints/openapi.yaml new file mode 100644 index 000000000..1bb8bf6d7 --- /dev/null +++ b/tests/examples/configs/endpoints/openapi.yaml @@ -0,0 +1 @@ +# empty diff --git a/tests/examples/configs/firewall-policies/cidrs.yaml b/tests/examples/configs/firewall-policies/cidrs.yaml new file mode 100644 index 000000000..6df2b79ee --- /dev/null +++ b/tests/examples/configs/firewall-policies/cidrs.yaml @@ -0,0 +1,4 @@ +rfc1918: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 diff --git a/tests/examples/configs/firewall-policies/rules.yaml b/tests/examples/configs/firewall-policies/rules.yaml new file mode 100644 index 000000000..d823983c5 --- /dev/null +++ b/tests/examples/configs/firewall-policies/rules.yaml @@ -0,0 +1,23 @@ +allow-admins: + description: Access from the admin subnet to all subnets + direction: INGRESS + action: allow + priority: 1000 + ranges: + - $rfc1918 + ports: + all: [] + target_resources: null + enable_logging: false + +allow-ssh-from-iap: + description: Enable SSH from IAP + direction: INGRESS + action: allow + priority: 1002 + ranges: + - 35.235.240.0/20 + ports: + tcp: ["22"] + target_resources: null + enable_logging: false diff --git a/tests/examples/configs/firewall/cidr_template.yaml b/tests/examples/configs/firewall/cidr_template.yaml new file mode 100644 index 000000000..990266419 --- /dev/null +++ b/tests/examples/configs/firewall/cidr_template.yaml @@ -0,0 +1,5 @@ +healthchecks: + - 35.191.0.0/16 + - 130.211.0.0/22 + - 209.85.152.0/22 + - 209.85.204.0/22 diff --git a/tests/examples/configs/firewall/rules/laod_balancers.yaml b/tests/examples/configs/firewall/rules/laod_balancers.yaml new file mode 100644 index 000000000..29b2dfc86 --- /dev/null +++ b/tests/examples/configs/firewall/rules/laod_balancers.yaml @@ -0,0 +1,10 @@ +allow-healthchecks: + description: Allow ingress from healthchecks. + ranges: + - healthchecks + targets: ["lb-backends"] + rules: + - protocol: tcp + ports: + - 80 + - 443 diff --git a/tests/examples/configs/org-policies/boolean.yaml b/tests/examples/configs/org-policies/boolean.yaml new file mode 100644 index 000000000..83aea4203 --- /dev/null +++ b/tests/examples/configs/org-policies/boolean.yaml @@ -0,0 +1,12 @@ +iam.disableServiceAccountKeyCreation: + enforce: true + +iam.disableServiceAccountKeyUpload: + enforce: false + rules: + - condition: + expression: resource.matchTagId("tagKeys/1234", "tagValues/1234") + title: condition + description: test condition + location: xxx + enforce: true diff --git a/tests/examples/configs/org-policies/list.yaml b/tests/examples/configs/org-policies/list.yaml new file mode 100644 index 000000000..d66a3da26 --- /dev/null +++ b/tests/examples/configs/org-policies/list.yaml @@ -0,0 +1,26 @@ +compute.vmExternalIpAccess: + deny: + all: true + +iam.allowedPolicyMemberDomains: + allow: + values: + - C0xxxxxxx + - C0yyyyyyy + +compute.restrictLoadBalancerCreationForTypes: + deny: + values: ["in:EXTERNAL"] + rules: + - condition: + expression: resource.matchTagId("tagKeys/1234", "tagValues/1234") + title: condition + description: test condition + allow: + values: ["in:EXTERNAL"] + - condition: + expression: resource.matchTagId("tagKeys/12345", "tagValues/12345") + title: condition2 + description: test condition2 + allow: + all: true diff --git a/tests/examples/configs/subnets/subnet-name.yaml b/tests/examples/configs/subnets/subnet-name.yaml new file mode 100644 index 000000000..5ac92e6fc --- /dev/null +++ b/tests/examples/configs/subnets/subnet-name.yaml @@ -0,0 +1,14 @@ +region: europe-west1 +description: Sample description +ip_cidr_range: 10.0.0.0/24 +# optional attributes +enable_private_access: false # defaults to true +iam_users: ["foobar@example.com"] # grant compute/networkUser to users +iam_groups: ["lorem@example.com"] # grant compute/networkUser to groups +iam_service_accounts: ["fbz@prj.iam.gserviceaccount.com"] +secondary_ip_ranges: # map of secondary ip ranges + secondary-range-a: 192.168.0.0/24 +flow_logs: # enable, set to empty map to use defaults + - aggregation_interval: "INTERVAL_5_SEC" + - flow_sampling: 0.5 + - metadata: "INCLUDE_ALL_METADATA" diff --git a/tests/examples/test_plan.py b/tests/examples/test_plan.py index be0686424..fda7284a1 100644 --- a/tests/examples/test_plan.py +++ b/tests/examples/test_plan.py @@ -23,13 +23,16 @@ def test_example(recursive_e2e_plan_runner, tmp_path, example): (tmp_path / 'fabric').symlink_to(Path(BASE_PATH, '../../').resolve()) (tmp_path / 'variables.tf').symlink_to( Path(BASE_PATH, 'variables.tf').resolve()) + (tmp_path / 'configs').symlink_to(Path(BASE_PATH, 'configs').resolve()) (tmp_path / 'main.tf').write_text(example) match = EXPECTED_RESOURCES_RE.search(example) expected_modules = int(match.group(1)) if match is not None else 1 expected_resources = int(match.group(2)) if match is not None else 1 + assert match is not None, "can't find tftest directive" + num_modules, num_resources = recursive_e2e_plan_runner( str(tmp_path), tmpdir=False) - assert expected_modules == num_modules - assert expected_resources == num_resources + assert expected_modules == num_modules, 'wrong number of modules' + assert expected_resources == num_resources, 'wrong number of resources'