Add support for quotas to project module (#2210)

* add support for quotas to project module * tfdoc * better outputs * Ensure keys in `quota_configs` are unique * update fast tests * Make quota E2E testable * Remove quota project caveat --------- Co-authored-by: Wiktor Niesiobędzki <wiktorn@google.com>
2024-04-10 19:03:04 +02:00
parent 215c5cec26
commit 9cace5272f
7 changed files with 140 additions and 9 deletions
--- a/fast/stages/0-bootstrap/automation.tf
+++ b/fast/stages/0-bootstrap/automation.tf
@@ -134,6 +134,7 @@ module "automation-project" {
      "cloudasset.googleapis.com",
      "cloudbilling.googleapis.com",
      "cloudkms.googleapis.com",
+      "cloudquotas.googleapis.com",
      "cloudresourcemanager.googleapis.com",
      "essentialcontacts.googleapis.com",
      "iam.googleapis.com",
--- a/modules/project/README.md
+++ b/modules/project/README.md
@@ -22,6 +22,7 @@ This module implements the creation and management of one GCP project including
 - [Project-scoped Tags](#project-scoped-tags)
 - [Custom Roles](#custom-roles)
  - [Custom Roles Factory](#custom-roles-factory)
+- [Quotas](#quotas)
 - [Outputs](#outputs)
  - [Managing project related configuration without creating it](#managing-project-related-configuration-without-creating-it)
 - [Files](#files)
@@ -797,6 +798,36 @@ includedPermissions:
  - resourcemanager.projects.list
 ```

+## Quotas
+
+Project and regional quotas can be managed via the `quotas` variable.
+
+```hcl
+module "project" {
+  source          = "./fabric/modules/project"
+  name            = "project"
+  billing_account = var.billing_account_id
+  parent          = var.folder_id
+  prefix          = var.prefix
+  quotas = {
+    cpus-ew8 = {
+      service         = "compute.googleapis.com"
+      quota_id        = "CPUS-per-project-region"
+      contact_email   = "user@example.com"
+      preferred_value = 321
+      dimensions = {
+        region = "europe-west8"
+      }
+    }
+  }
+  services = [
+    "cloudquotas.googleapis.com",
+    "compute.googleapis.com"
+  ]
+}
+# tftest modules=1 resources=4 e2e
+```
+
 ## Outputs

 Most of this module's outputs depend on its resources, to allow Terraform to compute all dependencies required for the project to be correctly configured. This allows you to reference outputs like `project_id` in other modules or resources without having to worry about setting `depends_on` blocks manually.
@@ -1044,10 +1075,12 @@ module "bucket" {
 | [main.tf](./main.tf) | Module-level locals and resources. | <code>google_compute_project_metadata_item</code> · <code>google_essential_contacts_contact</code> · <code>google_monitoring_monitored_project</code> · <code>google_project</code> · <code>google_project_service</code> · <code>google_resource_manager_lien</code> |
 | [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
 | [outputs.tf](./outputs.tf) | Module outputs. |  |
+| [quotas.tf](./quotas.tf) | None | <code>google_cloud_quotas_quota_preference</code> |
 | [service-accounts.tf](./service-accounts.tf) | Service identities and supporting resources. | <code>google_kms_crypto_key_iam_member</code> · <code>google_project_default_service_accounts</code> · <code>google_project_iam_member</code> · <code>google_project_service_identity</code> |
 | [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> · <code>google_compute_subnetwork_iam_member</code> · <code>google_project_iam_member</code> |
 | [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> · <code>google_tags_tag_key</code> · <code>google_tags_tag_key_iam_binding</code> · <code>google_tags_tag_value</code> · <code>google_tags_tag_value_iam_binding</code> |
 | [variables-iam.tf](./variables-iam.tf) | None |  |
+| [variables-quotas.tf](./variables-quotas.tf) | None |  |
 | [variables-tags.tf](./variables-tags.tf) | None |  |
 | [variables.tf](./variables.tf) | Module variables. |  |
 | [versions.tf](./versions.tf) | Version pins. |  |
@@ -1081,6 +1114,7 @@ module "bucket" {
 | [parent](variables.tf#L184) | Parent folder or organization in 'folders/folder_id' or 'organizations/org_id' format. | <code>string</code> |  | <code>null</code> |
 | [prefix](variables.tf#L194) | Optional prefix used to generate project id and name. | <code>string</code> |  | <code>null</code> |
 | [project_create](variables.tf#L204) | Create project. When set to false, uses a data source to reference existing project. | <code>bool</code> |  | <code>true</code> |
+| [quotas](variables-quotas.tf#L17) | Service quota configuration. | <code title="map&#40;object&#40;&#123;&#10;  service              &#61; string&#10;  quota_id             &#61; string&#10;  preferred_value      &#61; number&#10;  dimensions           &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  justification        &#61; optional&#40;string&#41;&#10;  contact_email        &#61; optional&#40;string&#41;&#10;  annotations          &#61; optional&#40;map&#40;string&#41;&#41;&#10;  ignore_safety_checks &#61; optional&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [service_config](variables.tf#L210) | Configure service API activation. | <code title="object&#40;&#123;&#10;  disable_on_destroy         &#61; bool&#10;  disable_dependent_services &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  disable_on_destroy         &#61; false&#10;  disable_dependent_services &#61; false&#10;&#125;">&#123;&#8230;&#125;</code> |
 | [service_encryption_key_ids](variables.tf#L222) | Cloud KMS encryption key in {SERVICE => [KEY_URL]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [service_perimeter_bridges](variables.tf#L229) | Name of VPC-SC Bridge perimeters to add project into. See comment in the variables file for format. | <code>list&#40;string&#41;</code> |  | <code>null</code> |
@@ -1102,9 +1136,11 @@ module "bucket" {
 | [name](outputs.tf#L51) | Project name. |  |
 | [number](outputs.tf#L63) | Project number. |  |
 | [project_id](outputs.tf#L82) | Project id. |  |
-| [service_accounts](outputs.tf#L101) | Product robot service accounts in project. |  |
-| [services](outputs.tf#L117) | Service APIs to enabled in the project. |  |
-| [sink_writer_identities](outputs.tf#L126) | Writer identities created for each sink. |  |
-| [tag_keys](outputs.tf#L133) | Tag key resources. |  |
-| [tag_values](outputs.tf#L142) | Tag value resources. |  |
+| [quota_configs](outputs.tf#L101) | Quota configurations. |  |
+| [quotas](outputs.tf#L112) | Quota resources. |  |
+| [service_accounts](outputs.tf#L117) | Product robot service accounts in project. |  |
+| [services](outputs.tf#L133) | Service APIs to enabled in the project. |  |
+| [sink_writer_identities](outputs.tf#L142) | Writer identities created for each sink. |  |
+| [tag_keys](outputs.tf#L149) | Tag key resources. |  |
+| [tag_values](outputs.tf#L158) | Tag value resources. |  |
 <!-- END TFDOC -->
--- a/modules/project/outputs.tf
+++ b/modules/project/outputs.tf
@@ -98,6 +98,22 @@ output "project_id" {
  ]
 }

+output "quota_configs" {
+  description = "Quota configurations."
+  value = {
+    for k, v in google_cloud_quotas_quota_preference.default :
+    k => {
+      granted   = v.quota_config.0.granted_value
+      preferred = v.quota_config.0.preferred_value
+    }
+  }
+}
+
+output "quotas" {
+  description = "Quota resources."
+  value       = google_cloud_quotas_quota_preference.default
+}
+
 output "service_accounts" {
  description = "Product robot service accounts in project."
  value = {
--- a/modules/project/quotas.tf
+++ b/modules/project/quotas.tf
@@ -0,0 +1,34 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+resource "google_cloud_quotas_quota_preference" "default" {
+  for_each      = var.quotas
+  parent        = "projects/${local.project.project_id}"
+  name          = each.key
+  service       = each.value.service
+  dimensions    = each.value.dimensions
+  quota_id      = each.value.quota_id
+  contact_email = each.value.contact_email
+  justification = each.value.justification
+  quota_config {
+    preferred_value = each.value.preferred_value
+    annotations     = each.value.annotations
+  }
+  ignore_safety_checks = each.value.ignore_safety_checks
+  depends_on = [
+    google_project_service.project_services
+  ]
+}
--- a/modules/project/variables-quotas.tf
+++ b/modules/project/variables-quotas.tf
@@ -0,0 +1,44 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "quotas" {
+  description = "Service quota configuration."
+  type = map(object({
+    service              = string
+    quota_id             = string
+    preferred_value      = number
+    dimensions           = optional(map(string), {})
+    justification        = optional(string)
+    contact_email        = optional(string)
+    annotations          = optional(map(string))
+    ignore_safety_checks = optional(string)
+  }))
+  nullable = false
+  default  = {}
+  validation {
+    condition = alltrue([
+      for k, v in var.quotas :
+      v.ignore_safety_checks == null || contains(
+        [
+          "QUOTA_DECREASE_BELOW_USAGE",
+          "QUOTA_DECREASE_PERCENTAGE_TOO_HIGH",
+          "QUOTA_SAFETY_CHECK_UNSPECIFIED"
+        ],
+        coalesce(v.ignore_safety_checks, "-")
+    )])
+    error_message = "Invalid value for ignore safety checks."
+  }
+}
--- a/tests/fast/stages/s0_bootstrap/checklist.yaml
+++ b/tests/fast/stages/s0_bootstrap/checklist.yaml
@@ -369,7 +369,7 @@ counts:
  google_project: 3
  google_project_iam_binding: 19
  google_project_iam_member: 6
-  google_project_service: 30
+  google_project_service: 31
  google_project_service_identity: 4
  google_service_account: 4
  google_service_account_iam_binding: 2
@@ -381,4 +381,4 @@ counts:
  google_tags_tag_key: 1
  google_tags_tag_value: 1
  modules: 17
-  resources: 195
+  resources: 196
--- a/tests/fast/stages/s0_bootstrap/simple.yaml
+++ b/tests/fast/stages/s0_bootstrap/simple.yaml
@@ -48,7 +48,7 @@ counts:
  google_project: 3
  google_project_iam_binding: 19
  google_project_iam_member: 6
-  google_project_service: 30
+  google_project_service: 31
  google_project_service_identity: 4
  google_service_account: 4
  google_service_account_iam_binding: 2
@@ -61,7 +61,7 @@ counts:
  google_tags_tag_value: 1
  local_file: 7
  modules: 16
-  resources: 186
+  resources: 187

 outputs:
  custom_roles: