dataplex aspect types module refactor (#3544)
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
3392953188
commit
a2a9be2593
@@ -75,13 +75,13 @@ IAM attributes can leverage substitutions for principals, which need to be defin
|
||||
module "aspect-types" {
|
||||
source = "./fabric/modules/dataplex-aspect-types"
|
||||
project_id = "test-project"
|
||||
context = {
|
||||
iam_principals = {
|
||||
test-sa = "serviceAccount:sa-0@test-project.iam.gserviceaccount.com"
|
||||
}
|
||||
}
|
||||
factories_config = {
|
||||
aspect_types = "data/aspect-types"
|
||||
context = {
|
||||
iam_principals = {
|
||||
test-sa = "serviceAccount:sa-0@test-project.iam.gserviceaccount.com"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=4 files=aspect-0,aspect-1
|
||||
@@ -125,7 +125,7 @@ display_name: "Test template 1."
|
||||
iam_bindings_additive:
|
||||
user:
|
||||
role: roles/dataplex.aspectTypeUser
|
||||
member: test-sa
|
||||
member: $iam_principals:test-sa
|
||||
metadata_template: |
|
||||
{
|
||||
"name": "tf-test-template-1",
|
||||
@@ -158,10 +158,11 @@ metadata_template: |
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [project_id](variables.tf#L67) | Project id where resources will be created. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L77) | Project id where resources will be created. | <code>string</code> | ✓ | |
|
||||
| [aspect_types](variables.tf#L17) | Aspect templates. Merged with those defined via the factory. | <code title="map(object({ description = optional(string) display_name = optional(string) labels = optional(map(string), {}) metadata_template = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [factories_config](variables.tf#L48) | Paths to folders for the optional factories. | <code title="object({ aspect_types = optional(string) context = optional(object({ iam_principals = optional(map(string), {}) }), {}) })">object({…})</code> | | <code>{}</code> |
|
||||
| [location](variables.tf#L60) | Location for aspect types. | <code>string</code> | | <code>"global"</code> |
|
||||
| [context](variables.tf#L48) | Context-specific interpolations. | <code title="object({ condition_vars = optional(map(map(string)), {}) custom_roles = optional(map(string), {}) iam_principals = optional(map(string), {}) locations = optional(map(string), {}) project_ids = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
||||
| [factories_config](variables.tf#L61) | Paths to folders for the optional factories. | <code title="object({ aspect_types = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [location](variables.tf#L70) | Location for aspect types. | <code>string</code> | | <code>"global"</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -53,26 +53,28 @@ resource "google_dataplex_aspect_type_iam_binding" "authoritative" {
|
||||
for binding in local.iam :
|
||||
"${binding.aspect_type_id}.${binding.role}" => binding
|
||||
}
|
||||
role = each.value.role
|
||||
aspect_type_id = google_dataplex_aspect_type.default[each.value.aspect_type_id].id
|
||||
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
|
||||
members = [
|
||||
for v in each.value.members :
|
||||
lookup(var.factories_config.context.iam_principals, v, v)
|
||||
lookup(local.ctx.iam_principals, v, v)
|
||||
]
|
||||
}
|
||||
|
||||
resource "google_dataplex_aspect_type_iam_binding" "bindings" {
|
||||
for_each = local.iam_bindings
|
||||
role = each.value.role
|
||||
aspect_type_id = google_dataplex_aspect_type.default[each.value.aspect_type_id].id
|
||||
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
|
||||
members = [
|
||||
for v in each.value.members :
|
||||
lookup(var.factories_config.context.iam_principals, v, v)
|
||||
lookup(local.ctx.iam_principals, v, v)
|
||||
]
|
||||
dynamic "condition" {
|
||||
for_each = each.value.condition == null ? [] : [""]
|
||||
content {
|
||||
expression = each.value.condition.expression
|
||||
expression = templatestring(
|
||||
each.value.condition.expression, var.context.condition_vars
|
||||
)
|
||||
title = each.value.condition.title
|
||||
description = each.value.condition.description
|
||||
}
|
||||
@@ -82,14 +84,16 @@ resource "google_dataplex_aspect_type_iam_binding" "bindings" {
|
||||
resource "google_dataplex_aspect_type_iam_member" "members" {
|
||||
for_each = local.iam_bindings_additive
|
||||
aspect_type_id = google_dataplex_aspect_type.default[each.value.aspect_type_id].id
|
||||
role = each.value.role
|
||||
role = lookup(local.ctx.custom_roles, each.value.role, each.value.role)
|
||||
member = lookup(
|
||||
var.factories_config.context.iam_principals, each.value.member, each.value.member
|
||||
local.ctx.iam_principals, each.value.member, each.value.member
|
||||
)
|
||||
dynamic "condition" {
|
||||
for_each = each.value.condition == null ? [] : [""]
|
||||
content {
|
||||
expression = each.value.condition.expression
|
||||
expression = templatestring(
|
||||
each.value.condition.expression, var.context.condition_vars
|
||||
)
|
||||
title = each.value.condition.title
|
||||
description = each.value.condition.description
|
||||
}
|
||||
|
||||
@@ -37,12 +37,22 @@ locals {
|
||||
metadata_template = lookup(v, "metadata_template", null)
|
||||
}
|
||||
})
|
||||
ctx = {
|
||||
for k, v in var.context : k => {
|
||||
for kk, vv in v : "${local.ctx_p}${k}:${kk}" => vv
|
||||
} if k != "condition_vars"
|
||||
}
|
||||
ctx_p = "$"
|
||||
location = try(local.ctx.locations[var.location], var.location)
|
||||
project_id = var.project_id == null ? null : lookup(
|
||||
local.ctx.project_ids, var.project_id, var.project_id
|
||||
)
|
||||
}
|
||||
|
||||
resource "google_dataplex_aspect_type" "default" {
|
||||
for_each = local.aspect_types
|
||||
project = var.project_id
|
||||
location = var.location
|
||||
project = local.project_id
|
||||
location = local.location
|
||||
aspect_type_id = each.key
|
||||
description = each.value.description
|
||||
display_name = each.value.display_name
|
||||
|
||||
@@ -31,11 +31,11 @@
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"patternProperties": {
|
||||
"^roles/": {
|
||||
"^(?:roles/|\\$custom_roles:)": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"pattern": "^(?:domain:|group:|serviceAccount:|user:|principal:|principalSet:|[a-z])"
|
||||
"pattern": "^(?:domain:|group:|serviceAccount:|user:|principal:|principalSet:||\\$iam_principals:[a-z0-9_-]+)"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -52,12 +52,12 @@
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"pattern": "^(?:domain:|group:|serviceAccount:|user:|principal:|principalSet:|[a-z])"
|
||||
"pattern": "^(?:domain:|group:|serviceAccount:|user:|principal:|principalSet:|\\$iam_principals:[a-z0-9_-]+)"
|
||||
}
|
||||
},
|
||||
"role": {
|
||||
"type": "string",
|
||||
"pattern": "^roles/"
|
||||
"pattern": "^(?:roles/|\\$custom_roles:)"
|
||||
},
|
||||
"condition": {
|
||||
"type": "object",
|
||||
@@ -92,11 +92,11 @@
|
||||
"properties": {
|
||||
"member": {
|
||||
"type": "string",
|
||||
"pattern": "^(?:domain:|group:|serviceAccount:|user:|principal:|principalSet:|[a-z])"
|
||||
"pattern": "^(?:domain:|group:|serviceAccount:|user:|principal:|principalSet:|\\$iam_principals:[a-z0-9_-]+)"
|
||||
},
|
||||
"role": {
|
||||
"type": "string",
|
||||
"pattern": "^roles/"
|
||||
"pattern": "^(?:roles/|\\$custom_roles:)"
|
||||
},
|
||||
"condition": {
|
||||
"type": "object",
|
||||
|
||||
@@ -45,13 +45,23 @@ variable "aspect_types" {
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "context" {
|
||||
description = "Context-specific interpolations."
|
||||
type = object({
|
||||
condition_vars = optional(map(map(string)), {})
|
||||
custom_roles = optional(map(string), {})
|
||||
iam_principals = optional(map(string), {})
|
||||
locations = optional(map(string), {})
|
||||
project_ids = optional(map(string), {})
|
||||
})
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "factories_config" {
|
||||
description = "Paths to folders for the optional factories."
|
||||
type = object({
|
||||
aspect_types = optional(string)
|
||||
context = optional(object({
|
||||
iam_principals = optional(map(string), {})
|
||||
}), {})
|
||||
})
|
||||
nullable = false
|
||||
default = {}
|
||||
|
||||
Reference in New Issue
Block a user