kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Embed subnet-level IAM in the variables controlling creation of subnets

Browse Source 
This moves the top-level `iam`, `iam_bindings` and
`iam_bindings_additive` variables into subnet-level attributes. This
change also allows setting permissions to PSC or proxy-only subnets

As part of this change, the factory interface is more aligned with the
rest of the modules using a `factories_config` variable. In the future
we can add a cidrs template similar to the firewall policy module
This commit is contained in:
Julio Castillo
2023-09-14 17:20:37 +02:00
parent b3dc91b5cd
commit f19ab4872f
3 changed files with 186 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files

167
modules/net-vpc/subnets.tf
View File

@@ -1,5 +1,5 @@
/**
* Copyright 2022 Google LLC
* Copyright 2023 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,68 +18,112 @@
locals {
_factory_data = {
for f in try(fileset(var.data_folder, "**/*.yaml"), []) :
trimsuffix(basename(f), ".yaml") => yamldecode(file("${var.data_folder}/${f}"))
for f in try(fileset(var.factories_config.subnets_folder, "**/*.yaml"), []) :
trimsuffix(basename(f), ".yaml") => yamldecode(file("${var.factories_config.subnets_folder}/${f}"))
}
_factory_subnets = {
for k, v in local._factory_data : "${v.region}/${try(v.name, k)}" => {
name = try(v.name, k)
ip_cidr_range = v.ip_cidr_range
region = v.region
for k, v in local._factory_data :
"${v.region}/${try(v.name, k)}" => {
active = try(v.active, true)
description = try(v.description, null)
enable_private_access = try(v.enable_private_access, true)
flow_logs_config = try(v.flow_logs, null)
ipv6 = try(v.ipv6, null)
secondary_ip_ranges = try(v.secondary_ip_ranges, null)
iam = try(v.iam, [])
iam_members = try(v.iam_members, [])
purpose = try(v.purpose, null)
active = try(v.active, null)
global = null
flow_logs_config = can(v.flow_logs) ? {
aggregation_interval = try(v.flow_logs_config.aggregation_interval, null)
filter_expression = try(v.flow_logs_config.filter_expression, null)
flow_sampling = try(v.flow_logs_config.flow_sampling, null)
metadata = try(v.flow_logs_config.metadata, null)
metadata_fields = try(v.flow_logs_config.metadata_fields, null)
} : null
global = try(v.global, false)
ip_cidr_range = v.ip_cidr_range
ipv6 = can(v.ipv6) ? {
access_type = try(v.ipv6.access_type, "INTERNAL")
} : null
name = try(v.name, k)
region = v.region
secondary_ip_ranges = try(v.secondary_ip_ranges, null)
iam = try(v.iam, {})
iam_bindings = can(v.iam_bindings) ? {
for k2, v2 in v.iam_bindings :
k2 => {
members = v2.members
condition = can(v2.condition) ? {
expression = v2.condition.expression
title = v2.condition.title
description = try(v2.condition.description, null)
} : null
}
} : {}
iam_bindings_additive = can(v.iam_bindings_additive) ? {
for k2, v2 in v.iam_bindings_additive :
k2 => {
member = v2.member
role = v2.role
condition = can(v2.condition) ? {
expression = v2.condition.expression
title = v2.condition.title
description = try(v2.condition.description, null)
} : null
}
} : {}
_is_regular = !try(v.psc == true, false) && !try(v.proxy_only == true, false)
_is_psc = try(v.psc == true, false)
_is_proxy_only = try(v.proxy_only == true, false)
}
}
_factory_subnets_iam = [
for k, v in local._factory_subnets : {
subnet = k
role = "roles/compute.networkUser"
members = v.iam
} if v.purpose == null && v.iam != null
]
_subnet_iam = flatten([
for subnet, roles in(var.subnet_iam == null ? {} : var.subnet_iam) : [
for role, members in roles : {
members = members
role = role
subnet = subnet
}
]
])
subnet_iam = concat(
[for k in local._factory_subnets_iam : k if length(k.members) > 0],
local._subnet_iam
all_subnets = merge(
{ for k, v in google_compute_subnetwork.subnetwork : k => v },
{ for k, v in google_compute_subnetwork.proxy_only : k => v },
{ for k, v in google_compute_subnetwork.psc : k => v }
)
subnet_iam = flatten(concat(
[
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [
for role, members in s.iam :
{
role = role
members = members
subnet = "${s.region}/${s.name}"
}
]
],
))
subnet_iam_bindings = flatten([
for subnet, roles in(var.subnet_iam_bindings == null ? {} : var.subnet_iam_bindings) : [
for role, data in roles : {
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [
for role, data in s.iam_bindings : {
role = role
subnet = subnet
subnet = "${s.region}/${s.name}"
members = data.members
condition = data.condition
}
]
])
# note: all additive bindings share a single namespace for the key.
# In other words, if you have multiple additive bindings with the
# same name, only one will be used
subnet_iam_bindings_additive = merge([
for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : {
for key, data in s.iam_bindings_additive :
key => {
role = data.role
subnet = "${s.region}/${s.name}"
member = data.member
condition = data.condition
}
}
]...)
subnets = merge(
{ for s in var.subnets : "${s.region}/${s.name}" => s },
{ for k, v in local._factory_subnets : k => v if v.purpose == null }
{ for k, v in local._factory_subnets : k => v if v._is_regular }
)
subnets_proxy_only = merge(
{ for s in var.subnets_proxy_only : "${s.region}/${s.name}" => s },
{ for k, v in local._factory_subnets : k => v if v.purpose == "REGIONAL_MANAGED_PROXY" },
{ for k, v in local._factory_subnets : k => v if v.purpose == "GLOBAL_MANAGED_PROXY" }
{ for k, v in local._factory_subnets : k => v if v._is_proxy_only },
)
subnets_psc = merge(
{ for s in var.subnets_psc : "${s.region}/${s.name}" => s },
{ for k, v in local._factory_subnets : k => v if v.purpose == "PRIVATE_SERVICE_CONNECT" }
{ for k, v in local._factory_subnets : k => v if v._is_psc }
)
}
@@ -130,19 +174,12 @@ resource "google_compute_subnetwork" "proxy_only" {
name = each.value.name
region = each.value.region
ip_cidr_range = each.value.ip_cidr_range
description = (
each.value.description == null
? "Terraform-managed proxy-only subnet for Regional HTTPS, Internal HTTPS or Cross-Regional HTTPS Internal LB."
: each.value.description
description = coalesce(
each.value.description,
"Terraform-managed proxy-only subnet for Regional HTTPS, Internal HTTPS or Cross-Regional HTTPS Internal LB."
)
purpose = try(
each.value.purpose,
each.value.global == true
? "GLOBAL_MANAGED_PROXY"
: "REGIONAL_MANAGED_PROXY"
)
role = each.value.active != false ? "ACTIVE" : "BACKUP"
purpose = each.value.global ? "GLOBAL_MANAGED_PROXY" : "REGIONAL_MANAGED_PROXY"
role = each.value.active ? "ACTIVE" : "BACKUP"
}
resource "google_compute_subnetwork" "psc" {
@@ -152,22 +189,22 @@ resource "google_compute_subnetwork" "psc" {
name = each.value.name
region = each.value.region
ip_cidr_range = each.value.ip_cidr_range
description = (
each.value.description == null
? "Terraform-managed subnet for Private Service Connect (PSC NAT)."
: each.value.description
description = coalesce(
each.value.description,
"Terraform-managed subnet for Private Service Connect (PSC NAT)."
)
purpose = "PRIVATE_SERVICE_CONNECT"
}
resource "google_compute_subnetwork_iam_binding" "authoritative" {
for_each = {
for binding in local.subnet_iam :
"${binding.subnet}.${binding.role}" => binding
}
project = var.project_id
subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name
region = google_compute_subnetwork.subnetwork[each.value.subnet].region
subnetwork = local.all_subnets[each.value.subnet].name
region = local.all_subnets[each.value.subnet].region
role = each.value.role
members = each.value.members
}
@@ -178,8 +215,8 @@ resource "google_compute_subnetwork_iam_binding" "bindings" {
"${binding.subnet}.${binding.role}.${try(binding.condition.title, "")}" => binding
}
project = var.project_id
subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name
region = google_compute_subnetwork.subnetwork[each.value.subnet].region
subnetwork = local.all_subnets[each.value.subnet].name
region = local.all_subnets[each.value.subnet].region
role = each.value.role
members = each.value.members
dynamic "condition" {
@@ -192,13 +229,11 @@ resource "google_compute_subnetwork_iam_binding" "bindings" {
}
}
# TODO: merge factory subnet IAM members
resource "google_compute_subnetwork_iam_member" "bindings" {
for_each = var.subnet_iam_bindings_additive
for_each = local.subnet_iam_bindings_additive
project = var.project_id
subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name
region = google_compute_subnetwork.subnetwork[each.value.subnet].region
subnetwork = local.all_subnets[each.value.subnet].name
region = local.all_subnets[each.value.subnet].region
role = each.value.role
member = each.value.member
dynamic "condition" {