Add support for subnet-level service network user grants to project module, improve docs (#1907)
* improve project factory example * light refactor of project modules shared vpc internals and docs * add support for subnet-level grants on host project
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
0feb131964
commit
f548b65b1c
@@ -228,9 +228,21 @@ This table lists all affected services and roles that you need to grant to servi
|
||||
|
||||
## Shared VPC
|
||||
|
||||
The module allows managing Shared VPC status for both hosts and service projects, and includes a simple way of assigning Shared VPC roles to service identities.
|
||||
The module allows managing Shared VPC status for both hosts and service projects, and control of IAM bindings for API service identities.
|
||||
|
||||
You can enable Shared VPC Host at the project level and manage project service association independently.
|
||||
Project service association for VPC host projects can be
|
||||
|
||||
- autoritatively managed in the host project by enabling Shared VPC and specifying the set of service projects, or
|
||||
- additively managed in service projects by by enabling Shared VPC in the host project and then "attaching" each service project independently
|
||||
|
||||
IAM bindings in the host project for API service identities can be managed from service projects in two different ways:
|
||||
|
||||
- via the `service_identity_iam` attribute, by specifying the set of roles and service agents
|
||||
- via the `service_iam_grants` attribute that leverages a [fixed list of roles for each service](./sharedvpc-agent-iam.yaml), by specifying a list of services
|
||||
|
||||
While the first method is more explicit and readable, the second method is simpler and less error prone as all appropriate roles are predefined for all required service agents (eg compute and cloud services). You can mix and match as the two sets of bindings are then internally combined.
|
||||
|
||||
This example shows a simple configuration with a host project, and a service project independently attached with granular IAM bindings for service identities.
|
||||
|
||||
```hcl
|
||||
module "host-project" {
|
||||
@@ -272,7 +284,7 @@ module "service-project" {
|
||||
# tftest modules=2 resources=10 inventory=shared-vpc.yaml e2e
|
||||
```
|
||||
|
||||
The module allows also granting necessary permissions in host project to service identities by specifying which services will be used in service project in `grant_iam_for_services`.
|
||||
This example shows a similar configuration, with the simpler way of defining IAM bindings for service identities. The list of services passed to `service_iam_grants` uses the same module's outputs to establish a dependency, as service identities are only typically available after service (API) activation.
|
||||
|
||||
```hcl
|
||||
module "host-project" {
|
||||
@@ -296,13 +308,47 @@ module "service-project" {
|
||||
"container.googleapis.com",
|
||||
]
|
||||
shared_vpc_service_config = {
|
||||
host_project = module.host-project.project_id
|
||||
host_project = module.host-project.project_id
|
||||
# reuse the list of services from the module's outputs
|
||||
service_iam_grants = module.service-project.services
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=9 inventory=shared-vpc-auto-grants.yaml e2e
|
||||
```
|
||||
|
||||
In specific cases it might make sense to selectively grant the `compute.networkUser` role for service identities at the subnet level, and while that is best done via org policies it's also supported by this module.
|
||||
|
||||
```hcl
|
||||
module "host-project" {
|
||||
source = "./fabric/modules/project"
|
||||
billing_account = var.billing_account_id
|
||||
name = "host"
|
||||
parent = var.folder_id
|
||||
prefix = var.prefix
|
||||
shared_vpc_host_config = {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
|
||||
module "service-project" {
|
||||
source = "./fabric/modules/project"
|
||||
billing_account = var.billing_account_id
|
||||
name = "service"
|
||||
parent = var.folder_id
|
||||
prefix = var.prefix
|
||||
services = [
|
||||
"compute.googleapis.com",
|
||||
]
|
||||
shared_vpc_service_config = {
|
||||
host_project = module.host-project.project_id
|
||||
service_identity_subnet_iam = {
|
||||
"europe-west1/gce" = ["compute"]
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=6 inventory=shared-vpc-subnet-grants.yaml
|
||||
```
|
||||
|
||||
## Organization Policies
|
||||
|
||||
To manage organization policies, the `orgpolicy.googleapis.com` service should be enabled in the quota project.
|
||||
@@ -617,7 +663,7 @@ output "compute_robot" {
|
||||
|
||||
### Managing project related configuration without creating it
|
||||
|
||||
The module offers managing all related resources without ever touching the project itself by using `project_create = false`
|
||||
The module offers managing all related resources without ever touching the project itself by using `project_create = false`
|
||||
|
||||
```hcl
|
||||
module "create-project" {
|
||||
@@ -827,7 +873,6 @@ module "bucket" {
|
||||
# tftest modules=7 resources=53 inventory=data.yaml e2e
|
||||
```
|
||||
|
||||
|
||||
<!-- TFDOC OPTS files:1 -->
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Files
|
||||
@@ -840,7 +885,7 @@ module "bucket" {
|
||||
| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
|
||||
| [outputs.tf](./outputs.tf) | Module outputs. | |
|
||||
| [service-accounts.tf](./service-accounts.tf) | Service identities and supporting resources. | <code>google_kms_crypto_key_iam_member</code> · <code>google_project_default_service_accounts</code> · <code>google_project_iam_member</code> · <code>google_project_service_identity</code> |
|
||||
| [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> · <code>google_project_iam_member</code> |
|
||||
| [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> · <code>google_compute_subnetwork_iam_member</code> · <code>google_project_iam_member</code> |
|
||||
| [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> |
|
||||
| [variables.tf](./variables.tf) | Module variables. | |
|
||||
| [versions.tf](./versions.tf) | Version pins. | |
|
||||
@@ -879,9 +924,9 @@ module "bucket" {
|
||||
| [service_perimeter_standard](variables.tf#L276) | Name of VPC-SC Standard perimeter to add project into. See comment in the variables file for format. | <code>string</code> | | <code>null</code> |
|
||||
| [services](variables.tf#L282) | Service APIs to enable. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [shared_vpc_host_config](variables.tf#L288) | Configures this project as a Shared VPC host project (mutually exclusive with shared_vpc_service_project). | <code title="object({ enabled = bool service_projects = optional(list(string), []) })">object({…})</code> | | <code>null</code> |
|
||||
| [shared_vpc_service_config](variables.tf#L297) | Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config). | <code title="object({ host_project = string service_identity_iam = optional(map(list(string)), {}) service_iam_grants = optional(list(string), []) })">object({…})</code> | | <code title="{ host_project = null }">{…}</code> |
|
||||
| [skip_delete](variables.tf#L319) | Allows the underlying resources to be destroyed without destroying the project itself. | <code>bool</code> | | <code>false</code> |
|
||||
| [tag_bindings](variables.tf#L325) | Tag bindings for this project, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
||||
| [shared_vpc_service_config](variables.tf#L297) | Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config). | <code title="object({ host_project = string service_identity_iam = optional(map(list(string)), {}) service_identity_subnet_iam = optional(map(list(string)), {}) service_iam_grants = optional(list(string), []) })">object({…})</code> | | <code title="{ host_project = null }">{…}</code> |
|
||||
| [skip_delete](variables.tf#L320) | Allows the underlying resources to be destroyed without destroying the project itself. | <code>bool</code> | | <code>false</code> |
|
||||
| [tag_bindings](variables.tf#L326) | Tag bindings for this project, in key => tag value id format. | <code>map(string)</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -17,22 +17,27 @@
|
||||
# tfdoc:file:description Shared VPC project-level configuration.
|
||||
|
||||
locals {
|
||||
_shared_vpc_agent_config = yamldecode(file("${path.module}/sharedvpc-agent-iam.yaml"))
|
||||
_shared_vpc_agent_config_filtered = [
|
||||
for config in local._shared_vpc_agent_config : config
|
||||
if contains(var.shared_vpc_service_config.service_iam_grants, config.service)
|
||||
_svpc = var.shared_vpc_service_config
|
||||
# read the list of service/roles for API service agents
|
||||
_svpc_agent_config = yamldecode(file(
|
||||
"${path.module}/sharedvpc-agent-iam.yaml"
|
||||
))
|
||||
# filter the list and keep services for which we need to create IAM bindings
|
||||
_svpc_agent_config_filtered = [
|
||||
for v in local._svpc_agent_config : v
|
||||
if contains(local._svpc.service_iam_grants, v.service)
|
||||
]
|
||||
_shared_vpc_agent_grants = flatten(flatten([
|
||||
for api in local._shared_vpc_agent_config_filtered : [
|
||||
for service, roles in api.agents : [
|
||||
# normalize the list of service/role tuples
|
||||
_svpc_agent_grants = flatten(flatten([
|
||||
for v in local._svpc_agent_config_filtered : [
|
||||
for service, roles in v.agents : [
|
||||
for role in roles : { role = role, service = service }
|
||||
]
|
||||
]
|
||||
]))
|
||||
|
||||
# compute the host project IAM bindings for this project's service identities
|
||||
# normalize the service identity IAM bindings directly defined by the user
|
||||
_svpc_service_iam = flatten([
|
||||
for role, services in var.shared_vpc_service_config.service_identity_iam : [
|
||||
for role, services in local._svpc.service_identity_iam : [
|
||||
for service in services : { role = role, service = service }
|
||||
]
|
||||
])
|
||||
@@ -44,9 +49,24 @@ locals {
|
||||
try(var.shared_vpc_host_config.service_projects, null), []
|
||||
)
|
||||
}
|
||||
|
||||
# combine the two sets of service/role bindings defined above
|
||||
svpc_service_iam = {
|
||||
for b in setunion(local._svpc_service_iam, local._shared_vpc_agent_grants) : "${b.role}:${b.service}" => b
|
||||
for b in setunion(local._svpc_service_iam, local._svpc_agent_grants) :
|
||||
"${b.role}:${b.service}" => b
|
||||
}
|
||||
# normalize the service identity subnet IAM bindings
|
||||
_svpc_service_subnet_iam = flatten([
|
||||
for subnet, services in local._svpc.service_identity_subnet_iam : [
|
||||
for service in services : [{
|
||||
region = split("/", subnet)[0]
|
||||
subnet = split("/", subnet)[1]
|
||||
service = service
|
||||
}]
|
||||
]
|
||||
])
|
||||
svpc_service_subnet_iam = {
|
||||
for v in local._svpc_service_subnet_iam :
|
||||
"${v.region}:${v.subnet}:${v.service}" => v
|
||||
}
|
||||
}
|
||||
|
||||
@@ -90,3 +110,24 @@ resource "google_project_iam_member" "shared_vpc_host_robots" {
|
||||
data.google_storage_project_service_account.gcs_sa,
|
||||
]
|
||||
}
|
||||
|
||||
resource "google_compute_subnetwork_iam_member" "shared_vpc_host_robots" {
|
||||
for_each = local.svpc_service_subnet_iam
|
||||
project = var.shared_vpc_service_config.host_project
|
||||
region = each.value.region
|
||||
subnetwork = each.value.subnet
|
||||
role = "roles/compute.networkUser"
|
||||
member = (
|
||||
each.value.service == "cloudservices"
|
||||
? "serviceAccount:${local.service_account_cloud_services}"
|
||||
: "serviceAccount:${local.service_accounts_robots[each.value.service]}"
|
||||
)
|
||||
depends_on = [
|
||||
google_project_service.project_services,
|
||||
google_project_service_identity.servicenetworking,
|
||||
google_project_service_identity.jit_si,
|
||||
google_project_default_service_accounts.default_service_accounts,
|
||||
data.google_bigquery_default_service_account.bq_sa,
|
||||
data.google_storage_project_service_account.gcs_sa,
|
||||
]
|
||||
}
|
||||
|
||||
@@ -298,9 +298,10 @@ variable "shared_vpc_service_config" {
|
||||
description = "Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config)."
|
||||
# the list of valid service identities is in service-agents.yaml
|
||||
type = object({
|
||||
host_project = string
|
||||
service_identity_iam = optional(map(list(string)), {})
|
||||
service_iam_grants = optional(list(string), [])
|
||||
host_project = string
|
||||
service_identity_iam = optional(map(list(string)), {})
|
||||
service_identity_subnet_iam = optional(map(list(string)), {})
|
||||
service_iam_grants = optional(list(string), [])
|
||||
})
|
||||
default = {
|
||||
host_project = null
|
||||
|
||||
Reference in New Issue
Block a user