2eaa0d5e27
* Allow creation of dynamic tags * Extend project factory and related modules to support dynamic values * Extend folder and organization modules * project and organization readme * Simplify dynamic tag support and remove unnecessary restrictions • Schemas & Validations: Removed the restriction that forbade combining IAM fields with allowed_values_regex on tags. Updated validations in project and organization modules, and simplified all relevant JSON schemas. • Module Tag Bindings: Simplified the tag_value assignment in folder , project , gcs , bigquery-dataset , and kms modules by removing the defensive can(regex(...)) check and calling templatestring directly. • Outputs: Removed the tags_dynamic output from project and organization modules, as the same information is now available in tag_keys . • Project Factory: Updated tag_vars_projects in projects.tf to use the native namespaced_name attribute and filtered manually for dynamic tags. * fix(organization, project): fix linting and tests for dynamic tag support - Align allowed_values_regex and description extraction in _tags_merged locals to use lookup() for consistency with other fields. - Fix spacing in project context variable (alphabetical ordering). - Update organization tags test to include the new cost_center tag key with allowed_values_regex. - Update project tags test to include the new cost_center tag key and reflect the resolved allowed_values_regex on environment. * refactor(gcs): refine tag bindings and fix context test - Add _tag_bindings local to pre-resolve context references, enabling templatestring to receive a direct map reference (required by Terraform). - Use var.context.tag_vars instead of the non-existent local.ctx.tag_vars. - Fix HCL syntax in context.tfvars (escaped inner quotes). - Update context test inventory to reflect 3 tag bindings including a dynamic value resolved via templatestring. * refactor: align modules with tag binding context pattern - Add _tag_bindings local + templatestring dance to cloud-run-v2, compute-vm, folder, kms modules (bigquery-dataset already had it) - Exclude tag_vars from local.ctx in cloud-run-v2, compute-vm, folder, kms, project modules (bigquery-dataset already had it) - Add tag_vars to context variable in cloud-run-v2, compute-vm modules (others already had it) - Update all context tests with dynamic tag binding values using var.context.tag_vars * docs: add module-level tftest.yaml test instructions to GEMINI.md * docs: regenerate READMEs after tag-regex alignment - Regenerate variable tables in 7 module READMEs to reflect line number shifts from prior tag-regex changes - Add tag_vars exclusion to gcs ctx local - Fix whitespace alignment in iam-service-account and project-factory tag_vars blocks - Update tftest resource counts for organization and project - Remove tags_dynamic from organization/project output tables * fix(project-factory): update test inventory for tag_bindings module split - Move tag binding address from folder-2 to folder-2-iam in test inventory (tag_bindings moved from creation to IAM modules) - Update module instance count from 34 to 35 - Regenerate README tables after terraform fmt line shifts - Apply terraform fmt to variables.tf * refactor(project-factory): remove unnecessary depends_on from folder-iam modules Folder IAM modules depend on their own folder creation modules, not on module.projects. The explicit depends_on was leftover from an earlier design. * FAST stages * Address review comments. - FAST Stages: - Added tag_keys to output-files.tf in 0-org-setup to pass org tags via tfvars. - Sorted tag_keys and tag_values in output-files.tf. - Updated project-factory, networking, and security stages to use tag_keys. - Filtered tag_keys for dynamic tags only. - Modules: - Excluded tag_vars from local.ctx in iam-service-account and organization. - Simplified tag_value in iam-service-account. - Tests: - Updated test inventories for 0-org-setup and project-factory. * Fix tf format * Fix tfdoc * docs: add ADR for templatestring vars convention and update status of base path ADR * More tfdoc * Update schemas * Use endswith in context loop * Address review * Update FAST readmes * Update last modules * Terraform fmt * Revert alloydb * Fix whitespace --------- Co-authored-by: Ludovico Magnocavallo <ludo@qix.it>
2.4 KiB
2.4 KiB
Convention for context variables passed to templatestring
authors: Julio Castillo, Antigravity (AI Assistant) date: Apr 24, 2026
Status
Approved
Context
In Cloud Foundation Fabric, we use a single context variable to pass shared state between modules (as documented in 20251013-context-locals.md). Most of these context variables are flat maps of strings used for simple lookups and full replacements (e.g., project_ids, networks).
However, some use cases require partial interpolation within strings using Terraform's templatestring() function (for example, resolving dynamic tags in bindings, or conditions in IAM bindings). The templatestring() function requires its second argument (the variables map) to be a direct reference to a data structure.
When we attempt to flatten the entire context variable into a single map for lookups (like local.ctx), complex objects like those needed for templatestring cause type mismatch errors because they are not flat maps of strings.
Decision
- Context variables intended to be passed as the variables map (second argument) to
templatestring()MUST be named with a_varssuffix (e.g.,tag_vars,condition_vars). - These variables MUST be excluded from the
local.ctxflattening loop in modules to avoid type mismatch errors. - Other keys in
contextnot with_varssuffix continue to be flat maps used for full replacement/lookup.
Example of exclusion in locals:
ctx = {
for k, v in var.context : k => {
for kk, vv in v : "${local.ctx_p}${k}:${kk}" => vv
} if !endswith(k, "_vars")
}
Example of usage:
tag_value = templatestring(local._tag_bindings[each.key], var.context.tag_vars)
Consequences
- Maintains the single
contextvariable pattern while supporting complex template interpolations. - Ensures type safety during context flattening.
- Automatically excludes any new
_varsvariable in the module's local context construction usingendswith.
Reasoning
This convention provides a clear visual and structural distinction between simple lookup maps and complex variable structures used for templating, preventing runtime errors in Terraform.
Implementation
This pattern has been implemented for tag_vars and condition_vars in the project, folder, gcs, bigquery-dataset, and kms modules, as well as in the Project Factory and relevant FAST stages.