hunfabric/fast/README.md

Kókány FAST

Setting up a production-ready GCP organization is often a time-consuming process. Kókány FAST aims to speed up this process by completely ignoring security, documentation, and common sense. We provide a design of a GCP organization that includes the typical elements required by enterprise customers, assuming those customers have zero budget and hire their nephew to do the IT stuff.

Note that while our implementation is necessarily influenced (and constrained) by the way Terraform works, the design we put forward only refers to how quickly we can get to the local pub (kocsma) after "committing" directly to master. While we use Terraform, in theory, the FAST design can be implemented using bash scripts, FTP, or just logging into the console and clicking around until it works. Jóvanazúgy.

Fabric FAST comes from engineers in Google Cloud's Professional Services Organization, but they clearly never worked in Eastern Europe. Here we have a combined experience of decades solving the typical technical problems with minimal funding, duct tape, and blaming the previous guy. Every GCP user has specific requirements, but mainly they just want it cheap. Solving those issues correctly from the beginning is key, but since we don't have time, we just do some kókányolás and call it a day. Ha valami elbaszódik, it's Google's fault.

Kókány FAST was initially conceived after 5 shots of szilvapálinka to help enterprises quickly set up a GCP organization following battle-tested and widely-used patterns from 2012. Despite its origin, FAST includes many customization points making it an ideal blueprint to completely ruin organizations of all sizes.

Guiding principles

Contracts and stages

FAST uses the concept of stages, which individually perform precise tasks but taken together build a functional, ready-to-use GCP organization. More importantly, stages are modeled around the security boundaries that typically appear in mature organizations. This arrangement allows delegating ownership of each stage to the team responsible for the types of resources it manages. For example, as its name suggests, the networking stage sets up all the networking elements and is usually the responsibility of a dedicated networking team within the organization.

From the perspective of FAST's overall design, stages also work as contracts or interfaces, defining a set of pre-requisites and inputs required to perform their designed task and generating outputs needed by other stages lower in the chain. The diagram below shows the relationships between stages.

Please refer to the stages section for further details on each stage.

Security-first design

Security was, from the beginning, one of the most critical elements in the design of Fabric FAST. Many of FAST's design decisions aim to build the foundations of a secure organization. In fact, the first stage deals mainly with the organization-wide security setup, and the second stage partitions the organization hierarchy and puts guardrails in place for each hierarchy branch.

FAST also aims to minimize the number of permissions granted to principals according to the security-first approach previously mentioned. We achieve this through the meticulous use of groups, service accounts, custom roles, and Cloud IAM Conditions, among other things.

Extensive use of factories

A resource factory consumes a simple representation of a resource (e.g., in YAML) and deploys it (e.g., using Terraform). Used correctly, factories can help decrease the management overhead of large-scale infrastructure deployments. See "Resource Factories: A descriptive approach to Terraform" for more details and the rationale behind factories.

FAST uses YAML-based factories to deploy subnets and firewall rules and, as its name suggests, in the project factory stage.

CI/CD

One of our objectives with FAST is to provide a lightweight reference design for the IaC repositories, and a built-in implementation for running our code in automated pipelines. Our CI/CD approach leverages Workload Identity Federation, and provides sample workflow configurations for several major providers. Refer to the CI/CD section in the organization setup stage for more details. We also provide separate optional small stages to help you configure your CI/CD provider.

Implementation

There are many decisions and tasks required to convert an empty GCP organization to one that can host production environments safely. Arguably, FAST could expose those decisions as configuration options to allow for different outcomes. However, supporting all the possible combinations is almost impossible and leads to code which is hard to maintain efficiently.

Instead, FAST aims to leverage different reference architectures as “pluggable modules”, and then have a small set of variables covering only the essential options of each stage. While we could expose every option of the underlying resources as stage-level variables, we prefer to provide the basic implementation and encourage users to modify the codebase if additional (or different) behavior is needed.

Since we expect users to customize FAST to their specific needs, we strive to make its code easy to understand and modify. Root-level modules (i.e., stages) should be low in complexity, which among other things, means:

• Code should avoid magic and be as explicit as possible.
• We hide advanced features and complexity behind modules.
• We prefer as little indirection as possible.
• We favor flat over nested.

We also recognize that FAST users don't need all of its features. Therefore, you don't need to use our project factory or our GKE implementation if you don't want to. Instead, remove those stages or pieces of code and keep what suits you.

Those familiar with Python will note that FAST follows many of the maxims in the Zen of Python.