2eaa0d5e27
* Allow creation of dynamic tags * Extend project factory and related modules to support dynamic values * Extend folder and organization modules * project and organization readme * Simplify dynamic tag support and remove unnecessary restrictions • Schemas & Validations: Removed the restriction that forbade combining IAM fields with allowed_values_regex on tags. Updated validations in project and organization modules, and simplified all relevant JSON schemas. • Module Tag Bindings: Simplified the tag_value assignment in folder , project , gcs , bigquery-dataset , and kms modules by removing the defensive can(regex(...)) check and calling templatestring directly. • Outputs: Removed the tags_dynamic output from project and organization modules, as the same information is now available in tag_keys . • Project Factory: Updated tag_vars_projects in projects.tf to use the native namespaced_name attribute and filtered manually for dynamic tags. * fix(organization, project): fix linting and tests for dynamic tag support - Align allowed_values_regex and description extraction in _tags_merged locals to use lookup() for consistency with other fields. - Fix spacing in project context variable (alphabetical ordering). - Update organization tags test to include the new cost_center tag key with allowed_values_regex. - Update project tags test to include the new cost_center tag key and reflect the resolved allowed_values_regex on environment. * refactor(gcs): refine tag bindings and fix context test - Add _tag_bindings local to pre-resolve context references, enabling templatestring to receive a direct map reference (required by Terraform). - Use var.context.tag_vars instead of the non-existent local.ctx.tag_vars. - Fix HCL syntax in context.tfvars (escaped inner quotes). - Update context test inventory to reflect 3 tag bindings including a dynamic value resolved via templatestring. * refactor: align modules with tag binding context pattern - Add _tag_bindings local + templatestring dance to cloud-run-v2, compute-vm, folder, kms modules (bigquery-dataset already had it) - Exclude tag_vars from local.ctx in cloud-run-v2, compute-vm, folder, kms, project modules (bigquery-dataset already had it) - Add tag_vars to context variable in cloud-run-v2, compute-vm modules (others already had it) - Update all context tests with dynamic tag binding values using var.context.tag_vars * docs: add module-level tftest.yaml test instructions to GEMINI.md * docs: regenerate READMEs after tag-regex alignment - Regenerate variable tables in 7 module READMEs to reflect line number shifts from prior tag-regex changes - Add tag_vars exclusion to gcs ctx local - Fix whitespace alignment in iam-service-account and project-factory tag_vars blocks - Update tftest resource counts for organization and project - Remove tags_dynamic from organization/project output tables * fix(project-factory): update test inventory for tag_bindings module split - Move tag binding address from folder-2 to folder-2-iam in test inventory (tag_bindings moved from creation to IAM modules) - Update module instance count from 34 to 35 - Regenerate README tables after terraform fmt line shifts - Apply terraform fmt to variables.tf * refactor(project-factory): remove unnecessary depends_on from folder-iam modules Folder IAM modules depend on their own folder creation modules, not on module.projects. The explicit depends_on was leftover from an earlier design. * FAST stages * Address review comments. - FAST Stages: - Added tag_keys to output-files.tf in 0-org-setup to pass org tags via tfvars. - Sorted tag_keys and tag_values in output-files.tf. - Updated project-factory, networking, and security stages to use tag_keys. - Filtered tag_keys for dynamic tags only. - Modules: - Excluded tag_vars from local.ctx in iam-service-account and organization. - Simplified tag_value in iam-service-account. - Tests: - Updated test inventories for 0-org-setup and project-factory. * Fix tf format * Fix tfdoc * docs: add ADR for templatestring vars convention and update status of base path ADR * More tfdoc * Update schemas * Use endswith in context loop * Address review * Update FAST readmes * Update last modules * Terraform fmt * Revert alloydb * Fix whitespace --------- Co-authored-by: Ludovico Magnocavallo <ludo@qix.it>
88 lines
2.9 KiB
HCL
88 lines
2.9 KiB
HCL
/**
|
|
* Copyright 2025 Google LLC
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
locals {
|
|
projects_keyrings = flatten([
|
|
for k, v in local.projects_input : [
|
|
for name, opts in v.kms.keyrings : {
|
|
project_key = k
|
|
project_name = v.name
|
|
name = name
|
|
location = opts.location
|
|
iam = lookup(opts, "iam", {})
|
|
iam_bindings = lookup(opts, "iam_bindings", {})
|
|
iam_bindings_additive = lookup(opts, "iam_bindings_additive", {})
|
|
tag_bindings = lookup(opts, "tag_bindings", {})
|
|
keys = lookup(opts, "keys", {})
|
|
} if try(opts.location, null) != null
|
|
]
|
|
])
|
|
projects_kms_keys = {
|
|
for k, v in local.projects_input : k => merge([
|
|
for kk, kv in v.kms.keyrings : {
|
|
for key_k, key_v in module.kms["${k}/${kk}"].key_ids :
|
|
"${k}/${kk}/${key_k}" => key_v if try(kv.location, null) != null
|
|
}
|
|
]...)
|
|
}
|
|
kms_autokeys = merge([
|
|
for k, v in module.projects : {
|
|
for kk, kv in v.kms_autokeys : "autokey/${k}/${kk}" => v
|
|
}
|
|
]...)
|
|
kms_keys = merge([
|
|
for k, v in local.projects_kms_keys : v
|
|
]...)
|
|
}
|
|
|
|
module "kms" {
|
|
source = "../kms"
|
|
for_each = {
|
|
for k in local.projects_keyrings : "${k.project_key}/${k.name}" => k
|
|
}
|
|
project_id = module.projects[each.value.project_key].project_id
|
|
keyring = {
|
|
location = coalesce(
|
|
local.data_defaults.overrides.locations.storage,
|
|
lookup(each.value, "location", null),
|
|
local.data_defaults.defaults.locations.storage
|
|
)
|
|
name = each.value.name
|
|
}
|
|
iam = each.value.iam
|
|
iam_bindings = each.value.iam_bindings
|
|
iam_bindings_additive = each.value.iam_bindings_additive
|
|
tag_bindings = each.value.tag_bindings
|
|
keys = each.value.keys
|
|
context = merge(local.ctx, {
|
|
tag_vars = {
|
|
projects = merge(try(local.ctx.tag_vars.projects, {}), local.tag_vars_projects)
|
|
organization = try(local.ctx.tag_vars.organization, {})
|
|
}
|
|
iam_principals = merge(
|
|
local.ctx.iam_principals,
|
|
local.projects_sas_iam_emails,
|
|
local.automation_sas_iam_emails,
|
|
lookup(local.self_sas_iam_emails, each.value.project_key, {}),
|
|
local.projects_service_agents
|
|
)
|
|
locations = local.ctx.locations
|
|
project_ids = local.ctx_project_ids
|
|
tag_keys = local.ctx_tag_keys
|
|
tag_values = local.ctx_tag_values
|
|
})
|
|
}
|