kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
99f53d37f003ef534bea8127c0fbffd5b4a8e8a2
hunfabric/tests/modules/folder/context.yaml
Julio Castillo 2eaa0d5e27 Add support for dynamic tags (#3897) 
* Allow creation of dynamic tags

* Extend project factory and related modules to support dynamic values

* Extend folder and organization modules

* project and organization readme

* Simplify dynamic tag support and remove unnecessary restrictions

  • Schemas & Validations: Removed the restriction that forbade combining IAM fields with  allowed_values_regex  on tags. Updated validations in  project  and  organization  modules, and
  simplified all relevant JSON schemas.
  • Module Tag Bindings: Simplified the  tag_value  assignment in  folder ,  project ,  gcs ,  bigquery-dataset , and  kms  modules by removing the defensive  can(regex(...))  check and
  calling  templatestring  directly.
  • Outputs: Removed the  tags_dynamic  output from  project  and  organization  modules, as the same information is now available in  tag_keys .
  • Project Factory: Updated  tag_vars_projects  in  projects.tf  to use the native  namespaced_name  attribute and filtered manually for dynamic tags.

* fix(organization, project): fix linting and tests for dynamic tag support

- Align allowed_values_regex and description extraction in _tags_merged
  locals to use lookup() for consistency with other fields.
- Fix spacing in project context variable (alphabetical ordering).
- Update organization tags test to include the new cost_center tag key
  with allowed_values_regex.
- Update project tags test to include the new cost_center tag key and
  reflect the resolved allowed_values_regex on environment.

* refactor(gcs): refine tag bindings and fix context test

- Add _tag_bindings local to pre-resolve context references, enabling
  templatestring to receive a direct map reference (required by Terraform).
- Use var.context.tag_vars instead of the non-existent local.ctx.tag_vars.
- Fix HCL syntax in context.tfvars (escaped inner quotes).
- Update context test inventory to reflect 3 tag bindings including a
  dynamic value resolved via templatestring.

* refactor: align modules with tag binding context pattern

- Add _tag_bindings local + templatestring dance to cloud-run-v2,
  compute-vm, folder, kms modules (bigquery-dataset already had it)
- Exclude tag_vars from local.ctx in cloud-run-v2, compute-vm, folder,
  kms, project modules (bigquery-dataset already had it)
- Add tag_vars to context variable in cloud-run-v2, compute-vm modules
  (others already had it)
- Update all context tests with dynamic tag binding values using
  var.context.tag_vars

* docs: add module-level tftest.yaml test instructions to GEMINI.md

* docs: regenerate READMEs after tag-regex alignment

- Regenerate variable tables in 7 module READMEs to reflect
  line number shifts from prior tag-regex changes
- Add tag_vars exclusion to gcs ctx local
- Fix whitespace alignment in iam-service-account and
  project-factory tag_vars blocks
- Update tftest resource counts for organization and project
- Remove tags_dynamic from organization/project output tables

* fix(project-factory): update test inventory for tag_bindings module split

- Move tag binding address from folder-2 to folder-2-iam in test
  inventory (tag_bindings moved from creation to IAM modules)
- Update module instance count from 34 to 35
- Regenerate README tables after terraform fmt line shifts
- Apply terraform fmt to variables.tf

* refactor(project-factory): remove unnecessary depends_on from folder-iam modules

Folder IAM modules depend on their own folder creation modules, not
on module.projects. The explicit depends_on was leftover from an
earlier design.

* FAST stages

* Address review comments.

- FAST Stages:
  - Added tag_keys to output-files.tf in 0-org-setup to pass org tags via tfvars.
  - Sorted tag_keys and tag_values in output-files.tf.
  - Updated project-factory, networking, and security stages to use tag_keys.
  - Filtered tag_keys for dynamic tags only.
- Modules:
  - Excluded tag_vars from local.ctx in iam-service-account and organization.
  - Simplified tag_value in iam-service-account.
- Tests:
  - Updated test inventories for 0-org-setup and project-factory.

* Fix tf format

* Fix tfdoc

* docs: add ADR for templatestring vars convention and update status of base path ADR

* More tfdoc

* Update schemas

* Use endswith in context loop

* Address review

* Update FAST readmes

* Update last modules

* Terraform fmt

* Revert alloydb

* Fix whitespace

---------

Co-authored-by: Ludovico Magnocavallo <ludo@qix.it>
2026-04-24 20:45:45 +00:00

172 lines
5.9 KiB
YAML
Raw Blame History

# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
values:
google_cloud_asset_folder_feed.default["test"]:
asset_names: null
asset_types: null
billing_project: test-project
condition: []
content_type: null
feed_id: test
feed_output_config:
- pubsub_destination:
- topic: projects/test-prod-audit-logs-0/topics/audit-logs
timeouts: null
google_essential_contacts_contact.contact["$email_addresses:default"]:
email: foo@example.com
language_tag: en
notification_category_subscriptions:
- ALL
timeouts: null
google_folder.folder[0]:
deletion_protection: false
display_name: Test Context
parent: organizations/1234567890
tags: null
timeouts: null
google_folder_iam_audit_config.default["allServices"]:
audit_log_config:
- exempted_members:
- group:test-group@example.com
log_type: ADMIN_READ
- exempted_members: []
log_type: DATA_READ
service: allServices
google_folder_iam_binding.authoritative["$custom_roles:myrole_one"]:
condition: []
members:
- group:test-group@example.com
- user:test-user@example.com
role: organizations/366118655033/roles/myRoleOne
google_folder_iam_binding.authoritative["roles/owner"]:
condition: []
members:
- group:test-group@example.com
role: roles/owner
google_folder_iam_binding.authoritative["roles/viewer"]:
condition: []
members:
- serviceAccount:test@test-project.iam.gserviceaccount.com
role: roles/viewer
google_folder_iam_binding.bindings["iam-bpc:$custom_roles:myrole_one-expires_after_2020_12_31"]:
condition:
- description: Expiring at midnight of 2020-12-31
expression: request.time < timestamp("2021-01-01T00:00:00Z")
title: expires_after_2020_12_31
members:
- user:test-user@example.com
role: organizations/366118655033/roles/myRoleOne
google_folder_iam_binding.bindings["iam-bpc:$custom_roles:myrole_two-expires_after_2020_12_31"]:
condition:
- description: Expiring at midnight of 2020-12-31
expression: request.time < timestamp("2021-01-01T00:00:00Z")
title: expires_after_2020_12_31
members:
- user:test-user@example.com
role: organizations/366118655033/roles/myRoleTwo
google_folder_iam_binding.bindings["iam-bpc:roles/storage.admin-expires_after_2020_12_31"]:
condition:
- description: Expiring at midnight of 2020-12-31
expression: request.time < timestamp("2021-01-01T00:00:00Z")
title: expires_after_2020_12_31
members:
- user:test-user@example.com
role: roles/storage.admin
google_folder_iam_binding.bindings["myrole_two"]:
condition:
- description: null
expression: resource.matchTag('1234567890/environment', 'development')
title: Test
members:
- serviceAccount:test@test-project.iam.gserviceaccount.com
role: organizations/366118655033/roles/myRoleTwo
google_folder_iam_member.bindings["myrole_two"]:
condition: []
member: user:test-user@example.com
role: organizations/366118655033/roles/myRoleTwo
google_logging_folder_settings.default[0]:
kms_key_name: projects/test-kms-0/locations/europe-west8/keyRings/test/cryptoKeys/test
timeouts: null
google_logging_folder_sink.sink["test-pubsub"]:
description: test-pubsub (Terraform-managed).
destination: pubsub.googleapis.com/projects/test-prod-audit-logs-0/topics/audit-logs
disabled: false
exclusions: []
filter: log_id('cloudaudit.googleapis.com/activity')
include_children: true
intercept_children: false
name: test-pubsub
google_privileged_access_manager_entitlement.default["net-admins"]:
additional_notification_targets: []
approval_workflow:
- manual_approvals:
- require_approver_justification: true
steps:
- approvals_needed: 1
approver_email_recipients: null
approvers:
- principals:
- group:test-group@example.com
eligible_users:
- principals:
- group:test-group@example.com
entitlement_id: net-admins
location: global
max_request_duration: 3600s
privileged_access:
- gcp_iam_access:
- resource_type: cloudresourcemanager.googleapis.com/Folder
role_bindings:
- condition_expression: null
role: roles/compute.networkAdmin
- condition_expression: null
role: roles/compute.admin
- condition_expression: null
role: organizations/366118655033/roles/myRoleTwo
requester_justification_config:
- not_mandatory: []
unstructured:
- {}
timeouts: null
google_pubsub_topic_iam_member.pubsub-sinks-binding["test-pubsub"]:
condition: []
project: test-prod-audit-logs-0
role: roles/pubsub.publisher
topic: audit-logs
google_tags_tag_binding.binding["bar"]:
tag_value: tagValues/1234567891
timeouts: null
google_tags_tag_binding.binding["baz"]:
tag_value: tagValues/1234567890
timeouts: null
google_tags_tag_binding.binding["foo"]:
tag_value: foo-test-0/dynamic_test/cc-123
timeouts: null
counts:
google_cloud_asset_folder_feed: 1
google_essential_contacts_contact: 1
google_folder: 1
google_folder_iam_audit_config: 1
google_folder_iam_binding: 7
google_folder_iam_member: 1
google_logging_folder_settings: 1
google_logging_folder_sink: 1
google_privileged_access_manager_entitlement: 1
google_pubsub_topic_iam_member: 1
google_tags_tag_binding: 3
modules: 0
resources: 19
Reference in New Issue View Git Blame Copy Permalink