kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c0bf32e797b7de9cb8ac1d161c7f1ab4432acbc2
hunfabric/tests/modules/project_factory/examples/example.yaml
Julio Castillo c0bf32e797 Refactor service agent management (#2423) 
* Service agents script

* Service agents update

* WIP

* Update script and terraform

* Fix tests

* Fix linter

* Update docs

* Bring back pf example inventory

* Fix tests

* Fix more tests

* Fix tests

* Use dataclasses for build_service_agents.py

* Remove unneeded field() from build_service_agents

* Re-enable CMEK depends_on in project outputs

* Update tools/requirements.txt

* Enable storage in GCS example projects

* Fix tests

* Add CMEK Service Agents dependencies for services

* Fix typos and data platform cmek

* More typos
2024-07-23 22:05:38 +02:00

504 lines
21 KiB
YAML
Raw Blame History

# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
values:
module.project-factory.module.automation-buckets["prj-app-3/state"].google_storage_bucket.bucket:
autoclass:
- enabled: false
cors: []
custom_placement_config: []
default_event_based_hold: null
enable_object_retention: null
encryption: []
force_destroy: false
labels: null
lifecycle_rule: []
location: EU
logging: []
name: test-pf-prj-app-3-state
project: bar-baz-iac-0
requester_pays: null
retention_policy: []
storage_class: MULTI_REGIONAL
timeouts: null
uniform_bucket_level_access: true
versioning:
- enabled: false
? module.project-factory.module.automation-buckets["prj-app-3/state"].google_storage_bucket_iam_binding.authoritative["roles/storage.objectCreator"]
: bucket: test-pf-prj-app-3-state
condition: []
members:
- serviceAccount:test-pf-prj-app-3-rw@bar-baz-iac-0.iam.gserviceaccount.com
role: roles/storage.objectCreator
? module.project-factory.module.automation-buckets["prj-app-3/state"].google_storage_bucket_iam_binding.authoritative["roles/storage.objectViewer"]
: bucket: test-pf-prj-app-3-state
condition: []
members:
- group:devops@example.org
- serviceAccount:test-pf-prj-app-3-ro@bar-baz-iac-0.iam.gserviceaccount.com
- serviceAccount:test-pf-prj-app-3-rw@bar-baz-iac-0.iam.gserviceaccount.com
role: roles/storage.objectViewer
module.project-factory.module.automation-service-accounts["prj-app-3/ro"].google_service_account.service_account[0]:
account_id: test-pf-prj-app-3-ro
create_ignore_already_exists: null
description: Read-only automation sa for app example 0.
disabled: false
display_name: Service account ro for prj-app-3.
project: bar-baz-iac-0
timeouts: null
module.project-factory.module.automation-service-accounts["prj-app-3/rw"].google_service_account.service_account[0]:
account_id: test-pf-prj-app-3-rw
create_ignore_already_exists: null
description: Read/write automation sa for app example 0.
disabled: false
display_name: Service account rw for prj-app-3.
project: bar-baz-iac-0
timeouts: null
module.project-factory.module.billing-account[0].google_billing_budget.default["test-100"]:
all_updates_rule:
- disable_default_iam_recipients: true
enable_project_level_recipients: false
pubsub_topic: null
schema_version: '1.0'
amount:
- last_period_amount: null
specified_amount:
- nanos: null
units: '100'
billing_account: 123456-123456-123456
budget_filter:
- calendar_period: null
credit_types_treatment: INCLUDE_ALL_CREDITS
custom_period: []
resource_ancestors:
- folders/1234567890
display_name: 100 dollars in current spend
ownership_scope: null
threshold_rules:
- spend_basis: CURRENT_SPEND
threshold_percent: 0.5
- spend_basis: CURRENT_SPEND
threshold_percent: 0.75
timeouts: null
module.project-factory.module.billing-account[0].google_monitoring_notification_channel.default["billing-default"]:
description: null
display_name: Budget email notification billing-default.
enabled: true
force_delete: false
labels:
email_address: gcp-billing-admins@example.com
project: foo-billing-audit
sensitive_labels: []
timeouts: null
type: email
user_labels: null
module.project-factory.module.hierarchy-folder-lvl-1["bar"].google_folder.folder[0]:
display_name: Bar (level 1)
parent: folders/4567890
timeouts: null
module.project-factory.module.hierarchy-folder-lvl-1["foo"].google_folder.folder[0]:
display_name: Foo (level 1)
parent: folders/12345678
timeouts: null
module.project-factory.module.hierarchy-folder-lvl-1["foo"].google_folder_iam_binding.authoritative["roles/viewer"]:
condition: []
members:
- group:a@example.com
role: roles/viewer
module.project-factory.module.hierarchy-folder-lvl-2["bar/baz"].google_folder.folder[0]:
display_name: Bar Baz (level 2)
timeouts: null
module.project-factory.module.hierarchy-folder-lvl-2["foo/baz"].google_folder.folder[0]:
display_name: Foo Baz (level 2)
timeouts: null
module.project-factory.module.projects["bar-baz-iac-0"].data.google_storage_project_service_account.gcs_sa[0]:
project: test-pf-bar-baz-iac-0
user_project: null
module.project-factory.module.projects["bar-baz-iac-0"].google_essential_contacts_contact.contact["admin@example.com"]:
email: admin@example.com
language_tag: en
notification_category_subscriptions:
- ALL
parent: projects/test-pf-bar-baz-iac-0
timeouts: null
module.project-factory.module.projects["bar-baz-iac-0"].google_project.project[0]:
auto_create_network: false
billing_account: 012345-67890A-BCDEF0
effective_labels:
environment: test
labels:
environment: test
name: test-pf-bar-baz-iac-0
project_id: test-pf-bar-baz-iac-0
skip_delete: false
terraform_labels:
environment: test
timeouts: null
module.project-factory.module.projects["bar-baz-iac-0"].google_project_iam_member.service_agents["container-engine-robot"]:
condition: []
project: test-pf-bar-baz-iac-0
role: roles/container.serviceAgent
module.project-factory.module.projects["bar-baz-iac-0"].google_project_iam_member.service_agents["gkenode"]:
condition: []
project: test-pf-bar-baz-iac-0
role: roles/container.nodeServiceAgent
? module.project-factory.module.projects["bar-baz-iac-0"].google_project_service.project_services["container.googleapis.com"]
: disable_dependent_services: false
disable_on_destroy: false
project: test-pf-bar-baz-iac-0
service: container.googleapis.com
timeouts: null
? module.project-factory.module.projects["bar-baz-iac-0"].google_project_service.project_services["stackdriver.googleapis.com"]
: disable_dependent_services: false
disable_on_destroy: false
project: test-pf-bar-baz-iac-0
service: stackdriver.googleapis.com
timeouts: null
module.project-factory.module.projects["bar-baz-iac-0"].google_project_service.project_services["storage.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-bar-baz-iac-0
service: storage.googleapis.com
timeouts: null
? module.project-factory.module.projects["bar-baz-iac-0"].google_project_service_identity.default["container.googleapis.com"]
: project: test-pf-bar-baz-iac-0
service: container.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-1"].data.google_storage_project_service_account.gcs_sa[0]:
project: test-pf-prj-app-1
user_project: null
module.project-factory.module.projects["prj-app-1"].google_essential_contacts_contact.contact["admin@example.com"]:
email: admin@example.com
language_tag: en
notification_category_subscriptions:
- ALL
parent: projects/test-pf-prj-app-1
timeouts: null
? module.project-factory.module.projects["prj-app-1"].google_kms_crypto_key_iam_member.service_agent_cmek["projects/kms-central-prj/locations/europe-west3/keyRings/my-keyring/cryptoKeys/europe3-gce.gs-project-accounts"]
: condition: []
crypto_key_id: projects/kms-central-prj/locations/europe-west3/keyRings/my-keyring/cryptoKeys/europe3-gce
role: roles/cloudkms.cryptoKeyEncrypterDecrypter
module.project-factory.module.projects["prj-app-1"].google_project.project[0]:
auto_create_network: false
billing_account: 012345-67890A-BCDEF0
effective_labels:
app: app-1
environment: test
team: foo
folder_id: '12345678'
labels:
app: app-1
environment: test
team: foo
name: test-pf-prj-app-1
org_id: null
project_id: test-pf-prj-app-1
skip_delete: false
terraform_labels:
app: app-1
environment: test
team: foo
timeouts: null
module.project-factory.module.projects["prj-app-1"].google_project_iam_member.service_agents["container-engine-robot"]:
condition: []
project: test-pf-prj-app-1
role: roles/container.serviceAgent
module.project-factory.module.projects["prj-app-1"].google_project_iam_member.service_agents["gkenode"]:
condition: []
project: test-pf-prj-app-1
role: roles/container.nodeServiceAgent
module.project-factory.module.projects["prj-app-1"].google_project_service.project_services["container.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-1
service: container.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-1"].google_project_service.project_services["stackdriver.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-1
service: stackdriver.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-1"].google_project_service.project_services["storage.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-1
service: storage.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-1"].google_project_service_identity.default["container.googleapis.com"]:
project: test-pf-prj-app-1
service: container.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-2"].data.google_storage_project_service_account.gcs_sa[0]:
project: test-pf-prj-app-2
user_project: null
module.project-factory.module.projects["prj-app-2"].google_compute_shared_vpc_service_project.shared_vpc_service[0]:
deletion_policy: null
host_project: foo-host
service_project: test-pf-prj-app-2
timeouts: null
? module.project-factory.module.projects["prj-app-2"].google_compute_subnetwork_iam_member.shared_vpc_host_robots["europe-west1:prod-default-ew1:cloudservices"]
: condition: []
project: foo-host
region: europe-west1
role: roles/compute.networkUser
subnetwork: prod-default-ew1
? module.project-factory.module.projects["prj-app-2"].google_compute_subnetwork_iam_member.shared_vpc_host_robots["europe-west1:prod-default-ew1:container-engine"]
: condition: []
project: foo-host
region: europe-west1
role: roles/compute.networkUser
subnetwork: prod-default-ew1
? module.project-factory.module.projects["prj-app-2"].google_compute_subnetwork_iam_member.shared_vpc_host_subnets_iam["europe-west1:prod-default-ew1:group:team-1@example.com"]
: condition: []
member: group:team-1@example.com
project: foo-host
region: europe-west1
role: roles/compute.networkUser
subnetwork: prod-default-ew1
module.project-factory.module.projects["prj-app-2"].google_essential_contacts_contact.contact["admin@example.com"]:
email: admin@example.com
language_tag: en
notification_category_subscriptions:
- ALL
parent: projects/test-pf-prj-app-2
timeouts: null
? module.project-factory.module.projects["prj-app-2"].google_org_policy_policy.default["compute.restrictSharedVpcSubnetworks"]
: dry_run_spec: []
name: projects/test-pf-prj-app-2/policies/compute.restrictSharedVpcSubnetworks
parent: projects/test-pf-prj-app-2
spec:
- inherit_from_parent: null
reset: null
rules:
- allow_all: null
condition: []
deny_all: null
enforce: null
values:
- allowed_values:
- projects/foo-host/regions/europe-west1/subnetworks/prod-default-ew1
denied_values: null
timeouts: null
module.project-factory.module.projects["prj-app-2"].google_project.project[0]:
auto_create_network: false
billing_account: 123456-123456-123456
effective_labels:
app: app-2
environment: test
team: foo
folder_id: '12345678'
labels:
app: app-2
environment: test
team: foo
name: test-pf-prj-app-2
org_id: null
project_id: test-pf-prj-app-2
skip_delete: false
terraform_labels:
app: app-2
environment: test
team: foo
timeouts: null
module.project-factory.module.projects["prj-app-2"].google_project_iam_member.service_agents["compute-system"]:
condition: []
project: test-pf-prj-app-2
role: roles/compute.serviceAgent
module.project-factory.module.projects["prj-app-2"].google_project_iam_member.service_agents["container-engine-robot"]:
condition: []
project: test-pf-prj-app-2
role: roles/container.serviceAgent
module.project-factory.module.projects["prj-app-2"].google_project_iam_member.service_agents["gkenode"]:
condition: []
project: test-pf-prj-app-2
role: roles/container.nodeServiceAgent
module.project-factory.module.projects["prj-app-2"].google_project_iam_member.service_agents["serverless-robot-prod"]:
condition: []
project: test-pf-prj-app-2
role: roles/run.serviceAgent
? module.project-factory.module.projects["prj-app-2"].google_project_iam_member.shared_vpc_host_robots["roles/container.hostServiceAgentUser:container-engine"]
: condition: []
project: foo-host
role: roles/container.hostServiceAgentUser
? module.project-factory.module.projects["prj-app-2"].google_project_iam_member.shared_vpc_host_robots["roles/vpcaccess.user:cloudrun"]
: condition: []
project: foo-host
role: roles/vpcaccess.user
module.project-factory.module.projects["prj-app-2"].google_project_service.project_services["compute.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-2
service: compute.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-2"].google_project_service.project_services["container.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-2
service: container.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-2"].google_project_service.project_services["run.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-2
service: run.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-2"].google_project_service.project_services["stackdriver.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-2
service: stackdriver.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-2"].google_project_service.project_services["storage.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-2
service: storage.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-2"].google_project_service_identity.default["container.googleapis.com"]:
project: test-pf-prj-app-2
service: container.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-2"].google_project_service_identity.default["run.googleapis.com"]:
project: test-pf-prj-app-2
service: run.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-3"].data.google_storage_project_service_account.gcs_sa[0]:
project: test-pf-prj-app-3
user_project: null
module.project-factory.module.projects["prj-app-3"].google_compute_shared_vpc_host_project.shared_vpc_host[0]:
project: test-pf-prj-app-3
timeouts: null
module.project-factory.module.projects["prj-app-3"].google_essential_contacts_contact.contact["admin@example.com"]:
email: admin@example.com
language_tag: en
notification_category_subscriptions:
- ALL
parent: projects/test-pf-prj-app-3
timeouts: null
module.project-factory.module.projects["prj-app-3"].google_project.project[0]:
auto_create_network: false
billing_account: 123456-123456-123456
effective_labels:
environment: test
labels:
environment: test
name: test-pf-prj-app-3
project_id: test-pf-prj-app-3
skip_delete: false
terraform_labels:
environment: test
timeouts: null
module.project-factory.module.projects["prj-app-3"].google_project_iam_binding.authoritative["roles/owner"]:
condition: []
members:
- serviceAccount:test-pf-prj-app-3-rw@bar-baz-iac-0.iam.gserviceaccount.com
project: test-pf-prj-app-3
role: roles/owner
module.project-factory.module.projects["prj-app-3"].google_project_iam_binding.authoritative["roles/viewer"]:
condition: []
members:
- serviceAccount:test-pf-prj-app-3-ro@bar-baz-iac-0.iam.gserviceaccount.com
project: test-pf-prj-app-3
role: roles/viewer
module.project-factory.module.projects["prj-app-3"].google_project_iam_member.service_agents["serverless-robot-prod"]:
condition: []
project: test-pf-prj-app-3
role: roles/run.serviceAgent
module.project-factory.module.projects["prj-app-3"].google_project_service.project_services["run.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-3
service: run.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-3"].google_project_service.project_services["stackdriver.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-3
service: stackdriver.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-3"].google_project_service.project_services["storage.googleapis.com"]:
disable_dependent_services: false
disable_on_destroy: false
project: test-pf-prj-app-3
service: storage.googleapis.com
timeouts: null
module.project-factory.module.projects["prj-app-3"].google_project_service_identity.default["run.googleapis.com"]:
project: test-pf-prj-app-3
service: run.googleapis.com
timeouts: null
? module.project-factory.module.service-accounts["prj-app-1/app-1-be"].google_project_iam_member.project-roles["my-host-project-roles/compute.networkUser"]
: condition: []
project: my-host-project
role: roles/compute.networkUser
? module.project-factory.module.service-accounts["prj-app-1/app-1-be"].google_project_iam_member.project-roles["test-pf-prj-app-1-roles/logging.logWriter"]
: condition: []
project: test-pf-prj-app-1
role: roles/logging.logWriter
? module.project-factory.module.service-accounts["prj-app-1/app-1-be"].google_project_iam_member.project-roles["test-pf-prj-app-1-roles/monitoring.metricWriter"]
: condition: []
project: test-pf-prj-app-1
role: roles/monitoring.metricWriter
module.project-factory.module.service-accounts["prj-app-1/app-1-be"].google_service_account.service_account[0]:
account_id: app-1-be
create_ignore_already_exists: null
description: null
disabled: false
display_name: Terraform-managed.
project: test-pf-prj-app-1
timeouts: null
? module.project-factory.module.service-accounts["prj-app-1/app-1-fe"].google_project_iam_member.project-roles["my-host-project-roles/compute.networkUser"]
: condition: []
project: my-host-project
role: roles/compute.networkUser
module.project-factory.module.service-accounts["prj-app-1/app-1-fe"].google_service_account.service_account[0]:
account_id: app-1-fe
create_ignore_already_exists: null
description: null
disabled: false
display_name: Test app 1 frontend.
project: test-pf-prj-app-1
timeouts: null
module.project-factory.module.service-accounts["prj-app-2/app-2-be"].google_service_account.service_account[0]:
account_id: app-2-be
create_ignore_already_exists: null
description: null
disabled: false
display_name: Terraform-managed.
project: test-pf-prj-app-2
timeouts: null
counts:
google_billing_budget: 1
google_compute_shared_vpc_host_project: 1
google_compute_shared_vpc_service_project: 1
google_compute_subnetwork_iam_member: 3
google_essential_contacts_contact: 4
google_folder: 4
google_folder_iam_binding: 1
google_kms_crypto_key_iam_member: 1
google_monitoring_notification_channel: 1
google_org_policy_policy: 1
google_project: 4
google_project_iam_binding: 2
google_project_iam_member: 15
google_project_service: 14
google_project_service_identity: 5
google_service_account: 5
google_storage_bucket: 1
google_storage_bucket_iam_binding: 2
google_storage_project_service_account: 4
modules: 16
resources: 70
Reference in New Issue View Git Blame Copy Permalink