Skip to content
This repository was archived by the owner on Jan 4, 2023. It is now read-only.

Commit e8198a0

Browse files
KonradSchiebanKonradSchieban
authored
CICD Implementation (Issue #2) (#111)
* Adding cloudbuild.yml * Added Inspec steps * Added Readme for cicd setup
1 parent 8385333 commit e8198a0

File tree

7 files changed

+398
-9
lines changed

7 files changed

+398
-9
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ Here are the projects/services we make use of in this Blueprint:
3131
* [Diagrams](docs/diagrams.md)
3232
* [Kubernetes RBAC via Google Groups membership demonstration](docs/Google-Groups-and-RBAC.md)
3333
* [Development](/docs/development.md)
34+
* [Continuous Integration with Cloud Build](/docs/cicd.md)
3435
* [Known Issues and Limitations](#known-issues-and-limitations)
3536
* [Helpful Links](#helpful-links)
3637

‎_helpers/admin_project_setup.sh‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,12 @@ echo "Continuing in 10 seconds. Ctrl+C to cancel"
3131
sleep 10
3232

3333
echo "=> Creating project inside the folder ${TF_VAR_folder_id}"
34-
gcloud projects create "${TF_ADMIN_PROJECT}" \
35-
--folder "${TF_VAR_folder_id}"
34+
project_exists=`gcloud projects list --filter "${TF_ADMIN_PROJECT}" | grep "${TF_ADMIN_PROJECT}" | wc -l | tr -d ' '`
35+
if [ "$project_exists" = "0" ];then
36+
gcloud projects create "${TF_ADMIN_PROJECT}" --folder "${TF_VAR_folder_id}"
37+
else
38+
echo "Project already exists. Skipping"
39+
fi
3640

3741
echo "=> Linking ${TF_VAR_billing_account} Billing Account to your project"
3842
gcloud beta billing projects link "${TF_ADMIN_PROJECT}" \

‎_helpers/build-infra.sh‎

Lines changed: 43 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,24 +14,61 @@
1414
# See the License for the specific language governing permissions and
1515
# limitations under the License.
1616

17-
# Set up the admin resources run
18-
echo 'Setting up the Terraform Admin Project'
17+
usage() {
18+
echo "Usage: build-infra [-ach] "
19+
echo
20+
echo "Builds infrastructure of pci-gke-blueprint"
21+
echo
22+
echo " -c (optional) Running script in continuous integration and skipping service account creation"
23+
echo " -a (optional) Admin project setup will be skipped"
24+
echo " -h (optional) Print this help menu"
25+
}
26+
27+
unset run_type skip_admin_project
28+
skip_admin_project=false
29+
30+
while getopts 'ach' c
31+
do
32+
case $c in
33+
c) run_type="cicd";;
34+
a) skip_admin_project=true;;
35+
h|?)
36+
usage
37+
exit 2
38+
;;
39+
esac
40+
done
1941

2042
# Source the environment setup file you created previously
2143
source ./workstation.env
2244

23-
# Create the Admin project
24-
./_helpers/admin_project_setup.sh
45+
if [ "$skip_admin_project" = "false" ];then
46+
# Set up the admin resources run
47+
echo 'Setting up the Terraform Admin Project'
48+
49+
# Create the Admin project
50+
./_helpers/admin_project_setup.sh
51+
fi
2552

26-
# Create the Terraform service account
27-
./_helpers/setup_service_account.sh
53+
if [ "$run_type" = "cicd" ];then
54+
# Prepare CloudBuild service account
55+
cloud_build_service_account=`gcloud config get-value account`
56+
./_helpers/setup_cloud_build_service_account.sh $cloud_build_service_account
57+
else
58+
# Create the Terraform service account
59+
./_helpers/setup_service_account.sh
60+
fi
2861

2962
# run terraform
3063
sed "s/<SET TO THE VALUE OF TF_ADMIN_BUCKET>/${TF_ADMIN_BUCKET}/" terraform/infrastructure/backend.tf.example > terraform/infrastructure/backend.tf
3164
pushd terraform/infrastructure
3265
terraform init
3366
terraform plan -out terraform.out
3467
terraform apply terraform.out
68+
if [ $? -ne 0 ];then
69+
echo "Terraform apply failed. Aborting..."
70+
exit 1
71+
fi
3572
popd
3673

3774
# DNS

‎_helpers/setup_cloud_build_service_account.sh‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
#!/bin/bash
2+
# Copyright 2020 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
cloud_build_service_account=$1
17+
18+
# Fail fast when a command fails or a variable is undefined
19+
set -eu
20+
21+
echo ""
22+
echo "Preparing to execute with the following values:"
23+
echo "==================================================="
24+
echo "Admin Project: ${TF_ADMIN_PROJECT:?}"
25+
echo "Organization: ${TF_VAR_org_id:?}"
26+
echo "Billing Account: ${TF_VAR_billing_account:?}"
27+
echo "Folder: ${TF_VAR_folder_id:?}"
28+
echo "State Bucket: ${TF_ADMIN_BUCKET:?}"
29+
echo "Cloud Build Service Account: ${cloud_build_service_account:?}"
30+
echo "==================================================="
31+
echo ""
32+
echo "Continuing in 10 seconds. Ctrl+C to cancel"
33+
sleep 10
34+
35+
36+
echo "=> Binding IAM roles to service account"
37+
38+
# Add Viewer permissions for the Terraform Admin project
39+
gcloud projects add-iam-policy-binding "${TF_ADMIN_PROJECT}" \
40+
--member "serviceAccount:$cloud_build_service_account" \
41+
--role roles/viewer
42+
43+
# Enable Access Context Manager API for the Terraform Admin project
44+
gcloud services --project ${TF_ADMIN_PROJECT} enable accesscontextmanager.googleapis.com
45+
46+
# Add Storage Admin permissions for the Terraform Admin project
47+
gcloud projects add-iam-policy-binding "${TF_ADMIN_PROJECT}" \
48+
--member "serviceAccount:$cloud_build_service_account" \
49+
--role roles/storage.admin
50+
51+
# Add accesscontextmanager.policyAdmin
52+
gcloud organizations add-iam-policy-binding "${TF_VAR_org_id}" \
53+
--member "serviceAccount:$cloud_build_service_account" \
54+
--role="roles/accesscontextmanager.policyAdmin"
55+
56+
# Add resourcemanager.organizationAdmin
57+
gcloud organizations add-iam-policy-binding "${TF_VAR_org_id}" \
58+
--member "serviceAccount:$cloud_build_service_account" \
59+
--role="roles/resourcemanager.organizationAdmin"
60+
61+
# Add orgpolicy.policyAdmin
62+
gcloud organizations add-iam-policy-binding "${TF_VAR_org_id}" \
63+
--member "serviceAccount:$cloud_build_service_account" \
64+
--role="roles/orgpolicy.policyAdmin"
65+
66+
# Add billing admin
67+
gcloud organizations add-iam-policy-binding "${TF_VAR_org_id}" \
68+
--member "serviceAccount:$cloud_build_service_account" \
69+
--role="roles/billing.admin"
70+
71+
# Add Storage Admin permissions to entire Folder
72+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
73+
--member "serviceAccount:$cloud_build_service_account" \
74+
--role roles/storage.admin
75+
76+
# Add Container cluster admin permissions to entire Folder
77+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
78+
--member "serviceAccount:$cloud_build_service_account" \
79+
--role roles/container.admin
80+
81+
# Add serviceusage.serviceUsageAdmin
82+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
83+
--member "serviceAccount:$cloud_build_service_account" \
84+
--role roles/serviceusage.serviceUsageAdmin
85+
86+
# Add IAM serviceAccountUser permissions to entire Folder
87+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
88+
--member "serviceAccount:$cloud_build_service_account" \
89+
--role roles/iam.serviceAccountUser
90+
91+
# Add Project Creator permissions to entire Folder
92+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
93+
--member "serviceAccount:$cloud_build_service_account" \
94+
--role roles/resourcemanager.projectCreator
95+
96+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
97+
--member "serviceAccount:$cloud_build_service_account" \
98+
--role roles/resourcemanager.folderIamAdmin
99+
100+
# Add Billing Project Manager permissions to all projects in Folder
101+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
102+
--member "serviceAccount:$cloud_build_service_account" \
103+
--role roles/billing.projectManager
104+
105+
# Add Compute Admin permissions to all projects in Folder
106+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
107+
--member "serviceAccount:$cloud_build_service_account" \
108+
--role roles/compute.admin
109+
110+
# Add Shared VPC Admin permissions to all projects in Folder
111+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
112+
--member "serviceAccount:$cloud_build_service_account" \
113+
--role roles/compute.xpnAdmin
114+
115+
echo "=> Setting up IAM roles for StackDriver Logging"
116+
117+
gcloud resource-manager folders add-iam-policy-binding "${TF_VAR_folder_id}" \
118+
--member "serviceAccount:$cloud_build_service_account" \
119+
--role roles/logging.configWriter
120+
121+
echo ""
122+
echo "Service Account set up successfully"
123+
echo ""

‎cicd/cloudbuild.yml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
# Copyright 2020 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
substitutions:
16+
_GOOGLE_GROUPS_DOMAIN: ''
17+
_TF_ADMIN_BUCKET: ''
18+
_TF_ADMIN_PROJECT: ''
19+
_TF_VAR_BILLING_ACCOUNT: ''
20+
_TF_VAR_FOLDER_ID: ''
21+
_TF_VAR_FRONTEND_ZONE_DNS_NAME: ''
22+
_TF_VAR_GSUITE_ID: ''
23+
_TF_VAR_ORG_ID: ''
24+
_TF_VAR_PROJECT_PREFIX: ''
25+
_GCR_PROJECT_ID: ''
26+
_REPORTS_BUCKET: ''
27+
_DESTROY_INFRA_AFTER_CREATE: ''
28+
29+
30+
timeout: 3000s
31+
steps:
32+
- id: 'Build Infra'
33+
name: 'gcr.io/cloud-foundation-cicd/cft/developer-tools:0'
34+
waitFor: ['-']
35+
entrypoint: 'sh'
36+
env:
37+
- GOOGLE_GROUPS_DOMAIN=${_GOOGLE_GROUPS_DOMAIN}
38+
- TF_ADMIN_BUCKET=${_TF_ADMIN_BUCKET}
39+
- TF_ADMIN_PROJECT=${_TF_ADMIN_PROJECT}
40+
- TF_VAR_billing_account=${_TF_VAR_BILLING_ACCOUNT}
41+
- TF_VAR_folder_id=${_TF_VAR_FOLDER_ID}
42+
- TF_VAR_frontend_zone_dns_name=${_TF_VAR_FRONTEND_ZONE_DNS_NAME}
43+
- TF_VAR_gsuite_id=${_TF_VAR_GSUITE_ID}
44+
- TF_VAR_org_id=${_TF_VAR_ORG_ID}
45+
- TF_VAR_project_prefix=${_TF_VAR_PROJECT_PREFIX}
46+
args:
47+
- '-c'
48+
- |
49+
cloud_build_service_account=`gcloud config get-value account`
50+
cp workstation.env.example workstation.env
51+
sed -i "s/YOUR_ORG_ID/${_TF_VAR_ORG_ID}/g" workstation.env
52+
sed -i "s/YOUR_GSUITE_ID/${_TF_VAR_GSUITE_ID}/g" workstation.env
53+
sed -i "s/YOUR_BILLING_ACCOUNT_ID/${_TF_VAR_BILLING_ACCOUNT}/g" workstation.env
54+
sed -i "s/YOUR_PROJECT_FOLDER/${_TF_VAR_FOLDER_ID}/g" workstation.env
55+
sed -i "s/demo-pci/${_TF_VAR_PROJECT_PREFIX}/g" workstation.env
56+
sed -i "/export TF_ADMIN_PROJECT/c\export TF_ADMIN_PROJECT=${_TF_ADMIN_PROJECT}" workstation.env
57+
sed -i "s/terraform-admin-<INSERT-RANDOM-IDENTIFIER-HERE>/${_TF_ADMIN_BUCKET}/g" workstation.env
58+
sed -i "/TF_VAR_frontend_zone_dns_name=/c\export TF_VAR_frontend_zone_dns_name=\"${_TF_VAR_FRONTEND_ZONE_DNS_NAME}\"" workstation.env
59+
sed -i "/GOOGLE_GROUPS_DOMAIN=/c\GOOGLE_GROUPS_DOMAIN=\"${_GOOGLE_GROUPS_DOMAIN}\"" workstation.env
60+
sed -i '/GOOGLE_APPLICATION_CREDENTIALS/d' workstation.env
61+
sed -i "/TF_VAR_terraform_service_account/c\export TF_VAR_terraform_service_account=\"serviceAccount:$cloud_build_service_account\"" workstation.env
62+
cat workstation.env
63+
source workstation.env
64+
./_helpers/build-infra.sh -c
65+
66+
- id: 'Write input file'
67+
waitFor: ['Build Infra']
68+
name: gcr.io/cloud-foundation-cicd/cft/developer-tools:0
69+
entrypoint: '/bin/sh'
70+
args:
71+
- '-c'
72+
- |
73+
cloud_build_service_account=`gcloud config get-value account`
74+
75+
cat <<EOF > /workspace/inputs.yml
76+
gcp_project_id: "${_TF_VAR_PROJECT_PREFIX}-in-scope"
77+
gcp_gke_locations:
78+
- 'us-central1'
79+
gce_zones:
80+
- 'us-central1'
81+
- 'us-central1-a'
82+
- 'us-central1-b'
83+
- 'us-central1-c'
84+
- 'us-central1-d'
85+
- 'us-central1-e'
86+
- 'us-central1-f'
87+
cis_version: ""
88+
cis_url: ""
89+
fw_change_control_id_regex: 'CID:'
90+
fw_override_control_id_regex: 'CID:'
91+
logging_viewer_list: []
92+
logging_admin_list: []
93+
project_owners_list: ["serviceAccount:$cloud_build_service_account"]
94+
gcs_logging_buckets: []
95+
cai_inventory_bucket_name: ""
96+
cai_inventory_file_path: ""
97+
cai_inventory_age_seconds: 60
98+
gcs_pii_buckets: []
99+
kms_regions_list:
100+
- "us-central1"
101+
kms_admins_list: []
102+
kms_encrypters_list: []
103+
kms_decrypters_list: []
104+
kms_encrypterdecrypters_list: []
105+
kms_rotation_period_seconds: 7776000
106+
environment_label: 'env'
107+
memorystore_admins_list: []
108+
cloudsql_admins_list: []
109+
cloudsql_clients_list: []
110+
bq_admins_list: []
111+
spanner_admins_list: []
112+
environment_label: "goog-gke-node"
113+
allow_all_tcp_ports: []
114+
allow_all_udp_ports: []
115+
EOF
116+
cat /workspace/inputs.yml
117+
118+
- id: 'Run PCI Profile on in-scope project'
119+
waitFor: ['Write input file']
120+
name: gcr.io/${_GCR_PROJECT_ID}/inspec-gcp-pci-profile:v3.2.1-3
121+
entrypoint: '/bin/sh'
122+
args:
123+
- '-c'
124+
- |
125+
inspec exec /share/. -t gcp:// \
126+
--input-file /workspace/inputs.yml \
127+
--reporter cli json:/workspace/pci_report.json html:/workspace/pci_report.html | tee out.json
128+
129+
- id: 'Store json Report'
130+
waitFor: ['Run PCI Profile on in-scope project']
131+
name: gcr.io/cloud-builders/gsutil
132+
args:
133+
- cp
134+
- /workspace/pci_report.json
135+
- gs://${_REPORTS_BUCKET}/pci_report-${BUILD_ID}.json
136+
137+
- id: 'Store HTML Report'
138+
waitFor: ['Run PCI Profile on in-scope project']
139+
name: gcr.io/cloud-builders/gsutil
140+
args:
141+
- cp
142+
- /workspace/pci_report.html
143+
- gs://${_REPORTS_BUCKET}/pci_report-${BUILD_ID}.html
144+
145+
- id: 'Destroy Infra'
146+
waitFor: ['Store HTML Report']
147+
name: gcr.io/cloud-foundation-cicd/cft/developer-tools:0
148+
entrypoint: '/bin/sh'
149+
args:
150+
- '-c'
151+
- |
152+
if [ "${_DESTROY_INFRA_AFTER_CREATE}" = "true" ];then
153+
cat workstation.env
154+
source workstation.env
155+
cd terraform/infrastructure
156+
terraform destroy -auto-approve
157+
fi
158+

0 commit comments

Comments
 (0)