devops.hcl

# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

schema = {
  title                = "Devops Recipe"
  additionalProperties = false
  required = [
    "admins_group",
    "project",
  ]
  properties = {
    parent_type = {
      description = <<EOF
        Type of parent GCP resource to apply the policy.
        Must be one of 'organization' or 'folder'.
      EOF
      type        = "string"
      pattern     = "^organization|folder$"
    }
    parent_id = {
      description = <<EOF
        ID of parent GCP resource to apply the policy.
        Can be one of the organization ID or folder ID according to parent_type.
      EOF
      type        = "string"
      pattern     = "^[0-9]{8,25}$"
    }
    billing_account = {
      description = "ID of billing account to attach to this project."
      type        = "string"
    }
    project = {
      description          = "Config for the project to host devops resources such as remote state and CICD."
      type                 = "object"
      additionalProperties = false
      required = [
        "project_id",
        "owners_group",
      ]
      properties = {
        project_id = {
          description = "ID of project."
          type        = "string"
          pattern     = "^[a-z][a-z0-9\\-]{4,28}[a-z0-9]$"
        }
        owners_group = {
          description          = <<EOF
            Group which will be given owner access to the project.
            It will be created if 'exists' is false.
            NOTE: By default, the creating user will be the owner of the project.
            However, this group will own the project going forward. Make sure to include
            yourselve in the group,
          EOF
          type                 = "object"
          additionalProperties = false
          required = [
            "id",
          ]
          properties = {
            id = {
              description = "Email address of the group."
              type        = "string"
            }
            exists = {
              description = "Whether or not the group exists already. Default to 'false'."
              type        = "boolean"
            }
            customer_id = {
              description = <<EOF
                Customer ID of the organization to create the group in.
                See <https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains#retrieving_customer_id>
                for how to obtain it.
              EOF
              type        = "string"
            }
            description = {
              description = "Description of the group."
              type        = "string"
            }
            display_name = {
              description = "Display name of the group."
              type        = "string"
            }
            owners = {
              description = "Owners of the group."
              type        = "array"
              items = {
                type = "string"
              }
            }
            # Due to limitations in the underlying module, managers and members
            # are not supported and should be configured in the Google Workspace
            # Admin console.
            # managers = {
            #   description = "Managers of the group."
            #   type        = "array"
            #   items = {
            #     type = "string"
            #   }
            # }
            # members = {
            #   description = "Members of the group."
            #   type        = "array"
            #   items = {
            #     type = "string"
            #   }
            # }
          }
        }
        apis = {
          description = <<EOF
            List of APIs enabled in the devops project.

            NOTE: If a CICD is deployed within this project, then the APIs of
            all resources managed by the CICD must be listed here
            (even if the resources themselves are in different projects).
          EOF
        }
        labels = {
          description = "Map of labels for this project"
          type        = "object"
          patternProperties = {
            ".+" = { type = "string" }
          }
        }
      }
    }
    state_bucket = {
      description = "Name of Terraform remote state bucket."
      type        = "string"
    }
    storage_location = {
      description = "Location of state bucket."
      type        = "string"
    }
    admins_group = {
      description          = <<EOF
        Group which will be given admin access to the folder or organization.
        It will be created if 'exists' is false.
      EOF
      type                 = "object"
      additionalProperties = false
      required = [
        "id",
      ]
      properties = {
        id = {
          description = "Email address of the group."
          type        = "string"
        }
        exists = {
          description = "Whether or not the group exists already. Default to 'false'."
          type        = "boolean"
        }
        customer_id = {
          description = <<EOF
            Customer ID of the organization to create the group in.
            See <https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains#retrieving_customer_id>
            for how to obtain it.
          EOF
          type        = "string"
        }
        description = {
          description = "Description of the group."
          type        = "string"
        }
        display_name = {
          description = "Display name of the group."
          type        = "string"
        }
        owners = {
          description = "Owners of the group."
          type        = "array"
          items = {
            type = "string"
          }
        }
        # Due to limitations in the underlying module, managers and members
        # are not supported and should be configured in the Google Workspace
        # Admin console.
        # managers = {
        #   description = "Managers of the group."
        #   type        = "array"
        #   items = {
        #     type = "string"
        #   }
        # }
        # members = {
        #   description = "Members of the group."
        #   type        = "array"
        #   items = {
        #     type = "string"
        #   }
        # }
      }
    }
    enable_gcs_backend = {
      description = <<EOF
        Whether to enable GCS backend for the devops module.
        Defaults to false.

        Since the devops module creates the state bucket, it cannot back up
        the state to the GCS bucket on the first module. Thus, this field
        should be set to false initially.

        After the devops module has been applied once and the state bucket
        exists, the user should set this to true and regenerate the configs.

        To migrate the state from local to GCS, run `terraform init` on the
        module.
      EOF
      type        = "boolean"
    }
    terraform_addons = {
      description = <<EOF
        Additional Terraform configuration for the devops deployment.
        For schema see ./deployment.hcl.
      EOF
    }
  }
}

template "git" {
  component_path = "../components/git"
  output_path    = ".."
}

template "deployment" {
  recipe_path = "./deployment.hcl"
  passthrough = [
    "terraform_addons",
  ]
  data = {
    # The default value for `enable_gcs_backend` when not specified in the "deployment"
    # recipe is set to `true`, while in the "devops" recipe, the default value when not
    # specified should be `false`.
    enable_gcs_backend = {{get . "enable_gcs_backend" false}}
  }
}

template "devops" {
  component_path = "../components/devops"
}