chore: Per-module isolation for integration tests

Makefile

@@ -93,4 +93,4 @@ docker_test_integration:
 		-e TF_VAR_project_id \
 		-v "$(CURDIR)":/workspace \
 		$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
-		/usr/local/bin/test_integration.sh
+		cft test run all

build/int.cloudbuild.yaml

@@ -49,34 +49,19 @@ steps:
 #   - 'TF_VAR_create_access_context_manager_access_policy=false'
 #   waitFor:
 #   - prepare
-- id: create
-  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create']
-  waitFor:
-  - prepare
-- id: converge
-  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge']
+- id: simple-cloud-run
   waitFor:
-  - create
-- id: verify
+    - prepare
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify']
-  waitFor:
-  - converge
-- id: destroy
-  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy']
-  waitFor:
-  - verify
-- id: create all
+  args: ['/bin/bash', '-c', 'cft test run TestSimpleCloudRun --verbose']
+- id: create cloud-run-with-cmek
   waitFor:
-    - destroy
+    - simple-cloud-run
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
   args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && source_test_env && init_credentials && cft test run TestCloudRunWithCMEK --test-dir test/integration --stage init --verbose']
 - id: converge cloud-run-with-cmek
   waitFor:
-    - create all
+    - create cloud-run-with-cmek
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
   args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && source_test_env && init_credentials && cft test run TestCloudRunWithCMEK --test-dir test/integration --stage apply --verbose']
 - id: verify cloud-run-with-cmek

test/integration/simple_cloud_run/simple_test.go

@@ -0,0 +1,50 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package simple_cloud_run
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/gcloud"
+	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSimpleCloudRun(t *testing.T) {
+	cloudRun := tft.NewTFBlueprintTest(t)
+
+	cloudRun.DefineVerify(
+		func(assert *assert.Assertions) {
+			cloudRun.DefaultVerify(assert)
+
+			projectID := cloudRun.GetStringOutput("project_id")
+			location := cloudRun.GetStringOutput("service_location")
+			serviceName := cloudRun.GetStringOutput("service_name")
+			serviceStatus := cloudRun.GetStringOutput("service_status")
+
+			gcProjectOps := gcloud.WithCommonArgs([]string{"--project", projectID, "--format", "json"})
+			projectOp := gcloud.Run(t, "services list --enabled --filter='config.name=run.googleapis.com'", gcProjectOps).Array()[0]
+
+			assert.Equal("run.googleapis.com", projectOp.Get("config").Get("name").String(), "should have the right API enabled")
+
+			gcOps := gcloud.WithCommonArgs([]string{"--project", projectID, "--region", location, "--format", "json"})
+
+			op := gcloud.Run(t, fmt.Sprintf("run services list --filter=metadata.name=%q", serviceName), gcOps).Array()[0]
+
+			assert.Equal(serviceStatus, op.Get("status").Get("conditions").Array()[0].Get("type").String(), "should have the right service status")
+		})
+	cloudRun.Test()
+}

test/setup/iam.tf

@@ -110,45 +110,56 @@ locals {
     ],
   }
 
-  int_required_roles = tolist(toset(flatten(values(local.per_module_roles))))
+  extra_roles_for_tests = {
+    root = [
+      // For "examples/cloud_run_vpc_connector".
+      "roles/iam.networkAdmin",
+      "roles/vpcaccess.admin",
+    ],
+    job-exec = [
+      "roles/compute.viewer",
+    ]
+  }
+
+  // A list of items like:
+  // { module_name = "x", role = "role1"}
+  // { module_name = "x", role = "role2"}
+  // { module_name = "y", role = "role3"}
+  module_role_combinations = flatten(
+    [for module_name, _ in module.project :
+      [for role in setunion(local.per_module_roles[module_name], lookup(local.extra_roles_for_tests, module_name, [])) : {
+        module_name = module_name
+        role        = role
+        }
+      ]
+    ]
+  )
 }
 
 resource "google_service_account" "int_test" {
-  project      = module.project.project_id
+  for_each = module.project
+
+  project      = each.value.project_id
   account_id   = "ci-account"
   display_name = "ci-account"
 }
 
-resource "google_organization_iam_member" "org_member" {
-  count = length(local.org_required_roles)
-
-  org_id = var.org_id
-  role   = local.org_required_roles[count.index]
-  member = "serviceAccount:${google_service_account.int_test.email}"
-}
-
-resource "google_folder_iam_member" "folder_member" {
-  count = length(local.folder_required_roles)
-
-  folder = "folders/${var.folder_id}"
-  role   = local.folder_required_roles[count.index]
-  member = "serviceAccount:${google_service_account.int_test.email}"
-}
-
 resource "google_project_iam_member" "int_test" {
-  count = length(local.int_required_roles)
-
-  project = module.project.project_id
-  role    = local.int_required_roles[count.index]
-  member  = "serviceAccount:${google_service_account.int_test.email}"
-}
+  for_each = {
+    for combination in local.module_role_combinations :
+    "${combination.module_name}.${combination.role}" => {
+      service_account = google_service_account.int_test[combination.module_name]
+      role            = combination.role
+    }
+  }
 
-resource "google_billing_account_iam_member" "int_billing_admin" {
-  billing_account_id = var.billing_account
-  role               = "roles/billing.user"
-  member             = "serviceAccount:${google_service_account.int_test.email}"
+  project = each.value.service_account.project
+  role    = each.value.role
+  member  = "serviceAccount:${each.value.service_account.email}"
 }
 
 resource "google_service_account_key" "int_test" {
-  service_account_id = google_service_account.int_test.id
+  for_each = module.project
+
+  service_account_id = google_service_account.int_test[each.key].id
 }

test/setup/main.tf

@@ -131,19 +131,32 @@ locals {
       "iap.googleapis.com"
     ],
   }
+  extra_services_for_tests = {
+    root = [
+      // For "examples/cloud_run_vpc_connector".
+      "vpcaccess.googleapis.com",
+    ],
+  }
+  per_module_test_services = {
+    for module, services in local.per_module_services :
+    module => setunion(services, lookup(local.extra_services_for_tests, module, []))
+  }
 }
 
 module "project" {
+  for_each = local.per_module_test_services
+
   source  = "terraform-google-modules/project-factory/google"
   version = "~> 17.0"
 
-  name                    = "ci-cloud-run"
-  random_project_id       = "true"
-  org_id                  = var.org_id
-  folder_id               = var.folder_id
-  billing_account         = var.billing_account
-  default_service_account = "keep"
-  deletion_policy         = "DELETE"
+  name                     = "ci-cloud-run"
+  random_project_id        = "true"
+  random_project_id_length = 8
+  org_id                   = var.org_id
+  folder_id                = var.folder_id
+  billing_account          = var.billing_account
+  default_service_account  = "keep"
+  deletion_policy          = "DELETE"
 
-  activate_apis = flatten(values(local.per_module_services))
+  activate_apis = each.value
 }

test/setup/outputs.tf

@@ -14,16 +14,18 @@
  * limitations under the License.
  */
 
-output "project_id" {
-  value = module.project.project_id
+// project_ids_per_module is resolved to `project_id` by the tft test framework.
+output "project_ids_per_module" {
+  value = {
+    for module_name, v in module.project : module_name => v.project_id
+  }
 }
 
-output "sa_email" {
-  value = google_service_account.int_test.email
-}
-
-output "sa_key" {
-  value     = google_service_account_key.int_test.private_key
+// `sa_keys_per_module` is resolved to `sa_key` by the tft test framework.
+output "sa_keys_per_module" {
+  value = {
+    for module_name, v in google_service_account_key.int_test : module_name => v.private_key
+  }
   sensitive = true
 }