Skip to content

Commit 648e9e8

Browse files
upodroidupodroid
committed
deploy datadog to GCP
1 parent 64bacf2 commit 648e9e8

File tree

15 files changed

+210
-147
lines changed

15 files changed

+210
-147
lines changed

‎infra/gcp/bash/ensure-organization.sh

Lines changed: 0 additions & 143 deletions
This file was deleted.

‎infra/gcp/terraform/boskos/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ module "project" {
6565
"logging.googleapis.com",
6666
"monitoring.googleapis.com",
6767
"secretmanager.googleapis.com",
68+
"cloudasset.googleapis.com",
6869
]
6970
}
7071

‎infra/gcp/terraform/k8s-infra-gcp-gcve/iam.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,5 +31,11 @@ module "iam" {
3131
"roles/secretmanager.secretAccessor" = [
3232
"serviceAccount:k8s-infra-prow-build.svc.id.goog[external-secrets/external-secrets]"
3333
]
34+
"roles/viewer" = [
35+
"serviceAccount:[email protected]"
36+
]
37+
"roles/serviceusage.serviceUsageConsumer" = [
38+
"serviceAccount:[email protected]"
39+
]
3440
}
3541
}

‎infra/gcp/terraform/k8s-infra-seed/README.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# k8s-infra-seed Terraform layer
2+
3+
This terraform layer manages the following infrastucture:
4+
5+
1. The kubernetes.io GCP organization
6+
1. All org level configurations
7+
1. The k8s-infra-seed GCP project.
8+
9+
It will eventually replace k8s-infra-kubernetes-io project.

‎infra/gcp/terraform/k8s-infra-seed/iam.tf

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
module "iam" {
2+
source = "terraform-google-modules/iam/google//modules/organizations_iam"
3+
version = "~> 8.1"
4+
5+
organizations = [data.google_organization.org.org_id]
6+
7+
mode = "authoritative"
8+
9+
bindings = {
10+
"roles/owner" = [
11+
google_service_account.atlantis.member,
12+
"group:[email protected]",
13+
]
14+
15+
"roles/billing.admin" = [
16+
google_service_account.atlantis.member,
17+
"group:[email protected]",
18+
"user:[email protected]",
19+
]
20+
"roles/billing.viewer" = [
21+
"group:[email protected]"
22+
]
23+
"roles/resourcemanager.organizationAdmin" = [
24+
"serviceAccount:[email protected]",
25+
"group:[email protected]",
26+
"user:[email protected]",
27+
]
28+
29+
"roles/resourcemanager.folderAdmin" = [
30+
"group:[email protected]",
31+
google_service_account.atlantis.member,
32+
]
33+
"roles/browser" = [
34+
"group:[email protected]",
35+
"group:[email protected]",
36+
"user:[email protected]",
37+
google_service_account.datadog.member,
38+
]
39+
"roles/resourcemanager.projectCreator" = [
40+
"group:[email protected]",
41+
google_service_account.atlantis.member,
42+
]
43+
"roles/orgpolicy.policyAdmin" = [
44+
"group:[email protected]",
45+
"serviceAccount:[email protected]",
46+
]
47+
"roles/cloudsupport.admin" = [
48+
"group:[email protected]",
49+
]
50+
51+
"organizations/758905017065/roles/audit.viewer" = [
52+
"group:[email protected]",
53+
"serviceAccount:[email protected]"
54+
]
55+
"organizations/758905017065/roles/organization.admin" = [ #TODO: remove this role and use the predefined google roles
56+
"group:[email protected]"
57+
]
58+
"roles/serviceusage.serviceUsageConsumer" = [
59+
google_service_account.datadog.member,
60+
]
61+
"roles/compute.viewer" = [
62+
google_service_account.datadog.member,
63+
]
64+
"roles/cloudasset.viewer" = [
65+
google_service_account.datadog.member,
66+
]
67+
"roles/monitoring.viewer" = [
68+
google_service_account.datadog.member,
69+
]
70+
}
71+
}

‎infra/gcp/terraform/k8s-infra-seed/main.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
data "google_organization" "org" {
2+
domain = "kubernetes.io"
3+
}

‎infra/gcp/terraform/k8s-infra-seed/provider.tf

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
provider "google" {
18+
}
19+
20+
provider "google-beta" {
21+
}
22+
23+
terraform {
24+
required_version = "1.10.5"
25+
26+
backend "gcs" {
27+
bucket = "k8s-infra-terraform"
28+
prefix = "k8s-infra-seed"
29+
}
30+
31+
required_providers {
32+
google = {
33+
version = "6.26.0"
34+
}
35+
google-beta = {
36+
version = "6.26.0"
37+
}
38+
}
39+
}

‎infra/gcp/terraform/k8s-infra-seed/service-accounts.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
resource "google_service_account" "atlantis" {
2+
account_id = "atlantis"
3+
display_name = "Atlantis"
4+
project = var.seed_project_id
5+
}
6+
7+
resource "google_service_account_iam_binding" "atlantis" {
8+
service_account_id = google_service_account.atlantis.id
9+
10+
role = "roles/iam.workloadIdentityUser"
11+
members = [
12+
"serviceAccount:k8s-infra-prow.svc.id.goog[atlantis/atlantis]",
13+
]
14+
}
15+
16+
resource "google_service_account" "datadog" {
17+
account_id = "datadog"
18+
project = var.seed_project_id
19+
}
20+
21+
resource "google_service_account_iam_binding" "datadog" {
22+
service_account_id = google_service_account.datadog.id
23+
role = "roles/iam.serviceAccountTokenCreator"
24+
members = [
25+
"serviceAccount:ddgci-3aada836c27bc3f0fb00@datadog-gci-sts-us5-prod.iam.gserviceaccount.com",
26+
"serviceAccount:service-127754664067@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com"
27+
]
28+
}

‎infra/gcp/terraform/k8s-infra-seed/terraform.tfvars

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
seed_project_id = "k8s-infra-seed"

‎infra/gcp/terraform/k8s-infra-seed/variables.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
variable "seed_project_id" {
2+
description = "The ID of the seed project."
3+
type = string
4+
}

0 commit comments

Comments
 (0)