feat: add confidential space

3-networks-hub-and-spoke/modules/base_env/main.tf

@@ -57,6 +57,7 @@ locals {
     "cloudtrace.googleapis.com",
     "composer.googleapis.com",
     "compute.googleapis.com",
+    "confidentialcomputing.googleapis.com",
     "connectgateway.googleapis.com",
     "contactcenterinsights.googleapis.com",
     "container.googleapis.com",

3-networks-svpc/modules/base_env/main.tf

@@ -70,6 +70,7 @@ locals {
     "cloudtrace.googleapis.com",
     "composer.googleapis.com",
     "compute.googleapis.com",
+    "confidentialcomputing.googleapis.com",
     "connectgateway.googleapis.com",
     "contactcenterinsights.googleapis.com",
     "container.googleapis.com",

4-projects/README.md

@@ -57,7 +57,7 @@ For an overview of the architecture and the parts, see the
 
 The purpose of this step is to set up the folder structure, projects, and infrastructure pipelines for applications that are connected as service projects to the shared VPC created in the previous stage.
 
-For each business unit, a shared `infra-pipeline` project is created along with Cloud Build triggers, CSRs for application infrastructure code and Google Cloud Storage buckets for state storage.
+For each business unit, a shared `infra-pipeline` project is created along with Cloud Build triggers, CSRs for application infrastructure code and Google Cloud Storage buckets for state storage. A new Docker image will be built for the Confidential Space environment, which will be used in the `5-app-infra` step.
 
 This step follows the same [conventions](https://github.com/terraform-google-modules/terraform-example-foundation#branching-strategy) as the Foundation pipeline deployed in [0-bootstrap](https://github.com/terraform-google-modules/terraform-example-foundation/blob/master/0-bootstrap/README.md).
 A custom [workspace](https://github.com/terraform-google-modules/terraform-google-bootstrap/blob/master/modules/tf_cloudbuild_workspace/README.md) (`bu1-example-app`) is created by this pipeline and necessary roles are granted to the Terraform Service Account of this workspace by enabling variable `sa_roles` as shown in this [example](https://github.com/terraform-google-modules/terraform-example-foundation/blob/master/4-projects/modules/base_env/example_shared_vpc_project.tf).
@@ -201,6 +201,13 @@ grep -rl 10.3.64.0 business_unit_2/ | xargs sed -i 's/10.3.64.0/10.4.64.0/g'
    git checkout -b production
    git push origin production
    ```
+1. Run `terraform init` in the `production` folder to generate the outputs required by step `5-app-infra`.
+
+```bash
+cd business_unit_1/production
+terraform init
+cd ../..
+```
 
 1. After production has been applied, apply development.
 1. Merge changes to development. Because this is a [named environment branch](../docs/FAQ.md#what-is-a-named-branch),
@@ -211,6 +218,14 @@ grep -rl 10.3.64.0 business_unit_2/ | xargs sed -i 's/10.3.64.0/10.4.64.0/g'
    git push origin development
    ```
 
+1. Run `terraform init` in the `development` folder to generate the outputs required by step `5-app-infra`.
+
+```bash
+cd business_unit_1/development
+terraform init
+cd ../..
+```
+
 1. After development has been applied, apply nonproduction.
 1. Merge changes to nonproduction. Because this is a [named environment branch](../docs/FAQ.md#what-is-a-named-branch),
    pushing to this branch triggers both _terraform plan_ and _terraform apply_. Review the apply output in your Cloud Build project. https://console.cloud.google.com/cloud-build/builds;region=DEFAULT_REGION?project=YOUR_CLOUD_BUILD_PROJECT_ID
@@ -220,6 +235,14 @@ grep -rl 10.3.64.0 business_unit_2/ | xargs sed -i 's/10.3.64.0/10.4.64.0/g'
    git push origin nonproduction
    ```
 
+1. Run `terraform init` in the `nonproduction` folder to generate the outputs required by step `5-app-infra`.
+
+```bash
+cd business_unit_1/nonproduction
+terraform init
+cd ../..
+```
+
 1. Before executing the next step, unset the `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` environment variable.
 
    ```bash

4-projects/business_unit_1/development/README.md

@@ -18,7 +18,12 @@
 | Name | Description |
 |------|-------------|
 | access\_context\_manager\_policy\_id | Access Context Manager Policy ID. |
+| bootstrap\_cloudbuild\_project\_id | Cloudbuild project ID. |
 | bucket | The created storage bucket. |
+| cloudbuild\_sa | Cloudbuild Service Account. |
+| confidential\_space\_project | Confidential Space project id. |
+| confidential\_space\_project\_number | Confidential Space project number. |
+| confidential\_space\_workload\_sa | Workload Service Account for confidential space |
 | default\_region | The default region for the project. |
 | floating\_project | Project sample floating project. |
 | iap\_firewall\_tags | The security tags created for IAP (SSH and RDP) firewall rules and to be used on the VM created on step 5-app-infra on the peering network project. |

4-projects/business_unit_1/development/main.tf

@@ -38,3 +38,88 @@ module "env" {
   project_deletion_policy      = var.project_deletion_policy
   folder_deletion_protection   = var.folder_deletion_protection
 }
+
+resource "google_service_account" "workload_sa" {
+  account_id   = "confidential-space-workload-sa"
+  display_name = "Workload Service Account for confidential space"
+  project      = module.env.confidential_space_project
+}
+
+resource "google_project_iam_member" "service_usage_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/serviceusage.serviceUsageAdmin"
+  member  = google_service_account.workload_sa.member
+}
+
+resource "google_project_iam_member" "service_account_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.serviceAccountAdmin"
+  member  = google_service_account.workload_sa.member
+}
+
+resource "google_project_iam_member" "workload_kms_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/cloudkms.admin"
+  member  = google_service_account.workload_sa.member
+}
+
+resource "google_project_iam_member" "workload_instance_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/compute.instanceAdmin.v1"
+  member  = google_service_account.workload_sa.member
+}
+
+resource "google_project_iam_member" "cb_workload_identity_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.workloadIdentityPoolAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cb_service_usage_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/serviceusage.serviceUsageAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cb_service_account_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.serviceAccountAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cloudbuild_kms_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/cloudkms.admin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cloudbuild_instance_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/compute.instanceAdmin.v1"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cloudbuild_gcs_admin_sa" {
+  project = module.env.confidential_space_project
+  role    = "roles/storage.admin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cloudbuild_project_iam_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/resourcemanager.projectIamAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "workload_identity_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.workloadIdentityPoolAdmin"
+  member  = "serviceAccount:${google_service_account.workload_sa.email}"
+}
+
+resource "google_project_iam_member" "workload_identity_admin_cb" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.workloadIdentityPoolAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+

4-projects/business_unit_1/development/outputs.tf

@@ -93,3 +93,30 @@ output "default_region" {
   description = "The default region for the project."
   value       = local.default_region
 }
+
+output "confidential_space_project" {
+  description = "Confidential Space project id."
+  value       = module.env.confidential_space_project
+}
+
+
+output "confidential_space_project_number" {
+  description = "Confidential Space project number."
+  value       = module.env.confidential_space_project_number
+}
+
+output "bootstrap_cloudbuild_project_id" {
+  description = "Cloudbuild project ID."
+  value       = local.cloudbuild_project_id
+}
+
+output "cloudbuild_sa" {
+  description = "Cloudbuild Service Account."
+  value       = module.env.cloudbuild_sa
+}
+
+output "confidential_space_workload_sa" {
+  description = "Workload Service Account for confidential space"
+  value       = google_service_account.workload_sa.email
+}
+

4-projects/business_unit_1/development/remote.tf

@@ -15,10 +15,11 @@
  */
 
 locals {
-  default_region     = data.terraform_remote_state.bootstrap.outputs.common_config.default_region
-  default_region_2   = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_2
-  default_region_gcs = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_gcs
-  default_region_kms = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_kms
+  default_region        = data.terraform_remote_state.bootstrap.outputs.common_config.default_region
+  default_region_2      = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_2
+  default_region_gcs    = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_gcs
+  default_region_kms    = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_kms
+  cloudbuild_project_id = data.terraform_remote_state.bootstrap.outputs.cloudbuild_project_id
 }
 
 data "terraform_remote_state" "bootstrap" {

4-projects/business_unit_1/nonproduction/README.md

@@ -18,7 +18,12 @@
 | Name | Description |
 |------|-------------|
 | access\_context\_manager\_policy\_id | Access Context Manager Policy ID. |
+| bootstrap\_cloudbuild\_project\_id | Cloudbuild project ID. |
 | bucket | The created storage bucket. |
+| cloudbuild\_sa | Cloudbuild Service Account. |
+| confidential\_space\_project | Confidential Space project id. |
+| confidential\_space\_project\_number | Confidential Space project number. |
+| confidential\_space\_workload\_sa | Workload Service Account for confidential space |
 | default\_region | The default region for the project. |
 | floating\_project | Project sample floating project. |
 | iap\_firewall\_tags | The security tags created for IAP (SSH and RDP) firewall rules and to be used on the VM created on step 5-app-infra on the peering network project. |

4-projects/business_unit_1/nonproduction/main.tf

@@ -38,3 +38,88 @@ module "env" {
   project_deletion_policy      = var.project_deletion_policy
   folder_deletion_protection   = var.folder_deletion_protection
 }
+
+resource "google_service_account" "workload_sa" {
+  account_id   = "confidential-space-workload-sa"
+  display_name = "Workload Service Account for confidential space"
+  project      = module.env.confidential_space_project
+}
+
+resource "google_project_iam_member" "service_usage_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/serviceusage.serviceUsageAdmin"
+  member  = google_service_account.workload_sa.member
+}
+
+resource "google_project_iam_member" "service_account_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.serviceAccountAdmin"
+  member  = google_service_account.workload_sa.member
+}
+
+resource "google_project_iam_member" "workload_kms_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/cloudkms.admin"
+  member  = google_service_account.workload_sa.member
+}
+
+resource "google_project_iam_member" "workload_instance_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/compute.instanceAdmin.v1"
+  member  = google_service_account.workload_sa.member
+}
+
+resource "google_project_iam_member" "cb_workload_identity_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.workloadIdentityPoolAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cb_service_usage_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/serviceusage.serviceUsageAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cb_service_account_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.serviceAccountAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cloudbuild_kms_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/cloudkms.admin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cloudbuild_instance_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/compute.instanceAdmin.v1"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cloudbuild_gcs_admin_sa" {
+  project = module.env.confidential_space_project
+  role    = "roles/storage.admin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "cloudbuild_project_iam_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/resourcemanager.projectIamAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+
+resource "google_project_iam_member" "workload_identity_admin" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.workloadIdentityPoolAdmin"
+  member  = "serviceAccount:${google_service_account.workload_sa.email}"
+}
+
+resource "google_project_iam_member" "workload_identity_admin_cb" {
+  project = module.env.confidential_space_project
+  role    = "roles/iam.workloadIdentityPoolAdmin"
+  member  = "serviceAccount:${module.env.cloudbuild_sa}"
+}
+

4-projects/business_unit_1/nonproduction/outputs.tf

@@ -93,3 +93,30 @@ output "default_region" {
   description = "The default region for the project."
   value       = local.default_region
 }
+
+output "confidential_space_project" {
+  description = "Confidential Space project id."
+  value       = module.env.confidential_space_project
+}
+
+
+output "confidential_space_project_number" {
+  description = "Confidential Space project number."
+  value       = module.env.confidential_space_project_number
+}
+
+output "bootstrap_cloudbuild_project_id" {
+  description = "Cloudbuild project ID."
+  value       = local.cloudbuild_project_id
+}
+
+output "cloudbuild_sa" {
+  description = "Cloudbuild Service Account."
+  value       = module.env.cloudbuild_sa
+}
+
+output "confidential_space_workload_sa" {
+  description = "Workload Service Account for confidential space"
+  value       = google_service_account.workload_sa.email
+}
+

4-projects/business_unit_1/nonproduction/remote.tf

@@ -15,10 +15,11 @@
  */
 
 locals {
-  default_region     = data.terraform_remote_state.bootstrap.outputs.common_config.default_region
-  default_region_2   = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_2
-  default_region_gcs = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_gcs
-  default_region_kms = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_kms
+  default_region        = data.terraform_remote_state.bootstrap.outputs.common_config.default_region
+  default_region_2      = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_2
+  default_region_gcs    = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_gcs
+  default_region_kms    = data.terraform_remote_state.bootstrap.outputs.common_config.default_region_kms
+  cloudbuild_project_id = data.terraform_remote_state.bootstrap.outputs.cloudbuild_project_id
 }
 
 data "terraform_remote_state" "bootstrap" {

4-projects/business_unit_1/production/README.md

@@ -18,7 +18,12 @@
 | Name | Description |
 |------|-------------|
 | access\_context\_manager\_policy\_id | Access Context Manager Policy ID. |
+| bootstrap\_cloudbuild\_project\_id | Cloudbuild project ID. |
 | bucket | The created storage bucket. |
+| cloudbuild\_sa | Cloudbuild Service Account. |
+| confidential\_space\_project | Confidential Space project id. |
+| confidential\_space\_project\_number | Confidential Space project number. |
+| confidential\_space\_workload\_sa | Workload Service Account for confidential space |
 | default\_region | The default region for the project. |
 | floating\_project | Project sample floating project. |
 | iap\_firewall\_tags | The security tags created for IAP (SSH and RDP) firewall rules and to be used on the VM created on step 5-app-infra on the peering network project. |