Skip to content

Commit 34a615b

Browse files
jose-pablo-camachojose-pablo-camacho
committed
SSPROD-55654 - include/exclude: add deprecation date for management_group_ids var
1 parent 8a9dc4a commit 34a615b

File tree

3 files changed

+55
-38
lines changed

3 files changed

+55
-38
lines changed

‎modules/onboarding/README.md‎

Lines changed: 52 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -2,70 +2,87 @@
22

33
This module will deploy Foundational Onboarding resources in GCP for a single project, or for a GCP Organization.
44
The Foundational Onboarding module serves the following functions:
5+
56
- retrieving inventory for single project, or for all projects within an Organization.
67
- running organization scraping in the case of organizational onboarding within GCP Organization.
78

89
If instrumenting a project, the following resources will be created:
10+
911
- All the necessary `Service Accounts` and `Policies` to enable the Onboarding operation at the project level
10-
- A `Service Account key` and added role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
11-
- A cloud account in the Sysdig Backend, associated with the GCP project and with the required component to serve the foundational functions.
12+
- A `Service Account key` and added role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on
13+
your behalf to validate resources.
14+
- A cloud account in the Sysdig Backend, associated with the GCP project and with the required component to serve the
15+
foundational functions.
1216

1317
If instrumenting an Organziation, the following resources will be created:
18+
1419
- All the necessary `Service Accounts` and `Policies` to enable the Onboarding operation at the organization level
15-
- A `Service Account key` and added role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on your behalf to validate resources.
16-
- A cloud account in the Sysdig Backend, associated with the management project and with the required component to serve the foundational functions.
17-
- A cloud organization in the Sysdig Backend, associated with the GCP Organization to fetch the organization structure to install Sysdig Secure for Cloud on.
20+
- A `Service Account key` and added role permissions to the `Service Account`, to allow Sysdig to authenticate to GCP on
21+
your behalf to validate resources.
22+
- A cloud account in the Sysdig Backend, associated with the management project and with the required component to serve
23+
the foundational functions.
24+
- A cloud organization in the Sysdig Backend, associated with the GCP Organization to fetch the organization structure
25+
to install Sysdig Secure for Cloud on.
1826

1927
Note:
20-
- The outputs from the foundational module, such as `sysdig_secure_account_id` are needed as inputs to the other features/integrations modules for subsequent modular installs.
28+
29+
- The outputs from the foundational module, such as `sysdig_secure_account_id` are needed as inputs to the other
30+
features/integrations modules for subsequent modular installs.
2131

2232
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
33+
2334
## Requirements
2435

25-
| Name | Version |
26-
|------|-----------|
36+
| Name | Version |
37+
|---------------------------------------------------------------------------|-----------|
2738
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
28-
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 4.21.0 |
29-
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 1.34.0 |
39+
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 4.21.0 |
40+
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 1.34.0 |
3041

3142
## Providers
3243

33-
| Name | Version |
34-
|------|---------|
35-
| <a name="provider_google"></a> [google](#provider\_google) | 5.0.0 |
36-
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1 |
44+
| Name | Version |
45+
|------------------------------------------------------------|---------|
46+
| <a name="provider_google"></a> [google](#provider\_google) | 5.0.0 |
47+
| <a name="provider_random"></a> [random](#provider\_random) | >= 3.1 |
3748

3849
## Modules
3950

4051
No modules.
4152

4253
## Resources
4354

44-
| [google_service_account.onboarding_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
45-
| [google_organization.org](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/organization) | data source |
46-
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
55+
| [google_service_account.onboarding_auth](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) |
56+
resource |
57+
| [google_organization.org](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/organization) |
58+
data source |
59+
| [google_project.project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) |
60+
data source |
4761
| [random_id.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
48-
| [google_project_iam_member.browser](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_member) | resource |
49-
| [google_organization_iam_member.browser](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam#google_organization_iam_member) | resource |
50-
| [google_service_account_key.onboarding_service_account_key](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_key) | resource |
51-
| [sysdig_secure_cloud_auth_account.google_account](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account) | resource |
52-
| [sysdig_secure_organization.google_organization](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_organization) | resource |
62+
| [google_project_iam_member.browser](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_member) |
63+
resource |
64+
| [google_organization_iam_member.browser](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_organization_iam#google_organization_iam_member) |
65+
resource |
66+
| [google_service_account_key.onboarding_service_account_key](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_key) |
67+
resource |
68+
| [sysdig_secure_cloud_auth_account.google_account](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_cloud_auth_account) |
69+
resource |
70+
| [sysdig_secure_organization.google_organization](https://registry.terraform.io/providers/sysdiglabs/sysdig/latest/docs/resources/secure_organization) |
71+
resource |
5372

5473
## Inputs
5574

56-
| Name | Description | Type | Default | Required |
57-
|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|---------|:--------:|
58-
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no |
59-
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no |
60-
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes |
61-
| <a name="input_suffix"></a> [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no |
62-
| <a name="input_management_group_ids"></a> [suffix](#input\_management\_group\_ids) | TO BE DEPRECATED: Please work with Sysdig to migrate to using `include_folders` instead.<br>List of management group ids w.r.t an org install. If not provided, set to empty by default | `set(string)` | `[]` | no |
63-
| <a name="input_include_folders"></a> [suffix](#input\_include\_folders) | folders to include for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012 | `set(string)` | `[]` | no |
64-
| <a name="input_exclude_folders"></a> [suffix](#input\_exclude\_folders) | folders to exclude for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012 | `set(string)` | `[]` | no |
65-
| <a name="input_include_projects"></a> [suffix](#input\_include\_projects) | projects to include for organization. i.e: my-project-id | `set(string)` | `[]` | no |
66-
| <a name="input_exclude_projects"></a> [suffix](#input\_exclude\_projects) | projects to exclude for organization. i.e: my-project-id | `set(string)` | `[]` | no |
67-
68-
75+
| Name | Description | Type | Default | Required |
76+
|-----------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|---------|:--------:|
77+
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | (Optional) Set this field to 'true' to deploy secure-for-cloud to a GCP Organization. | `bool` | `false` | no |
78+
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no |
79+
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | (Required) Target Project identifier provided by the customer | `string` | n/a | yes |
80+
| <a name="input_suffix"></a> [suffix](#input\_suffix) | (Optional) Suffix to uniquely identify resources during multiple installs. If not provided, random value is autogenerated | `string` | `null` | no |
81+
| <a name="input_management_group_ids"></a> [suffix](#input\_management\_group\_ids) | TO BE DEPRECATED on 30th November, 2025: Please work with Sysdig to migrate to using `include_folders` instead.<br>List of management group ids w.r.t an org install. If not provided, set to empty by default | `set(string)` | `[]` | no |
82+
| <a name="input_include_folders"></a> [suffix](#input\_include\_folders) | folders to include for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012 | `set(string)` | `[]` | no |
83+
| <a name="input_exclude_folders"></a> [suffix](#input\_exclude\_folders) | folders to exclude for organization in the format 'folders/{folder_id}'. i.e: folders/123456789012 | `set(string)` | `[]` | no |
84+
| <a name="input_include_projects"></a> [suffix](#input\_include\_projects) | projects to include for organization. i.e: my-project-id | `set(string)` | `[]` | no |
85+
| <a name="input_exclude_projects"></a> [suffix](#input\_exclude\_projects) | projects to exclude for organization. i.e: my-project-id | `set(string)` | `[]` | no |
6986

7087
## Outputs
7188

‎modules/onboarding/locals.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ check "validate_org_configuration_params" {
1818
assert {
1919
condition = length(var.management_group_ids) == 0 # if this condition is false we throw warning
2020
error_message = <<-EOT
21-
WARNING: TO BE DEPRECATED 'management_group_ids': Please work with Sysdig to migrate your Terraform installs to use 'include_folders' instead.
21+
WARNING: TO BE DEPRECATED 'management_group_ids' on 30th November, 2025. Please work with Sysdig to migrate your Terraform installs to use 'include_folders' instead.
2222
EOT
2323
}
2424

@@ -28,7 +28,7 @@ check "validate_org_configuration_params" {
2828
ERROR: If both management_group_ids and include_folders/exclude_folders/include_projects/exclude_projects variables are populated,
2929
ONLY management_group_ids will be considered. Please use only one of the two methods.
3030
31-
Note: management_group_ids is going to be DEPRECATED soon, please work with Sysdig to migrate your Terraform installs.
31+
Note: management_group_ids is going to be DEPRECATED 'management_group_ids' on 30th November, 2025. Please work with Sysdig to migrate your Terraform installs.
3232
EOT
3333
}
3434
}

‎modules/onboarding/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ variable "organization_domain" {
1717

1818
variable "management_group_ids" {
1919
description = <<-EOF
20-
TO BE DEPRECATED: Please work with Sysdig to migrate to using `include_folders` instead.
20+
TO BE DEPRECATED on 30th November, 2025: Please work with Sysdig to migrate to using `include_folders` instead.
2121
When set, restrict onboarding to a set of folder identifiers whose child projects and projects are to be onboarded.
2222
Default: onboard all folders.
2323
EOF

0 commit comments

Comments
 (0)