Skip to content

Commit ac028dc

Browse files
glasntglasnt
authored
Merge branch 'main' into fix-root-ca-sample
2 parents ec4e7a0 + 67a2337 commit ac028dc

File tree

32 files changed

+1196
-69
lines changed

32 files changed

+1196
-69
lines changed

‎.github/CODEOWNERS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,10 @@
22

33
* @terraform-google-modules/terraform-samples-git-admins @terraform-google-modules/terraform-samples-reviewers
44
/.github/ @terraform-google-modules/terraform-samples-git-admins
5+
/test/ @terraform-google-modules/terraform-samples-git-admins @terraform-google-modules/cft-admins
6+
/build/ @terraform-google-modules/terraform-samples-git-admins @terraform-google-modules/cft-admins
57
/bigquery/ @terraform-google-modules/bigquery-terraform-swe @terraform-google-modules/terraform-samples-reviewers
8+
/cloud_scheduler/ @terraform-google-modules/terraform-samples-reviewers
69
/cloud_sql/ @terraform-google-modules/infra-db-sdk @terraform-google-modules/terraform-samples-reviewers
710
/cloudvpn/ @terraform-google-modules/dee-infra @terraform-google-modules/terraform-samples-reviewers
811
/composer/ @terraform-google-modules/cloud-dpes-composer @terraform-google-modules/terraform-samples-reviewers

‎Makefile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2022 Google LLC
1+
# Copyright 2022-2024 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.
@@ -18,8 +18,7 @@
1818
# Make will use bash instead of sh
1919
SHELL := /usr/bin/env bash
2020

21-
# Pin to 1.3.9 per https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/issues/1208
22-
DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.19
21+
DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.20
2322
DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
2423
REGISTRY_URL := gcr.io/cloud-foundation-cicd
2524
DOCKER_BIN ?= docker
@@ -70,6 +69,7 @@ docker_test_integration:
7069
.PHONY: docker_test_lint
7170
docker_test_lint:
7271
$(DOCKER_BIN) run --rm -it \
72+
-e ENABLE_PARALLEL=1 \
7373
-v "$(CURDIR)":/workspace \
7474
$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
7575
/usr/local/bin/test_lint.sh

‎application_integration/create_auth_config/main.tf‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
provider "google" {}
18+
19+
# [START application_integration_create_auth_config_auth_token]
20+
resource "google_integrations_client" "client" {
21+
location = "us-central1"
22+
}
23+
24+
resource "google_integrations_auth_config" "auth_config_auth_token" {
25+
location = "us-central1"
26+
display_name = "tf-auth-token"
27+
description = "Test auth config created via terraform"
28+
decrypted_credential {
29+
credential_type = "AUTH_TOKEN"
30+
auth_token {
31+
type = "Basic"
32+
token = "some-random-token"
33+
}
34+
}
35+
depends_on = [google_integrations_client.client]
36+
}
37+
# [END application_integration_create_auth_config_auth_token]
38+
39+
# [START application_integration_create_auth_config_certificate]
40+
resource "google_integrations_auth_config" "auth_config_certificate" {
41+
location = "us-central1"
42+
display_name = "tf-certificate"
43+
description = "Test auth config created via terraform"
44+
decrypted_credential {
45+
credential_type = "CLIENT_CERTIFICATE_ONLY"
46+
}
47+
client_certificate {
48+
ssl_certificate = <<EOT
49+
-----BEGIN CERTIFICATE-----
50+
MIICTTCCAbagAwIBAgIJAPT0tSKNxan/MA0GCSqGSIb3DQEBCwUAMCoxFzAVBgNV
51+
BAoTDkdvb2dsZSBURVNUSU5HMQ8wDQYDVQQDEwZ0ZXN0Q0EwHhcNMTUwMTAxMDAw
52+
MDAwWhcNMjUwMTAxMDAwMDAwWjAuMRcwFQYDVQQKEw5Hb29nbGUgVEVTVElORzET
53+
MBEGA1UEAwwKam9lQGJhbmFuYTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
54+
vDYFgMgxi5W488d9J7UpCInl0NXmZQpJDEHE4hvkaRlH7pnC71H0DLt0/3zATRP1
55+
JzY2+eqBmbGl4/sgZKYv8UrLnNyQNUTsNx1iZAfPUflf5FwgVsai8BM0pUciq1NB
56+
xD429VFcrGZNucvFLh72RuRFIKH8WUpiK/iZNFkWhZ0CAwEAAaN3MHUwDgYDVR0P
57+
AQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMB
58+
Af8EAjAAMBkGA1UdDgQSBBCVgnFBCWgL/iwCqnGrhTPQMBsGA1UdIwQUMBKAEKey
59+
Um2o4k2WiEVA0ldQvNYwDQYJKoZIhvcNAQELBQADgYEAYK986R4E3L1v+Q6esBtW
60+
JrUwA9UmJRSQr0N5w3o9XzarU37/bkjOP0Fw0k/A6Vv1n3vlciYfBFaBIam1qRHr
61+
5dMsYf4CZS6w50r7hyzqyrwDoyNxkLnd2PdcHT/sym1QmflsjEs7pejtnohO6N2H
62+
wQW6M0H7Zt8claGRla4fKkg=
63+
-----END CERTIFICATE-----
64+
EOT
65+
encrypted_private_key = <<EOT
66+
-----BEGIN PRIVATE KEY-----
67+
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCA/Oj2HXqs5fTk
68+
j/8DrlOQtLG3K9RMsYHvnwICLxkGqVcTfut58hDFLbQM8C3C0ENAKitNJplCJmYG
69+
8VpgZzgq8VxaGnlP/sXUFLMGksd5sATn0sY3SkPndTKk/dqqA4MIh/dYfh19ynEN
70+
hB9Ll/h54Yic2je2Qaxe/uMMu8RODTz3oCn7FcoYpPvfygfU0ntn4IcqH/hts5DG
71+
s+3otJk4entRZglQDxR+sWOsbLtJIQZDP8rH3jDVdl5l3wspgtMTY8b5T5+pLm0p
72+
/OzCmxT0dq/O6BhpxI1xf/zcdRZeWk5DTJxTi5AgPquTlAG/B6A3HkqBJ14hT/Rk
73+
iv7Ma3DLAgMBAAECggEABATkf9VfpiAT9zYdouk50bBpckvymQTyQLD8SlBaX+KY
74+
kgv/pHSXK4Pm4iensrQerFLgfqPA3U+FiqjW5Mv7c1VRK6HJbuVkpdzoXLI9IQsL
75+
vsBY7//9Ajk5P7NokjdB6JPdU/2dHROuQVa59cxPtzpHo0htnPlDOKXfFZZuoZ17
76+
Nr8WQHrHy8P8ABM1tLOzvU9Nlh7TcjQvev+HxkLek4qzYyJ/Ac7XOjg/XKUm1tZk
77+
O3BHr8YLabwyjO7l1t+2b14rUTL/8pfUZnAkEi3FAlPxm3ilftmX65zliC9G4ghk
78+
dr5PByT3DqnuIIglua9bISv1H34ogecd+9a6EU7RxQKBgQC2RPKLounXZo8vYiU4
79+
sFTEvjbs+u9Ypk4OrNLnb8KdacLBUaJGnf++xbBoKpwFCBJfy//fvuQfusYF9Gyn
80+
GxL43tw94C/H5upQYnDsmnQak6TbOu3mA24OGK7Rcq6NEHgeCY4HomutnSiPTZJq
81+
8jlpqgqh1itETe5avgkMNq3zBwKBgQC1KlztGzvbB+rUDc6Kfvk5pUbCSFKMMMa2
82+
NWNXeD6i2iA56zEYSbTjKQ3u9pjUV8LNqAdUFxmbdPxZjheNK2dEm68SVRXPKOeB
83+
EmQT+t/EyW9LqBEA2oZt3h2hXtK8ppJjQm4XUCDs1NphP87eNzx5FLzJWjG8VqDq
84+
jOvApNqPHQKBgDQqlZSbgvvwUYjJOUf5R7mri0LWKwyfRHX0xsQQe43cCC6WM7Cs
85+
Zdbu86dMkqzp+4BJfalHFDl0llp782D8Ybiy6CwZbvNyxptNIW7GYfZ9TVCllBMh
86+
5izIqbgub4DWNtq591l+Bf2BnmstU3uiagYw8awSBP4eo9p6y1IgkDafAoGBAJbi
87+
lIiqEP0IqA06/pWc0Qew3rD7OT0ndqjU6Es2i7xovURf3QDkinJThBZNbdYUzdsp
88+
IgloP9yY33/a90SNLLIYlARJtyNVZxK59X4qiOpF9prlfFvgpOumfbkj15JljTB8
89+
aGKkSvfVA5jRYwLysDwMCHwO0bOR1u3itos5AgsFAoGAKEGms1kuQ5/HyFgSmg9G
90+
wBUzu+5Y08/A37rvyXsR6GjmlZJvULEopJNUNCOOpITNQikXK63sIFry7/59eGv5
91+
UwKadZbfwbVF5ipu59UxfVE3lipf/mYePDqMkHVWv/8p+OnnJt9uKnyW8VSOu5uk
92+
82QF30zbIWDTUjrcugVAs+E=
93+
-----END PRIVATE KEY-----
94+
EOT
95+
}
96+
depends_on = [google_integrations_client.client]
97+
}
98+
# [END application_integration_create_auth_config_certificate]
99+
100+
# [START application_integration_create_auth_config_jwt]
101+
resource "google_integrations_auth_config" "auth_config_jwt" {
102+
location = "us-central1"
103+
display_name = "tf-jwt"
104+
description = "Test auth config created via terraform"
105+
decrypted_credential {
106+
credential_type = "JWT"
107+
jwt {
108+
jwt_header = "{\"alg\": \"HS256\", \"typ\": \"JWT\"}"
109+
jwt_payload = "{\"sub\": \"1234567890\", \"name\": \"John Doe\", \"iat\": 1516239022}"
110+
secret = "secret"
111+
}
112+
}
113+
depends_on = [google_integrations_client.client]
114+
}
115+
# [END application_integration_create_auth_config_jwt]
116+
117+
# [START application_integration_create_auth_config_oauth2_authorization_code]
118+
resource "google_integrations_auth_config" "auth_config_oauth2_authorization_code" {
119+
location = "us-central1"
120+
display_name = "tf-oauth2-authorization-code"
121+
description = "Test auth config created via terraform"
122+
decrypted_credential {
123+
credential_type = "OAUTH2_AUTHORIZATION_CODE"
124+
oauth2_authorization_code {
125+
client_id = "Kf7utRvgr95oGO5YMmhFOLo8"
126+
client_secret = "D-XXFDDMLrg2deDgczzHTBwC3p16wRK1rdKuuoFdWqO0wliJ"
127+
scope = "photo offline_access"
128+
auth_endpoint = "https://authorization-server.com/authorize"
129+
token_endpoint = "https://authorization-server.com/token"
130+
}
131+
}
132+
depends_on = [google_integrations_client.client]
133+
}
134+
# [END application_integration_create_auth_config_oauth2_authorization_code]
135+
136+
# [START application_integration_create_auth_config_oauth2_client_credentials]
137+
resource "google_integrations_auth_config" "auth_config_oauth2_client_credentials" {
138+
location = "us-central1"
139+
display_name = "tf-oauth2-client-credentials"
140+
description = "Test auth config created via terraform"
141+
decrypted_credential {
142+
credential_type = "OAUTH2_CLIENT_CREDENTIALS"
143+
oauth2_client_credentials {
144+
client_id = "demo-backend-client"
145+
client_secret = "MJlO3binatD9jk1"
146+
scope = "read"
147+
token_endpoint = "https://login-demo.curity.io/oauth/v2/oauth-token"
148+
request_type = "ENCODED_HEADER"
149+
token_params {
150+
entries {
151+
key {
152+
literal_value {
153+
string_value = "string-key"
154+
}
155+
}
156+
value {
157+
literal_value {
158+
string_value = "string-value"
159+
}
160+
}
161+
}
162+
}
163+
}
164+
}
165+
depends_on = [google_integrations_client.client]
166+
}
167+
# [END application_integration_create_auth_config_oauth2_client_credentials]

‎application_integration/provision_region/main.tf‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
data "google_project" "default" {
18+
}
19+
20+
# [START application_integration_edit_region]
21+
resource "random_id" "default" {
22+
byte_length = 8
23+
}
24+
25+
resource "google_kms_key_ring" "default" {
26+
name = "${random_id.default.hex}-example-keyring"
27+
location = "us-east1"
28+
}
29+
30+
resource "google_kms_crypto_key" "default" {
31+
name = "crypto-key-example"
32+
key_ring = google_kms_key_ring.default.id
33+
rotation_period = "7776000s"
34+
}
35+
36+
resource "google_kms_crypto_key_version" "default" {
37+
crypto_key = google_kms_crypto_key.default.id
38+
}
39+
40+
resource "google_service_account" "default" {
41+
account_id = "service-account-id"
42+
display_name = "Service Account"
43+
}
44+
45+
resource "google_integrations_client" "example" {
46+
location = "us-east1"
47+
create_sample_integrations = true
48+
run_as_service_account = google_service_account.default.email
49+
cloud_kms_config {
50+
kms_location = "us-east1"
51+
kms_ring = google_kms_key_ring.default.id
52+
key = google_kms_crypto_key.default.id
53+
key_version = google_kms_crypto_key_version.default.id
54+
kms_project_id = data.google_project.default.project_id
55+
}
56+
}
57+
# [END application_integration_edit_region]

‎build/int.cloudbuild.yaml‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,15 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
timeout: 14400s
15+
timeout: 21600s
1616
steps:
1717
- id: prune unchanged directories
1818
name: gcr.io/cloud-builders/git
1919
entrypoint: bash
2020
args:
2121
- -c
2222
- |
23+
set -e
2324
# If this is a periodic tests, skip the pruning and run all tests
2425
if [[ "$_PERIODIC" == "true" ]]; then
2526
echo "_PERIODIC is true, running all tests."
@@ -29,11 +30,26 @@ steps:
2930
git fetch --unshallow
3031
git diff origin/${_BASE_BRANCH} --name-only > _changed_files
3132
sed 's/\/.*/\//' _changed_files > _changed_folders
33+
34+
# Do not prune if changing tests themselves
35+
_INFRA_FOLDERS="build test .github"
36+
for d in _changed_folders; do
37+
if [[ "${_INFRA_FOLDERS}" =~ "$d" ]]; then
38+
echo "Infrastructure folders have changed; no tests will be pruned."
39+
exit 0 # do not prune
40+
fi
41+
done
42+
3243
for d in */; do
3344
if ! grep -q "^$d" _changed_folders && [[ "$d" != "test/" ]]; then
3445
rm -rf $d;
3546
fi
3647
done
48+
49+
# Report remaining folders
50+
echo Folders in scope for tests:
51+
for d in */; do echo $d; done
52+
3753
- id: prepare
3854
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
3955
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && prepare_environment']
@@ -76,4 +92,4 @@ tags:
7692
- 'integration'
7793
substitutions:
7894
_DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
79-
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.19'
95+
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.20'

‎build/lint.cloudbuild.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,4 @@ tags:
2222
- 'lint'
2323
substitutions:
2424
_DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
25-
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.19'
25+
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.20'

‎cloud_scheduler/basic/main.tf‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
/*
17+
Create a cron job using Cloud Scheduler
18+
See https://cloud.google.com/scheduler/docs/schedule-run-cron-job-terraform
19+
before running the code snippet.
20+
*/
21+
22+
# [START cloudscheduler_terraform_basic_enableapis]
23+
# Enable Cloud Scheduler API
24+
resource "google_project_service" "scheduler" {
25+
service = "cloudscheduler.googleapis.com"
26+
disable_on_destroy = false
27+
}
28+
# Enable Pub/Sub API
29+
resource "google_project_service" "pubsub" {
30+
service = "pubsub.googleapis.com"
31+
disable_on_destroy = false
32+
}
33+
# [END cloudscheduler_terraform_basic_enableapis]
34+
35+
# [START cloudscheduler_terraform_basic_pubsub_topic]
36+
# Create Pub/Sub topic
37+
resource "google_pubsub_topic" "default" {
38+
name = "pubsub_topic"
39+
}
40+
# [END cloudscheduler_terraform_basic_pubsub_topic]
41+
42+
# [START cloudscheduler_terraform_basic_pubsub_subscription]
43+
# Create Pub/Sub subscription
44+
resource "google_pubsub_subscription" "default" {
45+
name = "pubsub_subscription"
46+
topic = google_pubsub_topic.default.name
47+
}
48+
# [END cloudscheduler_terraform_basic_pubsub_subscription]
49+
50+
# [START cloudscheduler_terraform_basic_job]
51+
# Create a cron job using Cloud Scheduler
52+
resource "google_cloud_scheduler_job" "default" {
53+
name = "test-job"
54+
description = "test job"
55+
schedule = "30 16 * * 7"
56+
region = "us-central1"
57+
58+
pubsub_target {
59+
topic_name = google_pubsub_topic.default.id
60+
data = base64encode("Hello world!")
61+
}
62+
}
63+
# [END cloudscheduler_terraform_basic_job]

‎compute/region_autoscaler_basic/main.tf‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,13 +53,7 @@ resource "google_compute_instance_template" "foobar" {
5353
# To avoid embedding secret keys or user credentials in the instances, Google recommends that you use custom service accounts with the following access scopes.
5454
service_account {
5555
scopes = [
56-
"https://www.googleapis.com/auth/devstorage.read_only",
57-
"https://www.googleapis.com/auth/logging.write",
58-
"https://www.googleapis.com/auth/monitoring.write",
59-
"https://www.googleapis.com/auth/pubsub",
60-
"https://www.googleapis.com/auth/service.management.readonly",
61-
"https://www.googleapis.com/auth/servicecontrol",
62-
"https://www.googleapis.com/auth/trace.append",
56+
"https://www.googleapis.com/auth/cloud-platform"
6357
]
6458
}
6559
}

0 commit comments

Comments
 (0)