Skip to content

Commit 6969d9f

Browse files
apeabodyapeabody
authored
Merge branch 'main' into remove-base-project
2 parents 91e1c7d + dcfc4f9 commit 6969d9f

File tree

3 files changed

+89
-23
lines changed

3 files changed

+89
-23
lines changed

‎0-bootstrap/README-GitHub.md‎

Lines changed: 35 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -643,24 +643,48 @@ An environment variable `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` will be set with th
643643
./tf-wrapper.sh apply shared
644644
```
645645
646-
1. Push your plan branch.
646+
1. You must manually plan and apply the `production` environment since the `development`, `nonproduction` and `plan` environments depend on it.
647647
648648
```bash
649-
git push --set-upstream origin plan
649+
git checkout production
650+
git merge plan
650651
```
651652
652-
1. Open a pull request in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/pull/new/plan from the `plan` branch to the `production` branch and review the output.
653+
1. Run `init` and `plan` and review output for environment production.
653654
654-
> NOTE: Development and Non-production branches depends on the production branch to be deployed first, for the `3-networks-dual-svpc`.
655+
```bash
656+
./tf-wrapper.sh init production
657+
./tf-wrapper.sh plan production
658+
```
655659
656-
1. The Pull request will trigger a GitHub Action that will run Terraform `init`/`plan`/`validate` in the `production` environment.
657-
1. Review the GitHub Action output in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/actions under `tf-pull-request`.
658-
1. If the GitHub action is successful, merge the pull request in to the `production` branch.
659-
1. The merge will trigger a GitHub Action that will apply the terraform configuration for the `production` environment.
660-
1. Review merge output in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/actions under `tf-apply`.
661-
1. If the GitHub action is successful, apply the next environment.
660+
1. Run `apply` production.
662661
663-
1. Open a pull request in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/pull/new/plan from the `plan` branch to the `development` branch and review the output.
662+
```bash
663+
./tf-wrapper.sh apply production
664+
```
665+
666+
1. Push your production branch since development and nonproduction depends it.
667+
668+
*Note:** The Production envrionment must be the first branch to be pushed as it includes the DNS Hub communication that will be used by other environments.
669+
670+
```bash
671+
git add .
672+
git commit -m 'Initialize networks repo - production'
673+
git push --set-upstream origin production
674+
```
675+
676+
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `production` branch to the `plan` branch and review the output.
677+
678+
> NOTE: Development and Non-production branches depends on the production branch to be deployed first, for the `3-networks-dual-svpc`.
679+
680+
1. Push your plan branch.
681+
682+
```bash
683+
git checkout plan --set-upstream origin plan
684+
git push
685+
```
686+
687+
1. Open a pull request in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/pull/new/plan from the `production` branch to the `development` branch and review the output.
664688
1. The Pull request will trigger a GitHub Action that will run Terraform `init`/`plan`/`validate` in the `development` environment.
665689
1. Review the GitHub Action output in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/actions under `tf-pull-request`.
666690
1. If the GitHub action is successful, merge the pull request in to the `development` branch.

‎0-bootstrap/README-GitLab.md‎

Lines changed: 36 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ Run the `0-bootstrap/scripts/git_create_branches_helper.sh` script to create the
184184

185185
1. Go to https://gitlab.com/GITLAB-OWNER/GITLAB-RUNNER-REPO/-/settings/ci_cd#js-token-access
186186
1. Add all the repositories: Bootstrap, Organization, Environments, Networks, and Projects to the allow list tha allow access to the CI/CD runner image.
187-
1. In "Allow CI job tokens from the following projects to access this project" add the other projects/repositories. Format is <GITLAB-OWNER>/<GITLAB-REPO>
187+
1. In "Allow CI job tokens from the following projects to access this project" add the other projects/repositories. Format is `<GITLAB-OWNER>/<GITLAB-REPO>`
188188

189189
### Deploying step 0-bootstrap
190190

@@ -646,37 +646,61 @@ An environment variable `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` will be set with th
646646
./tf-wrapper.sh apply shared
647647
```
648648
649+
1. You must manually plan and apply the `production` environment since the `development`, `nonproduction` and `plan` environments depend on it.
650+
651+
```bash
652+
git checkout production
653+
git merge plan
654+
```
655+
656+
1. Run `init` and `plan` and review output for environment production.
657+
658+
```bash
659+
./tf-wrapper.sh init production
660+
./tf-wrapper.sh plan production
661+
```
662+
663+
1. Run `apply` production.
664+
665+
```bash
666+
./tf-wrapper.sh apply production
667+
```
668+
669+
1. Push your production branch since development and nonproduction depends it.
670+
671+
*Note:** The Production envrionment must be the first branch to be pushed as it includes the DNS Hub communication that will be used by other environments.
672+
673+
```bash
674+
git add .
675+
git commit -m 'Initialize networks repo - production'
676+
git push
677+
```
678+
679+
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `production` branch to the `plan` branch and review the output.
680+
649681
1. Push your plan branch.
650682
651683
```bash
684+
git checkout plan
652685
git push
653686
```
654687
655-
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `plan` branch to the `production` branch and review the output.
688+
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `production` branch to the `development` branch and review the output.
656689
657690
> NOTE: Development and Non-production branches depends on the production branch to be deployed first, for the `3-networks-dual-svpc`.
658691
659-
1. The merge request will trigger a GitLab pipelines that will run Terraform `init`/`plan`/`validate` in the `production` environment.
660-
1. Review the GitLab pipelines output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines.
661-
1. If the GitLab pipelines is successful, merge the merge request in to the `production` branch.
662-
1. The merge will trigger a GitLab pipelines that will apply the terraform configuration for the `production` environment.
663-
1. Review merge output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines under `tf-apply`.
664-
665-
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `plan` branch to the `development` branch and review the output.
666692
1. The merge request will trigger a GitLab pipelines that will run Terraform `init`/`plan`/`validate` in the `development` environment.
667693
1. Review the GitLab pipelines output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines.
668694
1. If the GitLab pipelines is successful, merge the merge request in to the `development` branch.
669695
1. The merge will trigger a GitLab pipelines that will apply the terraform configuration for the `development` environment.
670696
1. Review merge output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines under `tf-apply`.
671-
1. If the GitLab pipelines is successful, apply the next environment.
672697
673-
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `development` branch to the `nonproduction` branch and review the output.
698+
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `production` branch to the `nonproduction` branch and review the output.
674699
1. The merge request will trigger a GitLab pipelines that will run Terraform `init`/`plan`/`validate` in the `nonproduction` environment.
675700
1. Review the GitLab pipelines output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines.
676701
1. If the GitLab pipelines is successful, merge the merge request in to the `nonproduction` branch.
677702
1. The merge will trigger a GitLab pipelines that will apply the terraform configuration for the `nonproduction` environment.
678703
1. Review merge output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines under `tf-apply`.
679-
1. If the GitLab pipelines is successful, apply the next environment.
680704
681705
1. Before executing the next steps, unset the `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` environment variable.
682706

‎0-bootstrap/gitlab.tf.example‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ module "gitlab_oidc" {
112112
pool_id = "foundation-pool"
113113
provider_id = "foundation-gl-provider"
114114
sa_mapping = local.sa_mapping
115+
attribute_condition = "assertion.user_login=='${var.gl_repos.owner}'"
115116
}
116117

117118
resource "gitlab_project_variable" "variables" {
@@ -174,3 +175,20 @@ resource "google_service_account_iam_member" "self_impersonate" {
174175
role = "roles/iam.serviceAccountTokenCreator"
175176
member = "serviceAccount:${google_service_account.terraform-env-sa[each.key].email}"
176177
}
178+
179+
module "gcp_projects_state_bucket" {
180+
source = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
181+
version = "~> 9.0"
182+
183+
name = "${var.bucket_prefix}-${module.seed_bootstrap.seed_project_id}-gcp-projects-tfstate"
184+
project_id = module.seed_bootstrap.seed_project_id
185+
location = var.default_region
186+
force_destroy = var.bucket_force_destroy
187+
188+
encryption = {
189+
default_kms_key_name = local.state_bucket_kms_key
190+
}
191+
192+
depends_on = [module.seed_bootstrap.gcs_bucket_tfstate]
193+
}
194+

0 commit comments

Comments
 (0)