Skip to content

Commit dcfc4f9

Browse files
renato-rudnickirenato-rudnicki
authored
Fix: Update Gitlab and GitHub steps (#1399)
1 parent 39db506 commit dcfc4f9

File tree

3 files changed

+104
-38
lines changed

3 files changed

+104
-38
lines changed

‎0-bootstrap/README-GitHub.md

Lines changed: 43 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,7 @@ export the GitHub fine grained access token as an environment variable:
215215
terraform apply bootstrap.tfplan
216216
```
217217

218-
1. Run `terraform output` to get the email address of the terraform service accounts that will be used to run manual steps for `shared` environments in steps `3-networks-dual-svpc`, `3-networks-hub-and-spoke`, and `4-projects`.
218+
1. Run `terraform output` to get the email address of the terraform service accounts that will be used to run manual steps for `shared` environments in steps `3-networks-svpc`, `3-networks-hub-and-spoke`, and `4-projects`.
219219

220220
```bash
221221
export network_step_sa=$(terraform output -raw networks_step_terraform_service_account_email)
@@ -508,7 +508,7 @@ See any of the envs folder [README.md](../2-environments/envs/production/README.
508508
1. Review merge output in GitHub https://github.com/GITHUB-OWNER/GITHUB-ENVIRONMENTS-REPO/actions under `tf-apply`.
509509

510510
1. You can now move to the instructions in the network stage.
511-
To use the [Dual Shared VPC](https://cloud.google.com/architecture/security-foundations/networking#vpcsharedvpc-id7-1-shared-vpc-) network mode go to [Deploying step 3-networks-dual-svpc](#deploying-step-3-networks-dual-svpc),
511+
To use the [Shared VPC](https://cloud.google.com/architecture/security-foundations/networking#vpcsharedvpc-id7-1-shared-vpc-) network mode go to [Deploying step 3-networks-svpc](#deploying-step-3-networks-svpc),
512512
or go to [Deploying step 3-networks-hub-and-spoke](#deploying-step-3-networks-hub-and-spoke) to use the [Hub and Spoke](https://cloud.google.com/architecture/security-foundations/networking#hub-and-spoke) network mode.
513513

514514
1. Before moving to the next step, go back to the parent directory.
@@ -517,9 +517,9 @@ or go to [Deploying step 3-networks-hub-and-spoke](#deploying-step-3-networks-hu
517517
cd ..
518518
```
519519

520-
## Deploying step 3-networks-dual-svpc
520+
## Deploying step 3-networks-svpc
521521

522-
1. Clone the repository you created to host the `3-networks-dual-svpc` terraform configuration at the same level of the `terraform-example-foundation` folder.
522+
1. Clone the repository you created to host the `3-networks-svpc` terraform configuration at the same level of the `terraform-example-foundation` folder.
523523

524524
```bash
525525
git clone [email protected]:<GITHUB-OWNER>/<GITHUB-NETWORKS-REPO>.git gcp-networks
@@ -557,7 +557,7 @@ or go to [Deploying step 3-networks-hub-and-spoke](#deploying-step-3-networks-hu
557557
1. Copy contents of foundation to new repo.
558558

559559
```bash
560-
cp -RT ../terraform-example-foundation/3-networks-dual-svpc/ .
560+
cp -RT ../terraform-example-foundation/3-networks-svpc/ .
561561
cp -RT ../terraform-example-foundation/policy-library/ ./policy-library
562562
mkdir -p .github/workflows
563563
cp ../terraform-example-foundation/build/github-tf-* ./.github/workflows/
@@ -587,8 +587,8 @@ or go to [Deploying step 3-networks-hub-and-spoke](#deploying-step-3-networks-hu
587587
```
588588
589589
1. Update `common.auto.tfvars` file with values from your GCP environment.
590-
See any of the envs folder [README.md](../3-networks-dual-svpc/envs/production/README.md#inputs) files for additional information on the values in the `common.auto.tfvars` file.
591-
1. You must add your user email in the variable `perimeter_additional_members` to be able to see the resources created in the restricted project.
590+
See any of the envs folder [README.md](../3-networks-svpc/envs/production/README.md#inputs) files for additional information on the values in the `common.auto.tfvars` file.
591+
1. You must add your user email in the variable `perimeter_additional_members` to be able to see the resources created in the project.
592592
1. Update the `remote_state_bucket` variable with the backend bucket from step Bootstrap in the `common.auto.tfvars` file.
593593
594594
```bash
@@ -643,24 +643,48 @@ An environment variable `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` will be set with th
643643
./tf-wrapper.sh apply shared
644644
```
645645
646-
1. Push your plan branch.
646+
1. You must manually plan and apply the `production` environment since the `development`, `nonproduction` and `plan` environments depend on it.
647647
648648
```bash
649-
git push --set-upstream origin plan
649+
git checkout production
650+
git merge plan
650651
```
651652
652-
1. Open a pull request in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/pull/new/plan from the `plan` branch to the `production` branch and review the output.
653+
1. Run `init` and `plan` and review output for environment production.
653654
654-
> NOTE: Development and Non-production branches depends on the production branch to be deployed first, for the `3-networks-dual-svpc`.
655+
```bash
656+
./tf-wrapper.sh init production
657+
./tf-wrapper.sh plan production
658+
```
655659
656-
1. The Pull request will trigger a GitHub Action that will run Terraform `init`/`plan`/`validate` in the `production` environment.
657-
1. Review the GitHub Action output in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/actions under `tf-pull-request`.
658-
1. If the GitHub action is successful, merge the pull request in to the `production` branch.
659-
1. The merge will trigger a GitHub Action that will apply the terraform configuration for the `production` environment.
660-
1. Review merge output in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/actions under `tf-apply`.
661-
1. If the GitHub action is successful, apply the next environment.
660+
1. Run `apply` production.
662661
663-
1. Open a pull request in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/pull/new/plan from the `plan` branch to the `development` branch and review the output.
662+
```bash
663+
./tf-wrapper.sh apply production
664+
```
665+
666+
1. Push your production branch since development and nonproduction depends it.
667+
668+
*Note:** The Production envrionment must be the first branch to be pushed as it includes the DNS Hub communication that will be used by other environments.
669+
670+
```bash
671+
git add .
672+
git commit -m 'Initialize networks repo - production'
673+
git push --set-upstream origin production
674+
```
675+
676+
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `production` branch to the `plan` branch and review the output.
677+
678+
> NOTE: Development and Non-production branches depends on the production branch to be deployed first, for the `3-networks-dual-svpc`.
679+
680+
1. Push your plan branch.
681+
682+
```bash
683+
git checkout plan --set-upstream origin plan
684+
git push
685+
```
686+
687+
1. Open a pull request in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/pull/new/plan from the `production` branch to the `development` branch and review the output.
664688
1. The Pull request will trigger a GitHub Action that will run Terraform `init`/`plan`/`validate` in the `development` environment.
665689
1. Review the GitHub Action output in GitHub https://github.com/GITHUB-OWNER/GITHUB-NETWORKS-REPO/actions under `tf-pull-request`.
666690
1. If the GitHub action is successful, merge the pull request in to the `development` branch.
@@ -748,7 +772,7 @@ An environment variable `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` will be set with th
748772
749773
1. Update `common.auto.tfvars` file with values from your GCP environment.
750774
See any of the envs folder [README.md](../3-networks-hub-and-spoke/envs/production/README.md#inputs) files for additional information on the values in the `common.auto.tfvars` file.
751-
1. You must add your user email in the variable `perimeter_additional_members` to be able to see the resources created in the restricted project.
775+
1. You must add your user email in the variable `perimeter_additional_members` to be able to see the resources created in the project.
752776
1. Update the `remote_state_bucket` variable with the backend bucket from step Bootstrap in the `common.auto.tfvars` file.
753777
754778
```bash

‎0-bootstrap/README-GitLab.md

Lines changed: 43 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ Run the `0-bootstrap/scripts/git_create_branches_helper.sh` script to create the
184184

185185
1. Go to https://gitlab.com/GITLAB-OWNER/GITLAB-RUNNER-REPO/-/settings/ci_cd#js-token-access
186186
1. Add all the repositories: Bootstrap, Organization, Environments, Networks, and Projects to the allow list tha allow access to the CI/CD runner image.
187-
1. In "Allow CI job tokens from the following projects to access this project" add the other projects/repositories. Format is <GITLAB-OWNER>/<GITLAB-REPO>
187+
1. In "Allow CI job tokens from the following projects to access this project" add the other projects/repositories. Format is `<GITLAB-OWNER>/<GITLAB-REPO>`
188188

189189
### Deploying step 0-bootstrap
190190

@@ -283,7 +283,7 @@ export the GitLab personal or group access token as an environment variable:
283283
terraform apply bootstrap.tfplan
284284
```
285285

286-
1. Run `terraform output` to get the email address of the terraform service accounts that will be used to run manual steps for `shared` environments in steps `3-networks-dual-svpc`, `3-networks-hub-and-spoke`, and `4-projects`.
286+
1. Run `terraform output` to get the email address of the terraform service accounts that will be used to run manual steps for `shared` environments in steps `3-networks-svpc`, `3-networks-hub-and-spoke`, and `4-projects`.
287287

288288
```bash
289289
export network_step_sa=$(terraform output -raw networks_step_terraform_service_account_email)
@@ -539,10 +539,10 @@ See any of the envs folder [README.md](../2-environments/envs/production/README.
539539
```
540540

541541
1. You can now move to the instructions in the network stage.
542-
To use the [Dual Shared VPC](https://cloud.google.com/architecture/security-foundations/networking#vpcsharedvpc-id7-1-shared-vpc-) network mode go to [Deploying step 3-networks-dual-svpc](#deploying-step-3-networks-dual-svpc),
542+
To use the [Dual Shared VPC](https://cloud.google.com/architecture/security-foundations/networking#vpcsharedvpc-id7-1-shared-vpc-) network mode go to [Deploying step 3-networks-svpc](#deploying-step-3-networks-svpc),
543543
or go to [Deploying step 3-networks-hub-and-spoke](#deploying-step-3-networks-hub-and-spoke) to use the [Hub and Spoke](https://cloud.google.com/architecture/security-foundations/networking#hub-and-spoke) network mode.
544544

545-
## Deploying step 3-networks-dual-svpc
545+
## Deploying step 3-networks-svpc
546546

547547
1. Navigate into the repo. All subsequent steps assume you are running them from the `gcp-networks` directory.
548548
If you run them from another directory, adjust your copy paths accordingly.
@@ -560,7 +560,7 @@ or go to [Deploying step 3-networks-hub-and-spoke](#deploying-step-3-networks-hu
560560
1. Copy contents of foundation to new repo.
561561

562562
```bash
563-
cp -RT ../terraform-example-foundation/3-networks-dual-svpc/ .
563+
cp -RT ../terraform-example-foundation/3-networks-svpc/ .
564564
cp -RT ../terraform-example-foundation/policy-library/ ./policy-library
565565
cp ../terraform-example-foundation/build/gitlab-ci.yml ./.gitlab-ci.yml
566566
cp ../terraform-example-foundation/build/run_gcp_auth.sh .
@@ -590,8 +590,8 @@ or go to [Deploying step 3-networks-hub-and-spoke](#deploying-step-3-networks-hu
590590
```
591591
592592
1. Update `common.auto.tfvars` file with values from your GCP environment.
593-
See any of the envs folder [README.md](../3-networks-dual-svpc/envs/production/README.md#inputs) files for additional information on the values in the `common.auto.tfvars` file.
594-
1. You must add your user email in the variable `perimeter_additional_members` to be able to see the resources created in the restricted project.
593+
See any of the envs folder [README.md](../3-networks-svpc/envs/production/README.md#inputs) files for additional information on the values in the `common.auto.tfvars` file.
594+
1. You must add your user email in the variable `perimeter_additional_members` to be able to see the resources created in the project.
595595
1. Update the `remote_state_bucket` variable with the backend bucket from step Bootstrap in the `common.auto.tfvars` file.
596596
597597
```bash
@@ -646,37 +646,61 @@ An environment variable `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` will be set with th
646646
./tf-wrapper.sh apply shared
647647
```
648648
649+
1. You must manually plan and apply the `production` environment since the `development`, `nonproduction` and `plan` environments depend on it.
650+
651+
```bash
652+
git checkout production
653+
git merge plan
654+
```
655+
656+
1. Run `init` and `plan` and review output for environment production.
657+
658+
```bash
659+
./tf-wrapper.sh init production
660+
./tf-wrapper.sh plan production
661+
```
662+
663+
1. Run `apply` production.
664+
665+
```bash
666+
./tf-wrapper.sh apply production
667+
```
668+
669+
1. Push your production branch since development and nonproduction depends it.
670+
671+
*Note:** The Production envrionment must be the first branch to be pushed as it includes the DNS Hub communication that will be used by other environments.
672+
673+
```bash
674+
git add .
675+
git commit -m 'Initialize networks repo - production'
676+
git push
677+
```
678+
679+
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `production` branch to the `plan` branch and review the output.
680+
649681
1. Push your plan branch.
650682
651683
```bash
684+
git checkout plan
652685
git push
653686
```
654687
655-
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `plan` branch to the `production` branch and review the output.
688+
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `production` branch to the `development` branch and review the output.
656689
657690
> NOTE: Development and Non-production branches depends on the production branch to be deployed first, for the `3-networks-dual-svpc`.
658691
659-
1. The merge request will trigger a GitLab pipelines that will run Terraform `init`/`plan`/`validate` in the `production` environment.
660-
1. Review the GitLab pipelines output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines.
661-
1. If the GitLab pipelines is successful, merge the merge request in to the `production` branch.
662-
1. The merge will trigger a GitLab pipelines that will apply the terraform configuration for the `production` environment.
663-
1. Review merge output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines under `tf-apply`.
664-
665-
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `plan` branch to the `development` branch and review the output.
666692
1. The merge request will trigger a GitLab pipelines that will run Terraform `init`/`plan`/`validate` in the `development` environment.
667693
1. Review the GitLab pipelines output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines.
668694
1. If the GitLab pipelines is successful, merge the merge request in to the `development` branch.
669695
1. The merge will trigger a GitLab pipelines that will apply the terraform configuration for the `development` environment.
670696
1. Review merge output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines under `tf-apply`.
671-
1. If the GitLab pipelines is successful, apply the next environment.
672697
673-
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `development` branch to the `nonproduction` branch and review the output.
698+
1. Open a merge request in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/merge_requests?scope=all&state=opened from the `production` branch to the `nonproduction` branch and review the output.
674699
1. The merge request will trigger a GitLab pipelines that will run Terraform `init`/`plan`/`validate` in the `nonproduction` environment.
675700
1. Review the GitLab pipelines output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines.
676701
1. If the GitLab pipelines is successful, merge the merge request in to the `nonproduction` branch.
677702
1. The merge will trigger a GitLab pipelines that will apply the terraform configuration for the `nonproduction` environment.
678703
1. Review merge output in GitLab https://gitlab.com/GITLAB-OWNER/GITLAB-NETWORKS-REPO/-/pipelines under `tf-apply`.
679-
1. If the GitLab pipelines is successful, apply the next environment.
680704
681705
1. Before executing the next steps, unset the `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` environment variable.
682706
@@ -728,7 +752,7 @@ An environment variable `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` will be set with th
728752
729753
1. Update `common.auto.tfvars` file with values from your GCP environment.
730754
See any of the envs folder [README.md](../3-networks-hub-and-spoke/envs/production/README.md#inputs) files for additional information on the values in the `common.auto.tfvars` file.
731-
1. You must add your user email in the variable `perimeter_additional_members` to be able to see the resources created in the restricted project.
755+
1. You must add your user email in the variable `perimeter_additional_members` to be able to see the resources created in the project.
732756
1. Update the `remote_state_bucket` variable with the backend bucket from step Bootstrap in the `common.auto.tfvars` file.
733757
734758
```bash

‎0-bootstrap/gitlab.tf.example

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ module "gitlab_oidc" {
112112
pool_id = "foundation-pool"
113113
provider_id = "foundation-gl-provider"
114114
sa_mapping = local.sa_mapping
115+
attribute_condition = "assertion.user_login=='${var.gl_repos.owner}'"
115116
}
116117

117118
resource "gitlab_project_variable" "variables" {
@@ -174,3 +175,20 @@ resource "google_service_account_iam_member" "self_impersonate" {
174175
role = "roles/iam.serviceAccountTokenCreator"
175176
member = "serviceAccount:${google_service_account.terraform-env-sa[each.key].email}"
176177
}
178+
179+
module "gcp_projects_state_bucket" {
180+
source = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
181+
version = "~> 9.0"
182+
183+
name = "${var.bucket_prefix}-${module.seed_bootstrap.seed_project_id}-gcp-projects-tfstate"
184+
project_id = module.seed_bootstrap.seed_project_id
185+
location = var.default_region
186+
force_destroy = var.bucket_force_destroy
187+
188+
encryption = {
189+
default_kms_key_name = local.state_bucket_kms_key
190+
}
191+
192+
depends_on = [module.seed_bootstrap.gcs_bucket_tfstate]
193+
}
194+

0 commit comments

Comments
 (0)