Skip to content

Commit 9a8e364

Browse files
Android Build Filesystem (ABFS) Teamsce-taid
Android Build Filesystem (ABFS) Team
authored and
sce-taid
committed
Optionally create a Compute Engine instance for the ABFS example deployment.
PiperOrigin-RevId: 804745962
1 parent 1223413 commit 9a8e364

File tree

6 files changed

+217
-14
lines changed

6 files changed

+217
-14
lines changed

‎examples/simple/compute.tf‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
resource "google_compute_instance" "abfs_client" {
16+
count = var.create_client_instance_resource ? 1 : 0
17+
18+
project = var.project_id
19+
name = var.abfs_client_config.name
20+
zone = var.zone
21+
can_ip_forward = var.abfs_client_config.can_ip_forward
22+
deletion_protection = var.abfs_client_config.deletion_protection
23+
enable_display = var.abfs_client_config.enable_display
24+
machine_type = var.abfs_client_config.machine_type
25+
boot_disk {
26+
auto_delete = true
27+
device_name = var.abfs_client_config.name
28+
initialize_params {
29+
image = format(
30+
"projects/%s/global/images/%s",
31+
var.abfs_client_config.image_project,
32+
var.abfs_client_config.image_name
33+
)
34+
size = var.abfs_client_config.size
35+
type = var.abfs_client_config.type
36+
}
37+
mode = "READ_WRITE"
38+
}
39+
metadata = var.abfs_client_config.enable_oslogin ? {
40+
enable-osconfig = "TRUE"
41+
enable-oslogin = "true"
42+
} : {}
43+
network_interface {
44+
access_config {
45+
network_tier = "PREMIUM"
46+
}
47+
queue_count = 0
48+
stack_type = "IPV4_ONLY"
49+
subnetwork = module.abfs_vpc.subnets["${var.region}/${var.abfs_subnet_name}"].self_link
50+
}
51+
scheduling {
52+
automatic_restart = var.abfs_client_config.automatic_restart
53+
on_host_maintenance = var.abfs_client_config.preemptible ? "TERMINATE" : "MIGRATE"
54+
preemptible = var.abfs_client_config.preemptible
55+
provisioning_model = var.abfs_client_config.preemptible ? "SPOT" : "STANDARD"
56+
}
57+
service_account {
58+
email = local.abfs_service_account_email
59+
scopes = var.abfs_client_config.scopes
60+
}
61+
shielded_instance_config {
62+
enable_integrity_monitoring = var.abfs_client_config.shielded_instance_config.enable_integrity_monitoring
63+
enable_secure_boot = var.abfs_client_config.shielded_instance_config.enable_secure_boot
64+
enable_vtpm = var.abfs_client_config.shielded_instance_config.enable_vtpm
65+
}
66+
}
67+
68+
module "ops_agent_policy" {
69+
count = var.create_client_instance_resource ? 1 : 0
70+
71+
source = "github.com/terraform-google-modules/terraform-google-cloud-operations/modules/ops-agent-policy?ref=v0.6.0"
72+
73+
project = google_compute_instance.abfs_client[0].project
74+
zone = google_compute_instance.abfs_client[0].zone
75+
assignment_id = format(
76+
"goog-ops-agent-%s-%s",
77+
var.abfs_client_config.goog_ops_agent_policy,
78+
google_compute_instance.abfs_client[0].zone
79+
)
80+
agents_rule = {
81+
package_state = "installed"
82+
version = "latest"
83+
}
84+
instance_filter = {
85+
all = false
86+
inclusion_labels = [{
87+
labels = {
88+
goog-ops-agent-policy = var.abfs_client_config.goog_ops_agent_policy
89+
}
90+
}]
91+
}
92+
}

‎examples/simple/dns.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ module "cloud-dns-private-google-apis" {
4646
type = "private"
4747

4848
private_visibility_config_networks = [
49-
module.abfs-vpc.network_id
49+
module.abfs_vpc.network_id
5050
]
5151

5252
recordsets = [
@@ -79,7 +79,7 @@ module "cloud-dns-private-artifact-registry" {
7979
type = "private"
8080

8181
private_visibility_config_networks = [
82-
module.abfs-vpc.network_id
82+
module.abfs_vpc.network_id
8383
]
8484

8585
recordsets = [
@@ -112,7 +112,7 @@ module "source-repositories-private-artifact-registry" {
112112
type = "private"
113113

114114
private_visibility_config_networks = [
115-
module.abfs-vpc.network_id
115+
module.abfs_vpc.network_id
116116
]
117117

118118
recordsets = [

‎examples/simple/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ module "abfs_server" {
2828
project_id = data.google_project.project.project_id
2929
zone = var.zone
3030
service_account_email = local.abfs_service_account_email
31-
subnetwork = module.abfs-vpc.subnets["${var.region}/abfs-subnet"].name
31+
subnetwork = module.abfs_vpc.subnets["${var.region}/abfs-subnet"].name
3232
abfs_docker_image_uri = var.abfs_docker_image_uri
3333
abfs_license = var.abfs_license
3434
abfs_bucket_location = var.abfs_bucket_location
@@ -43,7 +43,7 @@ module "abfs_uploaders" {
4343
project_id = data.google_project.project.project_id
4444
zone = var.zone
4545
service_account_email = local.abfs_service_account_email
46-
subnetwork = module.abfs-vpc.subnets["${var.region}/abfs-subnet"].name
46+
subnetwork = module.abfs_vpc.subnets["${var.region}/abfs-subnet"].name
4747
abfs_docker_image_uri = var.abfs_docker_image_uri
4848
abfs_gerrit_uploader_count = var.abfs_gerrit_uploader_count
4949
abfs_gerrit_uploader_machine_type = var.abfs_gerrit_uploader_machine_type

‎examples/simple/network.tf‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,17 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
module "abfs-vpc" {
15+
moved {
16+
from = module.abfs-vpc
17+
to = module.abfs_vpc
18+
}
19+
20+
module "abfs_vpc" {
1621
source = "terraform-google-modules/network/google"
1722
version = "9.2.0"
1823

1924
project_id = data.google_project.project.project_id
20-
network_name = "abfs-network"
25+
network_name = var.abfs_network_name
2126
routing_mode = "GLOBAL"
2227

2328
firewall_rules = [
@@ -80,9 +85,9 @@ module "abfs-vpc" {
8085

8186
subnets = [
8287
{
83-
subnet_name = "abfs-subnet"
84-
subnet_ip = "10.2.0.0/16"
85-
subnet_private_access = "true"
88+
subnet_name = var.abfs_subnet_name
89+
subnet_ip = var.abfs_subnet_ip
90+
subnet_private_access = var.abfs_subnet_private_access
8691
subnet_region = var.region
8792
}
8893
]
@@ -95,7 +100,7 @@ module "abfs-vpc" {
95100
resource "google_compute_router" "nat_router" {
96101
project = var.project_id
97102
name = "natgw-router"
98-
network = module.abfs-vpc.network_self_link
103+
network = module.abfs_vpc.network_self_link
99104
region = var.region
100105
}
101106

‎examples/simple/terraform.tfvars.example‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,16 @@ abfs_spanner_database_create_tables = true
4545

4646
#alert_notification_email = "[email protected]"
4747

48+
# Whether to create the example GCE instance for testing ABFS.
49+
#create_client_instance_resource = true
50+
51+
# Example override for the client instance configuration.
52+
# Note: You only need to include keys you want to override from the defaults in variables.tf.
53+
# abfs_client_config = {
54+
# name = "my-abfs-client"
55+
# machine_type = "e2-standard-16"
56+
# }
57+
4858
create_cloud_workstation_resources = true
4959
cws_clusters = {
5060
"cws-abfs-cluster" = {
@@ -66,7 +76,9 @@ cws_configs = {
6676
persistent_disk_fs_type = "ext4"
6777
persistent_disk_type = "pd-ssd"
6878
persistent_disk_reclaim_policy = "RETAIN"
69-
creators = ["[email protected]"]
79+
creators = [
80+
# "[email protected]",
81+
]
7082
instances = [
7183
{
7284
name = "cws-abfs-instance"
@@ -75,3 +87,14 @@ cws_configs = {
7587
]
7688
}
7789
}
90+
91+
# Example for custom images for Cloud Workstations.
92+
# The key of the map is the name of the image to be built.
93+
cws_custom_images = {
94+
"asfp" = {
95+
# Optional: The region for the Cloud Scheduler job, defaults to the region of the Cloud Build trigger.
96+
scheduler_region = "europe-west1"
97+
# Optional: The schedule for the image rebuild, defaults to daily at 3 AM.
98+
ci_schedule = "0 3 * * *"
99+
}
100+
}

‎examples/simple/variables.tf‎

Lines changed: 85 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,36 @@ variable "project_id" {
1919

2020
variable "region" {
2121
type = string
22-
description = "Region for ABFS servers"
22+
description = "Region for ABFS resources"
2323
}
2424

2525
variable "zone" {
2626
type = string
27-
description = "Zone for ABFS servers"
27+
description = "Zone for ABFS resources"
28+
}
29+
30+
variable "abfs_network_name" {
31+
type = string
32+
description = "Name of the ABFS network"
33+
default = "abfs-network"
34+
}
35+
36+
variable "abfs_subnet_name" {
37+
type = string
38+
description = "Name of the ABFS subnetwork"
39+
default = "abfs-subnet"
40+
}
41+
42+
variable "abfs_subnet_ip" {
43+
type = string
44+
description = "IP range for the ABFS subnetwork"
45+
default = "10.2.0.0/16"
46+
}
47+
48+
variable "abfs_subnet_private_access" {
49+
type = bool
50+
description = "Enable private Google access for the ABFS subnetwork"
51+
default = true
2852
}
2953

3054
variable "abfs_docker_image_uri" {
@@ -74,6 +98,59 @@ variable "abfs_gerrit_uploader_manifest_server" {
7498
default = "android.googlesource.com"
7599
}
76100

101+
variable "abfs_client_config" {
102+
type = object({
103+
name = string
104+
machine_type = string
105+
image_project = string
106+
image_name = string
107+
size = number
108+
type = string
109+
scopes = list(string)
110+
goog_ops_agent_policy = string
111+
preemptible = bool
112+
automatic_restart = bool
113+
enable_oslogin = bool
114+
can_ip_forward = bool
115+
deletion_protection = bool
116+
enable_display = bool
117+
shielded_instance_config = object({
118+
enable_integrity_monitoring = bool
119+
enable_secure_boot = bool
120+
enable_vtpm = bool
121+
})
122+
})
123+
description = "Configuration for the ABFS client compute instance."
124+
default = {
125+
name = "abfs-client"
126+
machine_type = "n1-standard-8"
127+
image_project = "ubuntu-os-cloud"
128+
image_name = "ubuntu-minimal-2404-noble-amd64-v20250818"
129+
size = 2000
130+
type = "pd-ssd"
131+
scopes = [
132+
"https://www.googleapis.com/auth/devstorage.read_only",
133+
"https://www.googleapis.com/auth/logging.write",
134+
"https://www.googleapis.com/auth/monitoring.write",
135+
"https://www.googleapis.com/auth/service.management.readonly",
136+
"https://www.googleapis.com/auth/servicecontrol",
137+
"https://www.googleapis.com/auth/trace.append"
138+
]
139+
goog_ops_agent_policy = "v2-x86-template-1-4-0"
140+
preemptible = true
141+
automatic_restart = false
142+
enable_oslogin = true
143+
can_ip_forward = false
144+
deletion_protection = false
145+
enable_display = false
146+
shielded_instance_config = {
147+
enable_integrity_monitoring = true
148+
enable_secure_boot = false
149+
enable_vtpm = true
150+
}
151+
}
152+
}
153+
77154
# If you don't have an ABFS license yet, leave this empty and run terraform apply.
78155
# Submit the output via the Early Access Program (EAP) form.
79156
# When you received a license, insert it in your terraform.tfvars file and run terraform apply again.
@@ -134,6 +211,12 @@ variable "create_dns_zones" {
134211
default = true
135212
}
136213

214+
variable "create_client_instance_resource" {
215+
type = bool
216+
description = "Whether to create a Google Cloud Engine compute instance for an ABFS client"
217+
default = false
218+
}
219+
137220
variable "create_cloud_workstation_resources" {
138221
type = bool
139222
description = "Whether to create Cloud Workstation resources"

0 commit comments

Comments
 (0)