No public description

Android Build Filesystem (ABFS) Team · sce-taid · commit c35bf6de446d · 2025-06-20T10:06:29.000Z
PiperOrigin-RevId: 773613379
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,37 @@
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version 
+# control as they are data points which are potentially sensitive and subject 
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Ignore transient lock info files created by terraform apply
+.terraform.tfstate.lock.info
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
diff --git a/examples/simple/.terraform.lock.hcl b/examples/simple/.terraform.lock.hcl
diff --git a/examples/simple/iam.tf b/examples/simple/iam.tf
@@ -12,24 +12,23 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-resource "google_service_account" "abfs_server" {
-  project      = data.google_project.project.project_id
-  account_id   = "abfs-server"
-  display_name = "SA for ABFS server VMs"
+data "google_service_account" "abfs" {
+  project    = data.google_project.project.project_id
+  account_id = var.abfs_service_account_id
 }
 
 module "project-iam-bindings" {
-  source   = "terraform-google-modules/iam/google//modules/projects_iam"
-  version  = "8.1.0"
+  source  = "terraform-google-modules/iam/google//modules/projects_iam"
+  version = "8.1.0"
+
   projects = [data.google_project.project.project_id]
   mode     = "authoritative"
-
   bindings = {
-    "roles/logging.logWriter"                   = ["serviceAccount:${google_service_account.abfs_server.email}"],
-    "roles/monitoring.metricWriter"             = ["serviceAccount:${google_service_account.abfs_server.email}"],
-    "roles/monitoring.viewer"                   = ["serviceAccount:${google_service_account.abfs_server.email}"],
-    "roles/stackdriver.resourceMetadata.writer" = ["serviceAccount:${google_service_account.abfs_server.email}"],
-    "roles/artifactregistry.reader"             = ["serviceAccount:${google_service_account.abfs_server.email}"]
+    "roles/artifactregistry.reader"             = [data.google_service_account.abfs.member],
+    "roles/logging.logWriter"                   = [data.google_service_account.abfs.member],
+    "roles/monitoring.metricWriter"             = [data.google_service_account.abfs.member],
+    "roles/monitoring.viewer"                   = [data.google_service_account.abfs.member],
+    "roles/stackdriver.resourceMetadata.writer" = [data.google_service_account.abfs.member],
   }
 
   depends_on = [
diff --git a/examples/simple/main.tf b/examples/simple/main.tf
@@ -17,7 +17,7 @@ module "abfs-deployment" {
 
   project_id            = var.project_id
   zone                  = var.zone
-  service_account_email = google_service_account.abfs_server.email
+  service_account_email = data.google_service_account.abfs.email
   subnetwork            = module.abfs-vpc.subnets["${var.region}/abfs-subnet"].name
   abfs_docker_image_uri = var.abfs_docker_image_uri
   abfs_license          = var.abfs_license
@@ -28,7 +28,7 @@ module "abfs-uploaders" {
 
   project_id                           = var.project_id
   zone                                 = var.zone
-  service_account_email                = google_service_account.abfs_server.email
+  service_account_email                = data.google_service_account.abfs.email
   subnetwork                           = module.abfs-vpc.subnets["${var.region}/abfs-subnet"].name
   abfs_docker_image_uri                = var.abfs_docker_image_uri
   abfs_gerrit_uploader_manifest_server = var.abfs_gerrit_uploader_manifest_server
@@ -40,7 +40,8 @@ module "abfs-uploaders" {
 }
 
 module "monitoring" {
-  source             = "./monitoring"
+  source = "./monitoring"
+
   project_id         = data.google_project.project.project_id
   notification_email = var.alert_notification_email
 }
diff --git a/examples/simple/network.tf b/examples/simple/network.tf
@@ -19,15 +19,14 @@ module "abfs-vpc" {
   project_id   = data.google_project.project.project_id
   network_name = "abfs-network"
   routing_mode = "GLOBAL"
-
   firewall_rules = [
     {
       description             = "Allow egress to Google APIs via Private Google Access"
       direction               = "EGRESS"
       name                    = "allow-egress-google-apis"
       priority                = 1000
       ranges                  = ["199.36.153.8/30", "34.126.0.0/18"]
-      target_service_accounts = [google_service_account.abfs_server.email]
+      target_service_accounts = [data.google_service_account.abfs.email]
 
       allow = [
         {
@@ -59,8 +58,8 @@ module "abfs-vpc" {
       priority    = 1000
 
       ranges                  = ["0.0.0.0/0"]
-      source_service_accounts = [google_service_account.abfs_server.email]
-      target_service_accounts = [google_service_account.abfs_server.email]
+      source_service_accounts = [data.google_service_account.abfs.email]
+      target_service_accounts = [data.google_service_account.abfs.email]
       allow = [
         {
           protocol = "icmp"
@@ -77,7 +76,6 @@ module "abfs-vpc" {
       ]
     }
   ]
-
   subnets = [
     {
       subnet_name           = "abfs-subnet"
@@ -100,8 +98,9 @@ resource "google_compute_router" "nat_router" {
 }
 
 module "cloud-nat" {
-  source     = "terraform-google-modules/cloud-nat/google"
-  version    = "~> 5.3"
+  source  = "terraform-google-modules/cloud-nat/google"
+  version = "~> 5.3"
+
   project_id = var.project_id
   region     = var.region
   router     = google_compute_router.nat_router.name
diff --git a/examples/simple/outputs.tf b/examples/simple/outputs.tf
@@ -16,7 +16,7 @@ output "license_information" {
   value = {
     project_id                = data.google_project.project.project_id,
     project_number            = data.google_project.project.number,
-    service_account_email     = google_service_account.abfs_server.email
-    service_account_unique_id = google_service_account.abfs_server.unique_id
+    service_account_email     = data.google_service_account.abfs.email
+    service_account_unique_id = data.google_service_account.abfs.unique_id
   }
 }
diff --git a/examples/simple/variables.tf b/examples/simple/variables.tf
@@ -65,3 +65,8 @@ variable "alert_notification_email" {
   type        = string
   description = "Email address to send alert notifications to"
 }
+
+variable "abfs_service_account_id" {
+  type        = string
+  description = "ABFS service account ID (e.g. abfs@<project-id>.iam.gserviceaccount.com)"
+}

Original file line number	Diff line number	Diff line change
`@@ -19,15 +19,14 @@ module "abfs-vpc" {`
`19`	`19`	`project_id = data.google_project.project.project_id`
`20`	`20`	`network_name = "abfs-network"`
`21`	`21`	`routing_mode = "GLOBAL"`
`22`		`-`
`23`	`22`	`firewall_rules = [`
`24`	`23`	`{`
`25`	`24`	`description = "Allow egress to Google APIs via Private Google Access"`
`26`	`25`	`direction = "EGRESS"`
`27`	`26`	`name = "allow-egress-google-apis"`
`28`	`27`	`priority = 1000`
`29`	`28`	`ranges = ["199.36.153.8/30", "34.126.0.0/18"]`
`30`		`- target_service_accounts = [google_service_account.abfs_server.email]`
	`29`	`+ target_service_accounts = [data.google_service_account.abfs.email]`
`31`	`30`
`32`	`31`	`allow = [`
`33`	`32`	`{`
`@@ -59,8 +58,8 @@ module "abfs-vpc" {`
`59`	`58`	`priority = 1000`
`60`	`59`
`61`	`60`	`ranges = ["0.0.0.0/0"]`
`62`		`- source_service_accounts = [google_service_account.abfs_server.email]`
`63`		`- target_service_accounts = [google_service_account.abfs_server.email]`
	`61`	`+ source_service_accounts = [data.google_service_account.abfs.email]`
	`62`	`+ target_service_accounts = [data.google_service_account.abfs.email]`
`64`	`63`	`allow = [`
`65`	`64`	`{`
`66`	`65`	`protocol = "icmp"`
`@@ -77,7 +76,6 @@ module "abfs-vpc" {`
`77`	`76`	`]`
`78`	`77`	`}`
`79`	`78`	`]`
`80`		`-`
`81`	`79`	`subnets = [`
`82`	`80`	`{`
`83`	`81`	`subnet_name = "abfs-subnet"`
`@@ -100,8 +98,9 @@ resource "google_compute_router" "nat_router" {`
`100`	`98`	`}`
`101`	`99`
`102`	`100`	`module "cloud-nat" {`
`103`		`- source = "terraform-google-modules/cloud-nat/google"`
`104`		`- version = "~> 5.3"`
	`101`	`+ source = "terraform-google-modules/cloud-nat/google"`
	`102`	`+ version = "~> 5.3"`
	`103`	`+`
`105`	`104`	`project_id = var.project_id`
`106`	`105`	`region = var.region`
`107`	`106`	`router = google_compute_router.nat_router.name`
Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@ output "license_information" {`
`16`	`16`	`value = {`
`17`	`17`	`project_id = data.google_project.project.project_id,`
`18`	`18`	`project_number = data.google_project.project.number,`
`19`		`- service_account_email = google_service_account.abfs_server.email`
`20`		`- service_account_unique_id = google_service_account.abfs_server.unique_id`
	`19`	`+ service_account_email = data.google_service_account.abfs.email`
	`20`	`+ service_account_unique_id = data.google_service_account.abfs.unique_id`
`21`	`21`	`}`
`22`	`22`	`}`
Original file line number	Diff line number	Diff line change
`@@ -65,3 +65,8 @@ variable "alert_notification_email" {`
`65`	`65`	`type = string`
`66`	`66`	`description = "Email address to send alert notifications to"`
`67`	`67`	`}`
	`68`	`+`
	`69`	`+variable "abfs_service_account_id" {`
	`70`	`+ type = string`
	`71`	`+ description = "ABFS service account ID (e.g. abfs@<project-id>.iam.gserviceaccount.com)"`
	`72`	`+}`