Skip to content

Commit 97c69e6

Browse files
qz267Zheng Qin
qz267
and
Zheng Qin
authored
feat: per module requirements configs for lb-http (#520)
Co-authored-by: Zheng Qin <[email protected]>
1 parent 4e92dac commit 97c69e6

File tree

9 files changed

+124
-80
lines changed

9 files changed

+124
-80
lines changed

‎.terraform.lock‎

Whitespace-only changes.

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ docker_generate_docs:
7979
-e ENABLE_BPMETADATA=1 \
8080
-v "$(CURDIR)":/workspace \
8181
$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
82-
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs'
82+
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs --per-module-requirements'
8383

8484
## Generate files from autogen
8585
.PHONY: docker_generate_modules

‎metadata.yaml‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -336,24 +336,21 @@ spec:
336336
roles:
337337
- level: Project
338338
roles:
339-
- roles/compute.xpnAdmin
340-
- level: Project
341-
roles:
342-
- roles/storage.admin
343-
- roles/compute.admin
344339
- roles/run.admin
345340
- roles/iam.serviceAccountUser
346341
- roles/certificatemanager.owner
347342
- roles/vpcaccess.admin
348343
- roles/iam.serviceAccountAdmin
344+
- roles/storage.admin
345+
- roles/compute.admin
349346
services:
347+
- certificatemanager.googleapis.com
350348
- cloudresourcemanager.googleapis.com
351-
- storage-api.googleapis.com
352-
- serviceusage.googleapis.com
353349
- compute.googleapis.com
354-
- run.googleapis.com
355350
- iam.googleapis.com
356-
- certificatemanager.googleapis.com
351+
- run.googleapis.com
352+
- serviceusage.googleapis.com
353+
- storage-api.googleapis.com
357354
- vpcaccess.googleapis.com
358355
providerVersions:
359356
- source: hashicorp/google

‎modules/backend/metadata.yaml‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -331,24 +331,18 @@ spec:
331331
roles:
332332
- level: Project
333333
roles:
334-
- roles/compute.xpnAdmin
335-
- level: Project
336-
roles:
337-
- roles/storage.admin
338-
- roles/compute.admin
339334
- roles/run.admin
335+
- roles/compute.networkAdmin
336+
- roles/iap.admin
340337
- roles/iam.serviceAccountUser
341-
- roles/certificatemanager.owner
342-
- roles/vpcaccess.admin
343338
- roles/iam.serviceAccountAdmin
339+
- roles/compute.admin
340+
- roles/storage.admin
344341
services:
345342
- cloudresourcemanager.googleapis.com
346-
- storage-api.googleapis.com
347-
- serviceusage.googleapis.com
348343
- compute.googleapis.com
349344
- run.googleapis.com
350-
- iam.googleapis.com
351-
- certificatemanager.googleapis.com
345+
- storage-api.googleapis.com
352346
- vpcaccess.googleapis.com
353347
providerVersions:
354348
- source: hashicorp/google

‎modules/dynamic_backends/metadata.yaml‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -326,9 +326,6 @@ spec:
326326
description: The default URL map used by this module.
327327
requirements:
328328
roles:
329-
- level: Project
330-
roles:
331-
- roles/compute.xpnAdmin
332329
- level: Project
333330
roles:
334331
- roles/storage.admin
@@ -339,13 +336,13 @@ spec:
339336
- roles/vpcaccess.admin
340337
- roles/iam.serviceAccountAdmin
341338
services:
339+
- certificatemanager.googleapis.com
342340
- cloudresourcemanager.googleapis.com
343-
- storage-api.googleapis.com
344-
- serviceusage.googleapis.com
345341
- compute.googleapis.com
346-
- run.googleapis.com
347342
- iam.googleapis.com
348-
- certificatemanager.googleapis.com
343+
- run.googleapis.com
344+
- serviceusage.googleapis.com
345+
- storage-api.googleapis.com
349346
- vpcaccess.googleapis.com
350347
providerVersions:
351348
- source: hashicorp/google

‎modules/frontend/metadata.yaml‎

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -244,25 +244,16 @@ spec:
244244
roles:
245245
- level: Project
246246
roles:
247-
- roles/compute.xpnAdmin
248-
- level: Project
249-
roles:
250-
- roles/storage.admin
251247
- roles/compute.admin
252-
- roles/run.admin
253-
- roles/iam.serviceAccountUser
248+
- roles/storage.admin
249+
- roles/iap.admin
254250
- roles/certificatemanager.owner
255-
- roles/vpcaccess.admin
256-
- roles/iam.serviceAccountAdmin
251+
- roles/iam.serviceAccountUser
257252
services:
258-
- cloudresourcemanager.googleapis.com
259-
- storage-api.googleapis.com
260-
- serviceusage.googleapis.com
253+
- certificatemanager.googleapis.com
261254
- compute.googleapis.com
262255
- run.googleapis.com
263-
- iam.googleapis.com
264-
- certificatemanager.googleapis.com
265-
- vpcaccess.googleapis.com
256+
- storage-api.googleapis.com
266257
providerVersions:
267258
- source: hashicorp/google
268259
version: ">= 6.0, < 7"

‎modules/serverless_negs/metadata.yaml‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -292,24 +292,21 @@ spec:
292292
roles:
293293
- level: Project
294294
roles:
295-
- roles/compute.xpnAdmin
296-
- level: Project
297-
roles:
295+
- roles/vpcaccess.admin
296+
- roles/iam.serviceAccountAdmin
298297
- roles/storage.admin
299298
- roles/compute.admin
300299
- roles/run.admin
301300
- roles/iam.serviceAccountUser
302301
- roles/certificatemanager.owner
303-
- roles/vpcaccess.admin
304-
- roles/iam.serviceAccountAdmin
305302
services:
303+
- certificatemanager.googleapis.com
306304
- cloudresourcemanager.googleapis.com
307-
- storage-api.googleapis.com
308-
- serviceusage.googleapis.com
309305
- compute.googleapis.com
310-
- run.googleapis.com
311306
- iam.googleapis.com
312-
- certificatemanager.googleapis.com
307+
- run.googleapis.com
308+
- serviceusage.googleapis.com
309+
- storage-api.googleapis.com
313310
- vpcaccess.googleapis.com
314311
providerVersions:
315312
- source: hashicorp/google

‎test/setup/iam.tf‎

Lines changed: 47 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,53 @@
1515
*/
1616

1717
locals {
18-
int_required_project_roles = [
19-
"roles/storage.admin",
20-
"roles/compute.admin",
21-
"roles/run.admin",
22-
"roles/iam.serviceAccountUser",
23-
"roles/certificatemanager.owner",
24-
"roles/vpcaccess.admin",
25-
"roles/iam.serviceAccountAdmin"
26-
]
18+
per_module_roles = {
19+
root = [
20+
"roles/storage.admin",
21+
"roles/compute.admin",
22+
"roles/run.admin",
23+
"roles/iam.serviceAccountUser",
24+
"roles/certificatemanager.owner",
25+
"roles/vpcaccess.admin",
26+
"roles/iam.serviceAccountAdmin"
27+
]
28+
backend = [
29+
"roles/compute.admin",
30+
"roles/storage.admin",
31+
"roles/run.admin",
32+
"roles/compute.networkAdmin",
33+
"roles/iap.admin",
34+
"roles/iam.serviceAccountUser",
35+
"roles/iam.serviceAccountAdmin"
36+
]
37+
dynamic_backends = [
38+
"roles/storage.admin",
39+
"roles/compute.admin",
40+
"roles/run.admin",
41+
"roles/iam.serviceAccountUser",
42+
"roles/certificatemanager.owner",
43+
"roles/vpcaccess.admin",
44+
"roles/iam.serviceAccountAdmin"
45+
]
46+
frontend = [
47+
"roles/compute.admin",
48+
"roles/storage.admin",
49+
"roles/iap.admin",
50+
"roles/certificatemanager.owner",
51+
"roles/iam.serviceAccountUser"
52+
]
53+
serverless_negs = [
54+
"roles/storage.admin",
55+
"roles/compute.admin",
56+
"roles/run.admin",
57+
"roles/iam.serviceAccountUser",
58+
"roles/certificatemanager.owner",
59+
"roles/vpcaccess.admin",
60+
"roles/iam.serviceAccountAdmin"
61+
]
62+
}
63+
64+
int_required_project_roles = tolist(toset(flatten(values(local.per_module_roles))))
2765
int_required_folder_roles = [
2866
"roles/compute.xpnAdmin"
2967
]

‎test/setup/main.tf‎

Lines changed: 50 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,54 @@
1414
* limitations under the License.
1515
*/
1616

17+
locals {
18+
per_module_services = {
19+
root = [
20+
"cloudresourcemanager.googleapis.com",
21+
"storage-api.googleapis.com",
22+
"serviceusage.googleapis.com",
23+
"compute.googleapis.com",
24+
"run.googleapis.com",
25+
"iam.googleapis.com",
26+
"certificatemanager.googleapis.com",
27+
"vpcaccess.googleapis.com",
28+
]
29+
backend = [
30+
"compute.googleapis.com",
31+
"run.googleapis.com",
32+
"storage-api.googleapis.com",
33+
"vpcaccess.googleapis.com",
34+
"cloudresourcemanager.googleapis.com",
35+
]
36+
dynamic_backends = [
37+
"cloudresourcemanager.googleapis.com",
38+
"storage-api.googleapis.com",
39+
"serviceusage.googleapis.com",
40+
"compute.googleapis.com",
41+
"run.googleapis.com",
42+
"iam.googleapis.com",
43+
"certificatemanager.googleapis.com",
44+
"vpcaccess.googleapis.com",
45+
]
46+
frontend = [
47+
"compute.googleapis.com",
48+
"storage-api.googleapis.com",
49+
"run.googleapis.com",
50+
"certificatemanager.googleapis.com",
51+
]
52+
serverless_negs = [
53+
"cloudresourcemanager.googleapis.com",
54+
"storage-api.googleapis.com",
55+
"serviceusage.googleapis.com",
56+
"compute.googleapis.com",
57+
"run.googleapis.com",
58+
"iam.googleapis.com",
59+
"certificatemanager.googleapis.com",
60+
"vpcaccess.googleapis.com",
61+
]
62+
}
63+
}
64+
1765
module "project-ci-lb-http" {
1866
source = "terraform-google-modules/project-factory/google"
1967
version = "~> 17.0"
@@ -28,16 +76,7 @@ module "project-ci-lb-http" {
2876
disable_services_on_destroy = false
2977
deletion_policy = "DELETE"
3078

31-
activate_apis = [
32-
"cloudresourcemanager.googleapis.com",
33-
"storage-api.googleapis.com",
34-
"serviceusage.googleapis.com",
35-
"compute.googleapis.com",
36-
"run.googleapis.com",
37-
"iam.googleapis.com",
38-
"certificatemanager.googleapis.com",
39-
"vpcaccess.googleapis.com",
40-
]
79+
activate_apis = tolist(toset(flatten(values(local.per_module_services))))
4180
}
4281

4382
module "project-ci-lb-http-1" {
@@ -54,14 +93,5 @@ module "project-ci-lb-http-1" {
5493
disable_services_on_destroy = false
5594
deletion_policy = "DELETE"
5695

57-
activate_apis = [
58-
"cloudresourcemanager.googleapis.com",
59-
"storage-api.googleapis.com",
60-
"serviceusage.googleapis.com",
61-
"compute.googleapis.com",
62-
"run.googleapis.com",
63-
"iam.googleapis.com",
64-
"certificatemanager.googleapis.com",
65-
"vpcaccess.googleapis.com",
66-
]
96+
activate_apis = tolist(toset(flatten(values(local.per_module_services))))
6797
}

0 commit comments

Comments
 (0)