Skip to content

Commit 5886a4e

Browse files
thiagonachethiagonache
authored
fix: All dependencies on gcloud have been removed. (#491)
BREAKING CHANGE: All null_resources for executing gcloud scripts have been removed. See the upgrade guide for details.
1 parent 6d90ff3 commit 5886a4e

File tree

20 files changed

+210
-302
lines changed

20 files changed

+210
-302
lines changed

‎README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -140,10 +140,8 @@ determining that location is as follows:
140140
| sa\_role | A role to give the default Service Account for the project (defaults to none) | `string` | `""` | no |
141141
| shared\_vpc | The ID of the host project which hosts the shared VPC | `string` | `""` | no |
142142
| shared\_vpc\_subnets | List of subnets fully qualified subnet IDs (ie. projects/$project\_id/regions/$region/subnetworks/$subnet\_id) | `list(string)` | `[]` | no |
143-
| skip\_gcloud\_download | Whether to skip downloading gcloud (assumes gcloud is already available outside the module) | `bool` | `false` | no |
144143
| usage\_bucket\_name | Name of a GCS bucket to store GCE usage reports in (optional) | `string` | `""` | no |
145144
| usage\_bucket\_prefix | Prefix in the GCS bucket to store GCE usage reports in (optional) | `string` | `""` | no |
146-
| use\_tf\_google\_credentials\_env\_var | Use GOOGLE\_CREDENTIALS environment variable to run gcloud auth activate-service-account with. | `bool` | `false` | no |
147145
| vpc\_service\_control\_attach\_enabled | Whether the project will be attached to a VPC Service Control Perimeter | `bool` | `false` | no |
148146
| vpc\_service\_control\_perimeter\_name | The name of a VPC Service Control Perimeter to add the created project to | `string` | `null` | no |
149147

‎docs/upgrading_to_project_factory_v10.0.md‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
# Upgrading to Project Factory v10.0
2+
3+
The v10.0 release of Project Factory is a backwards incompatible release for
4+
all modules since the breaking change is on
5+
[core_project_factory](../modules/core_project_factory) module which removes the
6+
need of gcloud and local-execs.
7+
8+
## Migration Instructions
9+
10+
Remove any references to `skip_gcloud_download and use_tf_google_credentials_env_var` if applicable.
11+
12+
## Upgrade provider version
13+
14+
The new resource which replaces the gcloud commands is only available on version
15+
3.47 of Google's terraform provider. So, make sure you relax the version range
16+
or set it to 3.47. Finally, run terraform apply.
17+
18+
```diff
19+
An execution plan has been generated and is shown below.
20+
Resource actions are indicated with the following symbols:
21+
+ create
22+
- destroy
23+
24+
Terraform will perform the following actions:
25+
26+
# module.project-factory.module.project-factory.google_project_default_service_accounts.default_service_accounts will be created
27+
+ resource "google_project_default_service_accounts" "default_service_accounts" {
28+
+ action = "DISABLE"
29+
+ id = (known after apply)
30+
+ project = "pf-test-1-6331"
31+
+ restore_policy = "REVERT"
32+
+ service_accounts = (known after apply)
33+
}
34+
35+
# module.project-factory.module.project-factory.null_resource.preconditions will be destroyed
36+
- resource "null_resource" "preconditions" {
37+
- id = "8792279262642897492" -> null
38+
- triggers = {
39+
- "billing_account" = "REDACTED"
40+
- "credentials_path" = ""
41+
- "folder_id" = ""
42+
- "org_id" = "REDACTED"
43+
- "shared_vpc" = ""
44+
} -> null
45+
}
46+
47+
# module.project-factory.module.project-factory.module.gcloud_delete.random_id.cache will be destroyed
48+
- resource "random_id" "cache" {
49+
- b64 = "s0C2TA" -> null
50+
- b64_std = "s0C2TA==" -> null
51+
- b64_url = "s0C2TA" -> null
52+
- byte_length = 4 -> null
53+
- dec = "3007362636" -> null
54+
- hex = "b340b64c" -> null
55+
- id = "s0C2TA" -> null
56+
}
57+
58+
# module.project-factory.module.project-factory.module.gcloud_deprivilege.random_id.cache will be destroyed
59+
- resource "random_id" "cache" {
60+
- b64 = "hPQCIQ" -> null
61+
- b64_std = "hPQCIQ==" -> null
62+
- b64_url = "hPQCIQ" -> null
63+
- byte_length = 4 -> null
64+
- dec = "2230583841" -> null
65+
- hex = "84f40221" -> null
66+
- id = "hPQCIQ" -> null
67+
}
68+
69+
# module.project-factory.module.project-factory.module.gcloud_disable.null_resource.decompress[0] will be destroyed
70+
- resource "null_resource" "decompress" {
71+
- id = "4421481963953862822" -> null
72+
- triggers = {
73+
- "activated_apis" = "compute.googleapis.com"
74+
- "arguments" = "bb0200e91aab415a1093a47a1cb2290c"
75+
- "decompress_command" = "tar -xzf .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/google-cloud-sdk.tar.gz -C .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a && cp .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/jq .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/google-cloud-sdk/bin/"
76+
- "default_service_account" = "[email protected]"
77+
- "download_gcloud_command" = "curl -sL -o .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/google-cloud-sdk.tar.gz https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-281.0.0-linux-x86_64.tar.gz"
78+
- "download_jq_command" = "curl -sL -o .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/jq https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 && chmod +x .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/jq"
79+
- "md5" = "8724d44955a417594c942e0101e4fe82"
80+
- "project_services" = "pf-test-1-6331"
81+
} -> null
82+
}
83+
84+
# module.project-factory.module.project-factory.module.gcloud_disable.null_resource.decompress_destroy[0] will be destroyed
85+
- resource "null_resource" "decompress_destroy" {
86+
- id = "5873000014534982711" -> null
87+
- triggers = {
88+
- "decompress_command" = "tar -xzf .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/google-cloud-sdk.tar.gz -C .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a && cp .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/jq .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/google-cloud-sdk/bin/"
89+
} -> null
90+
}
91+
92+
# module.project-factory.module.project-factory.module.gcloud_disable.null_resource.download_gcloud[0] will be destroyed
93+
- resource "null_resource" "download_gcloud" {
94+
- id = "8730604705650342734" -> null
95+
- triggers = {
96+
- "activated_apis" = "compute.googleapis.com"
97+
- "arguments" = "bb0200e91aab415a1093a47a1cb2290c"
98+
- "default_service_account" = "[email protected]"
99+
- "download_gcloud_command" = "curl -sL -o .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/google-cloud-sdk.tar.gz https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-281.0.0-linux-x86_64.tar.gz"
100+
- "md5" = "8724d44955a417594c942e0101e4fe82"
101+
- "project_services" = "pf-test-1-6331"
102+
} -> null
103+
}
104+
105+
# module.project-factory.module.project-factory.module.gcloud_disable.null_resource.download_jq[0] will be destroyed
106+
- resource "null_resource" "download_jq" {
107+
- id = "5384550100564211294" -> null
108+
- triggers = {
109+
- "activated_apis" = "compute.googleapis.com"
110+
- "arguments" = "bb0200e91aab415a1093a47a1cb2290c"
111+
- "default_service_account" = "[email protected]"
112+
- "download_jq_command" = "curl -sL -o .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/jq https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 && chmod +x .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/jq"
113+
- "md5" = "8724d44955a417594c942e0101e4fe82"
114+
- "project_services" = "pf-test-1-6331"
115+
} -> null
116+
}
117+
118+
# module.project-factory.module.project-factory.module.gcloud_disable.null_resource.prepare_cache[0] will be destroyed
119+
- resource "null_resource" "prepare_cache" {
120+
- id = "6650067270784592334" -> null
121+
- triggers = {
122+
- "activated_apis" = "compute.googleapis.com"
123+
- "arguments" = "bb0200e91aab415a1093a47a1cb2290c"
124+
- "default_service_account" = "[email protected]"
125+
- "md5" = "8724d44955a417594c942e0101e4fe82"
126+
- "prepare_cache_command" = "mkdir .terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a"
127+
- "project_services" = "pf-test-1-6331"
128+
} -> null
129+
}
130+
131+
# module.project-factory.module.project-factory.module.gcloud_disable.null_resource.run_command[0] will be destroyed
132+
- resource "null_resource" "run_command" {
133+
- id = "4614340806538524817" -> null
134+
- triggers = {
135+
- "activated_apis" = "compute.googleapis.com"
136+
- "arguments" = "bb0200e91aab415a1093a47a1cb2290c"
137+
- "create_cmd_body" = <<~EOT
138+
--project_id='pf-test-1-6331' \
139+
--sa_id='[email protected]' \
140+
--credentials_path='' \
141+
--impersonate-service-account='' \
142+
--action='disable'
143+
EOT
144+
- "create_cmd_entrypoint" = ".terraform/modules/project-factory/modules/core_project_factory/scripts/modify-service-account.sh"
145+
- "default_service_account" = "[email protected]"
146+
- "destroy_cmd_body" = "info"
147+
- "destroy_cmd_entrypoint" = "gcloud"
148+
- "gcloud_bin_abs_path" = "/Users/thiagocarvalho/dev/thiagonache/community/pdsa/.terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/google-cloud-sdk/bin"
149+
- "md5" = "8724d44955a417594c942e0101e4fe82"
150+
- "project_services" = "pf-test-1-6331"
151+
} -> null
152+
}
153+
154+
# module.project-factory.module.project-factory.module.gcloud_disable.null_resource.upgrade[0] will be destroyed
155+
- resource "null_resource" "upgrade" {
156+
- id = "3764618213551542611" -> null
157+
- triggers = {
158+
- "activated_apis" = "compute.googleapis.com"
159+
- "arguments" = "bb0200e91aab415a1093a47a1cb2290c"
160+
- "default_service_account" = "[email protected]"
161+
- "md5" = "8724d44955a417594c942e0101e4fe82"
162+
- "project_services" = "pf-test-1-6331"
163+
- "upgrade_command" = ".terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/google-cloud-sdk/bin/gcloud components update --quiet"
164+
} -> null
165+
}
166+
167+
# module.project-factory.module.project-factory.module.gcloud_disable.null_resource.upgrade_destroy[0] will be destroyed
168+
- resource "null_resource" "upgrade_destroy" {
169+
- id = "1128888759850027996" -> null
170+
- triggers = {
171+
- "upgrade_command" = ".terraform/modules/project-factory.project-factory.gcloud_disable/cache/1613618a/google-cloud-sdk/bin/gcloud components update --quiet"
172+
} -> null
173+
}
174+
175+
# module.project-factory.module.project-factory.module.gcloud_disable.random_id.cache will be destroyed
176+
- resource "random_id" "cache" {
177+
- b64 = "FhNhig" -> null
178+
- b64_std = "FhNhig==" -> null
179+
- b64_url = "FhNhig" -> null
180+
- byte_length = 4 -> null
181+
- dec = "370368906" -> null
182+
- hex = "1613618a" -> null
183+
- id = "FhNhig" -> null
184+
}
185+
186+
Plan: 1 to add, 0 to change, 12 to destroy.
187+
```
188+
189+
It is okay to create the resource since the API does not return error if you try
190+
to disable a disabled service account or delete a deleted service account.

‎examples/shared_vpc/main.tf‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ module "host-project" {
4848
org_id = var.organization_id
4949
folder_id = var.folder_id
5050
billing_account = var.billing_account
51-
skip_gcloud_download = true
5251
enable_shared_vpc_host_project = true
5352
}
5453

@@ -124,7 +123,6 @@ module "service-project" {
124123
]
125124

126125
disable_services_on_destroy = "false"
127-
skip_gcloud_download = "true"
128126
}
129127

130128
/******************************************
@@ -150,7 +148,6 @@ module "service-project-b" {
150148
]
151149

152150
disable_services_on_destroy = "false"
153-
skip_gcloud_download = "true"
154151
}
155152

156153
/******************************************

‎main.tf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,6 @@ module "project-factory" {
5858
disable_services_on_destroy = var.disable_services_on_destroy
5959
default_service_account = var.default_service_account
6060
disable_dependent_services = var.disable_dependent_services
61-
use_tf_google_credentials_env_var = var.use_tf_google_credentials_env_var
62-
skip_gcloud_download = var.skip_gcloud_download
6361
vpc_service_control_attach_enabled = var.vpc_service_control_attach_enabled
6462
vpc_service_control_perimeter_name = var.vpc_service_control_perimeter_name
6563
}

‎modules/core_project_factory/main.tf‎

Lines changed: 5 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -117,98 +117,11 @@ resource "google_compute_shared_vpc_host_project" "shared_vpc_host" {
117117
depends_on = [module.project_services]
118118
}
119119

120-
/******************************************
121-
Default compute service account retrieval
122-
*****************************************/
123-
data "null_data_source" "default_service_account" {
124-
inputs = {
125-
email = "${google_project.main.number}[email protected]"
126-
}
127-
}
128-
129-
/******************************************
130-
Default compute service account deletion
131-
*****************************************/
132-
module "gcloud_delete" {
133-
source = "terraform-google-modules/gcloud/google"
134-
version = "~> 2.0.0"
135-
136-
enabled = var.default_service_account == "delete"
137-
use_tf_google_credentials_env_var = var.use_tf_google_credentials_env_var
138-
139-
skip_download = var.skip_gcloud_download
140-
141-
create_cmd_entrypoint = "${path.module}/scripts/modify-service-account.sh"
142-
create_cmd_body = <<-EOT
143-
--project_id='${google_project.main.project_id}' \
144-
--sa_id='${data.null_data_source.default_service_account.outputs["email"]}' \
145-
--credentials_path='${var.credentials_path}' \
146-
--impersonate-service-account='${var.impersonate_service_account}' \
147-
--action='delete'
148-
EOT
149-
150-
create_cmd_triggers = {
151-
default_service_account = data.null_data_source.default_service_account.outputs["email"]
152-
activated_apis = join(",", local.activate_apis)
153-
project_services = module.project_services.project_id
154-
}
155-
}
156-
157-
/*********************************************
158-
Default compute service account deprivilege
159-
********************************************/
160-
module "gcloud_deprivilege" {
161-
source = "terraform-google-modules/gcloud/google"
162-
version = "~> 2.0.0"
163-
164-
enabled = var.default_service_account == "deprivilege"
165-
use_tf_google_credentials_env_var = var.use_tf_google_credentials_env_var
166-
167-
skip_download = var.skip_gcloud_download
168-
169-
create_cmd_entrypoint = "${path.module}/scripts/modify-service-account.sh"
170-
create_cmd_body = <<-EOT
171-
--project_id='${google_project.main.project_id}' \
172-
--sa_id='${data.null_data_source.default_service_account.outputs["email"]}' \
173-
--credentials_path='${var.credentials_path}' \
174-
--impersonate-service-account='${var.impersonate_service_account}' \
175-
--action='deprivilege'
176-
EOT
177-
178-
create_cmd_triggers = {
179-
default_service_account = data.null_data_source.default_service_account.outputs["email"]
180-
activated_apis = join(",", local.activate_apis)
181-
project_services = module.project_services.project_id
182-
}
183-
}
184-
185-
/******************************************
186-
Default compute service account disable
187-
*****************************************/
188-
module "gcloud_disable" {
189-
source = "terraform-google-modules/gcloud/google"
190-
version = "~> 2.0.0"
191-
192-
enabled = var.default_service_account == "disable"
193-
use_tf_google_credentials_env_var = var.use_tf_google_credentials_env_var
194-
195-
skip_download = var.skip_gcloud_download
196-
197-
create_cmd_entrypoint = "${path.module}/scripts/modify-service-account.sh"
198-
create_cmd_body = <<-EOT
199-
--project_id='${google_project.main.project_id}' \
200-
--sa_id='${data.null_data_source.default_service_account.outputs["email"]}' \
201-
--credentials_path='${var.credentials_path}' \
202-
--impersonate-service-account='${var.impersonate_service_account}' \
203-
--action='disable'
204-
EOT
205-
206-
create_cmd_triggers = {
207-
default_service_account = data.null_data_source.default_service_account.outputs["email"]
208-
activated_apis = join(",", local.activate_apis)
209-
project_services = module.project_services.project_id
210-
}
211-
120+
resource "google_project_default_service_accounts" "default_service_accounts" {
121+
action = upper(var.default_service_account)
122+
project = google_project.main.project_id
123+
restore_policy = "REVERT"
124+
depends_on = [module.project_services]
212125
}
213126

214127
/******************************************

0 commit comments

Comments
 (0)