Skip to content

Commit 1044f8e

Browse files
mscolnickmscolnick
committed
first commit
0 parents  commit 1044f8e

File tree

10 files changed

+250
-0
lines changed

10 files changed

+250
-0
lines changed

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
.terraform
2+
.terraform.lock.hcl

‎README.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# terraform-dp
2+
3+
Terraform modules to configure your marimo data plane.
4+
5+
## Usage - GCP
6+
7+
1. Create a project in GCP
8+
2. Add the following to your terraform configuration, or copy `modules/gcp/main.tf` to your project.
9+
10+
```hcl
11+
module "marimo_dp" {
12+
source = "github.com/marimo-team/terraform-dp//modules/gcp"
13+
version = "0.1.0"
14+
15+
project_id = "my-project"
16+
region = "us-central1"
17+
}
18+
```

‎development.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Development
2+
3+
## Install
4+
5+
```bash
6+
brew install terraform
7+
```
8+
9+
### Plan
10+
11+
```bash
12+
terraform init
13+
terraform plan
14+
```
15+
16+
## Formatting
17+
18+
```bash
19+
terraform fmt
20+
```
21+
22+
## Validate
23+
24+
```bash
25+
terraform validate
26+
```

‎modules/aws/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# AWS
2+
3+
> [!IMPORTANT]
4+
> In consideration.
5+
> Please reach out to us if you are interested in AWS support. <contact@marimo.io>

‎modules/azure/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Azure
2+
3+
> [!IMPORTANT]
4+
> In consideration.
5+
> Please reach out to us if you are interested in Azure support. <contact@marimo.io>

‎modules/gcp/README.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
## Requirements
2+
3+
| Name | Version |
4+
| ------------------------------------------------------------------------------ | -------------- |
5+
| <a name="requirement_google"></a> [google](#requirement_google) | >= 3.53, < 6.0 |
6+
| <a name="requirement_google-beta"></a> [google-beta](#requirement_google-beta) | >= 3.53, < 6.0 |
7+
8+
## Providers
9+
10+
| Name | Version |
11+
| ------------------------------------------------------------------------ | ------- |
12+
| <a name="provider_google"></a> [google](#provider_google) | 5.10.0 |
13+
| <a name="provider_google-beta"></a> [google-beta](#provider_google-beta) | 5.10.0 |
14+
15+
## Modules
16+
17+
| Name | Source | Version |
18+
| -------------------------------------------------------------------- | --------------------------------------------- | ------- |
19+
| <a name="module_gcs_buckets"></a> [gcs_buckets](#module_gcs_buckets) | terraform-google-modules/cloud-storage/google | ~> 5.0 |
20+
21+
## Resources
22+
23+
| Name | Type |
24+
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
25+
| [google-beta_google_artifact_registry_repository.marimo_apps_docker](https://registry.terraform.io/providers/hashicorp/google-beta/latest/docs/resources/google_artifact_registry_repository) | resource |
26+
| [google_project_iam_member.marimo_cp](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource |
27+
| [google_project_service.project_services](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_service) | resource |
28+
| [google_service_account.marimo_cp](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource |
29+
| [google_service_account_key.marimo_cp](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account_key) | resource |
30+
31+
## Inputs
32+
33+
| Name | Description | Type | Default | Required |
34+
| --------------------------------------------------------------- | ------------------------------------- | ------------- | --------------------------------------------------------------- | :------: |
35+
| <a name="input_labels"></a> [labels](#input_labels) | additional labels to add to resources | `map(string)` | <pre>{<br> "marimo": "true",<br> "terraform": "true"<br>}</pre> | no |
36+
| <a name="input_project_id"></a> [project_id](#input_project_id) | the project ID | `string` | n/a | yes |
37+
| <a name="input_region"></a> [region](#input_region) | the GCP region to deploy to | `string` | n/a | yes |
38+
39+
## Outputs
40+
41+
| Name | Description |
42+
| -------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------- |
43+
| <a name="output_marimo_artifact_registry"></a> [marimo_artifact_registry](#output_marimo_artifact_registry) | the artifact registry for the data plane |
44+
| <a name="output_marimo_cp_service_account"></a> [marimo_cp_service_account](#output_marimo_cp_service_account) | the service account for the control plane |
45+
| <a name="output_marimo_cp_service_account_key"></a> [marimo_cp_service_account_key](#output_marimo_cp_service_account_key) | the service account key for the control plane |

‎modules/gcp/main.tf

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
locals {
2+
roles = [
3+
"roles/run.developer", # Manage cloud run services
4+
"roles/run.invoker", # Invoke cloud run services
5+
"roles/secretmanager.secretAccessor", # Access env secrets
6+
"roles/secretmanager.admin", # Create and manage secrets
7+
"roles/artifactregistry.writer", # Push to docker registry in data plane
8+
"roles/iam.serviceAccountUser", # Impersonate service accounts
9+
"roles/iam.serviceAccountCreator", # Create service accounts
10+
]
11+
12+
activate_apis = [
13+
# Artifact Registry
14+
"artifactregistry.googleapis.com",
15+
# Identity and Access Management (IAM) API
16+
"iam.googleapis.com",
17+
# Secret Manager
18+
"secretmanager.googleapis.com",
19+
# Cloud Run
20+
"run.googleapis.com",
21+
"container.googleapis.com",
22+
# Cloud Storage
23+
"storage-api.googleapis.com",
24+
]
25+
}
26+
27+
# Activate APIs
28+
resource "google_project_service" "project_services" {
29+
for_each = toset(local.activate_apis)
30+
project = var.project_id
31+
service = each.value
32+
disable_on_destroy = false
33+
disable_dependent_services = false
34+
}
35+
36+
# Service account
37+
resource "google_service_account" "marimo_cp" {
38+
depends_on = [google_project_service.project_services]
39+
project = var.project_id
40+
account_id = "marimo-cp"
41+
display_name = "Marimo Control Plane Service Account"
42+
description = "Service account for the control plane to access the data plane"
43+
}
44+
45+
# Service account credentials
46+
resource "google_service_account_key" "marimo_cp" {
47+
depends_on = [google_project_service.project_services]
48+
service_account_id = google_service_account.marimo_cp.name
49+
}
50+
51+
# Add roles to service account
52+
resource "google_project_iam_member" "marimo_cp" {
53+
depends_on = [google_project_service.project_services]
54+
project = var.project_id
55+
for_each = toset(local.roles)
56+
role = each.value
57+
member = "serviceAccount:${google_service_account.marimo_cp.email}"
58+
}
59+
60+
# Docker Registry for Marimo Apps in Data Plane
61+
resource "google_artifact_registry_repository" "marimo_apps_docker" {
62+
depends_on = [google_project_service.project_services]
63+
# Beta provider is required for cleanup_policies
64+
# If you don't want to use cleanup_policies, you can use the google provider
65+
provider = google-beta
66+
location = var.region
67+
repository_id = "marimo-apps"
68+
description = "Marimo Apps Docker Registry"
69+
format = "DOCKER"
70+
project = var.project_id
71+
72+
labels = var.labels
73+
74+
cleanup_policies {
75+
id = "keep-minimum-versions"
76+
action = "KEEP"
77+
most_recent_versions {
78+
keep_count = 2
79+
}
80+
}
81+
}
82+
83+
# GCS Buckets for the data plane
84+
module "gcs_buckets" {
85+
depends_on = [google_project_service.project_services]
86+
# https://registry.terraform.io/modules/terraform-google-modules/cloud-storage/google/latest
87+
source = "terraform-google-modules/cloud-storage/google"
88+
version = "~> 5.0"
89+
project_id = var.project_id
90+
location = var.region
91+
names = [
92+
# App Code Bucket - Stores the code for all Marimo apps, before deployment
93+
"app-code-bucket",
94+
# App Screenshots Bucket - Stores the screenshots for all Marimo apps
95+
"app-screenshots-bucket",
96+
]
97+
# Buckets are globally unique in GCP
98+
prefix = var.project_id
99+
set_admin_roles = true
100+
admins = ["serviceAccount:${google_service_account.marimo_cp.email}"]
101+
versioning = {}
102+
labels = var.labels
103+
}

‎modules/gcp/outputs.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
output "marimo_cp_service_account" {
2+
description = "the service account for the control plane"
3+
value = google_service_account.marimo_cp.email
4+
}
5+
6+
output "marimo_cp_service_account_key" {
7+
description = "the service account key for the control plane"
8+
sensitive = true
9+
value = google_service_account_key.marimo_cp.private_key
10+
}
11+
12+
output "marimo_artifact_registry" {
13+
description = "the artifact registry for the data plane"
14+
value = google_artifact_registry_repository.marimo_apps_docker.name
15+
}

‎modules/gcp/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
variable "project_id" {
2+
description = "the project ID"
3+
type = string
4+
}
5+
6+
variable "region" {
7+
description = "the GCP region to deploy to"
8+
type = string
9+
}
10+
11+
variable "labels" {
12+
description = "additional labels to add to resources"
13+
type = map(string)
14+
default = {
15+
marimo = "true"
16+
terraform = "true"
17+
}
18+
}

‎modules/gcp/versions.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
terraform {
2+
required_providers {
3+
google = {
4+
source = "hashicorp/google"
5+
version = ">= 3.53, < 6.0"
6+
}
7+
8+
google-beta = {
9+
source = "hashicorp/google-beta"
10+
version = ">= 3.53, < 6.0"
11+
}
12+
}
13+
}

0 commit comments

Comments
 (0)