You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Use a shared workflow from shared-workflows repo
- Create a symbolic link to a default.nix file from shared-workflows repo (using git submodules)
`git submodule add https://github.com/meshcloud/shared-workflows.git ./shared-workflows`
`ln -s ./shared-workflows/terraform-meshplatform-modules/default.nix default.nix`
Copy file name to clipboardExpand all lines: README.md
+33-28Lines changed: 33 additions & 28 deletions
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
# GCP meshPlatform Module
2
2
3
-
Terraform module to integrate GCP as a meshPlatform into meshStack instance. With this module, service accounts used by meshStack are created with the required permissions. The output of this module is a set of credentials that need to be configured in meshStack as described in [meshcloud public docs](https://docs.meshcloud.io/docs/meshstack.how-to.integrate-meshplatform.html).
3
+
Terraform module to integrate GCP as a meshPlatform into meshStack instance. With this module, service accounts used by meshStack are created with the required permissions. The output of this module is a set of credentials that need to be configured in meshStack as described in [meshcloud public docs](https://docs.meshcloud.io/docs/meshstack.how-to.integrate-meshplatform.html).
@@ -57,25 +57,26 @@ To run this module, you need the following:
57
57
58
58
You can create [custom roles](./custom-roles/main.tf) and assign them to the identity applying those modules.
59
59
60
+
Additionally, after the module has run, replicator service account needs to be granted a role in the Admin Console (Workspace). This can only be done by `Super Administrators`.
Additionally, after the module has run, one of the Service Accounts needs to be granted a role in the Admin Console (Workspace). This can only be done by Super Administrators.
64
-
65
-
## How to Use This Module
66
+
Before using this module, you need a gcp project. We recommend creating a new project for meshcloud service accounts.
66
67
67
-
Before using this module, you need a gcp project. We recommend creating a new project for meshcloud service accounts.
68
+
You can create a gcp project by adding this terraform block to your terraform file:
68
69
69
-
You can create a gcp project by adding this terraform block to your terraform file:
70
+
```hcl
71
+
resource "google_project" "meshstack_root" {
72
+
name = <PROJECT_NAME>
73
+
project_id = <PROJECT_ID>
74
+
folder_id = <FOLDER_ID>
75
+
billing_account = <BILLING_ACCOUNT_ID>
76
+
}
77
+
```
70
78
71
-
```hcl
72
-
resource "google_project" "meshstack_root" {
73
-
name = <PROJECT_NAME>
74
-
project_id = <PROJECT_ID>
75
-
folder_id = <FOLDER_ID>
76
-
billing_account = <BILLING_ACCOUNT_ID>
77
-
}
78
-
```
79
+
## How to Use This Module
79
80
80
81
To provide some of the required variables, you will need to
81
82
@@ -90,27 +91,32 @@ To provide some of the required variables, you will need to
90
91
gcloud auth application-default login
91
92
```
92
93
93
-
2.Download the example `main.tf`and `outputs.tf` files.
94
+
2.Create a terraform file that calls this module and produces outputs. Similar to:
94
95
95
-
```sh
96
-
# Downloads main.tf and outputs.tf files into ~/terraform-gcp-meshplatform
> It is highly recommended to configure a [terraform backend](https://developer.hashicorp.com/terraform/language/settings/backends/configuration), otherwise you risk losing track of your applied resources.
109
+
101
110
3. Execute the module.
102
111
103
112
```sh
104
-
# Changes into ~/terraform-gcp-meshplatform and applies terraform
105
-
cd~/terraform-gcp-meshplatform
106
113
terraform init
107
114
terraform apply
108
115
```
109
116
110
-
4. Access terraform output and pass it securely to meshcloud.
117
+
4. Access terraform output to insert it in meshStack platform config.
111
118
112
119
```sh
113
-
# The JSON output contains sensitive values that must not be transmitted to meshcloud in plain text.
114
120
terraform output -json
115
121
```
116
122
@@ -119,20 +125,18 @@ To provide some of the required variables, you will need to
119
125
The replicator service account needs the "Groups Admin" role from the Admin Console (Workspace) to manage permissions for managed GCP projects.
120
126
To authorize the Service Account **via the Google Admin Console** navigate to `@Account` in the sidebar and then `Admin Roles -> Groups Admin` and click `Assign Service Accounts`. In the prompt that appears, enter the service account email, which looks like `user@project.iam.gserviceaccount.com`.
121
127
122
-
## Example Usages
123
-
124
-
Check [examples](./examples/) for different use cases. As a quick start we recommend using [basic-gcp-integration](./examples/basic-gcp-integration) example.
125
-
126
128
## Contributing Guide
127
129
128
-
Before opening a Pull Request, we recommend following the below steps to get a faster approval:
130
+
Before opening a Pull Request, please do the following:
We use pre-commit to perform several terraform related tasks such as `terraform validate`, `terraform fmt`, and generating terraform docs with `terraform_docs`
133
135
134
136
2. Execute `pre-commit install`: Hooks configured in `.pre-commit-config.yaml` will be executed automatically on commit. For manual execution, you can use `pre-commit run -a`.
135
137
138
+
To update git submodules, execute `git submodule foreach git pull`.
139
+
136
140
<!-- BEGIN_TF_DOCS -->
137
141
## Requirements
138
142
@@ -167,6 +171,7 @@ Before opening a Pull Request, we recommend following the below steps to get a f
| <a name="input_billing_account_id"></a> [billing\_account\_id](#input\_billing\_account\_id) | The GCP billing account in your organization. | `string` | n/a | yes |
169
173
| <a name="input_billing_org_id"></a> [billing\_org\_id](#input\_billing\_org\_id) | GCP organization ID that holds billing account. | `string` | n/a | yes |
174
+
| <a name="input_can_delete_projects_in_landing_zone_folder_ids"></a> [can\_delete\_projects\_in\_landing\_zone\_folder\_ids](#input\_can\_delete\_projects\_in\_landing\_zone\_folder\_ids) | The service account will have projectDeleter role only on the specified landing zone IDs. | `set(string)` | `[]` | no |
170
175
| <a name="input_carbon_export_module_enabled"></a> [carbon\_export\_module\_enabled](#input\_carbon\_export\_module\_enabled) | Determines whether or not to include the resources of the carbon footprint export module. | `bool` | `false` | no |
171
176
| <a name="input_cloud_billing_export_dataset_id"></a> [cloud\_billing\_export\_dataset\_id](#input\_cloud\_billing\_export\_dataset\_id) | GCP BigQuery dataset containing the Cloud Billing BigQuery export.<br><br> **ATTENTION**<br> You need to manually configure the billing account big query export before exceuting this module.<br> See https://docs.meshcloud.io/docs/meshstack.how-to.integrate-meshplatform-gcp-manually.html#set-up-gcp-billing-data-export for instructions. | `string` | n/a | yes |
172
177
| <a name="input_cloud_billing_export_project_id"></a> [cloud\_billing\_export\_project\_id](#input\_cloud\_billing\_export\_project\_id) | GCP Project where the BiqQuery table resides that holds the Cloud Billing export to BigQuery. See https://cloud.google.com/billing/docs/how-to/export-data-bigquery | `string` | n/a | yes |
| <aname="input_billing_account_id"></a> [billing\_account\_id](#input\_billing\_account\_id)| The GCP Billing Account in your organization. |`string`| n/a | yes |
38
40
| <aname="input_billing_org_id"></a> [billing\_org\_id](#input\_billing\_org\_id)| GCP Organization Id that holds billing account |`string`| n/a | yes |
41
+
| <aname="input_can_delete_projects_in_landing_zone_folder_ids"></a> [can\_delete\_projects\_in\_landing\_zone\_folder\_ids](#input\_can\_delete\_projects\_in\_landing\_zone\_folder\_ids)| The service account will have projectDeleter role only on the specified landing zone IDs. |`set(string)`|`[]`| no |
39
42
| <aname="input_landing_zone_folder_ids"></a> [landing\_zone\_folder\_ids](#input\_landing\_zone\_folder\_ids)| GCP Folders that make up the Landing Zone. The service account will only receive permissions on these folders. |`set(string)`| n/a | yes |
| <aname="input_project_id"></a> [project\_id](#input\_project\_id)| GCP Project ID where to create the resources. This is typically a 'meshstack-root' project |`string`| n/a | yes |
0 commit comments