Skip to content

Commit c324b43

Browse files
avozicovavozicov
authored
Merge pull request #2 from TerraHubCorp/dev
Building new production release
2 parents 856c186 + fff680c commit c324b43

38 files changed

+664
-2
lines changed

‎.terrahub.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
## project config
2+
project:
3+
name: demo-terraform-google
4+
code: f2754a99
5+
provider: google
6+
include:
7+
- '.'
8+
exclude:
9+
- '**/.terraform/*'
10+
- '**/node_modules/*'
11+
12+
## terraform config
13+
terraform:
14+
varFile:
15+
- default.tfvars
16+
var:
17+
google_project_id: project-123456789012
18+
google_region: us-central1
19+
google_org_id: 123456789012
20+
google_service_account_name: demo-team
21+
google_billing_account: 123456-ABCDEF-ZYXWVU
22+
google_location_id: us-central
23+
version: 0.11.7

‎README.md

Lines changed: 202 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,202 @@
1-
# terraform-demo-google
2-
Terraform Demo using Google provider
1+
# Terraform Demo using Google provider
2+
3+
## Login to Google Cloud
4+
5+
Run the following command in terminal:
6+
```shell
7+
gcloud auth login
8+
```
9+
10+
> NOTE: If you don't have Google Cloud CLI, check out
11+
[installation guide](https://cloud.google.com/sdk/install)
12+
13+
## Setup Environment Variables (Will Be Used Later)
14+
15+
Manual Setup (set values in double quotes and run the following command in terminal):
16+
```shell
17+
export GOOGLE_CLOUD_PROJECT="" ## e.g. terrahub-123456
18+
export GOOGLE_APPLICATION_CREDENTIALS="" ## e.g. ${HOME}/.config/gcloud/terraform.json
19+
export ORG_ID="" ## e.g. 123456789012
20+
export BILLING_ID="" ## e.g. 123456-ABCDEF-ZYXWVU
21+
export PROJECT_NAME="" ## e.g. TerraHub
22+
export IAM_NAME="" ## e.g. terraform
23+
export IAM_DESC="" ## e.g. terraform service account
24+
```
25+
26+
### Setup ORG_ID Programmatically
27+
28+
Automated Setup (run the following command in terminal):
29+
```shell
30+
export ORG_ID="$(gcloud organizations list --format=json | jq '.[0].name[14:]')"
31+
```
32+
33+
> NOTE: If you don't have JQ CLI, check out
34+
[installation guide](https://stedolan.github.io/jq/download/)
35+
36+
### Setup BILLING_ID Programmatically
37+
38+
Automated Setup (run the following command in terminal):
39+
```shell
40+
export BILLING_ID="$(gcloud beta billing accounts list --format=json | jq '.[0].name[16:]')"
41+
```
42+
43+
> NOTE: If you don't have JQ CLI, check out
44+
[installation guide](https://stedolan.github.io/jq/download/)
45+
46+
## Create Google Cloud Project & Billing
47+
48+
Run the following command in terminal:
49+
```shell
50+
gcloud projects create ${GOOGLE_CLOUD_PROJECT} \
51+
--name="${PROJECT_NAME}" \
52+
--organization="${ORG_ID}" \
53+
--set-as-default
54+
55+
gcloud config set project ${GOOGLE_CLOUD_PROJECT}
56+
57+
gcloud services enable cloudresourcemanager.googleapis.com
58+
gcloud services enable cloudbilling.googleapis.com
59+
gcloud services enable iam.googleapis.com
60+
gcloud services enable compute.googleapis.com
61+
62+
gcloud beta billing projects link ${GOOGLE_CLOUD_PROJECT} \
63+
--billing-account="${BILLING_ID}"
64+
```
65+
66+
Your output should be similar to the one below:
67+
```
68+
```
69+
70+
## Create Google Cloud IAM Service Account & Key
71+
72+
Run the following command in terminal:
73+
```shell
74+
gcloud iam service-accounts create ${IAM_NAME} \
75+
--display-name="${IAM_DESC}"
76+
77+
gcloud iam service-accounts keys create ${GOOGLE_APPLICATION_CREDENTIALS} \
78+
--iam-account="${IAM_NAME}@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com"
79+
```
80+
81+
Your output should be similar to the one below:
82+
```
83+
```
84+
85+
## Add IAM Policy Binding to Google Cloud Project
86+
87+
Run the following command in terminal:
88+
```shell
89+
gcloud projects add-iam-policy-binding ${GOOGLE_CLOUD_PROJECT} \
90+
--member="serviceAccount:${IAM_NAME}@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com" \
91+
--role="roles/editor"
92+
```
93+
94+
Your output should be similar to the one below:
95+
```
96+
```
97+
98+
## Add IAM Policy Binding to Google Cloud Organization
99+
100+
Run the following command in terminal:
101+
```shell
102+
gcloud organizations add-iam-policy-binding ${ORG_ID} \
103+
--member="serviceAccount:${IAM_NAME}@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com" \
104+
--role="roles/resourcemanager.projectCreator"
105+
106+
gcloud organizations add-iam-policy-binding ${ORG_ID} \
107+
--member="serviceAccount:${IAM_NAME}@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com" \
108+
--role="roles/billing.user"
109+
```
110+
111+
Your output should be similar to the one below:
112+
```
113+
```
114+
115+
## Create Terraform Configurations Using TerraHub
116+
117+
Run the following commands in terminal:
118+
```shell
119+
terrahub --help | head -3
120+
```
121+
122+
Your output should be similar to the one below:
123+
```
124+
Usage: terrahub [command] [options]
125+
126+
terrahub@0.0.28 (built: 2018-10-11T12:33:57.775Z)
127+
```
128+
129+
> NOTE: If you don't have TerraHub CLI, check out
130+
[installation guide](https://www.npmjs.com/package/terrahub)
131+
132+
Run the following command in terminal:
133+
```shell
134+
mkdir demo-terraform-google
135+
cd demo-terraform-google
136+
terrahub project -n demo-terraform-google
137+
```
138+
139+
Your output should be similar to the one below:
140+
```
141+
✅ Project successfully initialized
142+
```
143+
144+
## Create TerraHub Components
145+
146+
Run the following command in terminal:
147+
```shell
148+
terrahub component -t google_project -n project
149+
terrahub component -t google_service_account -n service_account -o ../project
150+
terrahub component -t google_service_account_key -n service_account_key -o ../service_account
151+
terrahub component -t google_project_iam_member -n project_iam_member -o ../project
152+
terrahub component -t google_project_iam_binding -n project_iam_policy_binding_storage_admin -o ../project_iam_member
153+
terrahub component -t google_project_iam_binding -n project_iam_policy_binding_compute_admin -o ../project_iam_member
154+
```
155+
156+
Your output should be similar to the one below:
157+
```
158+
✅ Done
159+
```
160+
161+
## Visualize TerraHub Components
162+
163+
Run the following command in terminal:
164+
```shell
165+
terrahub graph
166+
```
167+
168+
Your output should be similar to the one below:
169+
```
170+
Project: demo-terraform-google
171+
└─ project [path: ./project]
172+
├─ project_iam_member [path: ./project_iam_member]
173+
│ ├─ project_iam_binding_compute_admin [path: ./project_iam_binding_compute_admin]
174+
│ └─ project_iam_binding_storage_admin [path: ./project_iam_binding_storage_admin]
175+
└─ service_account [path: ./service_account]
176+
└─ service_account_key [path: ./service_account_key]
177+
```
178+
179+
## Update Project Config
180+
181+
Run the following command in terminal:
182+
```shell
183+
terrahub configure -c terraform.var.google_org_id="${ORG_ID}"
184+
terrahub configure -c terraform.var.google_billing_account="${BILLING_ID}"
185+
terrahub configure -c terraform.var.google_project_id="${GOOGLE_CLOUD_PROJECT}"
186+
```
187+
188+
Your output should be similar to the one below:
189+
```
190+
✅ Done
191+
```
192+
193+
## Run TerraHub Automation
194+
195+
Run the following command in terminal:
196+
```shell
197+
terrahub run -a -y
198+
```
199+
200+
Your output should be similar to the one below:
201+
```
202+
```

‎project/.terrahub.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## local config
2+
component:
3+
name: 'project'
4+
5+
ci:
6+
mapping:
7+
- '.'

‎project/README.md

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# google_project
2+
3+
Allows creation and management of a Google Cloud Platform project.
4+
5+
Projects created with this resource must be associated with an Organization. See the Organization documentation for more details.
6+
7+
The service account used to run Terraform when creating a google_project resource must have roles/resourcemanager.projectCreator. See the Access Control for Organizations Using IAM doc for more information.
8+
9+
Note that prior to 0.8.5, google_project functioned like a data source, meaning any project referenced by it had to be created and managed outside Terraform. As of 0.8.5, google_project functions like any other Terraform resource, with Terraform creating and managing the project. To replicate the old behavior, either:
10+
11+
- Use the project ID directly in whatever is referencing the project, using the google_project_iam_policy to replace the old policy_data property.
12+
- Use the import functionality to import your pre-existing project into Terraform, where it can be referenced and used just like always, keeping in mind that Terraform will attempt to undo any changes made outside Terraform.
13+
14+
It's important to note that any project resources that were added to your Terraform config prior to 0.8.5 will continue to function as they always have, and will not be managed by Terraform. Only newly added projects are affected.
15+
16+
## input variables
17+
18+
| Name | Description | Type | Default | Required |
19+
|------|-------------|:----:|:-----:|:-----:|
20+
|google_project_name|The display name of the project.|string|project|No|
21+
|google_project_id|The project ID. Changing this forces a new project to be created.|string|project-f2754a99|No|
22+
|google_org_id|The numeric ID of the organization this project belongs to. Changing this forces a new project to be created. Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization.|string||No|
23+
|google_project_folder_id|The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder.|string||No|
24+
|google_billing_account|The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details.|string||No|
25+
|google_project_skip_delete|If true, the Terraform resource can be deleted without deleting the Project via the Google API.|boolean|false|No|
26+
|google_project_auto_create_network|If true, the Terraform resource can be deleted without deleting the Project via the Google API.|boolean|false|No|
27+
|google_location_id|The location to serve the app from.|string|us-central|No|
28+
|custom_labels|Custom labels. A set of key/value label pairs to assign to the project.|map||No|
29+
|default_labels|Default labels. A set of key/value label pairs to assign to the project.|map|{"ThubName"= "project","ThubCode"= "f2754a99","ThubEnv"= "default","Description" = "Managed by TerraHub"}|No|
30+
31+
## output parameters
32+
33+
| Name | Description | Type |
34+
|------|-------------|:----:|
35+
|number|The numeric identifier of the project.|string|

‎project/main.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
resource "google_project" "project" {
2+
name = "${var.google_project_name}"
3+
project_id = "${var.google_project_id}"
4+
org_id = "${var.google_org_id}"
5+
folder_id = "${var.google_project_folder_id}"
6+
billing_account = "${var.google_billing_account}"
7+
#skip_delete = "${var.google_project_skip_delete}"
8+
auto_create_network = "${var.google_project_auto_create_network}"
9+
10+
#app_engine = {
11+
# location_id = "${var.google_location_id}"
12+
#}
13+
14+
labels = "${merge(var.default_labels, var.custom_labels)}"
15+
}

‎project/output.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Define list of variables to be output
2+
3+
output "number" {
4+
value = "${google_project.project.number}"
5+
}

‎project/provider.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
provider "google" {
2+
}

‎project/variables.tf

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Define list of variables to be used in main.tf
2+
3+
#############
4+
# top level #
5+
#############
6+
variable "google_project_name" {
7+
description = "The display name of the project."
8+
}
9+
10+
variable "google_project_id" {
11+
description = "The project ID. Changing this forces a new project to be created."
12+
}
13+
14+
variable "google_org_id" {
15+
description = "The numeric ID of the organization this project belongs to. Changing this forces a new project to be created. Only one of org_id or folder_id may be specified. If the org_id is specified then the project is created at the top level. Changing this forces the project to be migrated to the newly specified organization."
16+
}
17+
18+
variable "google_project_folder_id" {
19+
description = "The numeric ID of the folder this project should be created under. Only one of org_id or folder_id may be specified. If the folder_id is specified, then the project is created under the specified folder. Changing this forces the project to be migrated to the newly specified folder."
20+
}
21+
22+
variable "google_billing_account" {
23+
description = "The alphanumeric ID of the billing account this project belongs to. The user or service account performing this operation with Terraform must have Billing Account Administrator privileges (roles/billing.admin) in the organization. See Google Cloud Billing API Access Control for more details."
24+
}
25+
26+
variable "google_project_skip_delete" {
27+
description = "If true, the Terraform resource can be deleted without deleting the Project via the Google API."
28+
}
29+
30+
variable "google_project_auto_create_network" {
31+
description = "If true, the Terraform resource can be deleted without deleting the Project via the Google API."
32+
}
33+
34+
variable "google_location_id" {
35+
description = "The location to serve the app from."
36+
}
37+
38+
##########
39+
# labels #
40+
##########
41+
variable "custom_labels" {
42+
type = "map"
43+
description = "Custom labels. A set of key/value label pairs to assign to the project."
44+
default = {}
45+
}
46+
47+
variable "default_labels" {
48+
type = "map"
49+
description = "Default labels. A set of key/value label pairs to assign to the project."
50+
default = {}
51+
}
52+

‎project_iam_binding_compute_admin/.terrahub.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
## local config
2+
component:
3+
name: 'project_iam_binding_compute_admin'
4+
dependsOn:
5+
- '../project_iam_member'
6+
7+
ci:
8+
mapping:
9+
- '.'

‎project_iam_binding_compute_admin/README.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# google_project_iam_binding
2+
3+
Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the project are preserved.
4+
5+
Note: google_project_iam_binding resources can be used in conjunction with google_project_iam_member resources only if they do not grant privilege to the same role.
6+
7+
## input variables
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|:----:|:-----:|:-----:|
11+
|google_project_id|The project ID. If not specified, uses the ID of the project configured with the provider.|string||Yes|
12+
|google_project_role|The project ID. If not specified, uses the ID of the project configured with the provider.|string|roles/viewer|No|
13+
|google_project_members|Identities that will be granted the privilege in role.|list|[]|No|
14+
15+
## output parameters
16+
17+
| Name | Description | Type |
18+
|------|-------------|:----:|
19+
|etag|The etag of the project's IAM policy.|string|

0 commit comments

Comments
 (0)