Skip to content

Commit bf0c6e6

Browse files
amandakarinaapeabody
amandakarina
and
apeabody
authored
feat: adds validations, replace_me placeholders (#489)
Co-authored-by: Andrew Peabody <[email protected]>
1 parent 7f67680 commit bf0c6e6

File tree

6 files changed

+641
-116
lines changed

6 files changed

+641
-116
lines changed

‎helpers/eab-deployer/gcp/gcp.go‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
package gcp
1616

1717
import (
18+
"encoding/base64"
1819
"fmt"
1920
"maps"
2021
"slices"
@@ -228,3 +229,39 @@ func (g GCP) IsApiEnabled(t testing.TB, project, api string) bool {
228229
filter := fmt.Sprintf("config.name=%s", api)
229230
return len(g.Runf(t, "services list --enabled --project %s --filter %s", project, filter).Array()) > 0
230231
}
232+
233+
// IsApiEnabled checks if the api is enabled in the given project
234+
func (g GCP) GetSecretValue(t testing.TB, secretID string) string {
235+
secret := g.Runf(t, "secrets versions access %s/versions/latest", secretID)
236+
decoded, err := base64.StdEncoding.DecodeString(secret.Get("payload.data").String())
237+
if err != nil {
238+
fmt.Printf("Error decoding string: %s", err.Error())
239+
}
240+
return string(decoded)
241+
}
242+
243+
// IsComponentInstalled checks if a given gcloud component is installed
244+
func (g GCP) IsComponentInstalled(t testing.TB, componentID string) bool {
245+
filter := fmt.Sprintf("\"id='%s'\"", componentID)
246+
components := g.Runf(t, "components list --filter %s", filter).Array()
247+
if len(components) == 0 {
248+
return false
249+
}
250+
return components[0].Get("state.name").String() != "Not Installed"
251+
}
252+
253+
func (g GCP) GetRolePermissions(t testing.TB, roleName string) ([]string, error) {
254+
result := g.Runf(t, "iam roles describe %s", roleName)
255+
256+
permissions := []string{}
257+
for _, permission := range result.Get("includedPermissions").Array() {
258+
permissions = append(permissions, permission.String())
259+
}
260+
return permissions, nil
261+
}
262+
263+
func (g GCP) GetAuthToken(t testing.TB) string {
264+
result := g.Runf(t, "auth print-access-token")
265+
266+
return result.Get("token").String()
267+
}

‎helpers/eab-deployer/global.tfvars.example‎

Lines changed: 70 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -28,63 +28,58 @@ buckets_force_destroy = true
2828
deletion_protection = false
2929

3030
infra_cloudbuildv2_repository_config = {
31-
repo_type = "GITHUBv2"
31+
github_app_id_secret_id = "projects/REPLACE_ME/secrets/github-app-id"
32+
github_secret_id = "projects/REPLACE_ME/secrets/github-pat"
33+
gitlab_authorizer_credential_secret_id = ""
34+
gitlab_enterprise_ca_certificate = ""
35+
gitlab_enterprise_host_uri = ""
36+
gitlab_enterprise_service_directory = ""
37+
gitlab_read_authorizer_credential_secret_id = ""
38+
gitlab_webhook_secret_id = ""
39+
repo_type = "GITHUBv2"
3240
repositories = {
33-
multitenant = {
34-
repository_name = "eab-multitenant"
35-
repository_url = "https://github.com/USER/eab-multitenant.git"
36-
},
3741
applicationfactory = {
3842
repository_name = "eab-appfactory"
39-
repository_url = "https://github.com/USER/eab-appfactory.git"
40-
},
43+
repository_url = "https://github.com/REPLACE_ME/eab-appfactory.git"
44+
}
4145
fleetscope = {
4246
repository_name = "eab-fleetscope"
43-
repository_url = "https://github.com/USER/eab-fleetscope.git"
44-
},
47+
repository_url = "https://github.com/REPLACE_ME/eab-fleetscope.git"
48+
}
4549
hello-world = {
4650
repository_name = "hello-world-admin"
47-
repository_url = "https://github.com/USER/hello-world-admin.git"
51+
repository_url = "https://github.com/REPLACE_ME/hello-world-admin.git"
52+
}
53+
multitenant = {
54+
repository_name = "eab-multitenant"
55+
repository_url = "https://github.com/REPLACE_ME/eab-multitenant.git"
4856
}
4957
}
50-
# The Secret ID format is: projects/PROJECT_NUMBER/secrets/SECRET_NAME
51-
gitlab_authorizer_credential_secret_id = null
52-
gitlab_read_authorizer_credential_secret_id = null
53-
gitlab_webhook_secret_id = null
54-
# If you are using a self-hosted instance, you may change the URL below accordingly
55-
gitlab_enterprise_host_uri = null
56-
# Format is projects/PROJECT/locations/LOCATION/namespaces/NAMESPACE/services/SERVICE
57-
gitlab_enterprise_service_directory = null
58-
# .pem string
59-
gitlab_enterprise_ca_certificate = null
60-
secret_project_id = "SECRET_PROJECT_ID"
61-
62-
github_app_id_secret_id = "projects/SECRET_PROJECT_NUMER/secrets/github-app-id"
63-
github_secret_id = "projects/SECRET_PROJECT_NUMER/secrets/github-pat"
58+
secret_project_id = "REPLACE_ME"
6459
}
6560

6661
app_services_cloudbuildv2_repository_config = {
6762
repo_type = "GITHUBv2"
6863
repositories = {
6964
eab-default-example-hello-world = {
7065
repository_name = "hello-world-i-r"
71-
repository_url = "https://github.com/USER/hello-world-i-r.git"
66+
repository_url = "https://github.com/REPLACE_ME/hello-world-i-r.git"
7267
}
7368
}
7469
# The Secret ID format is: projects/PROJECT_NUMBER/secrets/SECRET_NAME
75-
gitlab_authorizer_credential_secret_id = null
76-
gitlab_read_authorizer_credential_secret_id = null
77-
gitlab_webhook_secret_id = null
70+
gitlab_authorizer_credential_secret_id = ""
71+
gitlab_read_authorizer_credential_secret_id = ""
72+
gitlab_webhook_secret_id = ""
7873
# If you are using a self-hosted instance, you may change the URL below accordingly
79-
gitlab_enterprise_host_uri = null
74+
gitlab_enterprise_host_uri = ""
8075
# Format is projects/PROJECT/locations/LOCATION/namespaces/NAMESPACE/services/SERVICE
81-
gitlab_enterprise_service_directory = null
76+
gitlab_enterprise_service_directory = ""
8277
# .pem string
83-
gitlab_enterprise_ca_certificate = null
84-
secret_project_id = "SECRET_PROJECT_ID"
78+
gitlab_enterprise_ca_certificate = ""
79+
secret_project_id = "REPLACE_ME"
8580

86-
github_app_id_secret_id = "projects/SECRET_PROJECT_NUMER/secrets/github-app-id"
87-
github_secret_id = "projects/SECRET_PROJECT_NUMER/secrets/github-pat"
81+
github_app_id_secret_id = "projects/REPLACE_ME/secrets/REPLACE_ME"
82+
github_secret_id = "projects/REPLACE_ME/secrets/REPLACE_ME"
8883
}
8984

9085

@@ -95,12 +90,13 @@ app_services_cloudbuildv2_repository_config = {
9590
// 1-bootstrap inputs
9691
// https://github.com/GoogleCloudPlatform/terraform-google-enterprise-application/tree/main/1-bootstrap#inputs
9792

98-
common_folder_id = "folders/COMMON_FOLDER_NUMBER"
99-
project_id = "SEED_PROJECT_ID"
100-
workerpool_id = "projects/WORKERPOOL_PROJECT_ID/locations/REGION/workerPools/CB_PRIVATE_WORKERPOOL_NAME"
101-
bucket_kms_key = "projects/KMS_PROJECT_ID/locations/REGION/keyRings/KEYRING_NAME/cryptoKeys/KEY_NAME"
102-
logging_bucket = "BUCKET_LOGGIN_NAME"
103-
kms_project_id ="KMS_PROJECT_ID"
93+
94+
common_folder_id = "folders/REPLACE_ME"
95+
project_id = "REPLACE_ME"
96+
workerpool_id = "projects/REPLACE_ME/locations/REPLACE_ME/workerPools/REPLACE_ME"
97+
bucket_kms_key = "projects/REPLACE_ME/locations/REPLACE_ME/keyRings/KEYRING_NAME/cryptoKeys/REPLACE_ME"
98+
logging_bucket = "REPLACE_ME"
99+
kms_project_id ="REPLACE_ME"
104100

105101
// 2-multitenant inputs
106102
apps = {
@@ -113,50 +109,50 @@ apps = {
113109

114110
envs = {
115111
"development" = {
116-
"billing_account" = "000000-000000-000000"
117-
"folder_id" = "folders/FOLDER_ID"
118-
"network_project_id" = "DEV_NETWORK_PROJECT_ID"
119-
"network_self_link" = "https://www.googleapis.com/compute/v1/projects/DEV_NETWORK_PROJECT_ID/global/networks/vpc-eab-vpc-development"
120-
"org_id" = "000000000000"
112+
"billing_account" = "REPLACE_ME"
113+
"folder_id" = "folders/REPLACE_ME"
114+
"network_project_id" = "REPLACE_ME"
115+
"network_self_link" = "https://www.googleapis.com/compute/v1/projects/REPLACE_ME/global/networks/vpc-eab-vpc-development"
116+
"org_id" = "REPLACE_ME"
121117
"subnets_self_links" = [
122-
"https://www.googleapis.com/compute/v1/projects/DEV_NETWORK_PROJECT_ID/regions/REGION/subnetworks/eab-development-REGION",
123-
"https://www.googleapis.com/compute/v1/projects/DEV_NETWORK_PROJECT_ID/regions/REGION2/subnetworks/eab-development-REGION2",
118+
"https://www.googleapis.com/compute/v1/projects/REPLACE_ME/regions/REPLACE_ME/subnetworks/eab-development-REPLACE_ME",
119+
"https://www.googleapis.com/compute/v1/projects/REPLACE_ME/regions/REPLACE_ME/subnetworks/eab-development-REPLACE_ME",
124120
]
125121
}
126122
"nonproduction" = {
127-
"billing_account" = "000000-000000-000000"
128-
"folder_id" = "folders/FOLDER_ID"
129-
"network_project_id" = "NONPROD_NETWORK_PROJECT_ID"
130-
"network_self_link" = "https://www.googleapis.com/compute/v1/projects/NONPROD_NETWORK_PROJECT_ID/global/networks/vpc-eab-vpc-nonproduction"
131-
"org_id" = "000000000000"
123+
"billing_account" = "REPLACE_ME"
124+
"folder_id" = "folders/REPLACE_ME"
125+
"network_project_id" = "REPLACE_ME"
126+
"network_self_link" = "https://www.googleapis.com/compute/v1/projects/REPLACE_ME/global/networks/vpc-eab-vpc-nonproduction"
127+
"org_id" = "REPLACE_ME"
132128
"subnets_self_links" = [
133-
"https://www.googleapis.com/compute/v1/projects/NONPROD_NETWORK_PROJECT_ID/regions/REGION/subnetworks/eab-nonproduction-REGION",
134-
"https://www.googleapis.com/compute/v1/projects/NONPROD_NETWORK_PROJECT_ID/regions/REGION2/subnetworks/eab-nonproduction-REGION2",
129+
"https://www.googleapis.com/compute/v1/projects/REPLACE_ME/regions/REPLACE_ME/subnetworks/eab-nonproduction-REPLACE_ME",
130+
"https://www.googleapis.com/compute/v1/projects/REPLACE_ME/regions/REPLACE_ME/subnetworks/eab-nonproduction-REPLACE_ME",
135131
]
136132
}
137133
"production" = {
138-
"billing_account" = "000000-000000-000000"
139-
"folder_id" = "folders/FOLDER_ID"
140-
"network_project_id" = "PROD_NETWORK_PROJECT_ID"
141-
"network_self_link" = "https://www.googleapis.com/compute/v1/projects/PROD_NETWORK_PROJECT_ID/global/networks/vpc-eab-vpc-production"
142-
"org_id" = "000000000000"
134+
"billing_account" = "REPLACE_ME"
135+
"folder_id" = "folders/REPLACE_ME"
136+
"network_project_id" = "REPLACE_ME"
137+
"network_self_link" = "https://www.googleapis.com/compute/v1/projects/REPLACE_ME/global/networks/vpc-eab-vpc-production"
138+
"org_id" = "REPLACE_ME"
143139
"subnets_self_links" = [
144-
"https://www.googleapis.com/compute/v1/projects/PROD_NETWORK_PROJECT_ID/regions/REGION/subnetworks/eab-production-REGION",
145-
"https://www.googleapis.com/compute/v1/projects/PROD_NETWORK_PROJECT_ID/regions/REGION2/subnetworks/eab-production-REGION2",
140+
"https://www.googleapis.com/compute/v1/projects/REPLACE_ME/regions/REPLACE_ME/subnetworks/eab-production-REPLACE_ME",
141+
"https://www.googleapis.com/compute/v1/projects/REPLACE_ME/regions/REPLACE_ME/subnetworks/eab-production-REPLACE_ME",
146142
]
147143
}
148144
}
149145

150146
// 3-fleetscope inputs
151147

152148
namespace_ids = {
153-
"hw-example" = "hw-example@DOMAIN.com"
149+
"hw-example" = "hw-example@example.com"
154150
}
155151

156-
remote_state_bucket = "REMOTE_STATE_BUCKET"
152+
remote_state_bucket = "REPLACE_ME"
157153
attestation_evaluation_mode = "ALWAYS_ALLOW"
158-
attestation_kms_key = "projects/ATTESTATION_PROJECT_ID/locations/REGION/keyRings/KMS_KEYRING_ATTESTATION_NAME/cryptoKeys/KMS_ATTESTATION_KEY_NAME"
159-
attestation_kms_project = "ATTESTATION_PROJECT_ID"
154+
attestation_kms_key = "projects/REPLACE_ME/locations/REPLACE_ME/keyRings/REPLACE_ME/cryptoKeys/REPLACE_ME"
155+
attestation_kms_project = "REPLACE_ME"
160156
enable_kueue = false
161157
config_sync_branch = ""
162158
config_sync_repository_url = ""
@@ -165,32 +161,32 @@ disable_istio_on_namespaces = []
165161

166162
// 4-appfactory
167163

168-
billing_account = "000000-000000-000000"
169-
org_id = "000000000000"
164+
billing_account = "REPLACE_ME"
165+
org_id = "REPLACE_ME"
170166

171167
infra_project_apis = [
172168
"iam.googleapis.com",
173169
"cloudresourcemanager.googleapis.com",
174170
"serviceusage.googleapis.com",
175171
"cloudbilling.googleapis.com"
176172
]
177-
service_perimeter_name = "accessPolicies/ACCESS_POLICY_ID/servicePerimeters/PERIMETER_NAME"
173+
service_perimeter_name = "accessPolicies/REPLACE_ME/servicePerimeters/REPLACE_ME"
178174
service_perimeter_mode = "DRY_RUN"
179-
access_level_name = "accessPolicies/ACCESS_POLICY_ID/accessLevels/ACCESS_LEVEL_NAME"
175+
access_level_name = "accessPolicies/REPLACE_ME/accessLevels/REPLACE_ME"
180176
applications = {
181177
"default-example" = {
182178
"hello-world" = {
183179
create_infra_project = false
184180
create_admin_project = true
185-
admin_project_id = null
181+
admin_project_id = ""
186182
}
187183
}
188184
}
189-
cb_private_workerpool_project_id = "SECRET_PROJECT_ID"
190-
location = "REGION"
185+
cb_private_workerpool_project_id = "REPLACE_ME"
186+
location = "REPLACE_ME"
191187

192188
// 5-appinfra
193189

194-
region = "REGION"
195-
trigger_location = "REGION"
190+
region = "REPLACE_ME"
191+
trigger_location = "REPLACE_ME"
196192
bucket_prefix = "bkt"

‎helpers/eab-deployer/main.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,8 +101,15 @@ func main() {
101101

102102
// validate inputs
103103
if cfg.validate {
104+
stages.ValidateComponents(t)
104105
stages.ValidateBasicFields(t, globalTFVars)
105106
stages.ValidateDestroyFlags(t, globalTFVars)
107+
stages.ValidatePermissions(t, globalTFVars)
108+
stages.ValidateRequiredAPIs(t, globalTFVars)
109+
stages.ValidateRepositories(t, globalTFVars)
110+
stages.ValidateNetworkRequirementes(t, globalTFVars)
111+
stages.ValidatePrivateWorkerPoolRequirementes(t, globalTFVars)
112+
stages.ValidateVPCSCRequirements(t, globalTFVars)
106113
return
107114
}
108115

‎helpers/eab-deployer/stages/apply.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ func DeployAppFactoryStage(t testing.TB, s steps.Steps, tfvars GlobalTFVars, out
209209
CloudbuildV2RepositoryConfig: tfvars.InfraCloudbuildV2RepositoryConfig,
210210
KMSProjectID: tfvars.KMSProjectID,
211211
ServicePerimeterName: tfvars.ServicePerimeterName,
212-
ServicePerimeterMode: *tfvars.ServicePerimeterMode,
212+
ServicePerimeterMode: tfvars.ServicePerimeterMode,
213213
InfraProjectAPIs: tfvars.InfraProjectAPIs,
214214
}
215215
err := utils.WriteTfvars(filepath.Join(c.EABPath, AppFactoryStep, "terraform.tfvars"), appFactory)

0 commit comments

Comments
 (0)