Skip to content

Commit 02bf581

Browse files
bharathkkbbharathkkb
authored
feat: migrate to GAR for runner images (#94)
1 parent e04ab65 commit 02bf581

File tree

14 files changed

+124
-36
lines changed

14 files changed

+124
-36
lines changed

‎examples/cloudbuild_enabled/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,6 @@ This example combines the Organization bootstrap module with the Cloud Build sub
2727
| seed\_project\_id | Project where service accounts and core APIs will be enabled. |
2828
| terraform\_sa\_email | Email for privileged service account for Terraform. |
2929
| terraform\_sa\_name | Fully qualified name for privileged service account for Terraform. |
30+
| tf\_runner\_artifact\_repo | GAR Repo created to store runner images |
3031

3132
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/cloudbuild_enabled/main.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ provider "google" {
1919
version = ">= 3.50"
2020
}
2121

22+
provider "google-beta" {
23+
version = ">= 3.50"
24+
}
25+
2226
provider "null" {
2327
version = "~> 2.1"
2428
}

‎examples/cloudbuild_enabled/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,3 +58,8 @@ output "kms_crypto_key" {
5858
description = "KMS key created by the module."
5959
value = module.cloudbuild_bootstrap.kms_crypto_key
6060
}
61+
62+
output "tf_runner_artifact_repo" {
63+
description = "GAR Repo created to store runner images"
64+
value = module.cloudbuild_bootstrap.tf_runner_artifact_repo
65+
}

‎kitchen.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,3 +58,7 @@ suites:
5858
controls:
5959
- bootstrap
6060
- cloudbuild
61+
- name: cloudbuild_enabled gcloud
62+
backend: local
63+
controls:
64+
- gcloud

‎modules/cloudbuild/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ Functional examples and sample Cloud Build definitions are included in the [exam
5959
| create\_cloud\_source\_repos | If shared Cloud Source Repos should be created. | `bool` | `true` | no |
6060
| default\_region | Default region to create resources where applicable. | `string` | `"us-central1"` | no |
6161
| folder\_id | The ID of a folder to host this project | `string` | `""` | no |
62+
| gar\_repo\_name | Custom name to use for GAR repo. | `string` | `""` | no |
6263
| group\_org\_admins | Google Group for GCP Organization Administrators | `string` | n/a | yes |
6364
| org\_id | GCP Organization ID | `string` | n/a | yes |
6465
| project\_id | Custom project ID to use for project created. | `string` | `""` | no |
@@ -83,6 +84,7 @@ Functional examples and sample Cloud Build definitions are included in the [exam
8384
| gcs\_bucket\_cloudbuild\_artifacts | Bucket used to store Cloud/Build artefacts in CloudBuild project. |
8485
| kms\_crypto\_key | KMS key created by the module. |
8586
| kms\_keyring | KMS Keyring created by the module. |
87+
| tf\_runner\_artifact\_repo | GAR Repo created to store runner images |
8688

8789
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8890

‎modules/cloudbuild/cloudbuild_builder/cloudbuild.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,16 @@ steps:
1818
- name: 'gcr.io/cloud-builders/docker'
1919
args: [
2020
'build',
21-
'--tag=gcr.io/${PROJECT_ID}/terraform',
21+
'--tag=${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/terraform',
2222
'--build-arg=TERRAFORM_VERSION=${_TERRAFORM_VERSION}',
2323
'--build-arg=TERRAFORM_VERSION_SHA256SUM=${_TERRAFORM_VERSION_SHA256SUM}',
2424
'--build-arg=TERRAFORM_VALIDATOR_RELEASE=${_TERRAFORM_VALIDATOR_RELEASE}',
2525
'.'
2626
]
27-
- name: 'gcr.io/${PROJECT_ID}/terraform'
27+
- name: '${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/terraform'
2828
args: ['version']
2929
substitutions:
3030
_TERRAFORM_VERSION: '0.13.6' # default value
3131
_TERRAFORM_VERSION_SHA256SUM: '55f2db00b05675026be9c898bdd3e8230ff0c5c78dd12d743ca38032092abfc9' # default value
3232
_TERRAFORM_VALIDATOR_RELEASE: '2020-09-24'
33-
images: ['gcr.io/${PROJECT_ID}/terraform']
33+
images: ['${_REGION}-docker.pkg.dev/${PROJECT_ID}/${_REPOSITORY}/terraform']

‎modules/cloudbuild/main.tf‎

Lines changed: 31 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,12 @@
1616

1717
locals {
1818
cloudbuild_project_id = var.project_id != "" ? var.project_id : format("%s-%s", var.project_prefix, "cloudbuild")
19-
cloudbuild_apis = ["cloudbuild.googleapis.com", "sourcerepo.googleapis.com", "cloudkms.googleapis.com"]
19+
gar_repo_name = var.gar_repo_name != "" ? var.gar_repo_name : format("%s-%s", var.project_prefix, "tf-runners")
20+
cloudbuild_apis = ["cloudbuild.googleapis.com", "sourcerepo.googleapis.com", "cloudkms.googleapis.com", "artifactregistry.googleapis.com"]
2021
impersonation_enabled_count = var.sa_enable_impersonation == true ? 1 : 0
21-
activate_apis = distinct(var.activate_apis)
22+
activate_apis = distinct(concat(var.activate_apis, local.cloudbuild_apis))
2223
apply_branches_regex = "^(${join("|", var.terraform_apply_branches)})$"
24+
gar_name = split("/", google_artifact_registry_repository.tf-image-repo.name)[length(split("/", google_artifact_registry_repository.tf-image-repo.name)) - 1]
2325
}
2426

2527
resource "random_id" "suffix" {
@@ -48,13 +50,6 @@ module "cloudbuild_project" {
4850
labels = var.project_labels
4951
}
5052

51-
resource "google_project_service" "cloudbuild_apis" {
52-
for_each = toset(local.cloudbuild_apis)
53-
project = module.cloudbuild_project.project_id
54-
service = each.value
55-
disable_on_destroy = false
56-
}
57-
5853
/******************************************
5954
Cloudbuild IAM for admins
6055
*******************************************/
@@ -94,9 +89,6 @@ resource "google_kms_key_ring" "tf_keyring" {
9489
project = module.cloudbuild_project.project_id
9590
name = "tf-keyring"
9691
location = var.default_region
97-
depends_on = [
98-
google_project_service.cloudbuild_apis,
99-
]
10092
}
10193

10294
/******************************************
@@ -120,9 +112,6 @@ resource "google_kms_crypto_key_iam_binding" "cloudbuild_crypto_key_decrypter" {
120112
"serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com",
121113
"serviceAccount:${var.terraform_sa_email}"
122114
]
123-
depends_on = [
124-
google_project_service.cloudbuild_apis,
125-
]
126115
}
127116

128117
/******************************************
@@ -146,9 +135,6 @@ resource "google_sourcerepo_repository" "gcp_repo" {
146135
for_each = var.create_cloud_source_repos ? toset(var.cloud_source_repos) : []
147136
project = module.cloudbuild_project.project_id
148137
name = each.value
149-
depends_on = [
150-
google_project_service.cloudbuild_apis,
151-
]
152138
}
153139

154140
/******************************************
@@ -223,6 +209,19 @@ resource "google_cloudbuild_trigger" "non_master_trigger" {
223209
]
224210
}
225211

212+
/***********************************************
213+
Cloud Build - Terraform Image Repo
214+
***********************************************/
215+
resource "google_artifact_registry_repository" "tf-image-repo" {
216+
provider = google-beta
217+
project = module.cloudbuild_project.project_id
218+
219+
location = var.default_region
220+
repository_id = local.gar_repo_name
221+
description = "Docker repository for Terraform runner images used by Cloud Build"
222+
format = "DOCKER"
223+
}
224+
226225
/***********************************************
227226
Cloud Build - Terraform builder
228227
***********************************************/
@@ -232,18 +231,20 @@ resource "null_resource" "cloudbuild_terraform_builder" {
232231
project_id_cloudbuild_project = module.cloudbuild_project.project_id
233232
terraform_version_sha256sum = var.terraform_version_sha256sum
234233
terraform_version = var.terraform_version
234+
gar_name = local.gar_name
235+
gar_location = google_artifact_registry_repository.tf-image-repo.location
235236
}
236237

237238
provisioner "local-exec" {
238239
command = <<EOT
239240
gcloud builds submit ${path.module}/cloudbuild_builder/ \
240241
--project ${module.cloudbuild_project.project_id} \
241242
--config=${path.module}/cloudbuild_builder/cloudbuild.yaml \
242-
--substitutions=_TERRAFORM_VERSION=${var.terraform_version},_TERRAFORM_VERSION_SHA256SUM=${var.terraform_version_sha256sum},_TERRAFORM_VALIDATOR_RELEASE=${var.terraform_validator_release}
243+
--substitutions=_TERRAFORM_VERSION=${var.terraform_version},_TERRAFORM_VERSION_SHA256SUM=${var.terraform_version_sha256sum},_TERRAFORM_VALIDATOR_RELEASE=${var.terraform_validator_release},_REGION=${google_artifact_registry_repository.tf-image-repo.location},_REPOSITORY=${local.gar_name}
243244
EOT
244245
}
245246
depends_on = [
246-
google_project_service.cloudbuild_apis,
247+
google_artifact_registry_repository_iam_member.terraform-image-iam
247248
]
248249
}
249250

@@ -255,9 +256,16 @@ resource "google_storage_bucket_iam_member" "cloudbuild_artifacts_iam" {
255256
bucket = google_storage_bucket.cloudbuild_artifacts.name
256257
role = "roles/storage.admin"
257258
member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
258-
depends_on = [
259-
google_project_service.cloudbuild_apis,
260-
]
259+
}
260+
261+
resource "google_artifact_registry_repository_iam_member" "terraform-image-iam" {
262+
provider = google-beta
263+
project = module.cloudbuild_project.project_id
264+
265+
location = google_artifact_registry_repository.tf-image-repo.location
266+
repository = google_artifact_registry_repository.tf-image-repo.name
267+
role = "roles/artifactregistry.writer"
268+
member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
261269
}
262270

263271
resource "google_service_account_iam_member" "cloudbuild_terraform_sa_impersonate_permissions" {
@@ -266,9 +274,6 @@ resource "google_service_account_iam_member" "cloudbuild_terraform_sa_impersonat
266274
service_account_id = var.terraform_sa_name
267275
role = "roles/iam.serviceAccountTokenCreator"
268276
member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
269-
depends_on = [
270-
google_project_service.cloudbuild_apis,
271-
]
272277
}
273278

274279
resource "google_organization_iam_member" "cloudbuild_serviceusage_consumer" {
@@ -277,9 +282,6 @@ resource "google_organization_iam_member" "cloudbuild_serviceusage_consumer" {
277282
org_id = var.org_id
278283
role = "roles/serviceusage.serviceUsageConsumer"
279284
member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
280-
depends_on = [
281-
google_project_service.cloudbuild_apis,
282-
]
283285
}
284286

285287
# Required to allow cloud build to access state with impersonation.
@@ -289,7 +291,4 @@ resource "google_storage_bucket_iam_member" "cloudbuild_state_iam" {
289291
bucket = var.terraform_state_bucket
290292
role = "roles/storage.admin"
291293
member = "serviceAccount:${module.cloudbuild_project.project_number}@cloudbuild.gserviceaccount.com"
292-
depends_on = [
293-
google_project_service.cloudbuild_apis,
294-
]
295294
}

‎modules/cloudbuild/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,8 @@ output "kms_crypto_key" {
3838
description = "KMS key created by the module."
3939
value = google_kms_crypto_key.tf_key
4040
}
41+
42+
output "tf_runner_artifact_repo" {
43+
description = "GAR Repo created to store runner images"
44+
value = google_artifact_registry_repository.tf-image-repo.name
45+
}

‎modules/cloudbuild/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,3 +169,9 @@ variable "terraform_apply_branches" {
169169
"master"
170170
]
171171
}
172+
173+
variable "gar_repo_name" {
174+
description = "Custom name to use for GAR repo."
175+
default = ""
176+
type = string
177+
}

‎modules/cloudbuild/versions.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ terraform {
2222
source = "hashicorp/google"
2323
version = ">= 3.50"
2424
}
25+
google-beta = {
26+
source = "hashicorp/google-beta"
27+
version = ">= 3.50"
28+
}
2529
}
2630

2731
provider_meta "google" {

0 commit comments

Comments
 (0)