fix: fix compute sa roles (#278)

Co-authored-by: Andrew Peabody <andrewpeabody@google.com>
GoogleCloudPlatform · Nov 12, 2024 · 2db1efd · 2db1efd
1 parent a24a39f
commit 2db1efd
Show file tree

Hide file tree

Showing 33 changed files with 111 additions and 52 deletions.
diff --git a/1-bootstrap/main.tf b/1-bootstrap/main.tf
@@ -56,7 +56,7 @@ module "tfstate_bucket" {
 
 module "tf_cloudbuild_workspace" {
   source  = "terraform-google-modules/bootstrap/google//modules/tf_cloudbuild_workspace"
-  version = "~> 8.0"
+  version = "~> 9.0"
 
   for_each = local.cb_config
 

diff --git a/1-bootstrap/versions.tf b/1-bootstrap/versions.tf
@@ -19,7 +19,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 3.53, < 7"
+      version = ">= 6.6, < 7"
     }
 
     time = {

diff --git a/2-multitenant/envs/development/README.md b/2-multitenant/envs/development/README.md
@@ -15,6 +15,7 @@
 | app\_ip\_addresses | App IP Addresses |
 | cluster\_membership\_ids | GKE cluster membership IDs |
 | cluster\_project\_id | Cluster Project ID |
+| cluster\_project\_number | Cluster Project number |
 | cluster\_regions | Regions with clusters |
 | cluster\_service\_accounts | The default service accounts used for nodes, if not overridden in node\_pools. |
 | cluster\_type | Cluster type |

diff --git a/2-multitenant/envs/development/outputs.tf b/2-multitenant/envs/development/outputs.tf
@@ -19,6 +19,11 @@ output "cluster_project_id" {
   value       = module.env.cluster_project_id
 }
 
+output "cluster_project_number" {
+  description = "Cluster Project number"
+  value       = module.env.cluster_project_number
+}
+
 output "network_project_id" {
   description = "Network Project ID"
   value       = module.env.network_project_id

diff --git a/2-multitenant/envs/nonproduction/README.md b/2-multitenant/envs/nonproduction/README.md
@@ -15,6 +15,7 @@
 | app\_ip\_addresses | App IP Addresses |
 | cluster\_membership\_ids | GKE cluster membership IDs |
 | cluster\_project\_id | Cluster Project ID |
+| cluster\_project\_number | Cluster Project number |
 | cluster\_regions | Regions with clusters |
 | cluster\_service\_accounts | The default service accounts used for nodes, if not overridden in node\_pools. |
 | cluster\_type | Cluster type |

diff --git a/2-multitenant/envs/nonproduction/outputs.tf b/2-multitenant/envs/nonproduction/outputs.tf
@@ -19,6 +19,11 @@ output "cluster_project_id" {
   value       = module.env.cluster_project_id
 }
 
+output "cluster_project_number" {
+  description = "Cluster Project number"
+  value       = module.env.cluster_project_number
+}
+
 output "network_project_id" {
   description = "Network Project ID"
   value       = module.env.network_project_id

diff --git a/2-multitenant/envs/production/README.md b/2-multitenant/envs/production/README.md
@@ -15,6 +15,7 @@
 | app\_ip\_addresses | App IP Addresses |
 | cluster\_membership\_ids | GKE cluster membership IDs |
 | cluster\_project\_id | Cluster Project ID |
+| cluster\_project\_number | Cluster Project number |
 | cluster\_regions | Regions with clusters |
 | cluster\_service\_accounts | The default service accounts used for nodes, if not overridden in node\_pools. |
 | cluster\_type | Cluster type |

diff --git a/2-multitenant/envs/production/outputs.tf b/2-multitenant/envs/production/outputs.tf
@@ -19,6 +19,11 @@ output "cluster_project_id" {
   value       = module.env.cluster_project_id
 }
 
+output "cluster_project_number" {
+  description = "Cluster Project number"
+  value       = module.env.cluster_project_number
+}
+
 output "network_project_id" {
   description = "Network Project ID"
   value       = module.env.network_project_id

diff --git a/2-multitenant/modules/env_baseline/README.md b/2-multitenant/modules/env_baseline/README.md
@@ -35,6 +35,7 @@ The following resources are created:
 | app\_ip\_addresses | App IP Addresses |
 | cluster\_membership\_ids | GKE cluster membership IDs |
 | cluster\_project\_id | Cluster Project ID |
+| cluster\_project\_number | Cluster Project ID |
 | cluster\_regions | Regions with clusters |
 | cluster\_service\_accounts | The default service accounts used for nodes, if not overridden in node\_pools. |
 | cluster\_type | Cluster type |

diff --git a/2-multitenant/modules/env_baseline/main.tf b/2-multitenant/modules/env_baseline/main.tf
@@ -42,6 +42,7 @@ module "eab_cluster_project" {
   svpc_host_project_id     = var.network_project_id
   shared_vpc_subnets       = var.cluster_subnetworks
   deletion_policy          = "DELETE"
+  default_service_account  = "KEEP"
 
   // Skip disabling APIs for gkehub.googleapis.com
   // https://cloud.google.com/anthos/fleet-management/docs/troubleshooting#error_when_disabling_the_fleet_api

diff --git a/2-multitenant/modules/env_baseline/outputs.tf b/2-multitenant/modules/env_baseline/outputs.tf
@@ -33,6 +33,11 @@ output "cluster_project_id" {
   value       = data.google_project.eab_cluster_project.project_id
 }
 
+output "cluster_project_number" {
+  description = "Cluster Project ID"
+  value       = data.google_project.eab_cluster_project.number
+}
+
 output "network_project_id" {
   description = "Network Project ID"
   value       = var.network_project_id
@@ -72,7 +77,8 @@ output "cluster_type" {
 
 output "cluster_service_accounts" {
   description = "The default service accounts used for nodes, if not overridden in node_pools."
-  value = [
-    for value in merge(module.gke-standard, module.gke-autopilot) : value.service_account
-  ]
+  value = setunion(
+    [for value in merge(module.gke-standard, module.gke-autopilot) : value.service_account],
+    [for value in module.eab_cluster_project : "${value.project_number}-compute@developer.gserviceaccount.com"]
+  )
 }
diff --git a/2-multitenant/modules/env_baseline/versions.tf b/2-multitenant/modules/env_baseline/versions.tf
@@ -20,11 +20,11 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, != 5.44.0, != 6.2.0, < 7"
+      version = ">= 6.6, < 7"
     }
     google-beta = {
       source  = "hashicorp/google-beta"
-      version = ">= 5, != 5.44.0, != 6.2.0, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 

diff --git a/3-fleetscope/modules/env_baseline/versions.tf b/3-fleetscope/modules/env_baseline/versions.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
     google-beta = {
       source  = "hashicorp/google-beta"

diff --git a/4-appfactory/envs/shared/main.tf b/4-appfactory/envs/shared/main.tf
@@ -33,8 +33,9 @@ locals {
 resource "google_folder" "app_folder" {
   for_each = toset(local.application_names)
 
-  display_name = each.key
-  parent       = var.common_folder_id
+  display_name        = each.key
+  parent              = var.common_folder_id
+  deletion_protection = false
 }
 
 module "components" {

diff --git a/4-appfactory/envs/shared/versions.tf b/4-appfactory/envs/shared/versions.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 

diff --git a/4-appfactory/modules/app-group-baseline/main.tf b/4-appfactory/modules/app-group-baseline/main.tf
@@ -54,6 +54,7 @@ module "app_admin_project" {
   org_id                   = var.org_id
   folder_id                = var.folder_id
   deletion_policy          = "DELETE"
+  default_service_account  = "KEEP"
   activate_apis = [
     "iam.googleapis.com",
     "cloudresourcemanager.googleapis.com",
@@ -75,7 +76,7 @@ resource "google_sourcerepo_repository" "app_infra_repo" {
 
 module "tf_cloudbuild_workspace" {
   source  = "terraform-google-modules/bootstrap/google//modules/tf_cloudbuild_workspace"
-  version = "~> 8.0"
+  version = "~> 9.0"
 
   project_id               = local.admin_project_id
   tf_repo_uri              = google_sourcerepo_repository.app_infra_repo.url
@@ -137,4 +138,5 @@ module "app_infra_project" {
   folder_id                = each.value.folder_id
   activate_apis            = var.infra_project_apis
   deletion_policy          = "DELETE"
+  default_service_account  = "KEEP"
 }
diff --git a/4-appfactory/modules/app-group-baseline/versions.tf b/4-appfactory/modules/app-group-baseline/versions.tf
@@ -20,11 +20,11 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
     google-beta = {
       source  = "hashicorp/google-beta"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 

diff --git a/5-appinfra/modules/alloydb-psc-setup/versions.tf b/5-appinfra/modules/alloydb-psc-setup/versions.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
     random = {
       source  = "hashicorp/random"

diff --git a/5-appinfra/modules/cicd-pipeline/versions.tf b/5-appinfra/modules/cicd-pipeline/versions.tf
@@ -20,11 +20,11 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
     google-beta = {
       source  = "hashicorp/google-beta"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 

diff --git a/build/int.cloudbuild.yaml b/build/int.cloudbuild.yaml
@@ -148,6 +148,7 @@ steps:
       ]
     waitFor:
       - appinfra-apply
+      - fleetscope-verify
 
   - id: appsource-verify-cymbal-shop
     name: "gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS"
@@ -159,6 +160,7 @@ steps:
       ]
     waitFor:
       - appinfra-apply
+      - fleetscope-verify
 
   - id: app-e2e
     name: "gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS"

diff --git a/...ples/cymbal-bank/5-appinfra/cymbal-bank/accounts-userservice/envs/development/versions.tf b/...ples/cymbal-bank/5-appinfra/cymbal-bank/accounts-userservice/envs/development/versions.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 }
diff --git a/...es/cymbal-bank/5-appinfra/cymbal-bank/accounts-userservice/envs/nonproduction/versions.tf b/...es/cymbal-bank/5-appinfra/cymbal-bank/accounts-userservice/envs/nonproduction/versions.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 }
diff --git a/examples/cymbal-bank/5-appinfra/cymbal-bank/accounts-userservice/envs/production/versions.tf b/examples/cymbal-bank/5-appinfra/cymbal-bank/accounts-userservice/envs/production/versions.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 }
diff --git a/examples/cymbal-bank/5-appinfra/cymbal-bank/ledger-ledgerwriter/envs/development/versions.tf b/examples/cymbal-bank/5-appinfra/cymbal-bank/ledger-ledgerwriter/envs/development/versions.tf
@@ -35,7 +35,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 }
diff --git a/...les/cymbal-bank/5-appinfra/cymbal-bank/ledger-ledgerwriter/envs/nonproduction/versions.tf b/...les/cymbal-bank/5-appinfra/cymbal-bank/ledger-ledgerwriter/envs/nonproduction/versions.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 }
diff --git a/examples/cymbal-bank/5-appinfra/cymbal-bank/ledger-ledgerwriter/envs/production/versions.tf b/examples/cymbal-bank/5-appinfra/cymbal-bank/ledger-ledgerwriter/envs/production/versions.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 }
diff --git a/examples/cymbal-shop/5-appinfra/cymbal-shop/cymbalshop/envs/shared/versions.tf b/examples/cymbal-shop/5-appinfra/cymbal-shop/cymbalshop/envs/shared/versions.tf
@@ -20,7 +20,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5, < 7"
+      version = ">= 6.6, < 7"
     }
   }
 

diff --git a/test/integration/appsource/cymbal_bank_test.go b/test/integration/appsource/cymbal_bank_test.go
@@ -213,16 +213,14 @@ func TestSourceCymbalBank(t *testing.T) {
 								} else if slices.Contains([]string{"IN_PROGRESS", "PENDING_RELEASE"}, latestRolloutState) {
 									return true, nil
 								} else {
-									logsCmd := fmt.Sprintf("logging read --project=%s", servicesInfoMap[serviceName].ProjectID)
-									logs := gcloud.Runf(t, logsCmd).Array()
-									for _, log := range logs {
-										t.Logf("%s build-log: %s", servicesInfoMap[serviceName].ServiceName, log.Get("textPayload").String())
-									}
+									logsCmd := fmt.Sprintf("builds log %s", rollouts[0].Get("deployingBuild").String())
+									logs := gcloud.Runf(t, logsCmd).String()
+									t.Logf("%s build-log: %s", servicesInfoMap[serviceName].ServiceName, logs)
 									return false, fmt.Errorf("Rollout %s.", latestRolloutState)
 								}
 							}
 						}
-						utils.Poll(t, pollCloudDeploy(rolloutListCmd), 40, 60*time.Second)
+						utils.Poll(t, pollCloudDeploy(rolloutListCmd), 30, 60*time.Second)
 					})
 					appsource.Test()
 				})

diff --git a/test/integration/appsource/cymbal_shop_test.go b/test/integration/appsource/cymbal_shop_test.go
@@ -141,11 +141,9 @@ func TestSourceCymbalShop(t *testing.T) {
 					} else if slices.Contains([]string{"IN_PROGRESS", "PENDING_RELEASE"}, latestRolloutState) {
 						return true, nil
 					} else {
-						logsCmd := fmt.Sprintf("logging read --project=%s", projectID)
-						logs := gcloud.Runf(t, logsCmd).Array()
-						for _, log := range logs {
-							t.Logf("%s build-log: %s", serviceName, log.Get("textPayload").String())
-						}
+						logsCmd := fmt.Sprintf("builds log %s", rollouts[0].Get("deployingBuild").String())
+						logs := gcloud.Runf(t, logsCmd).String()
+						t.Logf("%s build-log: %s", serviceName, logs)
 						return false, fmt.Errorf("Rollout %s.", latestRolloutState)
 					}
 				}