Support conformance env lifecycle in GCP CI Cloud Build

Author: roger2hk

deployment/live/gcp/cloudbuild/README.md

@@ -7,9 +7,9 @@ is responsible for:
 
 1. Building the `cmd/gcp` and `cmd/gcp/ci` docker images from the `main` branch,
 1. Deploying the `cmd/gcp/ci` image to Cloud Run,
-1. TODO: Creating a fresh conformance testing environment,
-1. TODO: Running the conformance test against the newly build conformance docker image,
-1. TODO: Turning-down the conformance testing environment.
+1. Creating a fresh conformance testing environment,
+1. Running the conformance test against the newly build conformance docker image,
+1. Turning-down the conformance testing environment.
 
 ## Initial setup
 
@@ -25,20 +25,10 @@ and the GitHub repository.
 
 ## Externally managed IAM
 
-In case your GCP organization manages the IAM externally, execute the following commands to import the IAM member resources.
-
-Example:
+In case your GCP organization manages the IAM externally, execute the following command before executing `terragrunt apply`.
 
 ```sh
-terragrunt import google_project_iam_member.logging_log_writer "static-ct roles/logging.logWriter serviceAccount:cloudbuild-prod-sa@static-ct.iam.gserviceaccount.com"
-terragrunt import google_project_iam_member.service_usage_viewer "static-ct roles/serviceusage.serviceUsageViewer serviceAccount:cloudbuild-prod-sa@static-ct.iam.gserviceaccount.com"
-terragrunt import google_project_iam_member.storage_admin "static-ct roles/storage.admin serviceAccount:cloudbuild-prod-sa@static-ct.iam.gserviceaccount.com"
-terragrunt import google_project_iam_member.spanner_admin "static-ct roles/spanner.admin serviceAccount:cloudbuild-prod-sa@static-ct.iam.gserviceaccount.com"
-terragrunt import google_project_iam_member.secretmanager_admin "static-ct roles/secretmanager.admin serviceAccount:cloudbuild-prod-sa@static-ct.iam.gserviceaccount.com"
-terragrunt import google_project_iam_member.iam_service_account_open_id_token_creator "static-ct roles/iam.serviceAccountOpenIdTokenCreator serviceAccount:cloudbuild-prod-sa@static-ct.iam.gserviceaccount.com"
-terragrunt import google_project_iam_member.iam_service_account_viewer "static-ct roles/iam.serviceAccountViewer serviceAccount:cloudbuild-prod-sa@static-ct.iam.gserviceaccount.com"
-terragrunt import google_project_iam_member.iam_service_account_admin "static-ct roles/iam.serviceAccountAdmin serviceAccount:cloudbuild-prod-sa@static-ct.iam.gserviceaccount.com"
-terragrunt import google_project_iam_member.resourcemanager_project_iam_admin "static-ct roles/resourcemanager.projectIamAdmin serviceAccount:cloudbuild-prod-sa@static-ct.iam.gserviceaccount.com"
-terragrunt import google_project_iam_member.run_admin "static-ct roles/run.admin serviceAccount:cloudbuild-prod
--sa@static-ct.iam.gserviceaccount.com"
-```
+export SKIP_IAM=true
+```
+
+Note that the `SKIP_IAM` value in Cloud Build is propagated to the conformance testing environment.

deployment/modules/gcp/cloudbuild/main.tf

@@ -69,6 +69,7 @@ resource "google_cloudbuild_trigger" "build_trigger" {
       dir    = "deployment/live/gcp/ci"
       env = [
         "GOOGLE_PROJECT=${var.project_id}",
+        "SKIP_IAM=${var.skip_iam}",
         "TF_IN_AUTOMATION=1",
         "TF_INPUT=false",
         "TF_VAR_project_id=${var.project_id}"
@@ -128,6 +129,7 @@ resource "google_cloudbuild_trigger" "build_trigger" {
       dir    = "deployment/live/gcp/ci"
       env = [
         "GOOGLE_PROJECT=${var.project_id}",
+        "SKIP_IAM=${var.skip_iam}",
         "TF_IN_AUTOMATION=1",
         "TF_INPUT=false",
         "TF_VAR_project_id=${var.project_id}"
@@ -171,6 +173,7 @@ resource "google_cloudbuild_trigger" "build_trigger" {
       dir    = "deployment/live/gcp/ci"
       env = [
         "GOOGLE_PROJECT=${var.project_id}",
+        "SKIP_IAM=${var.skip_iam}",
         "TF_IN_AUTOMATION=1",
         "TF_INPUT=false",
         "TF_VAR_project_id=${var.project_id}"

deployment/modules/gcp/cloudbuild/variables.tf

@@ -24,6 +24,6 @@ variable "github_owner" {
 }
 
 variable "skip_iam" {
-  description = "Skip for IAM externally managed GCP projects"
+  description = "Skip for GCP projects with externally managed IAM"
   type        = bool
 }

deployment/modules/gcp/cloudrun/variables.tf

@@ -54,6 +54,6 @@ variable "signer_private_key_secret_name" {
 }
 
 variable "skip_iam" {
-  description = "Skip for IAM externally managed GCP projects"
+  description = "Skip for GCP projects with externally managed IAM"
   type        = bool
 }

deployment/modules/gcp/conformance/variables.tf

@@ -29,6 +29,6 @@ variable "server_docker_image" {
 }
 
 variable "skip_iam" {
-  description = "Skip for IAM externally managed GCP projects"
+  description = "Skip for GCP projects with externally managed IAM"
   type        = bool
 }