Skip to content

Commit 214f5b1

Browse files
roger2hkroger2hk
authored
Add Cloud Build for GCP CI env (#58)
* Add Cloud Build for GCP CI env * Add Cloud Build for GCP CI env * Switch from ci to prod for cloud build service account * Add docker_env to cloud build config * Add docker_env to cloud build config * Remove roles/cloudbuild.builds.editor from cloud build service account * Add line to EOF * Move terraform source to cloud build root module * Remove unused terraform local var * Update `GOOGLE_PROJECT` default value to `static-ct` * Allow injecting the GitHub owner for Cloud Build repo mapping
1 parent d79b760 commit 214f5b1

File tree

6 files changed

+251
-0
lines changed

6 files changed

+251
-0
lines changed

‎deployment/live/gcp/cloudbuild/prod/.terraform.lock.hcl

Lines changed: 22 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎deployment/live/gcp/cloudbuild/prod/terragrunt.hcl

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
locals {
2+
docker_env = "ci"
3+
}
4+
5+
include "root" {
6+
path = find_in_parent_folders()
7+
expose = true
8+
}
9+
10+
inputs = merge(
11+
local,
12+
include.root.locals,
13+
)

‎deployment/live/gcp/cloudbuild/terragrunt.hcl

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
terraform {
2+
source = "${get_repo_root()}/deployment/modules/gcp//cloudbuild"
3+
}
4+
5+
locals {
6+
env = path_relative_to_include()
7+
project_id = get_env("GOOGLE_PROJECT", "static-ct")
8+
location = get_env("GOOGLE_REGION", "us-central1")
9+
base_name = get_env("TESSERA_BASE_NAME", "${local.env}-cloudbuild")
10+
github_owner = get_env("GITHUB_OWNER", "transparency-dev")
11+
}
12+
13+
remote_state {
14+
backend = "gcs"
15+
16+
config = {
17+
project = local.project_id
18+
location = local.location
19+
bucket = "${local.project_id}-${local.base_name}-terraform-state"
20+
prefix = "terraform.tfstate"
21+
22+
gcs_bucket_labels = {
23+
name = "terraform_state"
24+
env = "${local.env}"
25+
}
26+
}
27+
}

‎deployment/modules/gcp/cloudbuild/main.tf

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
terraform {
2+
backend "gcs" {}
3+
4+
required_providers {
5+
google = {
6+
source = "registry.terraform.io/hashicorp/google"
7+
version = "6.1.0"
8+
}
9+
}
10+
}
11+
12+
# Artifact Registry
13+
14+
resource "google_project_service" "artifact_registry_api" {
15+
service = "artifactregistry.googleapis.com"
16+
disable_on_destroy = false
17+
}
18+
19+
resource "google_artifact_registry_repository" "docker" {
20+
repository_id = "docker-${var.docker_env}"
21+
location = var.location
22+
description = "Static CT docker images"
23+
format = "DOCKER"
24+
depends_on = [
25+
google_project_service.artifact_registry_api,
26+
]
27+
}
28+
29+
# Cloud Build
30+
31+
locals {
32+
artifact_repo = "${var.location}-docker.pkg.dev/${var.project_id}/${google_artifact_registry_repository.docker.name}"
33+
conformance_gcp_docker_image = "${local.artifact_repo}/conformance-gcp"
34+
}
35+
36+
resource "google_project_service" "cloudbuild_api" {
37+
service = "cloudbuild.googleapis.com"
38+
disable_on_destroy = false
39+
}
40+
41+
resource "google_service_account" "cloudbuild_service_account" {
42+
account_id = "cloudbuild-${var.env}-sa"
43+
display_name = "Service Account for Cloud Build (${var.env})"
44+
}
45+
46+
resource "google_project_iam_member" "logging_log_writer" {
47+
project = var.project_id
48+
role = "roles/logging.logWriter"
49+
member = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
50+
}
51+
52+
resource "google_artifact_registry_repository_iam_member" "artifactregistry_writer" {
53+
project = google_artifact_registry_repository.docker.project
54+
location = google_artifact_registry_repository.docker.location
55+
repository = google_artifact_registry_repository.docker.name
56+
role = "roles/artifactregistry.writer"
57+
member = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
58+
}
59+
60+
# TODO: Use google_cloud_run_service_iam_member to limit the service scope.
61+
resource "google_project_iam_member" "run_developer" {
62+
project = var.project_id
63+
role = "roles/run.developer"
64+
member = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
65+
}
66+
67+
resource "google_project_iam_member" "iam_service_account_user" {
68+
project = var.project_id
69+
role = "roles/iam.serviceAccountUser"
70+
member = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
71+
}
72+
73+
resource "google_cloudbuild_trigger" "build_trigger" {
74+
name = "build-docker-${var.docker_env}"
75+
service_account = google_service_account.cloudbuild_service_account.id
76+
location = var.location
77+
78+
github {
79+
owner = var.github_owner
80+
name = "static-ct"
81+
push {
82+
branch = "^main$"
83+
}
84+
}
85+
86+
build {
87+
## TODO: Destroy any pre-existing deployment/live/gcp/ci environment.
88+
## This might happen if a previous cloud build failed for some reason.
89+
90+
## Build the SCTFE GCP Docker image.
91+
## This will be used by the building the conformance Docker image which includes
92+
## the test data.
93+
step {
94+
id = "docker_build_sctfe_gcp"
95+
name = "gcr.io/cloud-builders/docker"
96+
args = [
97+
"build",
98+
"-t", "sctfe-gcp:$SHORT_SHA",
99+
"-t", "sctfe-gcp:latest",
100+
"-f", "./cmd/gcp/Dockerfile",
101+
"."
102+
]
103+
}
104+
105+
## Build the SCTFE GCP Conformance Docker container image.
106+
step {
107+
id = "docker_build_conformance_gcp"
108+
name = "gcr.io/cloud-builders/docker"
109+
args = [
110+
"build",
111+
"-t", "${local.conformance_gcp_docker_image}:$SHORT_SHA",
112+
"-t", "${local.conformance_gcp_docker_image}:latest",
113+
"-f", "./cmd/gcp/ci/Dockerfile",
114+
"."
115+
]
116+
}
117+
118+
## Push the conformance Docker container image to Artifact Registry.
119+
step {
120+
id = "docker_push_conformance_gcp"
121+
name = "gcr.io/cloud-builders/docker"
122+
args = [
123+
"push",
124+
"--all-tags",
125+
local.conformance_gcp_docker_image
126+
]
127+
wait_for = ["docker_build_conformance_gcp"]
128+
}
129+
130+
## Deploy container image to Cloud Run.
131+
## TODO: Remove this as the `terragrunt apply` will bring up the Cloud Run.
132+
step {
133+
id = "cloud_run_deploy"
134+
name = "gcr.io/google.com/cloudsdktool/cloud-sdk"
135+
entrypoint = "gcloud"
136+
args = [
137+
"run",
138+
"deploy",
139+
"${var.docker_env}-static-ct",
140+
"--image",
141+
"${local.conformance_gcp_docker_image}:$SHORT_SHA",
142+
"--region",
143+
var.location
144+
]
145+
wait_for = ["docker_push_conformance_gcp"]
146+
}
147+
148+
## TODO: Apply the terragrunt configuration to create the CI environment.
149+
150+
options {
151+
logging = "CLOUD_LOGGING_ONLY"
152+
machine_type = "E2_HIGHCPU_8"
153+
}
154+
}
155+
156+
depends_on = [
157+
google_artifact_registry_repository.docker
158+
]
159+
}

‎deployment/modules/gcp/cloudbuild/variables.tf

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
variable "project_id" {
2+
description = "GCP project ID where the log is hosted"
3+
type = string
4+
}
5+
6+
variable "location" {
7+
description = "Location in which to create resources"
8+
type = string
9+
}
10+
11+
variable "env" {
12+
description = "Unique identifier for the env, e.g. dev or ci or prod"
13+
type = string
14+
}
15+
16+
variable "docker_env" {
17+
description = "Unique identifier for the Docker env, e.g. dev or ci or prod"
18+
type = string
19+
}
20+
21+
variable "github_owner" {
22+
description = "GitHub owner used in Cloud Build trigger repository mapping"
23+
type = string
24+
}

‎deployment/modules/gcp/cloudrun/main.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,12 @@ resource "google_service_account" "cloudrun_service_account" {
1919
display_name = "Service Account for Cloud Run (${var.env})"
2020
}
2121

22+
resource "google_project_iam_member" "run_service_agent" {
23+
project = var.project_id
24+
role = "roles/run.serviceAgent"
25+
member = "serviceAccount:${google_service_account.cloudrun_service_account.email}"
26+
}
27+
2228
resource "google_project_iam_member" "monitoring_metric_writer" {
2329
project = var.project_id
2430
role = "roles/monitoring.metricWriter"

0 commit comments

Comments
 (0)