Skip to content

Commit 48b92b1

Browse files
roger2hkroger2hk
committed
Add Cloud Build for GCP CI env
1 parent 43dbbbe commit 48b92b1

File tree

5 files changed

+240
-0
lines changed

5 files changed

+240
-0
lines changed

‎deployment/live/gcp/cloudbuild/ci/.terraform.lock.hcl

Lines changed: 22 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎deployment/live/gcp/cloudbuild/ci/terragrunt.hcl

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
terraform {
2+
source = "${get_repo_root()}/deployment/modules/gcp//cloudbuild"
3+
}
4+
5+
locals {
6+
server_docker_image = "${include.root.locals.location}-docker.pkg.dev/${include.root.locals.project_id}/docker-${include.root.locals.env}/conformance-gcp:latest"
7+
}
8+
9+
include "root" {
10+
path = find_in_parent_folders()
11+
expose = true
12+
}
13+
14+
inputs = merge(
15+
local,
16+
include.root.locals,
17+
)

‎deployment/live/gcp/cloudbuild/terragrunt.hcl

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
locals {
2+
env = path_relative_to_include()
3+
project_id = get_env("GOOGLE_PROJECT", "transparency-dev")
4+
location = get_env("GOOGLE_REGION", "us-central1")
5+
base_name = get_env("TESSERA_BASE_NAME", "${local.env}-cloudbuild")
6+
}
7+
8+
remote_state {
9+
backend = "gcs"
10+
11+
config = {
12+
project = local.project_id
13+
location = local.location
14+
bucket = "${local.project_id}-${local.base_name}-terraform-state"
15+
prefix = "terraform.tfstate"
16+
17+
gcs_bucket_labels = {
18+
name = "terraform_state"
19+
env = "${local.env}"
20+
}
21+
}
22+
}

‎deployment/modules/gcp/cloudbuild/main.tf

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
terraform {
2+
backend "gcs" {}
3+
4+
required_providers {
5+
google = {
6+
source = "registry.terraform.io/hashicorp/google"
7+
version = "6.1.0"
8+
}
9+
}
10+
}
11+
12+
# Artifact Registry
13+
14+
resource "google_project_service" "artifact_registry_api" {
15+
service = "artifactregistry.googleapis.com"
16+
disable_on_destroy = false
17+
}
18+
19+
resource "google_artifact_registry_repository" "docker" {
20+
repository_id = "docker-${var.env}"
21+
location = var.location
22+
description = "Static CT docker images"
23+
format = "DOCKER"
24+
depends_on = [
25+
google_project_service.artifact_registry_api,
26+
]
27+
}
28+
29+
# Cloud Build
30+
31+
locals {
32+
artifact_repo = "${var.location}-docker.pkg.dev/${var.project_id}/${google_artifact_registry_repository.docker.name}"
33+
conformance_gcp_docker_image = "${local.artifact_repo}/conformance-gcp"
34+
}
35+
36+
resource "google_project_service" "cloudbuild_api" {
37+
service = "cloudbuild.googleapis.com"
38+
disable_on_destroy = false
39+
}
40+
41+
resource "google_service_account" "cloudbuild_service_account" {
42+
account_id = "cloudbuild-${var.env}-sa"
43+
display_name = "Service Account for Cloud Build (${var.env})"
44+
}
45+
46+
resource "google_project_iam_member" "cloudbuild_builds_editor" {
47+
project = var.project_id
48+
role = "roles/cloudbuild.builds.editor"
49+
member = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
50+
}
51+
52+
resource "google_project_iam_member" "logging_log_writer" {
53+
project = var.project_id
54+
role = "roles/logging.logWriter"
55+
member = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
56+
}
57+
58+
resource "google_artifact_registry_repository_iam_member" "artifactregistry_writer" {
59+
project = google_artifact_registry_repository.docker.project
60+
location = google_artifact_registry_repository.docker.location
61+
repository = google_artifact_registry_repository.docker.name
62+
role = "roles/artifactregistry.writer"
63+
member = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
64+
}
65+
66+
# TODO: Use google_cloud_run_service_iam_member to limit the service scope.
67+
resource "google_project_iam_member" "run_developer" {
68+
project = var.project_id
69+
role = "roles/run.developer"
70+
member = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
71+
}
72+
73+
resource "google_project_iam_member" "iam_service_account_user" {
74+
project = var.project_id
75+
role = "roles/iam.serviceAccountUser"
76+
member = "serviceAccount:${google_service_account.cloudbuild_service_account.email}"
77+
}
78+
79+
resource "google_cloudbuild_trigger" "build_trigger" {
80+
name = "build-docker-${var.env}"
81+
service_account = google_service_account.cloudbuild_service_account.id
82+
location = var.location
83+
84+
github {
85+
owner = "transparency-dev"
86+
name = "static-ct"
87+
push {
88+
branch = "^main$"
89+
}
90+
}
91+
92+
build {
93+
## TODO: Destroy any pre-existing deployment/live/gcp/ci environment.
94+
## This might happen if a previous cloud build failed for some reason.
95+
96+
## Build the SCTFE GCP Docker image.
97+
## This will be used by the building the conformance Docker image which includes
98+
## the test data.
99+
step {
100+
id = "docker_build_sctfe_gcp"
101+
name = "gcr.io/cloud-builders/docker"
102+
args = [
103+
"build",
104+
"-t", "sctfe-gcp:$SHORT_SHA",
105+
"-t", "sctfe-gcp:latest",
106+
"-f", "./cmd/gcp/Dockerfile",
107+
"."
108+
]
109+
}
110+
111+
## Build the SCTFE GCP Conformance Docker container image.
112+
step {
113+
id = "docker_build_conformance_gcp"
114+
name = "gcr.io/cloud-builders/docker"
115+
args = [
116+
"build",
117+
"-t", "${local.conformance_gcp_docker_image}:$SHORT_SHA",
118+
"-t", "${local.conformance_gcp_docker_image}:latest",
119+
"-f", "./cmd/gcp/ci/Dockerfile",
120+
"."
121+
]
122+
}
123+
124+
## Push the conformance Docker container image to Artifact Registry.
125+
step {
126+
id = "docker_push_conformance_gcp"
127+
name = "gcr.io/cloud-builders/docker"
128+
args = [
129+
"push",
130+
"--all-tags",
131+
local.conformance_gcp_docker_image
132+
]
133+
wait_for = ["docker_build_conformance_gcp"]
134+
}
135+
136+
## Deploy container image to Cloud Run.
137+
## TODO: Remove this as the `terragrunt apply` will bring up the Cloud Run.
138+
step {
139+
id = "cloud_run_deploy"
140+
name = "gcr.io/google.com/cloudsdktool/cloud-sdk"
141+
entrypoint = "gcloud"
142+
args = [
143+
"run",
144+
"deploy",
145+
"${var.env}-static-ct",
146+
"--image",
147+
"${local.conformance_gcp_docker_image}:$SHORT_SHA",
148+
"--region",
149+
var.location
150+
]
151+
wait_for = ["docker_push_conformance_gcp"]
152+
}
153+
154+
## TODO: Apply the terragrunt configuration to create the CI environment.
155+
156+
options {
157+
logging = "CLOUD_LOGGING_ONLY"
158+
machine_type = "E2_HIGHCPU_8"
159+
}
160+
}
161+
162+
depends_on = [
163+
google_artifact_registry_repository.docker
164+
]
165+
}

‎deployment/modules/gcp/cloudbuild/variables.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
variable "project_id" {
2+
description = "GCP project ID where the log is hosted"
3+
type = string
4+
}
5+
6+
variable "location" {
7+
description = "Location in which to create resources"
8+
type = string
9+
}
10+
11+
variable "env" {
12+
description = "Unique identifier for the env, e.g. dev or ci or prod"
13+
type = string
14+
}

0 commit comments

Comments
 (0)