-
Notifications
You must be signed in to change notification settings - Fork 913
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into RS-469-Allow-Fabric-Organization-Module-to…
…-Intercept-Child-Logging
- Loading branch information
Showing
172 changed files
with
5,954 additions
and
245 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| # Using `map(string)` for `tag_bindings` variables | ||
|
|
||
| **authors:** [Julio](https://github.com/juliocc) | ||
| **date:** Dec 19, 2024 | ||
|
|
||
| ## Status | ||
|
|
||
| Accepted and implemented. | ||
|
|
||
| ## Context | ||
|
|
||
| We need to define a variable to manage tag bindings in our Terraform modules. This variable will be used across various modules and within the FAST framework to attach tags to resources via the `google_tags_tag_binding` resource. This variable needs to support both statically defined tags and tags that are dynamically generated during the apply phase of Terraform. | ||
|
|
||
| ## Decision: | ||
|
|
||
| We will use the `map(string)` type for the `tag_bindings` variable across all modules where it's needed. | ||
|
|
||
| ## Consequences | ||
|
|
||
| Minimal. This is already an established practice across the repository. | ||
|
|
||
| Note that the keys of the map are ignored by our code and only used to bypass Terraform limitations with dynamic values in a `for_each` argument. See [Using Expressions in for_each](https://developer.hashicorp.com/terraform/language/meta-arguments/for_each#using-expressions-in-for_each) in Terraform's documentation for more details. | ||
|
|
||
| ## Reasoning | ||
|
|
||
| The primary reason for choosing `map(string)` is to enable the use of dynamic tags without encountering Terraform errors related to dynamic values. By using a map, we avoid the limitations imposed by lists or sets and ensure that our modules and FAST can handle both static and dynamic tag values. | ||
|
|
||
| ## Alternatives Considered: | ||
|
|
||
| - `list(string)`: Lists would enforce a fixed number of tags defined at plan time, limiting flexibility and hindering the management of dynamic tags. | ||
| - `set(string)`: Similar to lists, sets would require all tag values to be known at plan time, which is not suitable for scenarios with dynamic tag generation. | ||
|
|
||
| ## Implementation: | ||
|
|
||
| At the time of writing this ADR, all modules and FAST stages already use `map(string)`. The purpose of this ADR is to document an existing practice. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| # Add-on stages | ||
|
|
||
| **authors:** [Ludo](https://github.com/ludoo), [Julio](https://github.com/juliocc) | ||
| **date:** Jan 5, 2025 | ||
|
|
||
| ## Status | ||
|
|
||
| Under implementation | ||
|
|
||
| ## Context | ||
|
|
||
| Some optional features are too complex to directly embed in stages, as they would complicate the variable scope, need to be replicated across parallel stages, and introduce a lot of nested code for the benefit of a small subset of users. | ||
|
|
||
| This need has surfaced with the network security stage, which has taken the approach of spreading its resources across different stages (security, networking, and its own netsec) and resulted in very layered, complicated code which is not easy to deploy or maintain. | ||
|
|
||
| This is how the current netsec stage looks like from a resource perspective: | ||
|
|
||
|  | ||
|
|
||
| Furthermore, the stage also tries to do "too much", by behaving as a full stage and adopting a design that statically maps its resources onto all FAST environments and networks. This results in code that is really hard to adapt for real life use cases and impossible to keep forward compatible, as changes are extensive and spread out across three stages. | ||
|
|
||
| ## Proposal | ||
|
|
||
| The proposal is to adopt a completely different approach, where large optional featuresets that we don't want to embed in our default stages should become "addon stages" that: | ||
|
|
||
| - reuse the IaC service account and bucket of the stage they interact with (e.g. networking for network security) to eliminate the need for custom IAM | ||
| - encapsulate all their resources in a single root module (the add-on stage) | ||
| - don't implement a static design but deal with the smallest possible unit of work, so that they can be cloned to implement different designs via tfvars | ||
| - provide optional FAST output variables for the main stages | ||
|
|
||
| This is what the network security stage looks like, once refactored according this proposal: | ||
|
|
||
|  | ||
|
|
||
| With this approach | ||
|
|
||
| - there are no dependencies in resman except for a providers file that adds a prefix to the state backend and reuses networking service accounts and bucket | ||
| - the stage design does not deal with environments, but simply implements one complete set of NGFW resources in a given project (typically the net landing or shared environment project) and allows free configuration of zones and VPC attachments | ||
| - any relevant resource already defined in the "main" stages can be referred to via interpolation, by using the stages outputs as contexts | ||
|
|
||
| The code then becomes really simple to use, read and evolve since it's essentially decoupled from the main stages except for a handful of FAST interface variables. | ||
|
|
||
| Add-on stages should live in a separate folder from stages, and once we finally manage to reafctor networking into a simple stage, we go back to having a clear progression for main stages that should make it easier for users to get to grips with FAST's complexity. We might also want to scrap the plugins folder, and replace with a short document explaining the pattern. | ||
|
|
||
| ```bash | ||
| fast | ||
| ├── addons | ||
| ├── 1-tenant-factory | ||
| └── 2-network-security | ||
| ├── assets | ||
| │ └── templates | ||
| ├── extras | ||
| │ ├── 0-cicd-github | ||
| │ └── 0-cicd-gitlab | ||
| ├── plugins | ||
| │ └── 2-networking-serverless-connector | ||
| └── stages | ||
| ├── 0-bootstrap | ||
| ├── 1-resman | ||
| ├── 1-vpcsc | ||
| ├── 2-networking-a-simple | ||
| ├── 2-networking-b-nva | ||
| ├── 2-networking-c-separate-envs | ||
| ├── 2-project-factory | ||
| ├── 2-security | ||
| ├── 3-gcve-dev | ||
| └── 3-gke-dev | ||
| ``` | ||
|
|
||
| ## Decision | ||
|
|
||
| TBD | ||
|
|
||
| ## Consequences | ||
|
|
||
| This approach also maps well to the current tenant factory stage, which essentially acts as a parallel resman stage reusing the same set of IaC resources. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,7 +5,7 @@ | |
|
|
||
| ## Status | ||
|
|
||
| Under discussion. | ||
| Accepted and implemented. | ||
|
|
||
| ## Context | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -97,5 +97,5 @@ module "test" { | |
| prefix = "prefix" | ||
| } | ||
| # tftest modules=9 resources=68 | ||
| # tftest modules=9 resources=69 | ||
| ``` | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| # Copyright 2024 Google LLC | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # https://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| # Fabric release: v36.0.1 | ||
|
|
||
| terraform { | ||
| required_version = ">= 1.8.0" | ||
| required_providers { | ||
| google = { | ||
| source = "hashicorp/google" | ||
| version = ">= 6.13.0, < 7.0.0" # tftest | ||
| } | ||
| google-beta = { | ||
| source = "hashicorp/google-beta" | ||
| version = ">= 6.13.0, < 7.0.0" # tftest | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| # Copyright 2024 Google LLC | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # https://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| # Fabric release: v36.0.1 | ||
|
|
||
| terraform { | ||
| required_version = ">= 1.8.0" | ||
| required_providers { | ||
| google = { | ||
| source = "hashicorp/google" | ||
| version = ">= 6.13.0, < 7.0.0" # tftest | ||
| } | ||
| google-beta = { | ||
| source = "hashicorp/google-beta" | ||
| version = ">= 6.13.0, < 7.0.0" # tftest | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| # Copyright 2024 Google LLC | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # https://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| # Fabric release: v36.0.1 | ||
|
|
||
| terraform { | ||
| required_version = ">= 1.8.0" | ||
| required_providers { | ||
| google = { | ||
| source = "hashicorp/google" | ||
| version = ">= 6.13.0, < 7.0.0" # tftest | ||
| } | ||
| google-beta = { | ||
| source = "hashicorp/google-beta" | ||
| version = ">= 6.13.0, < 7.0.0" # tftest | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.