obriensystems
commented
2 years ago clone/download repo goto
https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding
prereq
- verify the organization policy on location constraint is not set - there is some "us" regional assets required during the build https://console.cloud.google.com/iam-admin/orgpolicies/gcp-resourceLocations?organizationId=84
- super admin identity or workspace account
- has billing admin, folder admin, organizational admin
create folder for use instead of org
https://console.cloud.google.com/foldercreate?previousPage=%2Fcloud-resource-manager refresh page https://console.cloud.google.com/cloud-resource-manager get folder id https://console.cloud.google.com/iam-admin/settings?folder=45293448627
gcloud auth list mkdir github cd github https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/archive/refs/heads/main.zip cp ../pbmm-on-gcp-onboarding-main.zip . unzip pbmm-on-gcp-onboarding-main.zip
michael@cloudshell:~/github (landingzone-stg)$ cd pbmm-on-gcp-onboarding-main/environments/bootstrap/ michael@cloudshell:~/github/pbmm-on-gcp-onboarding-main/environments/bootstrap (landingzone-stg)$ chmod +x bootstrap.sh michael@cloudshell:~/github/pbmm-on-gcp-onboarding-main/environments/bootstrap (landingzone-stg)$ cd ../../modules/cloudbuild/cloudbuild_builder/ michael@cloudshell:~/github/pbmm-on-gcp-onboarding-main/modules/cloudbuild/cloudbuild_builder (landingzone-stg)$ chmod +x entrypoint.bash michael@cloudshell:~/github/pbmm-on-gcp-onboarding-main/modules/cloudbuild/cloudbuild_builder (landingzone-stg)$ cd ../../../environments/bootstrap/
create folder
vi bootstrap.auto.tfvars
bootstrap = { userDefinedString = "codev" # REQUIRED EDIT Appended to project name/id additionalUserDefinedString = "sbx" # OPTIONAL EDIT Additional appended string billingAccount = "01..B" # REQUIRED EDIT Billing Account in the format of ######-######-###### parent = "folders/45..7" # REQUIRED EDIT Organization Node in format "organizations/#############" or "folders/#############" terraformDeploymentAccount = "terraform0309" # REQUIRED EDIT Name of the service account to created to deploy the terraform code bootstrapEmail = "user:michael@co..d.org" # REQUIRED EDIT In the form of 'user:user@email.com region = "northamerica-northeast1" # REQUIRED EDIT Region name. northamerica-northeast1 cloud_source_repo_name = "co...zedlz" # REQUIRED EDIT CSR used as a mirror for code tfstate_buckets = { common = { name = "conta...dlzco" # REQUIRED EDIT Must be globally unique name = "con..zedlznp" # REQUIRED EDIT Must be globally unique name = "con..edlzpr" # REQUIRED EDIT Must be globally unique
cloud_build_admins = [ "user:michael@con..ed.org", REQUIRED EDIT user:user@google.com, group:users@google.com,serviceAccount:robot@PROJECT.iam.gserviceaccount.com ] group_build_viewers = [ "user:michael@containerized.org", REQUIRED EDIT user:user@google.com, group:users@google.com,serviceAccount:robot@PROJECT.iam.gserviceaccount.com ]
organization-config.auto.tfvars
organization_config = { org_id = "843157297140" # REQUIRED EDIT Numeric portion only '#############'" default_region = "northamerica-northeast1" # REQUIRED EDIT Cloudbuild Region department_code = "Co" # REQUIRED EDIT Two Characters. Capitol and then lowercase owner = "cod" # REQUIRED EDIT Used in naming standard environment = "P" # REQUIRED EDIT S-Sandbox P-Production Q-Quality D-development location = "northamerica-northeast1" # REQUIRED EDIT Location used for resources. Currently northamerica-northeast1 is available labels = {} # REQUIRED EDIT Object used for resource labels root_node = "folders/45...7" # REQUIRED EDIT Organization Node in format "organizations/#############" or "folders/###" contacts = { "michael@co...d.org" = ["ALL"] # REQUIRED EDIT Essential Contacts for notifications. Must be in the form EMAIL -> [NOTIFICATION_TYPES] } billing_account = "01...3B" # REQUIRED EDIT Format of ######-######-###### }
common/common.auto.tfvars
folders = { parent = "folders/4..7" user_defined_string = "acm" # REQUIRED EDIT. sink_name = "coprodsink1" # REQUIRED EDIT. Must be unique across organization bucket_viewer = "user:michael@co..ed.org" # REQUIRED EDIT.
run
michael@cloudshell:~/github/pbmm-on-gcp-onboarding-main/environments/bootstrap (landingzone-stg)$ ./bootstrap.sh run
Plan: 96 to add, 0 to change, 0 to destroy.
Changes to Outputs:
- csr_name = "containerizedlz"
- organization_config = {
- billing_account = "01..B"
- contacts = {}
- default_region = "northamerica-northeast1"
- department_code = "Co"
- environment = "P"
- labels = {}
- location = "northamerica-northeast1"
- org_id = "8..0"
- owner = "cod"
- root_node = "folders/45..7" }
- project_id = "cope-cod-codev-sbx"
- service_account_email = (known after apply)
- terraform_deployment_account = (known after apply)
- tfstate_bucket_names = {
- common = "copeco..edlzco"
- nonprod = "copeco...edlznp"
- prod = "copeco..dlzpr" }
1133 4 min to get past module.landing_zone_bootstrap.module.project.google_project.project: Still creating... [30s elapsed] module.landing_zone_bootstrap.module.project.google_project.project: Still creating... [3m0s elapsed] module.landing_zone_bootstrap.module.project.google_project.project: Creation complete after 3m3s [id=projects/cope-cod-codev-sbx] 1137
1140 module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder: Creating... module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder: Provisioning with 'local-exec'... module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): Executing: ["/bin/sh" "-c" " gcloud builds submit ../../modules/cloudbuild/cloudbuild_builder/ \\n --project=cope-cod-codev-sbx \\n --config=../../modules/cloudbuild/cloudbuild_builder/cloudbuild.yaml \\n --gcs-source-staging-dir \\n --substitutions=_TERRAFORM_VERSION=1.0.10,_TERRAFORM_VERSION_SHA256SUM=a221682fcc9cbd7fde22f305ead99b3ad49d8303f152e118edda086a2807716d,_TERRAFORM_VALIDATOR_RELEASE=2021-03-22,_REGION=northamerica-northeast1,_REPOSITORY=codev-tf-runners \\n --async\n"] google_artifact_registry_repository_iam_member.terraform-image-iam: Creation complete after 10s [id=projects/cope-cod-codev-sbx/locations/northamerica-northeast1/repositories/codev-tf-runners/roles/artifactregistry.admin/serviceAccount:terraform0309@cope-cod-codev-sbx.iam.gserviceaccount.com] module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): ERROR: (gcloud.builds.submit) argument --gcs-source-staging-dir: expected one argument module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): Usage: gcloud builds submit [[SOURCE] --no-source] [optional flags] module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): optional flags may be --async | --no-cache | --config | --disk-size | module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): --gcs-log-dir | --gcs-source-staging-dir | --help | module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): --ignore-file | --machine-type | --pack | --region | module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): --no-source | --substitutions | --suppress-logs | module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): --tag | --timeout | --worker-pool
module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): For detailed information on this command and its flags, run: module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder (local-exec): gcloud builds submit --help ╷ │ Warning: Experimental feature "module_variable_optional_attrs" is active │ │ on terraform.tf line 7, in terraform: │ 7: experiments = [module_variable_optional_attrs] │ │ Experimental features are subject to breaking changes in future minor or patch releases, based on feedback. │ │ If you have feedback on the design of this feature, please open a GitHub issue to discuss it. │ │ (and 2 more similar warnings elsewhere) ╵ ╷ │ Error: local-exec provisioner error │ │ with module.cloudbuild_bootstrap.null_resource.cloudbuild_terraform_builder, │ on ../../modules/cloudbuild/main.tf line 121, in resource "null_resource" "cloudbuild_terraform_builder": │ 121: provisioner "local-exec" { │ │ Error running command ' gcloud builds submit ../../modules/cloudbuild/cloudbuild_builder/ \ │ --project=cope-cod-codev-sbx \ │ --config=../../modules/cloudbuild/cloudbuild_builder/cloudbuild.yaml \ │ --gcs-source-staging-dir \ │ --substitutions=_TERRAFORM_VERSION=1.0.10,_TERRAFORM_VERSION_SHA256SUM=a221682fcc9cbd7fde22f305ead99b3ad49d8303f152e118edda086a2807716d,_TERRAFORM_VALIDATOR_RELEASE=2021-03-22,_REGION=northamerica-northeast1,_REPOSITORY=codev-tf-runners \ │ --async │ ': exit status 2. Output: ERROR: (gcloud.builds.submit) argument --gcs-source-staging-dir: expected one argument │ Usage: gcloud builds submit [[SOURCE] --no-source] [optional flags] │ optional flags may be --async | --no-cache | --config | --disk-size | │ --gcs-log-dir | --gcs-source-staging-dir | --help | │ --ignore-file | --machine-type | --pack | --region | │ --no-source | --substitutions | --suppress-logs | │ --tag | --timeout | --worker-pool │ │ For detailed information on this command and its flags, run: │ gcloud builds submit --help
remember to take out flag until the PR is merged
https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/pull/11/files remove line 126 of modules/cloudbuild/main.tf --gcs-source-staging-dir \
1144
rerun
Apply complete! Resources: 9 added, 0 changed, 9 destroyed.
Outputs:
csr_name = "containerizedlz" organization_config = { "billing_account" = "01...B" "contacts" = {} "default_region" = "northamerica-northeast1" "department_code" = "Co" "environment" = "P" "labels" = {} "location" = "northamerica-northeast1" "org_id" = "8..0" "owner" = "cod" "root_node" = "folders/4..7" } project_id = "cope-cod-codev-sbx" service_account_email = "terraform0309@cope-cod-codev-sbx.iam.gserviceaccount.com" terraform_deployment_account = "terraform0309@cope-cod-codev-sbx.iam.gserviceaccount.com" tfstate_bucket_names = { "common" = "copeco...edlzco" "nonprod" = "copeco..edlznp" "prod" = "copeco..edlzpr" } INFO - Uploading ./default.tfstate to cop..rizedlzco/environments/bootstrap/default.tfstate cope-cod-codev-sbx Copying file://./default.tfstate [Content-Type=application/octet-stream]... / [1 files][225.9 KiB/225.9 KiB] Operation completed over 1 objects/225.9 KiB. Terraform default.tfstate exists. INFO - Create bootstrap backend INFO - Create common backend INFO - Create bootstrap provider INFO - Create common provider INFO - Create nonprod backend and provider INFO - Create prod backend and provider INFO - Committing code to CSR rm: cannot remove '.git': No such file or directory
check cloud build https://console.cloud.google.com/cloud-build/builds
fmichaelobrien
capturing additions to the doc prior to a patch
https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding#readme
Use case: non-GCP domain for identity federation
20220317 update https://cloud.google.com/blog/topics/developers-practitioners/using-google-cloud-service-account-impersonation-your-terraform-code