Closed daniel-cit closed 3 years ago
browser
role to the cloud build service account in the infra pipeline to be able to augment the IAM bindings for (without this, terraform-validator fails with permission denied):
development
, non-production
, and production
.prj-bu1-c-app-cicd
project in the common folder. --impersonate-service-account=${var.app_cicd_build_sa}
prj-bu1-c-infra-pipeline
needs to enable Cloud Resource Manager API
gcp-policies
repo need to be populated like is done in the step 5 of the foundation https://github.com/terraform-google-modules/terraform-example-foundation/tree/master/5-app-infra#deploying-with-cloud-buildGCPSQLSSLConstraintV1.require_sql_ssl on resource
https://github.com/GoogleCloudPlatform/terraform-example-foundation-app/blob/ae238f3cce0f9541e683ec14bb2f23d307e51354/5-infrastructure/modules/cloud-sql/main.tf#L20GCPGKEMasterAuthorizedNetworksEnabledConstraintV1.enable_gke_master_authorized_networks
https://github.com/terraform-google-modules/terraform-example-foundation/blob/master/policy-library/policies/constraints/gke_master_authorized_networks_enabled.yaml
GCPGKEDashboardConstraintV1.disable_gke_dashboard
violation is a false positive since the dashboard is no longer installed by default and cannot be enable since version 1.15. You can delete the file https://github.com/terraform-google-modules/terraform-example-foundation/blob/master/policy-library/policies/constraints/gke_dashboard_disable.yaml to remove this violationGCPGKERestrictPodTrafficConstraintV1.gke_restrict_pod_traffic
violations needs additional configuration for:
Expected Behavior
Cloud build execution of step 5-infrastructure has no terraform-validator violations
Actual Behavior
Cloud build execution of step 5-infrastructure fails by cloning a empty
gcp-policies
repoIf we push the policies to the repo following the Foundation 5-app-infra README instructions, we got these terraform-validator violations:
Steps to Reproduce the Problem
Specifications