daniel-cit
commented
3 years ago - It is necessary to grant
browserrole to the cloud build service account in the infra pipeline to be able to augment the IAM bindings for (without this, terraform-validator fails with permission denied):- the environment folders
development,non-production, andproduction. - In the
prj-bu1-c-app-cicdproject in the common folder.
- the environment folders
- It is necessary to used impersonate when running the cloudbuild_image_builder:
https://github.com/GoogleCloudPlatform/terraform-example-foundation-app/blob/ae238f3cce0f9541e683ec14bb2f23d307e51354/5-infrastructure/modules/app_cicd_pipeline/repo.tf#L89
--impersonate-service-account=${var.app_cicd_build_sa} - Project
prj-bu1-c-infra-pipelineneeds to enableCloud Resource Manager API - The
gcp-policiesrepo need to be populated like is done in the step 5 of the foundation https://github.com/terraform-google-modules/terraform-example-foundation/tree/master/5-app-infra#deploying-with-cloud-build - New APIs that need to be added to the gcp-polices in the infra pipeline.
- "binaryauthorization.googleapis.com"
- "containeranalysis.googleapis.com"
- It is necessary to enable SSL in the Cloud SQL replicas to remove the violation
GCPSQLSSLConstraintV1.require_sql_ssl on resourcehttps://github.com/GoogleCloudPlatform/terraform-example-foundation-app/blob/ae238f3cce0f9541e683ec14bb2f23d307e51354/5-infrastructure/modules/cloud-sql/main.tf#L20 - It is necessary to add the subnetwork CIDR ranges to the authorized networks configuration to fix violation
GCPGKEMasterAuthorizedNetworksEnabledConstraintV1.enable_gke_master_authorized_networkshttps://github.com/terraform-google-modules/terraform-example-foundation/blob/master/policy-library/policies/constraints/gke_master_authorized_networks_enabled.yaml- 10.0.130.0/29
- 10.0.194.0/29
- 10.0.66.0/29
- 100.65.128.0/22
- 100.64.136.0/22
- 100.65.192.0/22
- 100.64.200.0/22
- 100.65.64.0/22
- 100.64.72.0/22
- The
GCPGKEDashboardConstraintV1.disable_gke_dashboardviolation is a false positive since the dashboard is no longer installed by default and cannot be enable since version 1.15. You can delete the file https://github.com/terraform-google-modules/terraform-example-foundation/blob/master/policy-library/policies/constraints/gke_dashboard_disable.yaml to remove this violation
GCPGKERestrictPodTrafficConstraintV1.gke_restrict_pod_traffic violations needs additional configuration for:
Expected Behavior
Cloud build execution of step 5-infrastructure has no terraform-validator violations
Actual Behavior
Cloud build execution of step 5-infrastructure fails by cloning a empty
gcp-policiesrepoIf we push the policies to the repo following the Foundation 5-app-infra README instructions, we got these terraform-validator violations:
Steps to Reproduce the Problem
Specifications