You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* fix seed and cloudbuild project prefix
* add network hub projects to base README
* change introduction of each project explanation section
* fix environment secrets project explanation
* add win activation FW rule and add links to explanation pages for the existing rules
* add minor detail for groups in the prerequesites section.
* update instuctions in 1-org READMEs
* update instructions in 2-environments READMEs
* add README link in manual step na fix envs folder name
* update instructions in 3-networks README
* additional instructions for finding the service perimeter names
* markdown linting fixes
* replace YOUR-ORGANIZATION_ID with YOUR_ORGANIZATION_ID
* replace terraform_sa_email with terraform_service_account
* fix typos
* fix app_infra_pipeline_cloudbuild_sa example
Copy file name to clipboardExpand all lines: 0-bootstrap/README-Jenkins.md
+5-5Lines changed: 5 additions & 5 deletions
Original file line number
Diff line number
Diff line change
@@ -6,12 +6,12 @@ Another CICD option is to use Cloud Build & Cloud Source Repos. If you don't hav
6
6
7
7
## Overview
8
8
9
-
The objective of the instructions below is to configure the infrastructure that allows you to run CICD deployments for the next stages (`1-org, 2-environments, 3-networks, 4-projects`) using Jenkins. The infrastructure consists in two Google Cloud Platform projects (`cft-seed` and `prj-cicd`) and VPN configuration to connect to your on-prem environment.
9
+
The objective of the instructions below is to configure the infrastructure that allows you to run CICD deployments for the next stages (`1-org, 2-environments, 3-networks, 4-projects`) using Jenkins. The infrastructure consists in two Google Cloud Platform projects (`prj-seed` and `prj-cicd`) and VPN configuration to connect to your on-prem environment.
10
10
11
-
It is a best practice to have two separate projects here (`cft-seed` and `prj-cicd`) for separation of concerns. On one hand, `cft-seed` stores terraform state and has the Service Account able to create / modify infrastructure. On the other hand, the deployment of that infrastructure is coordinated by Jenkins, which is implemented in `prj-cicd` and connected to your Master on-prem.
11
+
It is a best practice to have two separate projects here (`prj-seed` and `prj-cicd`) for separation of concerns. On one hand, `prj-seed` stores terraform state and has the Service Account able to create / modify infrastructure. On the other hand, the deployment of that infrastructure is coordinated by Jenkins, which is implemented in `prj-cicd` and connected to your Master on-prem.
12
12
13
13
**After following the instructions below, you will have:**
14
-
- The `cft-seed` project, which contains:
14
+
- The `prj-seed` project, which contains:
15
15
- Terraform state bucket
16
16
- Custom Service Account used by Terraform to create new resources in GCP
17
17
- The `prj-cicd` project, which contains:
@@ -20,7 +20,7 @@ It is a best practice to have two separate projects here (`cft-seed` and `prj-ci
20
20
- FW rules to allow communication over port 22
21
21
- VPN connection with on-prem (or where ever your Jenkins Master is located)
- This service account is granted the access to generate tokens on the Terraform custom service account in the `cft-seed` project
23
+
- This service account is granted the access to generate tokens on the Terraform custom service account in the `prj-seed` project
24
24
25
25
-**Note: these instructions do not indicate how to create a Jenkins Master.** To deploy a Jenkins Master, you should follow [Jenkins Architecture](https://www.jenkins.io/doc/book/architecting-for-scale/) recommendations.
26
26
@@ -135,7 +135,7 @@ You arrived to these instructions because you are using the `jenkins_bootstrap`
135
135
1. Open the link in your browser and accept.
136
136
137
137
1. Run terraform commands.
138
-
- After the credentials are configured, we will create the `cft-seed` project (which contains the GCS state bucket and Terraform custom service account) and the `prj-cicd` project (which contains the Jenkins Agent, its custom service account and where we will add VPN configuration)
138
+
- After the credentials are configured, we will create the `prj-seed` project (which contains the GCS state bucket and Terraform custom service account) and the `prj-cicd` project (which contains the Jenkins Agent, its custom service account and where we will add VPN configuration)
139
139
- **WARNING: Make sure you have commented-out the `cloudbuild_bootstrap` module and enabled the `jenkins_bootstrap` module in the `./main.tf` file**
140
140
- **Use Terraform 0.13.6** to run the terraform script with the commands below
Copy file name to clipboardExpand all lines: 0-bootstrap/README.md
+17-16Lines changed: 17 additions & 16 deletions
Original file line number
Diff line number
Diff line change
@@ -8,24 +8,25 @@ The purpose of this step is to bootstrap a GCP organization, creating all the re
8
8
1. A GCP [Billing Account](https://cloud.google.com/billing/docs/how-to/manage-billing-account)
9
9
1. Cloud Identity / Google Workspace (former G Suite) groups for organization and billing admins
10
10
1. User account should be used for running this step, service accounts are not supported.
11
-
1. Membership in the `group_org_admins` group for user running terraform.
12
-
1. Grant the roles mentioned in bootstrap [README.md](https://github.com/terraform-google-modules/terraform-google-bootstrap#permissions), as well as `roles/resourcemanager.folderCreator` for the user running the step.
11
+
1. Membership in the `group_org_admins` group for the user running terraform.
12
+
1. Grant the roles mentioned in bootstrap module [README.md](https://github.com/terraform-google-modules/terraform-google-bootstrap#permissions), as well as `roles/resourcemanager.folderCreator` for the user running the step.
13
13
14
-
Further details of permissions required and resources created, can be found in the bootstrap module [documentation.](https://github.com/terraform-google-modules/terraform-google-bootstrap)
14
+
Further details of groups, permissions required and resources created, can be found in the bootstrap module [documentation.](https://github.com/terraform-google-modules/terraform-google-bootstrap)
15
15
16
16
**Note:** when running the examples in this repository, you may receive various errors when applying terraform:
17
-
-`Error code 8, message: The project cannot be created because you have exceeded your allotted project quota.`. That means you have reached your [Project creation quota](https://support.google.com/cloud/answer/6330231). In this case you can use this [Request Project Quota Increase](https://support.google.com/code/contact/project_quota_increase) form to request a quota increase. The `terraform_sa_email` created in `0-bootstrap` should also be listed in "Email addresses that will be used to create projects" in that support form. If you face others quota errors, check the [Quota documentation](https://cloud.google.com/docs/quota) for guidence.
17
+
18
+
-`Error code 8, message: The project cannot be created because you have exceeded your allotted project quota.`. That means you have reached your [Project creation quota](https://support.google.com/cloud/answer/6330231). In this case you can use this [Request Project Quota Increase](https://support.google.com/code/contact/project_quota_increase) form to request a quota increase. The `terraform_service_account` created in `0-bootstrap` should also be listed in "Email addresses that will be used to create projects" in that support form. If you face others quota errors, check the [Quota documentation](https://cloud.google.com/docs/quota) for guidance.
18
19
-`Error: Error when reading or editing Organization Not Found : <organization-id>: googleapi: Error 403: The caller does not have permission, forbidden`.
19
-
- Check that your user have [Organization Admin](https://cloud.google.com/iam/docs/understanding-roles#resource-manager-roles) predefined role at the Organization level.
20
-
- If this is the case, try the following:
21
-
```
22
-
gcloud auth application-default login
23
-
gcloud auth list # <- confirm that correct account has a star next to it
24
-
```
25
-
- Re-run `terraform` after.
20
+
- Check that your user have [Organization Admin](https://cloud.google.com/iam/docs/understanding-roles#resource-manager-roles) predefined role at the Organization level.
21
+
- If this is the case, try the following:
22
+
```
23
+
gcloud auth application-default login
24
+
gcloud auth list # <- confirm that correct account has a star next to it
25
+
```
26
+
- Re-run `terraform` after.
26
27
- `Error: Error setting billing account "XXXXXX-XXXXXX-XXXXXX" for project "projects/some-project": googleapi: Error 400: Precondition check failed., failedPrecondition`. Most likely this is related to billing quota issue.
27
-
- To confirm this, try `gcloud alpha billing projects link projects/some-project --billing-account XXXXXX-XXXXXX-XXXXXX`.
28
-
- If output states `Cloud billing quota exceeded`, please request increase via [https://support.google.com/code/contact/billing_quota_increase](https://support.google.com/code/contact/billing_quota_increase).
28
+
- To confirm this, try `gcloud alpha billing projects link projects/some-project --billing-account XXXXXX-XXXXXX-XXXXXX`.
29
+
- If output states `Cloud billing quota exceeded`, please request increase via [https://support.google.com/code/contact/billing_quota_increase](https://support.google.com/code/contact/billing_quota_increase).
29
30
30
31
## 0-bootstrap usage to deploy Jenkins
31
32
@@ -77,13 +78,13 @@ Currently, the bucket information is replaced in the state backends as a part of
77
78
|------|-------------|
78
79
| cloudbuild\_project\_id | Project where CloudBuild configuration and terraform container image will reside. |
79
80
| csr\_repos | List of Cloud Source Repos created by the module, linked to Cloud Build triggers. |
80
-
| gcs\_bucket\_cloudbuild\_artifacts | Bucket used to store Cloud/Build artefacts in CloudBuild project. |
81
+
| gcs\_bucket\_cloudbuild\_artifacts | Bucket used to store Cloud/Build artifacts in CloudBuild project. |
81
82
| gcs\_bucket\_tfstate | Bucket used for storing terraform state for foundations pipelines in seed project. |
82
83
| kms\_crypto\_key | KMS key created by the module. |
83
84
| kms\_keyring | KMS Keyring created by the module. |
84
85
| seed\_project\_id | Project where service accounts and core APIs will be enabled. |
85
-
| terraform\_sa\_email | Email for privileged service account for Terraform. |
86
86
| terraform\_sa\_name | Fully qualified name for privileged service account for Terraform. |
87
+
| terraform\_service\_account | Email for privileged service account for Terraform. |
87
88
88
89
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
89
90
@@ -93,4 +94,4 @@ Currently, the bucket information is replaced in the state backends as a part of
- You should use the same version in the manual steps during 0-bootstrap to avoid possible [Terraform State Snapshot Lock](https://github.com/hashicorp/terraform/issues/23290) errors caused by differences in terraform versions. This can usually be resolved with a version upgrade.
97
+
- You should use the same version in the manual steps during 0-bootstrap to avoid possible [Terraform State Snapshot Lock](https://github.com/hashicorp/terraform/issues/23290) errors caused by differences in terraform versions. This can usually be resolved with a version upgrade.
on .terraform/modules/jenkins/terraform-google-project-factory-7.1.0/modules/core_project_factory/main.tf line 96, in resource "google_project" "main":
0 commit comments