Skip to content
This repository has been archived by the owner on Oct 20, 2023. It is now read-only.

Updating the way Forseti Server Configuration is retrieved from GCS #480

Merged
merged 4 commits into from
Mar 12, 2020
Merged

Updating the way Forseti Server Configuration is retrieved from GCS #480

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7744d2b
Updating the way Forseti Server Configuration is retrieved from GCS
Feb 1, 2020
6890c14
Pinning version of helm provider to ~> v0.10
Feb 5, 2020
a0ed507
Passing helm chart version through the on_gke_end_to_end example to t…
Feb 5, 2020
cf5cf96
Merge branch 'feature/add-gke-tests' into master
gkowalski-google Mar 12, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions examples/on_gke_end_to_end/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ provider "helm" {
debug = true
automount_service_account_token = true
install_tiller = true
version = "~> v0.10"
gkowalski-google marked this conversation as resolved.
Show resolved Hide resolved
}

#--------------------#
Expand Down Expand Up @@ -168,6 +169,7 @@ module "forseti" {
k8s_forseti_server_image_tag = var.k8s_forseti_server_image_tag
k8s_forseti_orchestrator_image_tag = var.k8s_forseti_orchestrator_image_tag
helm_repository_url = var.helm_repository_url
helm_chart_version = var.helm_chart_version
policy_library_repository_url = var.policy_library_repository_url
policy_library_repository_branch = var.policy_library_repository_branch
policy_library_sync_enabled = var.policy_library_sync_enabled
Expand Down
5 changes: 5 additions & 0 deletions examples/on_gke_end_to_end/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,11 @@ variable "helm_repository_url" {
default = "https://forseti-security-charts.storage.googleapis.com/release/"
}

variable "helm_chart_version" {
description = "The version of the Helm chart to use"
default = "2.2.1"
}

variable "k8s_forseti_namespace" {
description = "The Kubernetes namespace in which to deploy Forseti."
default = "forseti"
Expand Down
27 changes: 16 additions & 11 deletions modules/on_gke/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ resource "null_resource" "org_id_and_folder_id_are_both_empty" {
count = length(var.composite_root_resources) == 0 && var.org_id == "" && var.folder_id == "" ? 1 : 0

provisioner "local-exec" {
command = "echo 'composite_root_resources=${var.composite_root_resources} org_id=${var.org_id} folder_id=${var.org_id}' >&2; false"
command = "echo 'composite_root_resources=${var.composite_root_resources} org_id=${var.org_id} folder_id=${var.folder_id}' >&2; false"
gkowalski-google marked this conversation as resolved.
Show resolved Hide resolved
interpreter = ["bash", "-c"]
}
}
Expand Down Expand Up @@ -121,20 +121,23 @@ data "tls_public_key" "git_sync_public_ssh_key" {
//*****************************************
// Obtain Forseti Server Configuration
//*****************************************
data "google_storage_object_signed_url" "file_url" {
bucket = module.server_gcs.forseti-server-storage-bucket
path = "configs/forseti_conf_server.yaml"
content_md5 = module.server_config.forseti-server-config-md5
data "google_storage_bucket_object" "server_config_contents" {
bucket = module.server_gcs.forseti-server-storage-bucket
name = "configs/forseti_conf_server.yaml"
depends_on = [
module.server_config.forseti-server-config-md5
]
}

data "google_client_config" "current" {}

data "http" "server_config_contents" {
gkowalski-google marked this conversation as resolved.
Show resolved Hide resolved
url = data.google_storage_object_signed_url.file_url.signed_url
url = format("%s?alt=media", data.google_storage_bucket_object.server_config_contents.self_link)

# Optional request headers
request_headers = {
"Content-MD5" = module.server_config.forseti-server-config-md5
"Authorization" = "Bearer ${data.google_client_config.current.access_token}"
}

depends_on = ["data.google_storage_object_signed_url.file_url"]
}

//*****************************************
Expand Down Expand Up @@ -225,10 +228,12 @@ resource "helm_release" "forseti-security" {
version = var.helm_chart_version
chart = "forseti-security"
recreate_pods = var.recreate_pods
depends_on = ["kubernetes_role_binding.tiller",
depends_on = [
"kubernetes_role_binding.tiller",
"kubernetes_namespace.forseti",
"google_service_account_iam_binding.forseti_server_workload_identity",
"google_service_account_iam_binding.forseti_client_workload_identity"]
"google_service_account_iam_binding.forseti_client_workload_identity"
]

set {
name = "database.username"
Expand Down