feat: add instructions for deployment using GitLab pipelines

0-bootstrap/gitlab.tf.example

@@ -0,0 +1,175 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+  cicd_project_id = module.gitlab_cicd.project_id
+
+  wif_sa_cicd_project = {
+    "bootstrap" = [
+      "roles/iam.workloadIdentityPoolAdmin",
+    ],
+  }
+
+  gl_config = {
+    "bootstrap" = var.gl_repos.bootstrap,
+    "org"       = var.gl_repos.organization,
+    "env"       = var.gl_repos.environments,
+    "net"       = var.gl_repos.networks,
+    "proj"      = var.gl_repos.projects,
+  }
+
+  gl_branch_protection_envs = {
+    "env"  = var.gl_repos.environments,
+    "net"  = var.gl_repos.networks,
+    "proj" = var.gl_repos.projects,
+  }
+
+  sa_mapping = {
+    for k, v in local.gl_config : k => {
+      sa_name   = google_service_account.terraform-env-sa[k].name
+      attribute = "attribute.project_path/${var.gl_repos.owner}/${v}"
+    }
+  }
+
+  common_vars = {
+    "PROJECT_ID" : module.gitlab_cicd.project_id,
+    "CICD_RUNNER_REPO" : var.gl_repos.cicd_runner,
+    "WIF_PROVIDER_NAME" : module.gitlab_oidc.provider_name,
+    "TF_BACKEND" : module.seed_bootstrap.gcs_bucket_tfstate,
+    "TF_VAR_gitlab_token" : var.gitlab_token,
+  }
+
+  vars_list = flatten([
+    for k, v in local.gl_config : [
+      for name, value in local.common_vars : {
+        config     = k
+        name       = name
+        value      = value
+        repository = v
+      }
+    ]
+  ])
+
+  sa_vars = [for k, v in local.gl_config : {
+    config     = k
+    name       = "SERVICE_ACCOUNT_EMAIL"
+    value      = google_service_account.terraform-env-sa[k].email
+    repository = v
+    }
+  ]
+
+  gl_vars = { for v in concat(local.sa_vars, local.vars_list) : "${v.config}.${v.name}" => v }
+
+}
+
+provider "gitlab" {
+  token = var.gitlab_token
+}
+
+module "gitlab_cicd" {
+  source  = "terraform-google-modules/project-factory/google"
+  version = "~> 12.0"
+
+  name              = "${var.project_prefix}-b-cicd-wif-gl"
+  random_project_id = true
+  org_id            = var.org_id
+  folder_id         = google_folder.bootstrap.id
+  billing_account   = var.billing_account
+  activate_apis = [
+    "compute.googleapis.com",
+    "admin.googleapis.com",
+    "iam.googleapis.com",
+    "billingbudgets.googleapis.com",
+    "cloudbilling.googleapis.com",
+    "serviceusage.googleapis.com",
+    "cloudresourcemanager.googleapis.com",
+    "iamcredentials.googleapis.com",
+    "sts.googleapis.com",
+    "dns.googleapis.com",
+    "secretmanager.googleapis.com",
+
+  ]
+}
+
+module "gitlab_oidc" {
+  source = "./modules/gitlab-oidc"
+
+  project_id  = module.gitlab_cicd.project_id
+  pool_id     = "foundation-pool"
+  provider_id = "foundation-gl-provider"
+  sa_mapping  = local.sa_mapping
+}
+
+resource "gitlab_project_variable" "variables" {
+  for_each = local.gl_vars
+
+  project   = "${var.gl_repos.owner}/${each.value.repository}"
+  key       = each.value.name
+  value     = each.value.value
+  protected = false
+  masked    = true
+}
+
+resource "gitlab_branch_protection" "image" {
+  project = "${var.gl_repos.owner}/${var.gl_repos.cicd_runner}"
+  branch  = "image"
+}
+
+resource "gitlab_branch_protection" "plan" {
+  for_each = local.gl_config
+
+  project = "${var.gl_repos.owner}/${each.value}"
+  branch  = "plan"
+}
+
+resource "gitlab_branch_protection" "production" {
+  for_each = local.gl_config
+
+  project = "${var.gl_repos.owner}/${each.value}"
+  branch  = "production"
+}
+
+resource "gitlab_branch_protection" "non_production" {
+  for_each = local.gl_branch_protection_envs
+
+  project = "${var.gl_repos.owner}/${each.value}"
+  branch  = "non-production"
+}
+
+resource "gitlab_branch_protection" "development" {
+  for_each = local.gl_branch_protection_envs
+
+  project = "${var.gl_repos.owner}/${each.value}"
+  branch  = "development"
+}
+
+module "cicd_project_wif_iam_member" {
+  source   = "./modules/parent-iam-member"
+  for_each = local.wif_sa_cicd_project
+
+  member      = "serviceAccount:${google_service_account.terraform-env-sa[each.key].email}"
+  parent_type = "project"
+  parent_id   = local.cicd_project_id
+  roles       = each.value
+}
+
+resource "google_service_account_iam_member" "self_impersonate" {
+  for_each = local.granular_sa
+
+  service_account_id = google_service_account.terraform-env-sa[each.key].id
+  role               = "roles/iam.serviceAccountTokenCreator"
+  member             = "serviceAccount:${google_service_account.terraform-env-sa[each.key].email}"
+}

0-bootstrap/modules/gitlab-oidc/main.tf

@@ -0,0 +1,51 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+resource "google_project_service" "services" {
+  project            = var.project_id
+  count              = length(var.service_list)
+  service            = var.service_list[count.index]
+  disable_on_destroy = false
+}
+
+resource "google_iam_workload_identity_pool" "main" {
+  project                   = var.project_id
+  workload_identity_pool_id = var.pool_id
+  display_name              = var.pool_display_name
+  description               = var.pool_description
+  disabled                  = false
+}
+
+resource "google_iam_workload_identity_pool_provider" "main" {
+  project                            = var.project_id
+  workload_identity_pool_id          = google_iam_workload_identity_pool.main.workload_identity_pool_id
+  workload_identity_pool_provider_id = var.provider_id
+  display_name                       = var.provider_display_name
+  description                        = var.provider_description
+  attribute_condition                = var.attribute_condition
+  attribute_mapping                  = var.attribute_mapping
+  oidc {
+    allowed_audiences = var.allowed_audiences
+    issuer_uri        = var.issuer_uri
+  }
+}
+
+resource "google_service_account_iam_member" "wif-sa" {
+  for_each           = var.sa_mapping
+  service_account_id = each.value.sa_name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.main.name}/${each.value.attribute}"
+}

0-bootstrap/modules/gitlab-oidc/outputs.tf

@@ -0,0 +1,25 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "pool_name" {
+  description = "Pool name"
+  value       = google_iam_workload_identity_pool.main.name
+}
+
+output "provider_name" {
+  description = "Provider name"
+  value       = google_iam_workload_identity_pool_provider.main.name
+}

0-bootstrap/modules/gitlab-oidc/variables.tf

@@ -0,0 +1,130 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+variable "project_id" {
+  type        = string
+  description = "The project id to create Workload Identity Pool"
+}
+
+variable "service_list" {
+  description = "Google Cloud APIs required for the project"
+  type        = list(string)
+  default = [
+    "iam.googleapis.com",
+    "cloudresourcemanager.googleapis.com",
+    "sts.googleapis.com",
+    "iamcredentials.googleapis.com"
+  ]
+}
+
+variable "pool_id" {
+  type        = string
+  description = "Workload Identity Pool ID"
+}
+
+variable "pool_display_name" {
+  type        = string
+  description = "Workload Identity Pool display name"
+  default     = null
+}
+
+variable "pool_description" {
+  type        = string
+  description = "Workload Identity Pool description"
+  default     = "Workload Identity Pool managed by Terraform"
+}
+
+variable "provider_id" {
+  type        = string
+  description = "Workload Identity Pool Provider id"
+}
+
+variable "issuer_uri" {
+  type        = string
+  description = "Workload Identity Pool Issuer URL"
+  default     = "https://gitlab.com"
+}
+
+variable "provider_display_name" {
+  type        = string
+  description = "Workload Identity Pool Provider display name"
+  default     = null
+}
+
+variable "provider_description" {
+  type        = string
+  description = "Workload Identity Pool Provider description"
+  default     = "Workload Identity Pool Provider managed by Terraform"
+}
+
+variable "attribute_condition" {
+  type        = string
+  description = <<-EOF
+  Workload Identity Pool Provider attribute condition expression
+  For more info please see
+  https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider
+  EOF
+  default     = null
+}
+
+variable "attribute_mapping" {
+  type        = map(any)
+  description = <<-EOF
+  Workload Identity Pool Provider attribute mapping
+  For more info please see:
+  https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iam_workload_identity_pool_provider
+  https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html#token-payload
+  EOF
+  default = {
+    # Principal IAM
+    "google.subject" = "assertion.sub"
+    # standard claims
+    "attribute.sub" = "attribute.sub"
+    "attribute.iss" = "attribute.iss"
+    "attribute.aud" = "attribute.aud"
+    "attribute.exp" = "attribute.exp"
+    "attribute.nbf" = "attribute.nbf"
+    "attribute.iat" = "attribute.iat"
+    "attribute.jti" = "attribute.jti"
+    # GitLab custom claims
+    "attribute.namespace_id"   = "assertion.namespace_id"
+    "attribute.namespace_path" = "assertion.namespace_path"
+    "attribute.project_id"     = "assertion.project_id"
+    "attribute.project_path"   = "assertion.project_path"
+    "attribute.user_id"        = "assertion.user_id"
+    "attribute.user_login"     = "assertion.user_login"
+    "attribute.user_email"     = "assertion.user_email"
+  }
+}
+
+variable "allowed_audiences" {
+  type        = list(string)
+  description = "Workload Identity Pool Provider allowed audiences."
+  default     = []
+}
+
+variable "sa_mapping" {
+  type = map(object({
+    sa_name   = string
+    attribute = string
+  }))
+  description = <<-EOF
+    Service Account resource names and corresponding WIF provider attributes.
+    If attribute is set to `*` all identities in the pool are granted access to SAs
+  EOF
+  default     = {}
+}