Skip to content

Commit f79bbc5

Browse files
caetano-colindaniel-citapeabody
authored
feat(module): add cloudbuild connection module (#312)
Co-authored-by: Daniel Andrade <dandrade@ciandt.com> Co-authored-by: Andrew Peabody <andrewpeabody@google.com>
1 parent 62f5f7d commit f79bbc5

File tree

17 files changed

+1021
-1
lines changed

17 files changed

+1021
-1
lines changed

‎build/int.cloudbuild.yaml‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
timeout: 3600s
15+
timeout: 4200s
1616
steps:
1717
- id: swap-module-refs
1818
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
@@ -249,6 +249,44 @@ steps:
249249
args: ['/bin/bash', '-c', 'cft test run TestCloudBuildWorkspaceSimpleGitLab --stage teardown --verbose']
250250
secretEnv: ['IM_GITLAB_PAT']
251251

252+
- id: apply-cloudbuild-connection-github
253+
waitFor:
254+
- create-all
255+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
256+
args: ['/bin/bash', '-c', 'cft test run TestCloudBuildRepoConnectionGithub --stage apply --verbose']
257+
secretEnv: ['IM_GITHUB_PAT']
258+
- id: verify-cloudbuild-connection-github
259+
waitFor:
260+
- apply-cloudbuild-connection-github
261+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
262+
args: ['/bin/bash', '-c', 'cft test run TestCloudBuildRepoConnectionGithub --stage verify --verbose']
263+
secretEnv: ['IM_GITHUB_PAT']
264+
- id: teardown-cloudbuild-connection-github
265+
waitFor:
266+
- verify-cloudbuild-connection-github
267+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
268+
args: ['/bin/bash', '-c', 'cft test run TestCloudBuildRepoConnectionGithub --stage teardown --verbose']
269+
secretEnv: ['IM_GITHUB_PAT']
270+
271+
- id: apply-cloudbuild-connection-gitlab
272+
waitFor:
273+
- create-all
274+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
275+
args: ['/bin/bash', '-c', 'cft test run TestCloudBuildRepoConnectionGitLab --stage apply --verbose']
276+
secretEnv: ['IM_GITLAB_PAT']
277+
- id: verify-cloudbuild-connection-gitlab
278+
waitFor:
279+
- apply-cloudbuild-connection-gitlab
280+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
281+
args: ['/bin/bash', '-c', 'cft test run TestCloudBuildRepoConnectionGitLab --stage verify --verbose']
282+
secretEnv: ['IM_GITLAB_PAT']
283+
- id: teardown-cloudbuild-connection-gitlab
284+
waitFor:
285+
- verify-cloudbuild-connection-gitlab
286+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
287+
args: ['/bin/bash', '-c', 'cft test run TestCloudBuildRepoConnectionGitLab --stage teardown --verbose']
288+
secretEnv: ['IM_GITLAB_PAT']
289+
252290
availableSecrets:
253291
secretManager:
254292
- versionName: $_IM_GITHUB_PAT_SECRET_ID/versions/latest

‎examples/cloudbuild_repo_connection_github/README.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
## Overview
2+
3+
The example will create Cloud Build repositories (2nd gen) using a Github connection.
4+
5+
## Github Requirements for Cloud Build Connection
6+
7+
When using a Cloud Build repositories (2nd gen) GitHub repository, a Cloud Build connection to your repository provider will be created.
8+
9+
For GitHub connections you will need:
10+
11+
- Install the [Cloud Build App](https://github.com/apps/google-cloud-build) on Github.
12+
- Create a [Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) on Github with [scopes](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps#available-scopes) `repo` and `read:user` (or if app is installed in a organization use `read:org`).
13+
14+
For more information on this topic refer to the Cloud Build repositories (2nd gen) documentation for
15+
[Connect to a GitHub repository](https://cloud.google.com/build/docs/automating-builds/github/connect-repo-github?generation=2nd-gen).
16+
17+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
18+
## Inputs
19+
20+
| Name | Description | Type | Default | Required |
21+
|------|-------------|------|---------|:--------:|
22+
| github\_app\_id | The application ID for the Cloudbuild GitHub app. | `string` | n/a | yes |
23+
| github\_pat | The personal access token for authenticating with GitHub. | `string` | n/a | yes |
24+
| project\_id | The ID of the project in which to provision resources. | `string` | n/a | yes |
25+
| repository\_name | The name of the test repository. | `string` | n/a | yes |
26+
| repository\_url | The HTTPS clone URL of the repository, ending with .git. | `string` | n/a | yes |
27+
28+
## Outputs
29+
30+
| Name | Description |
31+
|------|-------------|
32+
| cloud\_build\_repositories\_2nd\_gen\_connection | Cloudbuild connection created. |
33+
| cloud\_build\_repositories\_2nd\_gen\_repositories | Created repositories. |
34+
35+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/cloudbuild_repo_connection_github/main.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "github_connection" {
18+
source = "terraform-google-modules/bootstrap/google//modules/cloudbuild_repo_connection"
19+
version = "~> 9.0"
20+
21+
project_id = var.project_id
22+
credential_config = {
23+
credential_type = "GITHUBv2"
24+
github_pat = var.github_pat
25+
github_app_id = var.github_app_id
26+
}
27+
28+
cloud_build_repositories = {
29+
"test_repo" = {
30+
repository_name = var.repository_name
31+
repository_url = var.repository_url
32+
},
33+
}
34+
}

‎examples/cloudbuild_repo_connection_github/outputs.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "cloud_build_repositories_2nd_gen_connection" {
18+
description = "Cloudbuild connection created."
19+
value = module.github_connection.cloud_build_repositories_2nd_gen_connection
20+
}
21+
22+
output "cloud_build_repositories_2nd_gen_repositories" {
23+
description = "Created repositories."
24+
value = module.github_connection.cloud_build_repositories_2nd_gen_repositories
25+
}
26+

‎examples/cloudbuild_repo_connection_github/variables.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The ID of the project in which to provision resources."
19+
type = string
20+
}
21+
22+
variable "github_pat" {
23+
description = "The personal access token for authenticating with GitHub."
24+
type = string
25+
}
26+
27+
variable "github_app_id" {
28+
description = "The application ID for the Cloudbuild GitHub app."
29+
type = string
30+
}
31+
32+
variable "repository_url" {
33+
description = "The HTTPS clone URL of the repository, ending with .git."
34+
type = string
35+
}
36+
37+
variable "repository_name" {
38+
description = "The name of the test repository."
39+
type = string
40+
}
41+

‎examples/cloudbuild_repo_connection_gitlab/README.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
## Overview
2+
3+
The example will create Cloud Build repositories (2nd gen) using a Gitlab connection.
4+
5+
## Gitlab Requirements for Cloud Build Connection
6+
7+
When using a Cloud Build repositories (2nd gen) GitLab repository, a Cloud Build connection to your repository provider will be needed.
8+
9+
For more information on this topic refer to the Cloud Build repositories (2nd gen) documentation:
10+
- [Connect to a GitLab host](https://cloud.google.com/build/docs/automating-builds/gitlab/connect-host-gitlab)
11+
- [Connect to a GitLab repository](https://cloud.google.com/build/docs/automating-builds/github/connect-repo-github?generation=2nd-gen)
12+
13+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
14+
## Inputs
15+
16+
| Name | Description | Type | Default | Required |
17+
|------|-------------|------|---------|:--------:|
18+
| gitlab\_authorizer\_credential | Credential for GitLab authorizer | `string` | n/a | yes |
19+
| gitlab\_read\_authorizer\_credential | Credential for GitLab read authorizer | `string` | n/a | yes |
20+
| project\_id | The ID of the project in which to provision resources. | `string` | n/a | yes |
21+
| repository\_name | The name of the test repository. | `string` | n/a | yes |
22+
| repository\_url | The HTTPS clone URL of the repository, ending with .git. | `string` | n/a | yes |
23+
24+
## Outputs
25+
26+
| Name | Description |
27+
|------|-------------|
28+
| cloud\_build\_repositories\_2nd\_gen\_connection | Cloudbuild connection created. |
29+
| cloud\_build\_repositories\_2nd\_gen\_repositories | Created repositories. |
30+
31+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/cloudbuild_repo_connection_gitlab/main.tf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "gitlab_connection" {
18+
source = "../../modules/cloudbuild_repo_connection"
19+
20+
project_id = var.project_id
21+
credential_config = {
22+
credential_type = "GITLABv2"
23+
gitlab_authorizer_credential = var.gitlab_authorizer_credential
24+
gitlab_read_authorizer_credential = var.gitlab_read_authorizer_credential
25+
}
26+
27+
cloud_build_repositories = {
28+
"test_repo" = {
29+
repository_name = var.repository_name
30+
repository_url = var.repository_url
31+
},
32+
}
33+
}

‎examples/cloudbuild_repo_connection_gitlab/outputs.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "cloud_build_repositories_2nd_gen_connection" {
18+
description = "Cloudbuild connection created."
19+
value = module.gitlab_connection.cloud_build_repositories_2nd_gen_connection
20+
}
21+
22+
output "cloud_build_repositories_2nd_gen_repositories" {
23+
description = "Created repositories."
24+
value = module.gitlab_connection.cloud_build_repositories_2nd_gen_repositories
25+
}

‎examples/cloudbuild_repo_connection_gitlab/variables.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The ID of the project in which to provision resources."
19+
type = string
20+
}
21+
22+
variable "repository_url" {
23+
description = "The HTTPS clone URL of the repository, ending with .git."
24+
type = string
25+
}
26+
27+
variable "repository_name" {
28+
description = "The name of the test repository."
29+
type = string
30+
}
31+
32+
variable "gitlab_authorizer_credential" {
33+
description = "Credential for GitLab authorizer"
34+
type = string
35+
}
36+
37+
variable "gitlab_read_authorizer_credential" {
38+
description = "Credential for GitLab read authorizer"
39+
type = string
40+
}
41+

‎modules/cloudbuild_repo_connection/README.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Overview
2+
3+
This module is designed to establish the corresponding Cloud Build repositories (2nd gen) based on the `cloud_build_repositories` variable, where users can specify the repository names and URLs from their own version control systems.
4+
5+
Additionally, it will create and manage secret versions, as well as configure the necessary permissions for cloud build service agent when utilizing Cloud Build repositories (2nd gen).
6+
7+
Users will provide the required secrets through the `credential_config` variable, indicating their chosen Git provider. Currently, the module supports both GitHub and GitLab.
8+
9+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
10+
## Inputs
11+
12+
| Name | Description | Type | Default | Required |
13+
|------|-------------|------|---------|:--------:|
14+
| cloud\_build\_repositories | Cloud Build repositories configuration:<br> - repository\_name: The name of the repository to be used in Cloud Build.<br> - repository\_url: The HTTPS clone URL for the repository. This URL must end with '.git' and be a valid HTTPS URL.<br><br>Each entry in this map must contain both `repository_name` and `repository_url` to properly integrate with the Cloud Build service. | <pre>map(object({<br> repository_name = string,<br> repository_url = string,<br> }))</pre> | n/a | yes |
15+
| cloudbuild\_connection\_name | Cloudbuild Connection Name. | `string` | `"generic-cloudbuild-connection"` | no |
16+
| credential\_config | Credential configuration options:<br> - credential\_type: Specifies the type of credential being used. Supported types are 'GITHUBv2' and 'GITLABv2'.<br> - github\_secret\_id: (Optional) The secret ID for GitHub credentials. Default is "cb-github-pat".<br> - github\_pat: (Optional) The personal access token for GitHub authentication.<br> - github\_app\_id: (Optional) The application ID for a GitHub App used for authentication. For app installation, follow this link: https://github.com/apps/google-cloud-build<br> - gitlab\_read\_authorizer\_credential: (Optional) The read authorizer credential for GitLab access.<br> - gitlab\_read\_authorizer\_credential\_secret\_id: (Optional) The secret ID for the GitLab read authorizer credential. Default is "cb-gitlab-read-api-credential".<br> - gitlab\_authorizer\_credential: (Optional) The authorizer credential for GitLab access.<br> - gitlab\_authorizer\_credential\_secret\_id: (Optional) The secret ID for the GitLab authorizer credential. Default is "cb-gitlab-api-credential". | <pre>object({<br> credential_type = string<br> github_secret_id = optional(string, "cb-github-pat")<br> github_pat = optional(string)<br> github_app_id = optional(string)<br> gitlab_read_authorizer_credential = optional(string)<br> gitlab_read_authorizer_credential_secret_id = optional(string, "cb-gitlab-read-api-credential")<br> gitlab_authorizer_credential = optional(string)<br> gitlab_authorizer_credential_secret_id = optional(string, "cb-gitlab-api-credential")<br> })</pre> | n/a | yes |
17+
| location | Resources location. | `string` | `"us-central1"` | no |
18+
| project\_id | The project id to create the secret and assign cloudbuild service account permissions. | `string` | n/a | yes |
19+
20+
## Outputs
21+
22+
| Name | Description |
23+
|------|-------------|
24+
| cloud\_build\_repositories\_2nd\_gen\_connection | The unique identifier of the Cloud Build connection created within the specified Google Cloud project.<br> Example format: projects/{{project}}/locations/{{location}}/connections/{{name}} |
25+
| cloud\_build\_repositories\_2nd\_gen\_repositories | A map of created repositories associated with the Cloud Build connection.<br>Each entry contains the repository's unique identifier and its remote URL.<br>Example format:<br>"key\_name" = {<br> "id" = "projects/{{project}}/locations/{{location}}/connections/{{parent\_connection}}/repositories/{{name}}",<br> "url" = "https://github.com/{{account/org}}/{{repository_name}}.git"<br>} |
26+
27+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

0 commit comments

Comments
 (0)