Skip to content

Commit 3dd4775

Browse files
airadieriru
airadier
and
iru
authored
feat(benchmark): Add an option to resuse existing workload identity pool via data (#130)
* Add an option to resuse existing workload identity pool via data * docs: add terrascan to contribute * docs: add terrascan to contribute * ci: lint * Remove unused data and improve description * ci: lint * docs: clarify varible desc * docs: give alternative to 409 bench * ci: lint * ci: lint --------- Co-authored-by: iru <[email protected]>
1 parent 0cf8683 commit 3dd4775

File tree

13 files changed

+74
-25
lines changed

13 files changed

+74
-25
lines changed

‎CONTRIBUTE.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@
4848

4949
## 1. Check::Pre-Commit
5050

51-
Technical validation for terraform **lint**, **validation**, and **documentation**
51+
Technical validation for terraform **lint**, **validation**, **documentation** and **security scan**.
5252

5353
We're using **pre-commit** | https://pre-commit.com
5454
- Defined in `/.pre-commit-config.yaml`
@@ -58,6 +58,7 @@ We're using **pre-commit** | https://pre-commit.com
5858
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
5959
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6060
```
61+
- pre-requirement download, see [Makefile](./Makefile)
6162

6263
## 2. Check::Integration tests
6364

‎README.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,13 @@ A: Currently Sysdig Backend does not support dynamic WorkloadPool and it's name
193193
https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers#delete-pool
194194
> You can undelete a pool for up to 30 days after deletion. After 30 days, deletion is permanent. Until a pool is permanently deleted, you cannot reuse its name when creating a new workload identity pool.<br/>
195195

196-
<br/>S: For the moment, federation workload identity pool+provider have fixed name. In case you want to reuse it, you can reactivate and import it, into your terraform state manually.
196+
<br/>S: For the moment, federation workload identity pool+provider have fixed name.
197+
Therea are several options here
198+
199+
In case you want to reuse it, you can make use of the `reuse_workload_identity_pool` attribute available in some
200+
examples.
201+
202+
Alternatively, you can reactivate and import it, into your terraform state manually.
197203
```bash
198204
# re-activate pool and provider
199205
$ gcloud iam workload-identity-pools undelete sysdigcloud --location=global

‎examples/single-project-k8s/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ See [inputs summary](#inputs) or module module [`variables.tf`](./variables.tf)
117117
| <a name="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark) | whether benchmark module is to be deployed | `bool` | `true` | no |
118118
| <a name="input_deploy_scanning"></a> [deploy\_scanning](#input\_deploy\_scanning) | true/false whether scanning module is to be deployed | `bool` | `false` | no |
119119
| <a name="input_name"></a> [name](#input\_name) | Suffix to be assigned to all created resources. Modify this value in case of conflict / 409 error to bypass Google soft delete issues | `string` | `"sfc"` | no |
120+
| <a name="input_reuse_workload_identity_pool"></a> [reuse\_workload\_identity\_pool](#input\_reuse\_workload\_identity\_pool) | Reuse existing workload identity pool, from previous deployment, with name 'sysdigcloud'. <br/> Will help overcome <a href='https://github.com/sysdiglabs/terraform-google-secure-for-cloud#q-getting-error-creating-workloadidentitypool-googleapi-error-409-requested-entity-already-exists'>redeploying error due to GCP softdelete</a><br/> | `bool` | `false` | no |
120121

121122
## Outputs
122123

‎examples/single-project-k8s/benchmark.tf

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@ module "cloud_bench" {
22
count = var.deploy_benchmark ? 1 : 0
33
source = "../../modules/services/cloud-bench"
44

5-
is_organizational = false
6-
role_name = "${var.name}${var.benchmark_role_name}"
7-
project_id = data.google_client_config.current.project
8-
regions = var.benchmark_regions
5+
is_organizational = false
6+
role_name = "${var.name}${var.benchmark_role_name}"
7+
project_id = data.google_client_config.current.project
8+
regions = var.benchmark_regions
9+
reuse_workload_identity_pool = var.reuse_workload_identity_pool
910
}

‎examples/single-project-k8s/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,12 @@ variable "benchmark_role_name" {
2828
default = "sysdigcloudbench"
2929
}
3030

31+
variable "reuse_workload_identity_pool" {
32+
type = bool
33+
description = "Reuse existing workload identity pool, from previous deployment, with name 'sysdigcloud'. <br/> Will help overcome <a href='https://github.com/sysdiglabs/terraform-google-secure-for-cloud#q-getting-error-creating-workloadidentitypool-googleapi-error-409-requested-entity-already-exists'>redeploying error due to GCP softdelete</a><br/>"
34+
default = false
35+
}
36+
3137

3238
# general
3339
variable "name" {

‎examples/single-project/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,7 @@ module "secure-for-cloud_example_single-project" {
114114
| <a name="input_deploy_benchmark"></a> [deploy\_benchmark](#input\_deploy\_benchmark) | whether benchmark module is to be deployed | `bool` | `true` | no |
115115
| <a name="input_deploy_scanning"></a> [deploy\_scanning](#input\_deploy\_scanning) | true/false whether scanning module is to be deployed | `bool` | `false` | no |
116116
| <a name="input_name"></a> [name](#input\_name) | Suffix to be assigned to all created resources. Modify this value in case of conflict / 409 error to bypass Google soft delete issues | `string` | `"sfc"` | no |
117+
| <a name="input_reuse_workload_identity_pool"></a> [reuse\_workload\_identity\_pool](#input\_reuse\_workload\_identity\_pool) | Reuse existing workload identity pool, from previous deployment, with name 'sysdigcloud'. <br/> Will help overcome <a href='https://github.com/sysdiglabs/terraform-google-secure-for-cloud#q-getting-error-creating-workloadidentitypool-googleapi-error-409-requested-entity-already-exists'>redeploying error due to GCP softdelete</a><br/> | `bool` | `false` | no |
117118

118119
## Outputs
119120

‎examples/single-project/benchmark.tf

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@ module "cloud_bench" {
22
count = var.deploy_benchmark ? 1 : 0
33
source = "../../modules/services/cloud-bench"
44

5-
is_organizational = false
6-
role_name = "${var.name}${var.benchmark_role_name}"
7-
project_id = data.google_client_config.current.project
8-
regions = var.benchmark_regions
5+
is_organizational = false
6+
role_name = "${var.name}${var.benchmark_role_name}"
7+
project_id = data.google_client_config.current.project
8+
regions = var.benchmark_regions
9+
reuse_workload_identity_pool = var.reuse_workload_identity_pool
910
}

‎examples/single-project/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,18 @@ variable "benchmark_role_name" {
3131
default = "sysdigcloudbench"
3232
}
3333

34+
3435
variable "cloud_connector_image" {
3536
type = string
3637
description = "The image to use for the Cloud Connector."
3738
default = "us-docker.pkg.dev/sysdig-public-registry/secure-for-cloud/cloud-connector:latest"
3839
}
3940

41+
variable "reuse_workload_identity_pool" {
42+
type = bool
43+
description = "Reuse existing workload identity pool, from previous deployment, with name 'sysdigcloud'. <br/> Will help overcome <a href='https://github.com/sysdiglabs/terraform-google-secure-for-cloud#q-getting-error-creating-workloadidentitypool-googleapi-error-409-requested-entity-already-exists'>redeploying error due to GCP softdelete</a><br/>"
44+
default = false
45+
}
4046

4147
#
4248
# general

‎modules/services/cloud-bench/README.md

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,14 @@ Deployed on **Sysdig Backend**
77
- An `gcp_foundations_bench-1.2.0` benchmark task schedule on a random hour of the day `rand rand * * *`
88
- coped to the configured `gcp.projectId` and `gcp.region`
99

10-
<!-- BEGIN_TF_DOCS -->
10+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
1111
## Requirements
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.14.0 |
16-
| <a name="requirement_google"></a> [google](#requirement\_google) | ~> 3.67.0 |
17-
| <a name="requirement_google-beta"></a> [google-beta](#requirement\_google-beta) | ~> 3.67.0 |
15+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.0 |
16+
| <a name="requirement_google"></a> [google](#requirement\_google) | >= 4.21.0 |
17+
| <a name="requirement_google-beta"></a> [google-beta](#requirement\_google-beta) | >= 4.21.0 |
1818
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1.0 |
1919
| <a name="requirement_sysdig"></a> [sysdig](#requirement\_sysdig) | >= 0.5.21 |
2020

@@ -39,12 +39,13 @@ No resources.
3939
|------|-------------|------|---------|:--------:|
4040
| <a name="input_is_organizational"></a> [is\_organizational](#input\_is\_organizational) | Whether this task is being created at the org or project level | `bool` | `false` | no |
4141
| <a name="input_organization_domain"></a> [organization\_domain](#input\_organization\_domain) | Organization domain. e.g. sysdig.com | `string` | `""` | no |
42-
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | ID of project to run the benchmark on | `string` | `""` | no |
43-
| <a name="input_project_ids"></a> [project\_ids](#input\_project\_ids) | IDs of projects to run the benchmark on. If empty, all organization projects will be defaulted. | `list(string)` | `[]` | no |
42+
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | Google cloud project ID to run Benchmarks on. It will create a trust-relationship, to allow Sysdig usage. | `string` | `""` | no |
43+
| <a name="input_project_ids"></a> [project\_ids](#input\_project\_ids) | Google cloud project IDs to run Benchmarks on. It will create a trust-relationship on each, to allow Sysdig usage. If empty, all organization projects will be defaulted. | `list(string)` | `[]` | no |
4444
| <a name="input_regions"></a> [regions](#input\_regions) | List of regions in which to run the benchmark. If empty, the task will contain all regions by default. | `list(string)` | `[]` | no |
45-
| <a name="input_role_name"></a> [role\_name](#input\_role\_name) | The name of the Service Account that will be created. | `string` | `"sysdigcloudbench"` | no |
45+
| <a name="input_reuse_workload_identity_pool"></a> [reuse\_workload\_identity\_pool](#input\_reuse\_workload\_identity\_pool) | Reuse existing workload identity pool, from previous deployment, with name 'sysdigcloud'. <br/> Will help overcome <a href='https://github.com/sysdiglabs/terraform-google-secure-for-cloud#q-getting-error-creating-workloadidentitypool-googleapi-error-409-requested-entity-already-exists'>redeploying error due to GCP softdelete</a><br/> | `bool` | `false` | no |
46+
| <a name="input_role_name"></a> [role\_name](#input\_role\_name) | The name of the Service Account/Role that will be created. Modify this value in case of conflict / 409 error to bypass Google soft delete | `string` | `"sysdigcloudbench"` | no |
4647

4748
## Outputs
4849

4950
No outputs.
50-
<!-- END_TF_DOCS -->
51+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/services/cloud-bench/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,9 @@ module "trust_relationship" {
66
for_each = toset(local.project_ids)
77
source = "./trust_relationship"
88

9-
project_id = each.key
10-
role_name = var.role_name
9+
project_id = each.key
10+
role_name = var.role_name
11+
reuse_workload_identity_pool = var.reuse_workload_identity_pool
1112
}
1213

1314
module "task" {

0 commit comments

Comments
 (0)