Skip to content

Commit

Permalink
cloudfunctions: bootstraped IAM roles for service agent (#12806)
Browse files Browse the repository at this point in the history
  • Loading branch information
@wyardley
wyardley authored Jan 24, 2025
1 parent 22c37cf commit 3c03e78
Showing 1 changed file with 19 additions and 26 deletions.
45 changes: 19 additions & 26 deletions ...ird_party/terraform/services/cloudfunctions/resource_cloudfunctions_function_test.go.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,15 @@ const testFirestoreTriggerPath = "./test-fixtures/firestore_trigger.js"
const testSecretEnvVarFunctionPath = "./test-fixtures/secret_environment_variables.js"
const testSecretVolumesMountFunctionPath = "./test-fixtures/secret_volumes_mount.js"

func bootstrapGcfAdminAgents(t *testing.T) {
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcf-admin-robot.iam.gserviceaccount.com",
Role: "roles/vpcaccess.admin",
},
})
}

func TestAccCloudFunctionsFunction_basic(t *testing.T) {
t.Parallel()

Expand Down Expand Up @@ -419,16 +428,16 @@ func TestAccCloudFunctionsFunction_vpcConnector(t *testing.T) {
networkName := fmt.Sprintf("tf-test-net-%d", acctest.RandInt(t))
vpcConnectorName := fmt.Sprintf("tf-test-conn-%s", acctest.RandString(t, 5))
zipFilePath := acctest.CreateZIPArchiveForCloudFunctionSource(t, testHTTPTriggerPath)
projectNumber := os.Getenv("GOOGLE_PROJECT_NUMBER")
defer os.Remove(zipFilePath) // clean up

bootstrapGcfAdminAgents(t)
acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckCloudFunctionsFunctionDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccCloudFunctionsFunction_vpcConnector(projectNumber, networkName, functionName, bucketName, zipFilePath, "10.10.0.0/28", vpcConnectorName),
Config: testAccCloudFunctionsFunction_vpcConnector(networkName, functionName, bucketName, zipFilePath, "10.10.0.0/28", vpcConnectorName),
},
{
ResourceName: funcResourceName,
Expand All @@ -437,7 +446,7 @@ func TestAccCloudFunctionsFunction_vpcConnector(t *testing.T) {
ImportStateVerifyIgnore: []string{"build_environment_variables", "labels", "terraform_labels"},
},
{
Config: testAccCloudFunctionsFunction_vpcConnector(projectNumber, networkName, functionName, bucketName, zipFilePath, "10.20.0.0/28", vpcConnectorName+"-update"),
Config: testAccCloudFunctionsFunction_vpcConnector(networkName, functionName, bucketName, zipFilePath, "10.20.0.0/28", vpcConnectorName+"-update"),
},
{
ResourceName: funcResourceName,
Expand All @@ -458,16 +467,16 @@ func TestAccCloudFunctionsFunction_vpcConnectorEgressSettings(t *testing.T) {
networkName := fmt.Sprintf("tf-test-net-%d", acctest.RandInt(t))
vpcConnectorName := fmt.Sprintf("tf-test-conn-%s", acctest.RandString(t, 5))
zipFilePath := acctest.CreateZIPArchiveForCloudFunctionSource(t, testHTTPTriggerPath)
projectNumber := os.Getenv("GOOGLE_PROJECT_NUMBER")
defer os.Remove(zipFilePath) // clean up

bootstrapGcfAdminAgents(t)
acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckCloudFunctionsFunctionDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccCloudFunctionsFunction_vpcConnectorEgressSettings(projectNumber, networkName, functionName, bucketName, zipFilePath, "10.10.0.0/28", vpcConnectorName, "PRIVATE_RANGES_ONLY"),
Config: testAccCloudFunctionsFunction_vpcConnectorEgressSettings(networkName, functionName, bucketName, zipFilePath, "10.10.0.0/28", vpcConnectorName, "PRIVATE_RANGES_ONLY"),
},
{
ResourceName: funcResourceName,
Expand All @@ -476,7 +485,7 @@ func TestAccCloudFunctionsFunction_vpcConnectorEgressSettings(t *testing.T) {
ImportStateVerifyIgnore: []string{"build_environment_variables", "labels", "terraform_labels"},
},
{
Config: testAccCloudFunctionsFunction_vpcConnectorEgressSettings(projectNumber, networkName, functionName, bucketName, zipFilePath, "10.20.0.0/28", vpcConnectorName+"-update", "ALL_TRAFFIC"),
Config: testAccCloudFunctionsFunction_vpcConnectorEgressSettings(networkName, functionName, bucketName, zipFilePath, "10.20.0.0/28", vpcConnectorName+"-update", "ALL_TRAFFIC"),
},
{
ResourceName: funcResourceName,
Expand Down Expand Up @@ -1053,16 +1062,10 @@ resource "google_cloudfunctions_function" "function" {
`, bucketName, zipFilePath, functionName)
}

func testAccCloudFunctionsFunction_vpcConnector(projectNumber, networkName, functionName, bucketName, zipFilePath, vpcIp, vpcConnectorName string) string {
func testAccCloudFunctionsFunction_vpcConnector(networkName, functionName, bucketName, zipFilePath, vpcIp, vpcConnectorName string) string {
return fmt.Sprintf(`
data "google_project" "project" {}

resource "google_project_iam_member" "gcfadmin" {
project = data.google_project.project.project_id
role = "roles/editor"
member = "serviceAccount:service-%[email protected]"
}

resource "google_compute_network" "vpc" {
name = "%s"
auto_create_subnetworks = false
Expand Down Expand Up @@ -1110,23 +1113,15 @@ resource "google_cloudfunctions_function" "function" {
min_instances = 3
vpc_connector = google_vpc_access_connector.%s.self_link
vpc_connector_egress_settings = "PRIVATE_RANGES_ONLY"

depends_on = [google_project_iam_member.gcfadmin]
}
`, projectNumber, networkName, vpcConnectorName, vpcConnectorName, vpcIp, bucketName, zipFilePath, functionName, vpcConnectorName)
`, networkName, vpcConnectorName, vpcConnectorName, vpcIp, bucketName, zipFilePath, functionName, vpcConnectorName)
}


func testAccCloudFunctionsFunction_vpcConnectorEgressSettings(projectNumber, networkName, functionName, bucketName, zipFilePath, vpcIp, vpcConnectorName, vpcConnectorEgressSettings string) string {
func testAccCloudFunctionsFunction_vpcConnectorEgressSettings(networkName, functionName, bucketName, zipFilePath, vpcIp, vpcConnectorName, vpcConnectorEgressSettings string) string {
return fmt.Sprintf(`
data "google_project" "project" {}

resource "google_project_iam_member" "gcfadmin" {
project = data.google_project.project.project_id
role = "roles/editor"
member = "serviceAccount:service-%[email protected]"
}

resource "google_compute_network" "vpc" {
name = "%s"
auto_create_subnetworks = false
Expand Down Expand Up @@ -1174,10 +1169,8 @@ resource "google_cloudfunctions_function" "function" {
min_instances = 3
vpc_connector = google_vpc_access_connector.%s.self_link
vpc_connector_egress_settings = "%s"

depends_on = [google_project_iam_member.gcfadmin]
}
`, projectNumber, networkName, vpcConnectorName, vpcConnectorName, vpcIp, bucketName, zipFilePath, functionName, vpcConnectorName, vpcConnectorEgressSettings)
`, networkName, vpcConnectorName, vpcConnectorName, vpcIp, bucketName, zipFilePath, functionName, vpcConnectorName, vpcConnectorEgressSettings)
}

{{ if ne $.TargetVersionName `ga` -}}
Expand Down

0 comments on commit 3c03e78

Please sign in to comment.