Skip to content

Commit 7c1c50c

Browse files
yliaogyliaog
authored
feat: added ci/cd pipeline for the frontend service (#51)
1 parent 1964445 commit 7c1c50c

19 files changed

+864
-1
lines changed

‎5-appinfra/apps/frontend/envs/shared/main.tf

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
application_name = "cymbal-bank"
19+
service_name = "frontend"
20+
repo_name = "eab-${local.application_name}-${local.service_name}"
21+
repo_branch = "main"
22+
}
23+
24+
module "app" {
25+
source = "../../../../modules/cicd-pipeline"
26+
27+
project_id = var.project_id
28+
region = var.region
29+
cluster_membership_id_dev = var.cluster_membership_id_dev
30+
cluster_membership_ids_nonprod = var.cluster_membership_ids_nonprod
31+
cluster_membership_ids_prod = var.cluster_membership_ids_prod
32+
33+
application_name = local.application_name
34+
service = local.service_name
35+
repo_name = local.repo_name
36+
repo_branch = local.repo_branch
37+
38+
buckets_force_destroy = var.buckets_force_destroy
39+
}

‎5-appinfra/apps/frontend/envs/shared/outputs.tf

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/

‎5-appinfra/apps/frontend/envs/shared/variables.tf

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "CI/CD project ID"
19+
type = string
20+
}
21+
22+
variable "region" {
23+
description = "CI/CD region"
24+
type = string
25+
}
26+
27+
variable "cluster_membership_id_dev" {
28+
description = "Cluster fleet membership ID in development environment"
29+
type = string
30+
}
31+
32+
variable "cluster_membership_ids_nonprod" {
33+
description = "Cluster fleet membership IDs in nonprod environment"
34+
type = list(string)
35+
}
36+
37+
variable "cluster_membership_ids_prod" {
38+
description = "Cluster fleet membership IDs in prod environment"
39+
type = list(string)
40+
}
41+
42+
variable "buckets_force_destroy" {
43+
description = "When deleting the bucket for storing CICD artifacts, this boolean option will delete all contained objects. If false, Terraform will fail to delete buckets which contain objects."
44+
type = bool
45+
default = false
46+
}

‎5-appinfra/modules/cicd-pipeline/README.md

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Cymbal Bank deployment example
2+
3+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
4+
## Inputs
5+
6+
| Name | Description | Type | Default | Required |
7+
|------|-------------|------|---------|:--------:|
8+
| application\_name | application name (e.g. 'cymbal-bank') | `string` | n/a | yes |
9+
| buckets\_force\_destroy | When deleting the bucket for storing CICD artifacts, this boolean option will delete all contained objects. If false, Terraform will fail to delete buckets which contain objects. | `bool` | `false` | no |
10+
| cluster\_membership\_id\_dev | Fleet membership ID for the cluster in development environment | `string` | n/a | yes |
11+
| cluster\_membership\_ids\_nonprod | Fleet membership IDs for the cluster in non-production environment | `list(string)` | n/a | yes |
12+
| cluster\_membership\_ids\_prod | Fleet membership IDs for the cluster in production environment | `list(string)` | n/a | yes |
13+
| project\_id | CI/CD project ID | `string` | n/a | yes |
14+
| region | CI/CD Region (e.g. us-central1) | `string` | n/a | yes |
15+
| repo\_branch | Branch to sync ACM configs from & trigger CICD if pushed to. | `string` | n/a | yes |
16+
| repo\_name | Short version of repository to sync ACM configs from & use source for CI (e.g. 'bank-of-anthos' for https://www.github.com/GoogleCloudPlatform/bank-of-anthos) | `string` | n/a | yes |
17+
| service | service name (e.g. 'frontend') | `string` | n/a | yes |
18+
19+
## Outputs
20+
21+
No outputs.
22+
23+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
24+

‎5-appinfra/modules/cicd-pipeline/apis.tf

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Copyright 2024 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
module "enabled_google_apis" {
16+
source = "terraform-google-modules/project-factory/google//modules/project_services"
17+
version = "~> 14.4"
18+
19+
project_id = var.project_id
20+
disable_services_on_destroy = false
21+
22+
activate_apis = [
23+
"artifactregistry.googleapis.com",
24+
"sourcerepo.googleapis.com",
25+
"certificatemanager.googleapis.com",
26+
"cloudbuild.googleapis.com",
27+
"clouddeploy.googleapis.com",
28+
"cloudresourcemanager.googleapis.com",
29+
"compute.googleapis.com",
30+
"anthos.googleapis.com",
31+
"container.googleapis.com",
32+
"gkehub.googleapis.com",
33+
"gkeconnect.googleapis.com",
34+
"anthosconfigmanagement.googleapis.com",
35+
"mesh.googleapis.com",
36+
"meshconfig.googleapis.com",
37+
"meshtelemetry.googleapis.com",
38+
"iam.googleapis.com",
39+
]
40+
}

‎5-appinfra/modules/cicd-pipeline/artifact-registry.tf

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Copyright 2024 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# create artifact registry for container images
16+
resource "google_artifact_registry_repository" "container_registry" {
17+
repository_id = var.application_name
18+
location = var.region
19+
format = "docker"
20+
description = "Bank of Anthos docker repository"
21+
project = var.project_id
22+
23+
depends_on = [
24+
module.enabled_google_apis
25+
]
26+
}
27+
28+
module "artifact-registry-repository-iam-bindings" {
29+
source = "terraform-google-modules/iam/google//modules/artifact_registry_iam"
30+
version = "~> 7.7"
31+
project = var.project_id
32+
repositories = [var.application_name]
33+
location = var.region
34+
mode = "authoritative"
35+
36+
bindings = {
37+
"roles/artifactregistry.reader" = [
38+
"serviceAccount:${data.google_project.project.number}[email protected]",
39+
"serviceAccount:${google_service_account.cloud_deploy.email}",
40+
"allAuthenticatedUsers"
41+
],
42+
}
43+
44+
depends_on = [
45+
module.enabled_google_apis,
46+
google_artifact_registry_repository.container_registry
47+
]
48+
}

‎5-appinfra/modules/cicd-pipeline/cloud-build-trigger.tf

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Copyright 2024 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# CI trigger configuration
16+
resource "google_cloudbuild_trigger" "ci" {
17+
name = "${local.service_clean}-ci"
18+
project = var.project_id
19+
location = var.region
20+
21+
trigger_template {
22+
branch_name = var.repo_branch
23+
repo_name = var.repo_name
24+
}
25+
included_files = ["src/${var.service}/**", "src/components/**"]
26+
filename = "src/${local.team_name}/cloudbuild.yaml"
27+
substitutions = {
28+
_SERVICE = local.service_name
29+
_TEAM = local.team_name
30+
_CACHE_URI = "gs://${google_storage_bucket.build_cache.name}/${google_storage_bucket_object.cache.name}"
31+
_CONTAINER_REGISTRY = "${local.container_registry.location}-docker.pkg.dev/${local.container_registry.project}/${local.container_registry.repository_id}"
32+
_SOURCE_STAGING_BUCKET = "gs://${google_storage_bucket.release_source_development.name}"
33+
_CACHE = local.cache_filename
34+
}
35+
service_account = google_service_account.cloud_build.id
36+
}

‎5-appinfra/modules/cicd-pipeline/cloud-deploy.tf

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Copyright 2024 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# create delivery pipeline for service including all targets
16+
resource "google_clouddeploy_delivery_pipeline" "delivery-pipeline" {
17+
project = var.project_id
18+
location = var.region
19+
name = var.service
20+
serial_pipeline {
21+
dynamic "stages" {
22+
for_each = { for idx, target in local.targets : idx => target }
23+
content {
24+
# TODO: use "production" profile once it works.
25+
profiles = [stages.value.name == "development" ? "development" : (startswith(stages.value.name, "non-production") ? "staging" : "production")]
26+
target_id = stages.value.name
27+
}
28+
}
29+
}
30+
}

‎5-appinfra/modules/cicd-pipeline/cloud-storage.tf

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Copyright 2024 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# GCS bucket used as skaffold build cache
16+
resource "google_storage_bucket" "build_cache" {
17+
project = var.project_id
18+
name = "build-cache-${local.service_name}-${data.google_project.project.number}"
19+
uniform_bucket_level_access = true
20+
location = var.region
21+
force_destroy = var.buckets_force_destroy
22+
}
23+
24+
resource "google_storage_bucket" "release_source_development" {
25+
project = var.project_id
26+
name = "release-source-development-${local.service_name}-${data.google_project.project.number}"
27+
uniform_bucket_level_access = true
28+
location = var.region
29+
force_destroy = var.buckets_force_destroy
30+
}
31+
32+
# Initialize cache with empty file
33+
resource "google_storage_bucket_object" "cache" {
34+
bucket = google_storage_bucket.build_cache.name
35+
36+
name = local.cache_filename
37+
content = " "
38+
39+
lifecycle {
40+
# do not reset cache when running terraform
41+
ignore_changes = [
42+
content,
43+
detect_md5hash
44+
]
45+
}
46+
}
47+
48+
# give CloudBuild SA access to skaffold cache
49+
resource "google_storage_bucket_iam_member" "build_cache" {
50+
bucket = google_storage_bucket.build_cache.name
51+
52+
member = "serviceAccount:${google_service_account.cloud_build.email}"
53+
role = "roles/storage.admin"
54+
}
55+
56+
# give CloudBuild SA access to write to source development bucket
57+
resource "google_storage_bucket_iam_member" "release_source_development_admin" {
58+
bucket = google_storage_bucket.release_source_development.name
59+
60+
member = "serviceAccount:${google_service_account.cloud_build.email}"
61+
role = "roles/storage.admin"
62+
}
63+
64+
# give CloudDeploy SA access to read from source development bucket
65+
resource "google_storage_bucket_iam_member" "release_source_development_objectViewer" {
66+
bucket = google_storage_bucket.release_source_development.name
67+
68+
member = "serviceAccount:${google_service_account.cloud_deploy.email}"
69+
role = "roles/storage.objectViewer"
70+
}

‎5-appinfra/modules/cicd-pipeline/locals.tf

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Copyright 2024 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
locals {
16+
cache_filename = "cache"
17+
service_name = reverse(split("/", var.service))[0]
18+
team_name = split("/", var.service)[0]
19+
service_clean = replace(var.service, "/", "-")
20+
targets = [google_clouddeploy_target.development, google_clouddeploy_target.non_prod[0], google_clouddeploy_target.non_prod[1], google_clouddeploy_target.prod[0], google_clouddeploy_target.prod[1]]
21+
container_registry = google_artifact_registry_repository.container_registry
22+
}

0 commit comments

Comments
 (0)