Canadian Public Sector Secure PBMM Landing Zone reference using Terraform 1.6 (for now 1.3.10) based on the PSO/TOC ready TEF V4 - Full clean organization deployment with mitigation/automation/parameterization modifications #360
Comments
20240407: clean org as-is deployment example - before modifications
in ol.xyz clean org with billing quota set
pull lastest code and branchsuper admin roles set
bootstrap project services enabled20240409:1020 copy tfvars before modifying for group creationMissing tfvars files because of .gitignore filter - fixed in https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/pull/366/files for #365 replace with fix #367 prereq - automated group creationhttps://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/0-bootstrap/README.md#prerequisites terraform init - do 1.3 downgrade firstWe will eventually need a later pbr friendly 1.6 version Installing local terraform 1.3.10https://releases.hashicorp.com/terraform/1.3.10/ Terraform initterraform plan1137 terraform vet - skip - need a local shellterraform apply1140 terraform applygroup creation needs flags setgroups are not created - forgot the flag flips to true terraform init, plan, apply1145 
group and groups exist - checking eventually consistent timing terraform plan/apply 4 - after wait state1151 
1210 TODO |
fmichaelobrien
changed the title
This was referenced Apr 8, 2024
This was referenced Apr 8, 2024
Closed
This was referenced Apr 9, 2024
Merged
After session refresh - terraform apply 5terraform apply1213 1215 
|
0-bootstrap inventory
step 8 of 0-bootstrap - service accountsskip 2nd update of step 10 of 0-bootstrap 11 - update backend bucket state - terraform init/plan/13 - clone policy reporepos 
|
1-orgsetup default security command center 
grant SCC roles/sa
moving to usage prepare for hub-and-spoke
cp terraform 1.3 while still not in docker 1-org step 1 - clone gcp-orgcheck SCC check ACM policy update bucket 1-org step 7/8 commit/push - trigger cloud buildcheck cloud build failures on the region - for bootstrap step 6 not fully complete - missed manual configs like domainshttps://source.cloud.google.com/prj-b-cicd-82vv/gcp-org/+/plan:envs/shared/terraform.tfvars?hl=en fix 0-bootstrap build firstmoving to #370 |
1-org continued - terraform apply with terraform 1.3 on bootstrap as well as cloud build
1-org step 9 - terraform apply via production branchBuild OK 
15 more projects - total of 18 so far 
|
2-environmentsAdvisory mail first
2-environments step 1 - csr clone2-env - do modifications to disable dev - quota reduction2-env step 3 rename tfvars (copy back to main repo)2-env step 5 commit for plan2-env step 7 review planneed to fix also outputs.tf rerun Enable all development 
2-environments - 10 production - non-production
fldr-non-production up with 3 projects 2-environments - bring up production - leave development off2-environments - total 6 more projects - total of 2420240410:1300 
|
obriensystems
added a commit
that referenced
this issue
Apr 10, 2024
3-networks-hub-and-spoke20240411 clone repo configure update tfvars auto update push to shared copy back to repo TODO: remove hardcoded repos |
obriensystems
added a commit
that referenced
this issue
Apr 13, 2024
obriensystems
added a commit
that referenced
this issue
Apr 13, 2024
|
20240413:1700 3-networks-hub-and-spoke continued
in step 9 forgot step 8 cb project id and impersonation 3-hub step 9x It looks like I am missing the apply on bootstrap from cloud build - or 2-environments - where the output occurs is in the state file off cloud build - not local 0-bootstrap solved - forgot to run development folder in 2 - I only had prod/non-prod - and was planning on skipping dev for quota - nope
2-environments apply developmentbefore after 
3-networks-hub-and-spoke
3-networks-hub-and-spoke shared applyACM error on iam role - fixing Service Usage Consumer missing from sa-terraform-net 
Addingsee #379 
wait 2 min for IAM propagation - retry apply rename hierarchical_firewall_policyThe SA needs the role compute.orgSecurityPolicyAdmin or more recently compute.orgFirewallPolicyAdmin Brute force - instead of rename in the console with potential state file corruption - change the name in the policy tf3 shared applybase issue - enable compute APIrename 3rd time 3-networks-hub-and-spoke step 11 shared applydone 3- shared |
obriensystems
changed the title
fmichaelobrien
changed the title
4-projects step 1per-session terraform downgrade 4-projects - step 5 modify tfvarshttps://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/4-projects/README.md |
|
@nbugden thank you for the bucket names fix GoogleCloudPlatform/magic-modules#10426 following closes upgrade the provider on the next init (1.3.10) and 1.6 (we are not using the default 1.7.5 yet) Sync procedure jira needed for #376 |
obriensystems
added a commit
that referenced
this issue
Apr 16, 2024
obriensystems
added a commit
that referenced
this issue
Apr 16, 2024
4-projects - step 5 modify tfvars
4-projects - step 6 repo create4-projects - apply SA and shared locallyplan 4-projects apply sharedboth business units up for shared push planCreate plan branch - retain changes 4-projects push plan4-projects - wait for plan cloud build job to finish - OK
4-projects step 15 - production CB apply |
|
#391 
|
|
39 projects (non-production and dev pending) |
4-projects step 17 - developmentcheck development apply trigger CSR repositories 4-projects - skip non-production for nowunset service account impersonation 
enumerate zombie resources like the two organization level firewall policies |
49 projects - production and development to 4-projectsneed workloads - 5-app-infra |
|
Architecture reverse engineering / diagramming in progress for Fortigate retrofit
MicrosegmentationThere are two classifications in the LZ - restricted and base. High Level Diagram - DefaultHigh Level Diagram - Development environment only
|
5-app-infra5-app-infra commit mainclone bu1-example-app5-app-infra step 10 check cloud build plan runthere is no trigger in cb for the example 
see #392
|
obriensystems
added a commit
that referenced
this issue
Apr 23, 2024
fmichaelobrien
added a commit
that referenced
this issue
Apr 23, 2024
…ample #360 - 0-bootstrap/1-org to 5-app-infra readme changes
|
See latest 3rd org testing 50 min for #421 in #421 (comment) |
This was referenced May 10, 2024
This was referenced May 23, 2024
|
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
A public sector terraform based landing zone based on the TEF V4 that will be V5 ready for collaboration with GCP PSO/TOC ready overlay changes.
Key off terraform-google-modules/terraform-example-foundation#1133
Verify as-is v4 after merging #358 - done
TEF (essentially R/O synced with the foundations security blueprint) V4 is
https://github.com/terraform-google-modules/terraform-example-foundation
Fork for automated resync is
https://github.com/CloudLandingZone/terraform-example-foundation
Architecture retrofit in progress via #389
Requirements
Shadow or temporarily host/fork work getting the TEF up for Public Sector clients via work in terraform-google-modules/terraform-example-foundation#1133 until we can get PRs merged directly in the TEF
The goal is to get everything done directly in the TEF, this repo is only temporary for velocity as we work out the PR process with the TEF and the modules in the GCP org
https://github.com/terraform-google-modules/
like
https://github.com/terraform-google-modules/terraform-google-project-factory
Work Items
https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/wiki/Work-Items
Architecture and Artifacts
editing
Microsegmentation
There are two classifications in the LZ - restricted and base.
There are three environments - development, non-production, production.
High Level Diagram - Default
High Level Diagram - Development environment only
graph LR; style LZ V3 fill:#44f,stroke:#f66,stroke-width:2px,color:#fff,stroke-dasharray: 5 5 %% mapped and documented bootstrap-prj-->seed-prj bootstrap-prj-->cicd-prjmermaid - diagrams as code
Projects view
VPC view
Work items and Use Cases
Issues
PRs
Branches
Deprecates
The text was updated successfully, but these errors were encountered: