Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

small fixes for READMEs #7

Merged
merged 1 commit into from
Aug 1, 2024
+31 −14
Merged

small fixes for READMEs #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions 0-bootstrap/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,6 +265,7 @@ Using GitHub Actions requires manual creation of the GitHub repositories used in
git add .
git commit -m 'Initialize bootstrap repo'
git push --set-upstream origin plan
cd ..
```

1. Continue with the instructions in the [1-org](../1-org/README.md) step.
Expand Down
3 changes: 3 additions & 0 deletions 1-org/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,4 +293,7 @@ Before executing the next stages, unset the `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT`

```bash
unset GOOGLE_IMPERSONATE_SERVICE_ACCOUNT

cd ../..
```
1. Proceed to the [2-environments](../2-environments/README.md) step.
14 changes: 10 additions & 4 deletions 2-environments/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@ Run `terraform output cloudbuild_project_id` in the `0-bootstrap` folder to get
git push origin production
```

### `N.B.` Read this before continuing further
### Read this before continuing further

A logging project will be created in every environment (`development`, `non-production`, `production`) when running this code. This project contains a storage bucket for the purposes of project logging within its respective environment. This requires the `[email protected]` group permissions for the storage bucket. Since foundations has more restricted security measures, a domain restriction constraint is enforced. This restraint will prevent the google cloud-storage-analytics group to be added to any permissions. In order for this terraform code to execute without error, manual intervention must be made to ensure everything applies without issue.

Expand Down Expand Up @@ -405,7 +405,8 @@ To use the `validate` option of the `tf-wrapper.sh` script, please follow the [i
export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=$(terraform -chdir="../0-bootstrap/" output -raw environment_step_terraform_service_account_email)
echo ${GOOGLE_IMPERSONATE_SERVICE_ACCOUNT}
```
1. Ensure you [disable The Orginization Policy](#do-this-before-you-push-development-non-production--production) on the `development` folder before continuing further

1. Ensure you [disable The Organization Policy](#read-this-before-continuing-further) on the `development` folder before continuing further.

1. Run `init` and `plan` and review output for environment development.

Expand All @@ -426,7 +427,7 @@ To use the `validate` option of the `tf-wrapper.sh` script, please follow the [i
./tf-wrapper.sh apply development
```

1. Ensure you [disable The Orginization Policy](#do-this-before-you-push-development-non-production--production) on the `non-production` folder before continuing further
1. Ensure you [disable The Organization Policy](#read-this-before-continuing-further) on the `non-production` folder before continuing further.

1. Run `init` and `plan` and review output for environment non-production.

Expand All @@ -446,7 +447,8 @@ To use the `validate` option of the `tf-wrapper.sh` script, please follow the [i
```bash
./tf-wrapper.sh apply non-production
```
1. Ensure you [disable The Orginization Policy](#do-this-before-you-push-development-non-production--production) on the `non-production` folder before continuing further

1. Ensure you [disable The Organization Policy](#read-this-before-continuing-further) on the `non-production` folder before continuing further.

1. Run `init` and `plan` and review output for environment production.

Expand All @@ -473,4 +475,8 @@ Before executing the next stages, unset the `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT`

```bash
unset GOOGLE_IMPERSONATE_SERVICE_ACCOUNT

cd ../..
```

1. You can now move to the instructions in the network step. To use the [Dual Shared VPC](https://cloud.google.com/architecture/security-foundations/networking#vpcsharedvpc-id7-1-shared-vpc-) network mode go to [3-networks-dual-svpc](../3-networks-dual-svpc/README.md).
2 changes: 2 additions & 0 deletions 3-networks-dual-svpc/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -418,3 +418,5 @@ Before executing the next stages, unset the `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT`
```bash
unset GOOGLE_IMPERSONATE_SERVICE_ACCOUNT
```

1. You can now move to the instructions in the [4-projects](../4-projects/README.md) step.
3 changes: 3 additions & 0 deletions 4-projects/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -358,4 +358,7 @@ Before executing the next stages, unset the `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT`

```bash
unset GOOGLE_IMPERSONATE_SERVICE_ACCOUNT

cd ../..
```
1. You can now move to the instructions in the [5-app-infra](../5-app-infra/README.md) step.
22 changes: 12 additions & 10 deletions 5-app-infra/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -514,10 +514,10 @@ To use the `validate` option of the `tf-wrapper.sh` script, please follow the [i
1. Use `terraform output` to get the Infra Pipeline Project ID from 4-projects output.

```bash
export INFRA_PIPELINE_PROJECT_ID=$(terraform -chdir="../../../4-projects/ml_business_unit/shared/" output -raw cloudbuild_project_id)
export INFRA_PIPELINE_PROJECT_ID=$(terraform -chdir="../terraform-google-enterprise-genai/4-projects/ml_business_unit/shared/" output -raw cloudbuild_project_id)
echo ${INFRA_PIPELINE_PROJECT_ID}

export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=$(terraform -chdir="../../../4-projects/ml_business_unit/shared/" output -json terraform_service_accounts | jq '."ml-artifact-publish"' --raw-output)
export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=$(terraform -chdir="../terraform-google-enterprise-genai/4-projects/ml_business_unit/shared/" output -json terraform_service_accounts | jq '."ml-artifact-publish"' --raw-output)
echo ${GOOGLE_IMPERSONATE_SERVICE_ACCOUNT}
```

Expand All @@ -531,7 +531,7 @@ To use the `validate` option of the `tf-wrapper.sh` script, please follow the [i
1. Run `validate` and check for violations.

```bash
./tf-wrapper.sh validate shared $(pwd)/../policy-library ${INFRA_PIPELINE_PROJECT_ID}
./tf-wrapper.sh validate shared $(pwd)/../terraform-google-enterprise-genai/policy-library ${INFRA_PIPELINE_PROJECT_ID}
```

1. Run `apply` shared.
Expand Down Expand Up @@ -636,7 +636,7 @@ unset GOOGLE_IMPERSONATE_SERVICE_ACCOUNT
1. Update `backend.tf` with your bucket from the infra pipeline output.

```bash
export backend_bucket=$(terraform -chdir="../gcp-projects/ml_business_unit/shared/" output -json state_buckets | jq '."ml-service-catalog"' --raw-output)
export backend_bucket=$(terraform -chdir="../terraform-google-enterprise-genai/4-projects/ml_business_unit/shared/" output -json state_buckets | jq '."ml-service-catalog"' --raw-output)
echo "backend_bucket = ${backend_bucket}"

for i in `find -name 'backend.tf'`; do sed -i "s/UPDATE_APP_INFRA_BUCKET/${backend_bucket}/" $i; done
Expand All @@ -645,15 +645,15 @@ unset GOOGLE_IMPERSONATE_SERVICE_ACCOUNT
1. Update the `log_bucket` variable with the value of the `logs_export_storage_bucket_name`.

```bash
export log_bucket=$(terraform -chdir="../gcp-org/envs/shared" output -raw logs_export_storage_bucket_name)
export log_bucket=$(terraform -chdir="../terraform-google-enterprise-genai/1-org/envs/shared" output -raw logs_export_storage_bucket_name)
echo "log_bucket = ${log_bucket}"
sed -i "s/REPLACE_LOG_BUCKET/${log_bucket}/" ./common.auto.tfvars
```

1. Provide the user permissions to run the terraform locally with the `serviceAccountTokenCreator` permission.

```bash
(cd ../terraform-google-enterprise-genai/4-projects && git checkout production && ./tf-wrapper init shared)
(cd ../terraform-google-enterprise-genai/4-projects && ./tf-wrapper.sh init shared)

member="user:$(gcloud auth list --filter="status=ACTIVE" --format="value(account)")"
echo ${member}
Expand All @@ -675,10 +675,10 @@ To use the `validate` option of the `tf-wrapper.sh` script, please follow the [i
1. Use `terraform output` to get the Infra Pipeline Project ID from 4-projects output.

```bash
export INFRA_PIPELINE_PROJECT_ID=$(terraform -chdir="../../../4-projects/ml_business_unit/shared/" output -raw cloudbuild_project_id)
export INFRA_PIPELINE_PROJECT_ID=$(terraform -chdir="../terraform-google-enterprise-genai/4-projects/ml_business_unit/shared/" output -raw cloudbuild_project_id)
echo ${INFRA_PIPELINE_PROJECT_ID}

export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=$(terraform -chdir="../../../4-projects/ml_business_unit/shared/" output -json terraform_service_accounts | jq '."ml-service-catalog"' --raw-output)
export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=$(terraform -chdir="../terraform-google-enterprise-genai/4-projects/ml_business_unit/shared/" output -json terraform_service_accounts | jq '."ml-service-catalog"' --raw-output)
echo ${GOOGLE_IMPERSONATE_SERVICE_ACCOUNT}
```

Expand All @@ -692,7 +692,7 @@ To use the `validate` option of the `tf-wrapper.sh` script, please follow the [i
1. Run `validate` and check for violations.

```bash
./tf-wrapper.sh validate shared $(pwd)/../policy-library ${INFRA_PIPELINE_PROJECT_ID}
./tf-wrapper.sh validate shared $(pwd)/../terraform-google-enterprise-genai/policy-library ${INFRA_PIPELINE_PROJECT_ID}
```

1. Run `apply` shared.
Expand Down Expand Up @@ -758,4 +758,6 @@ After executing this stage, unset the `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT` envir
cd ..
```

1. Navigate to the project that was output from `${ARTIFACT_PROJECT_ID}` in Google's Cloud Console to view the first run of images being built.
1. Navigate to the project that was output from `${SERVICE_CATALOG_PROJECT_ID}` in Google's Cloud Console to view the first run of images being built.

https://console.cloud.google.com/cloud-build/builds;region=us-central1?orgonly=true&project=${SERVICE_CATALOG_PROJECT_ID}&supportedpurview=project