@hiiretail/gcp-infra-generators 1.0.2 → 1.1.0

package/dist/generators/common-resources/pubsub/index.js

@@ -18,7 +18,7 @@ module.exports = class extends BaseGenerator {
       {
         type: 'list',
         name: 'createResource',
-        message: 'Do you want to create a new topic or a subscription?',
+        message: 'Do you want to create a new topic, subscription?',
         default: 'subscription',
         choices: ['topic', 'subscription'],
       },
@@ -168,6 +168,15 @@ module.exports = class extends BaseGenerator {
           'Please provide the audience that will be used when generating OIDC token',
         validate: required,
       },
+      {
+        when: (response) => response.createResource === 'topic',
+        type: 'list',
+        name: 'externalTopicPublishers',
+        message: 'Do you want to allow external publishers onto this topic?',
+        default: 'no',
+        choices: ['no', 'yes'],
+        validate: required,
+      },
     ];
 
     return this.prompt(prompts).then((props) => {
@@ -195,6 +204,7 @@ module.exports = class extends BaseGenerator {
       prodProjectIdConsumer,
       costCenter,
       externalSub,
+      externalTopicPublishers,
     } = this.answers;
 
     const dlqTopicName = `dlq.${getProjectId('prod').split('-prod')[0]}.common`;
@@ -224,7 +234,8 @@ module.exports = class extends BaseGenerator {
           'pubsub',
           topicName,
         );
-        ['terragrunt.hcl', 'spec.hcl'].forEach(async (file) => {
+        const files = ['terragrunt.hcl', 'spec.hcl'];
+        for (const file of files) {
           this.fs.copyTpl(
             this.templatePath(`pubsub/${file}`),
             this.destinationPath(`${topicDirPath}/${file}`),
@@ -236,7 +247,7 @@ module.exports = class extends BaseGenerator {
               dlqTopic,
             },
           );
-        });
+        }
       }
 
       let projectId = getProjectId(env);
@@ -276,7 +287,8 @@ module.exports = class extends BaseGenerator {
           );
         }
 
-        ['terragrunt.hcl', 'spec.hcl'].forEach(async (file) => {
+        const files = ['terragrunt.hcl', 'spec.hcl'];
+        for (const file of files) {
           this.fs.copyTpl(
             this.templatePath(`pubsub/${file}`),
             this.destinationPath(`${subscriptionDirPath}/${file}`),
@@ -286,7 +298,7 @@ module.exports = class extends BaseGenerator {
               existingTopic,
             },
           );
-        });
+        }
 
         await handleSubscribers(
           env,
@@ -297,11 +309,12 @@ module.exports = class extends BaseGenerator {
           dlqTopic,
         );
       }
+
       if (createResource === 'subscription' && externalSub === 'yes') {
         const externalDirPath = path.join(
           process.cwd(),
           'infra',
-          'prod',
+          env,
           'pubsub',
           existingTopic,
           `${clanName}-${env}`,
@@ -311,7 +324,8 @@ module.exports = class extends BaseGenerator {
           fs.mkdirSync(externalDirPath);
         }
 
-        ['terragrunt.hcl', 'spec.hcl'].forEach(async (file) => {
+        const files = ['terragrunt.hcl', 'spec.hcl'];
+        for (const file of files) {
           this.fs.copyTpl(
             this.templatePath(`pubsub-external/${file}`),
             this.destinationPath(`${externalDirPath}/${file}`),
@@ -326,7 +340,7 @@ module.exports = class extends BaseGenerator {
               projectId,
             },
           );
-        });
+        }
 
         const externalSubPath = `${externalDirPath}/subscribers.yaml`;
         if (env === 'staging') {
@@ -362,6 +376,28 @@ module.exports = class extends BaseGenerator {
           dlqTopic,
         );
       }
+
+      if (createResource === 'topic' && externalTopicPublishers === 'yes') {
+        const externalPublishersPath = path.join(
+          process.cwd(),
+          'infra',
+          env,
+          'pubsub',
+          topicName,
+          'external-publishers',
+        );
+
+        const files = ['terragrunt.hcl', 'bindings.yaml'];
+        for (const file of files) {
+          this.fs.copyTpl(
+            this.templatePath(`pubsub-external-publishers/${file}`),
+            this.destinationPath(`${externalPublishersPath}/${file}`),
+            {
+              ...this.answers,
+            },
+          );
+        }
+      }
     });
   }
 
@@ -370,7 +406,8 @@ module.exports = class extends BaseGenerator {
 ${chalk.green(`Your PubSub resources have now been created. To finalize your configuration, please continue
 with manual editing of the generated files.`)}
 ${chalk.green('1.')} Review created subscribers.
-${chalk.green('2.')} Push this change in a feature branch and open a pull request.
+${chalk.green('2.')} Review created external publishers.
+${chalk.green('3.')} Push this change in a feature branch and open a pull request.
 `);
   }
 };

package/dist/generators/common-resources/pubsub/templates/pubsub-external-publishers/bindings.yaml

@@ -0,0 +1,8 @@
+<% if (createResource == 'topic' && externalTopicPublishers == 'yes') { %>clans:
+# Add External serviceAccounts like:
+# clans:
+#   iam:
+#    - serviceAccount: ...
+#  store-data:
+#    - serviceAccount: ...
+<% } %>

package/dist/generators/common-resources/pubsub/templates/pubsub-external-publishers/terragrunt.hcl

@@ -0,0 +1,37 @@
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  source = "git::https://github.com/terraform-google-modules/terraform-google-iam.git//modules/pubsub_topics_iam?ref=v8.1.0"
+}
+
+include {
+  path = find_in_parent_folders("terragrunt_root.hcl")
+}
+
+locals {
+  project_vars = read_terragrunt_config(find_in_parent_folders("project.hcl"))
+  bindings_raw = yamldecode(file("${get_terragrunt_dir()}/bindings.yaml"))
+  clan_members = flatten([
+    for clan, members in local.bindings_raw.clans : [
+      for m in members : (
+        can(m.serviceAccount) ? m.serviceAccount : regex_replace("^serviceAccount:", "", m)
+      )
+    ]
+  ])
+
+  iam_bindings = {
+    "roles/pubsub.publisher" = [
+      for sa in local.clan_members : "serviceAccount:${sa}"
+    ]
+  }
+}
+
+dependency "topic" {
+  config_path = "../"
+}
+
+inputs =  {
+    project = local.project_vars.locals.project_id
+    pubsub_topics = [dependency.topic.outputs.topic]
+    bindings = local.iam_bindings
+}