Skip to content

Commit f7adaad

Browse files
authored
docs: gcp docs update (#4361)
* Add documentation for setting GCP accounts * Naming convention update
1 parent e000a44 commit f7adaad

5 files changed

Lines changed: 97 additions & 15 deletions

File tree

File renamed without changes.
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
#!/bin/bash
2-
# Install Terraform 1.12 using common script
2+
# Install Terraform 1.12
33
.github/scripts/setup/terraform-switch.sh 1.12

.github/workflows/integration-test.yml

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,21 @@ jobs:
1717
fail-fast: false
1818
matrix:
1919
integration:
20-
- name: Fixtures OpenTofu 1.9
20+
- name: Fixtures with OpenTofu
2121
os: ubuntu
2222
target: ./test
2323
setup_scripts:
2424
- .github/scripts/setup/tofu-switch.sh
25-
- name: Fixtures Terraform 1.5
25+
- name: Fixtures with Latest OSS Terraform
2626
os: ubuntu
2727
target: ./test
2828
setup_scripts:
29-
- .github/scripts/setup/terraform-switch-1-5.sh
30-
- name: Fixtures Terraform 1.12
29+
- .github/scripts/setup/terraform-switch-latest-oss.sh
30+
- name: Fixtures with Latest Terraform
3131
os: ubuntu
3232
target: ./test
3333
setup_scripts:
34-
- .github/scripts/setup/terraform-switch-1-12.sh
34+
- .github/scripts/setup/terraform-switch-latest.sh
3535
- name: SSH
3636
os: ubuntu
3737
target: ./...
@@ -69,22 +69,22 @@ jobs:
6969
secrets: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_TEST_S3_ASSUME_ROLE]
7070
setup_scripts:
7171
- .github/scripts/setup/tofu-switch.sh
72-
- name: AWS Terraform 1.5
72+
- name: AWS with Latest OSS Terraform
7373
os: ubuntu
7474
target: ./...
7575
tags: aws
7676
run: '^TestAws'
7777
secrets: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_TEST_S3_ASSUME_ROLE]
7878
setup_scripts:
79-
- .github/scripts/setup/terraform-switch-1-5.sh
80-
- name: AWS Terraform 1.12
79+
- .github/scripts/setup/terraform-switch-latest-oss.sh
80+
- name: AWS with Latest Terraform
8181
os: ubuntu
8282
target: ./...
8383
tags: aws
8484
run: '^TestAws'
8585
secrets: [AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_TEST_S3_ASSUME_ROLE]
8686
setup_scripts:
87-
- .github/scripts/setup/terraform-switch-1-12.sh
87+
- .github/scripts/setup/terraform-switch-latest.sh
8888
- name: AWSGCP
8989
os: ubuntu
9090
target: ./...
@@ -107,13 +107,13 @@ jobs:
107107
- .github/scripts/setup/windows-setup.ps1
108108
tags: windows
109109
run: '^TestWindows'
110-
- name: Provider Cache Terraform 1.12
110+
- name: Provider Cache with Latest Terraform
111111
os: ubuntu
112112
target: ./test
113113
setup_scripts:
114114
- .github/scripts/setup/provider-cache.sh
115-
- .github/scripts/setup/terraform-switch-1-12.sh
116-
- name: Provider Cache Tofu
115+
- .github/scripts/setup/terraform-switch-latest.sh
116+
- name: Provider Cache with Tofu
117117
os: ubuntu
118118
target: ./test
119119
setup_scripts:

docs-starlight/src/content/docs/03-community/01-contributing.mdx

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,47 @@ In general, we try to make sure that any test that requires a build tag is also
249249

250250
For example, all AWS tests are prefixed with `TestAws*`.
251251

252+
Terragrunt also includes integration tests for Google Cloud Platform (GCP). These tests are prefixed with `TestGcp*` and are tagged with the `gcp` build tag. To run these tests, you can use the `-tags` flag set in the `GOFLAGS` environment variable, similar to AWS tests:
253+
254+
```bash
255+
GOFLAGS='-tags=gcp' go test -run 'TestGcp*' .
256+
```
257+
258+
To successfully run the GCP tests, you must set the following environment variables:
259+
260+
- `GCLOUD_SERVICE_KEY`: The service account JSON key used for authentication.
261+
- `GOOGLE_CLOUD_PROJECT` or `GOOGLE_PROJECT_ID`: The GCP project name.
262+
- `GOOGLE_COMPUTE_ZONE`: The compute zone name.
263+
- `GOOGLE_IDENTITY_EMAIL`: The service account identity email.
264+
- `GCLOUD_SERVICE_KEY_IMPERSONATOR`: (Optional) An additional service account key used in impersonation tests.
265+
266+
Make sure these environment variables are set in your shell before running the tests. For example:
267+
268+
```bash
269+
export GCLOUD_SERVICE_KEY="/path/to/service-account.json"
270+
export GOOGLE_CLOUD_PROJECT="your-gcp-project"
271+
export GOOGLE_COMPUTE_ZONE="us-central1-a"
272+
export GOOGLE_IDENTITY_EMAIL="service-account@your-gcp-project.iam.gserviceaccount.com"
273+
export GCLOUD_SERVICE_KEY_IMPERSONATOR="/path/to/impersonator-service-account.json"
274+
```
275+
276+
The service account used for GCP tests must have the following IAM roles in your GCP project:
277+
278+
- `roles/storage.admin`
279+
- `roles/iam.serviceAccountTokenCreator`
280+
281+
You can assign these roles using the following gcloud commands:
282+
283+
```bash
284+
gcloud projects add-iam-policy-binding <gcp-project> \
285+
--member="<service-account>" \
286+
--role="roles/storage.admin"
287+
288+
gcloud projects add-iam-policy-binding <gcp-project> \
289+
--member="<service-account>" \
290+
--role="roles/iam.serviceAccountTokenCreator"
291+
```
292+
252293
#### Race tests
253294

254295
Given that Terragrunt is a tool that frequently involves concurrently running multiple things at once, there's always a risk for race conditions to occur. As such, there are dedicated tests that are run with the `-race` flag in CI to use golang's built-in tooling for identifying race conditions.
@@ -299,7 +340,7 @@ To accomplish these two goals, we have created an `errors` package that has seve
299340

300341
Here is how the `errors` package should be used:
301342

302-
1. Any time you want to create your own error, create a custom type for it, and when instantiating that type, wrap it with a call to `errors.New`. That way, any time you call a method defined in the Terragrunt code, you know the error it returns already has a stacktrace and you dont have to wrap it yourself.
343+
1. Any time you want to create your own error, create a custom type for it, and when instantiating that type, wrap it with a call to `errors.New`. That way, any time you call a method defined in the Terragrunt code, you know the error it returns already has a stacktrace and you don't have to wrap it yourself.
303344

304345
2. Any time you get back an error object from a function built into Go or a 3rd party library, immediately wrap it with `errors.New`. This gives us a stacktrace as close to the source as possible.
305346

docs/_docs/03_community/01-contributing.md

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,47 @@ In general, we try to make sure that any test that requires a build tag is also
278278

279279
For example, all AWS tests are prefixed with `TestAws*`.
280280

281+
Terragrunt also includes integration tests for Google Cloud Platform (GCP). These tests are prefixed with `TestGcp*` and are tagged with the `gcp` build tag. To run these tests, you can use the `-tags` flag set in the `GOFLAGS` environment variable, similar to AWS tests:
282+
283+
```bash
284+
GOFLAGS='-tags=gcp' go test -run 'TestGcp*' .
285+
```
286+
287+
To successfully run the GCP tests, you must set the following environment variables:
288+
289+
- `GCLOUD_SERVICE_KEY`: The service account JSON key used for authentication.
290+
- `GOOGLE_CLOUD_PROJECT` or `GOOGLE_PROJECT_ID`: The GCP project name.
291+
- `GOOGLE_COMPUTE_ZONE`: The compute zone name.
292+
- `GOOGLE_IDENTITY_EMAIL`: The service account identity email.
293+
- `GCLOUD_SERVICE_KEY_IMPERSONATOR`: (Optional) An additional service account key used in impersonation tests.
294+
295+
Make sure these environment variables are set in your shell before running the tests. For example:
296+
297+
```bash
298+
export GCLOUD_SERVICE_KEY="/path/to/service-account.json"
299+
export GOOGLE_CLOUD_PROJECT="your-gcp-project"
300+
export GOOGLE_COMPUTE_ZONE="us-central1-a"
301+
export GOOGLE_IDENTITY_EMAIL="service-account@your-gcp-project.iam.gserviceaccount.com"
302+
export GCLOUD_SERVICE_KEY_IMPERSONATOR="/path/to/impersonator-service-account.json"
303+
```
304+
305+
The service account used for GCP tests must have the following IAM roles in your GCP project:
306+
307+
- `roles/storage.admin`
308+
- `roles/iam.serviceAccountTokenCreator`
309+
310+
You can assign these roles using the following gcloud commands:
311+
312+
```bash
313+
gcloud projects add-iam-policy-binding <gcp-project> \
314+
--member="<service-account>" \
315+
--role="roles/storage.admin"
316+
317+
gcloud projects add-iam-policy-binding <gcp-project> \
318+
--member="<service-account>" \
319+
--role="roles/iam.serviceAccountTokenCreator"
320+
```
321+
281322
#### Race tests
282323

283324
Given that Terragrunt is a tool that frequently involves concurrently running multiple things at once, there's always a risk for race conditions to occur. As such, there are dedicated tests that are run with the `-race` flag in CI to use golang's built-in tooling for identifying race conditions.
@@ -328,7 +369,7 @@ To accomplish these two goals, we have created an `errors` package that has seve
328369

329370
Here is how the `errors` package should be used:
330371

331-
1. Any time you want to create your own error, create a custom type for it, and when instantiating that type, wrap it with a call to `errors.New`. That way, any time you call a method defined in the Terragrunt code, you know the error it returns already has a stacktrace and you dont have to wrap it yourself.
372+
1. Any time you want to create your own error, create a custom type for it, and when instantiating that type, wrap it with a call to `errors.New`. That way, any time you call a method defined in the Terragrunt code, you know the error it returns already has a stacktrace and you don't have to wrap it yourself.
332373

333374
2. Any time you get back an error object from a function built into Go or a 3rd party library, immediately wrap it with `errors.New`. This gives us a stacktrace as close to the source as possible.
334375

0 commit comments

Comments
 (0)