Helper tool to deploy the Terraform example foundation using Cloud Build and Cloud Source repositories.

• Go 1.22 or later
• Google Cloud SDK version 393.0.0 or later
• Git version 2.28.0 or later
• Terraform version 1.5.7 or later
• See 0-bootstrap README for additional IAM requirements on the user deploying the Foundation.
• To enable Security Command Center, choose a Security Command Center tier and create and grant permissions for the Security Command Center service account as described in Setting up Security Command Center.

Your environment need to use the same Terraform version used on the build pipeline. Otherwise, you might experience Terraform state snapshot lock errors.

Version 1.5.7 is the last version before the license model change. To use a later version of Terraform, ensure that the Terraform version used in the Operating System to manually execute part of the steps in 3-networks and 4-projects is the same version configured in the following code

• 0-bootstrap/build_cb.tf

  terraform_version = "1.5.7"
  

• scripts/validate-requirements.sh

  TF_VERSION="1.5.7"
  

• build/github-tf-apply.yaml

  terraform_version: '1.5.7'
  

• build/github-tf-plan-all.yaml

  terraform_version: "1.5.7"
  

• build/github-tf-pull-request.yaml

  terraform_version: "1.5.7"
  

• 0-bootstrap/Dockerfile

  ARG TERRAFORM_VERSION=1.5.7
  

• Check if required tools, Go 1.22.0+, Terraform 1.5.7+, gcloud 393.0.0+, and Git 2.28.0+, are installed:

  go version
  
  terraform -version
  
  gcloud --version
  
  git --version

• check if required components of gcloud are installed:

  gcloud components list --filter="id=beta"

• Follow the instructions in the output of the command if component beta is not installed to install it.

• Create a directory in the file system to host the Git Repositories that will be created (Cloud Source repositories, Github, or GitLab) and a copy of the terraform example foundation repository.

• Clone the terraform-example-foundation repository on this directory.

  deploy-directory/
  └── terraform-example-foundation
  

• Copy the file global.tfvars.example as global.tfvars to the same directory.

  deploy-directory/
  └── global.tfvars
  └── terraform-example-foundation
  

• Update global.tfvars with values from your environment.

• The 0-bootstrap README prerequisites section has additional prerequisites needed to run this helper.

• Variable code_checkout_path is the full path to deploy-directory directory.

• Variable foundation_code_path is the full path to terraform-example-foundation directory.

• By default, the foundation-deployer deploys all environments (production, nonproduction, development).

• To deploy only the production environment, set production_only_deploy = true in your global.tfvars file. When enabled:

  • Only production and shared stages are executed across 1-org, 2-environments, 3-networks, 4-projects, and 5-app-infra.
  • Non-production git branches (development, nonproduction) and empty CI/CD plan runs are bypassed.
  • Teardown (-destroy) only destroys provisioned production branches.

• See the READMEs for the stages for additional information:

  • 0-bootstrap
  • 1-org
  • 2-environments
  • 3-networks-svpc
  • 3-networks-hub-and-spoke
  • 4-projects
  • 5-app-infra

By default the foundation regional resources are deployed in us-west1 and us-central1 regions and multi-regional resources are deployed in the US multi-region.

Note: the region used for the variable default_region in the file global.tfvars MUST be one of the regions used for the default_region1 and default_region2 locals.

• Set the billing quota project in the gcloud configuration

  gcloud config set billing/quota_project <QUOTA-PROJECT>
  
  gcloud services enable \
  "cloudresourcemanager.googleapis.com" \
  "cloudbilling.googleapis.com" \
  "iamcredentials.googleapis.com" \
  "cloudbuild.googleapis.com" \
  "securitycenter.googleapis.com" \
  "accesscontextmanager.googleapis.com" \
  --project <QUOTA-PROJECT>
  

• Configure Application Default Credentials

  gcloud auth application-default login

• Install the helper:

  go install

• Validate the tfvars file. When you use the -validate flag, the helper verifies that your Google account (the one you configured with Application Default Credentials) has the required permissions on your organization, folder, and billing account to complete the deployment. If any required permissions are missing, the helper prints a list of the missing permissions so that you can request the necessary access from your administrator before running the full deployment. Additionally, if you configure a validator_project_id in the global.tfvars file, the -validate flag performs additional checks for the Security Command Center notification name and the tag key name. These additional checks require your account to have the Security Center Notification Configurations Viewer (roles/securitycenter.notificationConfigViewer) and Tag Viewer (roles/resourcemanager.tagViewer) roles:

  $HOME/go/bin/foundation-deployer -tfvars_file <PATH TO 'global.tfvars' FILE> -validate

• Run the helper:

  $HOME/go/bin/foundation-deployer -tfvars_file <PATH TO 'global.tfvars' FILE>

• To Suppress additional output use:

  $HOME/go/bin/foundation-deployer -tfvars_file <PATH TO 'global.tfvars' FILE> -quiet

• To destroy the deployment run:

  $HOME/go/bin/foundation-deployer -tfvars_file <PATH TO 'global.tfvars' FILE> -destroy

• After deployment:

  deploy-directory/
  └── bu1-example-app
  └── gcp-bootstrap
  └── gcp-environments
  └── gcp-networks
  └── gcp-org
  └── gcp-policies
  └── gcp-policies-app-infra
  └── gcp-projects
  └── global.tfvars
  └── terraform-example-foundation
  

  -tfvars_file file
        Full path to the Terraform .tfvars file with the configuration to be used.
  -steps_file file
        Path to the steps file to be used to save progress. (default ".steps.json")
  -list_steps
        List the existing steps.
  -reset_step step
        Name of a step to be reset. The step will be marked as pending.
  -validate
        Validate tfvars file inputs
  -quiet
        If true, additional output is suppressed.
  -disable_prompt
        Disable interactive prompt.
  -destroy
        Destroy the deployment.
  -help
        Prints this help text and exits.

See troubleshooting if you run into issues during this deploy.