diff --git a/README.md b/README.md index e66062e..1b37687 100644 --- a/README.md +++ b/README.md @@ -1,110 +1 @@ -# terraform-google-cloud-build-slack-notifier - -[![Build Status](https://www.travis-ci.com/simplifi/terraform-google-cloud-build-slack-notifier.svg?token=Tyt37RU5xWf1sPRSJyoD&branch=main)](https://www.travis-ci.com/simplifi/terraform-google-cloud-build-slack-notifier) - -A Terraform module to enable Slack notifications for Cloud Build events. - -**Note - This will add the following resources to your project:** - -- Google Cloud Storage Bucket for storing the notifier configuration -- Google Pub/Sub for events emitted from Cloud Build -- Google Cloud Run for processing the events emitted from Cloud Build - -This module is based on the instructions found in GCP's [Configuring Slack notifications](https://cloud.google.com/build/docs/configuring-notifications/configure-slack) guide. - -## Setup - -You will need a Slack app incoming webhook url stored in a Google Secret Manager -secret for this to work. - -- Create a [Slack app](https://api.slack.com/apps?new_app=1) for your desired Slack workspace. -- Activate [incoming webhooks](https://api.slack.com/messaging/webhooks) to post messages from Cloud Build to Slack. -- Create a new secret in Google Secret Manager and store the webhook url in it. - -## Pre-commit Hooks - -[Pre-commit](https://pre-commit.com/) hooks have been configured for this repo. - -The enabled hooks check for a variety of common problems in Terraform code, and -will run any time you commit to your branch. - -Pre-commit (and dependencies) can be installed by following the instructions -found here: - -- [Install `pre-commit`](https://pre-commit.com/#install) -- [Install `terraform-docs`](https://github.com/terraform-docs/terraform-docs#installation) - -To enable the hooks locally, run the following from the root of this repo: -`pre-commit install` - -To uninstall the hooks, run the following from the root of this repo: -`pre-commit uninstall` - -To skip running the hooks when you commit: -`git commit -n` aka `git commit --no-verify` - -**Currently enabled plugins:** - -- [pre-commit-terraform](https://github.com/antonbabenko/pre-commit-terraform) - - `terraform_fmt`: Rewrites all Terraform configuration files to a canonical format - - `terraform_docs`: Inserts input and output documentation into `README.md` - - `terraform_validate`: Validates all Terraform configuration files -- [pre-commit-hooks](https://github.com/pre-commit/pre-commit-hooks) - - `end-of-file-fixer`: Makes sure files end in a newline and only a newline - - `trailing-whitespace`: Trims trailing whitespace - - `check-merge-conflict`: Check for files that contain merge conflict strings - - -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 0.13 | -| [google](#requirement\_google) | >= 3.20 | -| [google-beta](#requirement\_google-beta) | >= 3.30 | -| [random](#requirement\_random) | >= 2.1 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [google-beta_google_cloud_run_service.cloud_build_notifier](https://registry.terraform.io/providers/hashicorp/google-beta/latest/docs/resources/google_cloud_run_service) | resource | -| [google-beta_google_project_service_identity.pubsub](https://registry.terraform.io/providers/hashicorp/google-beta/latest/docs/resources/google_project_service_identity) | resource | -| [google_project_iam_member.notifier_project_roles](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource | -| [google_project_iam_member.pubsub_invoker_roles](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource | -| [google_project_iam_member.pubsub_project_roles](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_iam_member) | resource | -| [google_project_service.apis](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_service) | resource | -| [google_pubsub_subscription.cloud_builds](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/pubsub_subscription) | resource | -| [google_pubsub_topic.cloud_builds](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/pubsub_topic) | resource | -| [google_secret_manager_secret_iam_member.notifier_secret_accessor](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/secret_manager_secret_iam_member) | resource | -| [google_service_account.notifier](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource | -| [google_service_account.pubsub_invoker](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_account) | resource | -| [google_storage_bucket.cloud_build_notifier](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket) | resource | -| [google_storage_bucket_object.cloud_build_notifier_config](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket_object) | resource | -| [google_storage_bucket_object.slack_template](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/storage_bucket_object) | resource | -| [random_id.cloud_build_notifier](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource | -| [random_id.cloud_build_notifier_service](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource | -| [google_secret_manager_secret_version.slack_webhook_url](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/secret_manager_secret_version) | data source | - -## Inputs - -| Name | Description | Type | Default | -|------|-------------|------|---------| -| [cloud\_build\_event\_filter](#input\_cloud\_build\_event\_filter) | The CEL filter to apply to incoming Cloud Build events. | `string` | `"build.substitutions['BRANCH_NAME'] == 'main' && build.status in [Build.Status.SUCCESS, Build.Status.FAILURE, Build.Status.TIMEOUT]"` | -| [cloud\_build\_notifier\_image](#input\_cloud\_build\_notifier\_image) | The image to use for the notifier. | `string` | `"us-east1-docker.pkg.dev/gcb-release/cloud-build-notifiers/slack:latest"` | -| [disable\_services\_on\_destroy](#input\_disable\_services\_on\_destroy) | If true, the service APIs used will be disabled on destroy. | `bool` | `false` | -| [name](#input\_name) | The name to use on all resources created. | `string` | n/a | -| [override\_slack\_template\_json](#input\_override\_slack\_template\_json) | Custom template to use for the Slack notifications, which overrides the default. | `string` | `""` | -| [project\_id](#input\_project\_id) | Project ID of the project in which Cloud Build is running. | `string` | n/a | -| [region](#input\_region) | The region in which to deploy the notifier service. | `string` | `"us-central1"` | -| [slack\_webhook\_url\_secret\_id](#input\_slack\_webhook\_url\_secret\_id) | The ID of an existing Google Secret Manager secret, containing a Slack webhook URL. This is usually the `id` from the output of a `google_secret_manager_secret` resource. | `string` | n/a | -| [slack\_webhook\_url\_secret\_project](#input\_slack\_webhook\_url\_secret\_project) | The project ID containing the slack\_webhook\_url\_secret\_id. | `string` | n/a | - -## Outputs - -No outputs. - +Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. diff --git a/main.tf b/main.tf deleted file mode 100644 index 08a699a..0000000 --- a/main.tf +++ /dev/null @@ -1,238 +0,0 @@ -# Cloud Build Notifier - -locals { - base_name = "cbn-${var.name}" -} - - -# ------------------------------------------------------------------------------ -# Project -# ------------------------------------------------------------------------------ - -# Enable required APIs -resource "google_project_service" "apis" { - for_each = toset([ - # Ensure cloudbuild API is enabled (it should already be though) - "cloudbuild.googleapis.com", - # Compute is used by Cloud Run, which in turn runs the notifier - "compute.googleapis.com", - # Pub/Sub is used to handle events from Cloud Build - "pubsub.googleapis.com", - # Cloud Run is used to run the notifier - "run.googleapis.com", - ]) - project = var.project_id - service = each.key - disable_on_destroy = var.disable_services_on_destroy - disable_dependent_services = var.disable_services_on_destroy -} - -# ------------------------------------------------------------------------------ -# Secrets -# ------------------------------------------------------------------------------ - -data "google_secret_manager_secret_version" "slack_webhook_url" { - project = var.slack_webhook_url_secret_project - secret = var.slack_webhook_url_secret_id -} - - -# ------------------------------------------------------------------------------ -# Service Accounts -# ------------------------------------------------------------------------------ - -# Create cloud build notifier service account -resource "google_service_account" "notifier" { - account_id = "${local.base_name}-nfy" - project = var.project_id -} - -# Give the service account required project permissions -resource "google_project_iam_member" "notifier_project_roles" { - for_each = toset([ - "roles/storage.objectViewer", - "roles/iam.serviceAccountTokenCreator", - "roles/logging.logWriter" - ]) - - project = var.project_id - role = each.key - member = "serviceAccount:${google_service_account.notifier.email}" -} - -# Give the notifier service account access to the secret -resource "google_secret_manager_secret_iam_member" "notifier_secret_accessor" { - project = var.slack_webhook_url_secret_project - secret_id = var.slack_webhook_url_secret_id - role = "roles/secretmanager.secretAccessor" - member = "serviceAccount:${google_service_account.notifier.email}" -} - -# Look up the pubsub SA -resource "google_project_service_identity" "pubsub" { - provider = google-beta - project = var.project_id - service = "pubsub.googleapis.com" -} - -# Grant the Pub/Sub SA permission to create auth tokens in your project -resource "google_project_iam_member" "pubsub_project_roles" { - project = var.project_id - role = "roles/iam.serviceAccountTokenCreator" - member = "serviceAccount:${google_project_service_identity.pubsub.email}" -} - -# Create a pub/sub invoker service account -resource "google_service_account" "pubsub_invoker" { - account_id = "${local.base_name}-pbs" - project = var.project_id -} - -# Give the pub/sub invoker service account the Cloud Run Invoker permission -resource "google_project_iam_member" "pubsub_invoker_roles" { - project = var.project_id - role = "roles/run.invoker" - member = "serviceAccount:${google_service_account.pubsub_invoker.email}" -} - - -# ------------------------------------------------------------------------------ -# GCS Bucket -# ------------------------------------------------------------------------------ - -# Create bucket -resource "random_id" "cloud_build_notifier" { - byte_length = 4 -} - -resource "google_storage_bucket" "cloud_build_notifier" { - project = var.project_id - name = "${local.base_name}-${random_id.cloud_build_notifier.hex}" - force_destroy = true - location = var.region - uniform_bucket_level_access = true -} - -locals { - slack_template_json = var.override_slack_template_json != "" ? var.override_slack_template_json : file("${path.module}/slack.json") -} - -resource "google_storage_bucket_object" "slack_template" { - name = "${local.base_name}-slack.json" - bucket = google_storage_bucket.cloud_build_notifier.name - content = local.slack_template_json -} - -resource "google_storage_bucket_object" "cloud_build_notifier_config" { - name = "${local.base_name}-config.yaml" - bucket = google_storage_bucket.cloud_build_notifier.name - - content = jsonencode({ - apiVersion = "cloud-build-notifiers/v1" - kind = "SlackNotifier" - metadata = { - name = local.base_name - } - spec = { - notification = { - filter = var.cloud_build_event_filter - delivery = { - webhookUrl = { - secretRef = "webhook-url" - } - } - template = { - type = "golang" - uri = "${google_storage_bucket.cloud_build_notifier.url}/${local.base_name}-slack.json" - } - } - secrets = [ - { - name = "webhook-url" - value = data.google_secret_manager_secret_version.slack_webhook_url.name - } - ] - } - }) -} - - -# ------------------------------------------------------------------------------ -# Cloud Run -# ------------------------------------------------------------------------------ - -resource "random_id" "cloud_build_notifier_service" { - # We use a keeper here so we can force cloud run to redeploy on script change. - keepers = { - script_hash = google_storage_bucket_object.cloud_build_notifier_config.md5hash - slack_template_hash = google_storage_bucket_object.slack_template.md5hash - } - - byte_length = 4 -} - -resource "google_cloud_run_service" "cloud_build_notifier" { - provider = google-beta - name = "${local.base_name}-${random_id.cloud_build_notifier_service.hex}" - location = var.region - project = var.project_id - - template { - spec { - service_account_name = google_service_account.notifier.email - - containers { - image = var.cloud_build_notifier_image - - env { - name = "CONFIG_PATH" - value = "${google_storage_bucket.cloud_build_notifier.url}/${local.base_name}-config.yaml" - } - - env { - name = "PROJECT_ID" - value = var.project_id - } - } - } - } - - autogenerate_revision_name = true - - lifecycle { - # Ignored because Cloud Run may add annotations outside of this config - ignore_changes = [ - metadata.0.annotations, - ] - } - - depends_on = [ - google_project_service.apis["run.googleapis.com"], - google_secret_manager_secret_iam_member.notifier_secret_accessor - ] -} - - -# ------------------------------------------------------------------------------ -# Pub/Sub -# ------------------------------------------------------------------------------ - -# Create the cloud-builds topic to receive build update messages for your notifier -resource "google_pubsub_topic" "cloud_builds" { - project = var.project_id - name = "cloud-builds" -} - -resource "google_pubsub_subscription" "cloud_builds" { - name = local.base_name - topic = google_pubsub_topic.cloud_builds.name - project = var.project_id - - push_config { - push_endpoint = google_cloud_run_service.cloud_build_notifier.status[0].url - - oidc_token { - service_account_email = google_service_account.pubsub_invoker.email - } - } -} diff --git a/outputs.tf b/outputs.tf deleted file mode 100644 index e69de29..0000000 diff --git a/slack.json b/slack.json deleted file mode 100644 index a954ebd..0000000 --- a/slack.json +++ /dev/null @@ -1,29 +0,0 @@ -[ - { - "type": "section", - "text": { - "type": "mrkdwn", - "text": "Cloud Build {{.Build.ProjectId}} {{.Build.Id}} {{.Build.Status}}" - } - }, - { - "type": "divider" - }, - { - "type": "section", - "text": { - "type": "mrkdwn", - "text": "View Build Logs" - }, - "accessory": { - "type": "button", - "text": { - "type": "plain_text", - "text": "Logs" - }, - "value": "click_me_123", - "url": "{{.Build.LogUrl}}", - "action_id": "button-action" - } - } - ] diff --git a/variables.tf b/variables.tf deleted file mode 100644 index 00f82b2..0000000 --- a/variables.tf +++ /dev/null @@ -1,57 +0,0 @@ -variable "project_id" { - description = "Project ID of the project in which Cloud Build is running." - type = string -} - -variable "name" { - description = "The name to use on all resources created." - type = string - - validation { - condition = can(regex("[a-z0-9-]{0,20}", var.name)) - error_message = "A name must be lowercase letters, numbers, or -." - } -} - -variable "slack_webhook_url_secret_id" { - description = "The ID of an existing Google Secret Manager secret, containing a Slack webhook URL. This is usually the `id` from the output of a `google_secret_manager_secret` resource." - type = string -} - -variable "slack_webhook_url_secret_project" { - description = "The project ID containing the slack_webhook_url_secret_id." - type = string -} - -variable "region" { - description = "The region in which to deploy the notifier service." - type = string - default = "us-central1" -} - -# See: https://cloud.google.com/build/docs/configuring-notifications/configure-slack#using_cel_to_filter_build_events -variable "cloud_build_event_filter" { - description = "The CEL filter to apply to incoming Cloud Build events." - type = string - default = "build.substitutions['BRANCH_NAME'] == 'main' && build.status in [Build.Status.SUCCESS, Build.Status.FAILURE, Build.Status.TIMEOUT]" -} - -variable "cloud_build_notifier_image" { - description = "The image to use for the notifier." - type = string - default = "us-east1-docker.pkg.dev/gcb-release/cloud-build-notifiers/slack:latest" -} - -# https://cloud.google.com/build/docs/configuring-notifications/configure-slack#configuring_slack_notifications (see slack.json under number 7) -# The default slack.json will be used if this is not provided. -variable "override_slack_template_json" { - description = "Custom template to use for the Slack notifications, which overrides the default." - type = string - default = "" -} - -variable "disable_services_on_destroy" { - description = "If true, the service APIs used will be disabled on destroy." - type = bool - default = false -} diff --git a/versions.tf b/versions.tf deleted file mode 100644 index bbe3b9e..0000000 --- a/versions.tf +++ /dev/null @@ -1,19 +0,0 @@ -terraform { - required_version = ">= 0.13" - required_providers { - google = { - source = "hashicorp/google" - version = ">= 3.20" - } - - google-beta = { - source = "hashicorp/google-beta" - version = ">= 3.30" - } - - random = { - source = "hashicorp/random" - version = ">= 2.1" - } - } -}