Skip to content

Commit 24416c4

Browse files
author
root
committed
2.185.0
1 parent 6dc5ea0 commit 24416c4

File tree

12 files changed

+183
-97
lines changed

12 files changed

+183
-97
lines changed

‎azure/azure_persistent/main.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@ variable "resource_group" {
55
description = "resource group name"
66
}
77

8+
variable "deploy_nfs" {
9+
type = bool
10+
description = "Deploy NFS for storing files after processing. Setting to false will disable the re-running of analysis pipelines and downloading files."
11+
default = true
12+
}
13+
814
variable "region" {
915
type = string
1016
description = "Region to deploy in"
@@ -72,6 +78,7 @@ resource "azurerm_storage_container" "container" {
7278
}
7379

7480
resource "azurerm_storage_share" "share" {
81+
count = var.deploy_nfs ? 1 : 0
7582
name = "cadoshare"
7683
storage_account_name = azurerm_storage_account.storage.name
7784
quota = var.share_size # TODO increase to 2TB

‎azure/azure_transient/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,10 +292,10 @@ resource "azurerm_linux_virtual_machine" "vm" {
292292
"echo -n ${var.use_secrets_manager} | sudo tee -a /home/admin/processor/envars/USE_SECRETS_MANAGER",
293293
"echo local_workers = ${var.local_workers} | sudo tee -a /home/admin/processor/first_run.cfg",
294294
"echo minimum_role_deployment = ${!var.deploy_acquisition_permissions} | sudo tee -a /home/admin/processor/first_run.cfg",
295+
"echo azure_storage_account = ${data.azurerm_storage_account.storage.name} | sudo tee -a /home/admin/processor/first_run.cfg"
295296
],
296297
var.deploy_nfs ? [
297298
"echo azure_storage_share = ${data.azurerm_storage_share.share[0].name} | sudo tee -a /home/admin/processor/first_run.cfg",
298-
"echo azure_storage_account = ${data.azurerm_storage_account.storage.name} | sudo tee -a /home/admin/processor/first_run.cfg"
299299
] : [],
300300
[
301301
for k, v in var.tags :

‎gcp/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,9 @@ No resources.
5959
| <a name="input_create_cloud_build_role_service_account"></a> [create\_cloud\_build\_role\_service\_account](#input\_create\_cloud\_build\_role\_service\_account) | Create a custom Cloud Build role | `bool` | `true` | no |
6060
| <a name="input_credentials_file"></a> [credentials\_file](#input\_credentials\_file) | Path to the credentials file | `string` | `""` | no |
6161
| <a name="input_custom_networking"></a> [custom\_networking](#input\_custom\_networking) | Custom networking configuration. Set to null to create new resources. | <pre>object({<br> vpc_name = string<br> public_subnet_name = string<br> })</pre> | `null` | no |
62+
| <a name="input_deploy_acquisition_permissions"></a> [deploy\_acquisition\_permissions](#input\_deploy\_acquisition\_permissions) | Deploy instance with permissions needed for same project acquisitions | `bool` | `true` | no |
6263
| <a name="input_deploy_nfs"></a> [deploy\_nfs](#input\_deploy\_nfs) | Deploy NFS for storing files after processing. Setting to false will disable the re-running of analysis pipelines and downloading files. | `bool` | `true` | no |
64+
| <a name="input_enable_platform_updates"></a> [enable\_platform\_updates](#input\_enable\_platform\_updates) | Enable platform updates, False requires updates via Terraform | `bool` | `true` | no |
6365
| <a name="input_finalize_cmd"></a> [finalize\_cmd](#input\_finalize\_cmd) | Command to run on the VM after deployment | `string` | `"sudo /home/admin/processor/release/finalize.sh --main"` | no |
6466
| <a name="input_image"></a> [image](#input\_image) | Cado Response VM image path | `string` | `"projects/cado-public/global/images/cadoresponse"` | no |
6567
| <a name="input_inbound_ports"></a> [inbound\_ports](#input\_inbound\_ports) | The list of ports to open | `list(string)` | <pre>[<br> "22",<br> "443"<br>]</pre> | no |

‎gcp/gcpVars.tfvars

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,12 @@ instance_worker_type = "n2-highmem-8" # Choose your desired worker VM size. De
2424
# Network settings
2525
allowed_ips = ["1.2.3.4/32", "2.3.4.5/32"] # List IPs you wish to whitelist.
2626

27-
nfs_protocol = "NFS_V3" # Choose the NFS protocol version. Default is "NFS_V3". "NFS_V4_1" is in GCP beta.
28-
deploy_nfs = true # Deploy NFS for storing files after processing. Setting to false will disable the re-running of analysis pipelines and downloading files.
29-
use_secrets_manager = true # Use GCP Secret Manager for storing secrets, set to false to store on disk.
27+
nfs_protocol = "NFS_V3" # Choose the NFS protocol version. Default is "NFS_V3". "NFS_V4_1" is in GCP beta.
28+
deploy_nfs = true # Deploy NFS for storing files after processing. Setting to false will disable the re-running of analysis pipelines and downloading files.
29+
use_secrets_manager = true # Use GCP Secret Manager for storing secrets, set to false to store on disk.
30+
local_workers = false # Deploy without scalable workers. Only limited acquisition types will be available.
31+
deploy_acquisition_permissions = true # Deploy instance with permissions needed for same project acquisitions.
32+
enable_platform_updates = true # Enable platform updates. False requires updates via Terraform.
3033

3134
# If you'd like to use custom networking, uncomment the following block and provide the necessary information.
3235
# If you're unsure, leave this section commented out and the deployment will use default networking settings.

‎gcp/main.tf

Lines changed: 30 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -37,31 +37,37 @@ module "networking" {
3737
}
3838

3939
module "iam" {
40-
source = "./modules/iam"
41-
project_id = var.project_id
42-
unique_name = var.unique_name
43-
role = var.role
40+
source = "./modules/iam"
41+
project_id = var.project_id
42+
unique_name = var.unique_name
43+
role = var.role
44+
use_secrets_manager = var.use_secrets_manager
45+
local_workers = var.local_workers
46+
deploy_acquisition_permissions = var.deploy_acquisition_permissions
47+
enable_platform_updates = var.enable_platform_updates
4448
}
4549

4650
module "deploy" {
47-
source = "./modules/deploy"
48-
project_id = var.project_id
49-
region = var.region
50-
unique_name = var.unique_name
51-
vm_size = var.vm_size
52-
vol_size = var.vol_size
53-
tags = var.tags
54-
service_account = module.iam.service_account
55-
boot_disk_image = var.image
56-
network_config = module.networking.vpc_network
57-
subnetwork_config = module.networking.custom_subnetwork
58-
network_name = module.networking.vpc_network_name
59-
finalize_cmd = var.finalize_cmd
60-
proxy = var.proxy
61-
proxy_cert_url = var.proxy_cert_url
62-
instance_worker_type = var.instance_worker_type
63-
use_beta = local.use_beta
64-
deploy_nfs = var.deploy_nfs
65-
use_secrets_manager = var.use_secrets_manager
66-
local_workers = var.local_workers
51+
source = "./modules/deploy"
52+
project_id = var.project_id
53+
region = var.region
54+
unique_name = var.unique_name
55+
vm_size = var.vm_size
56+
vol_size = var.vol_size
57+
tags = var.tags
58+
service_account = module.iam.service_account
59+
boot_disk_image = var.image
60+
network_config = module.networking.vpc_network
61+
subnetwork_config = module.networking.custom_subnetwork
62+
network_name = module.networking.vpc_network_name
63+
finalize_cmd = var.finalize_cmd
64+
proxy = var.proxy
65+
proxy_cert_url = var.proxy_cert_url
66+
instance_worker_type = var.instance_worker_type
67+
use_beta = local.use_beta
68+
deploy_nfs = var.deploy_nfs
69+
use_secrets_manager = var.use_secrets_manager
70+
local_workers = var.local_workers
71+
deploy_acquisition_permissions = var.deploy_acquisition_permissions
72+
enable_platform_updates = var.enable_platform_updates
6773
}

‎gcp/modules/deploy/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,9 @@ No modules.
3232
| Name | Description | Type | Default | Required |
3333
|------|-------------|------|---------|:--------:|
3434
| <a name="input_boot_disk_image"></a> [boot\_disk\_image](#input\_boot\_disk\_image) | The image to use for the VM's boot disk | `string` | n/a | yes |
35+
| <a name="input_deploy_acquisition_permissions"></a> [deploy\_acquisition\_permissions](#input\_deploy\_acquisition\_permissions) | Whether to deploy the acquisition permissions | `bool` | n/a | yes |
3536
| <a name="input_deploy_nfs"></a> [deploy\_nfs](#input\_deploy\_nfs) | Deploy NFS for storing files after processing. Setting to false will disable the re-running of analysis pipelines and downloading files. | `bool` | n/a | yes |
37+
| <a name="input_enable_platform_updates"></a> [enable\_platform\_updates](#input\_enable\_platform\_updates) | Enable platform updates, False requires updates via Terraform | `bool` | n/a | yes |
3638
| <a name="input_finalize_cmd"></a> [finalize\_cmd](#input\_finalize\_cmd) | Command to run on the VM after deployment | `string` | n/a | yes |
3739
| <a name="input_instance_worker_type"></a> [instance\_worker\_type](#input\_instance\_worker\_type) | Set Worker instance type | `string` | n/a | yes |
3840
| <a name="input_local_workers"></a> [local\_workers](#input\_local\_workers) | Deploy without scalable workers. Only limited acquisition types will be available | `bool` | n/a | yes |

‎gcp/modules/deploy/main.tf

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,19 +42,18 @@ resource "google_compute_instance" "vm_instance" {
4242
"echo bucket = $storage_bucket >> /home/admin/processor/first_run.cfg",
4343
"echo service_account_email = ${var.service_account} >> /home/admin/processor/first_run.cfg",
4444
"echo deployment_mode = terraform >> /home/admin/processor/first_run.cfg",
45-
"echo feature_flag_platform_upgrade = true >> /home/admin/processor/first_run.cfg",
45+
"echo feature_flag_platform_upgrade = ${var.enable_platform_updates} >> /home/admin/processor/first_run.cfg",
4646
"echo PROXY_url = ${var.proxy} >> /home/admin/processor/first_run.cfg",
4747
"echo PROXY_cert_url = ${var.proxy_cert_url} >> /home/admin/processor/first_run.cfg",
4848
"echo worker_instance = ${var.instance_worker_type} >> /home/admin/processor/first_run.cfg",
4949
"echo local_workers = ${var.local_workers} >> /home/admin/processor/first_run.cfg",
50+
"echo minimum_role_deployment = ${!var.deploy_acquisition_permissions} >> /home/admin/processor/first_run.cfg",
51+
"echo -n ${var.use_secrets_manager} > /home/admin/processor/envars/USE_SECRETS_MANAGER"
5052
],
5153
[
5254
for k, v in var.tags :
5355
"echo CUSTOM_TAG_${k} = ${v} | sudo tee -a /home/admin/processor/first_run.cfg"
5456
],
55-
[
56-
"echo -n ${var.use_secrets_manager} > /home/admin/processor/envars/USE_SECRETS_MANAGER"
57-
],
5857
[
5958
join(" ", concat([
6059
"${var.finalize_cmd}",
@@ -109,7 +108,7 @@ resource "google_filestore_instance" "beta_filestore_instance" {
109108
}
110109

111110
resource "google_filestore_instance" "filestore_instance" {
112-
count = (var.use_beta && var.deploy_nfs) ? 0 : 1
111+
count = (!var.use_beta && var.deploy_nfs) ? 1 : 0
113112
name = "cadoresponse-fileshare-${var.unique_name}"
114113
location = data.google_compute_zones.available.names[0]
115114
tier = "BASIC_HDD"

‎gcp/modules/deploy/variables.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,3 +88,13 @@ variable "local_workers" {
8888
type = bool
8989
description = "Deploy without scalable workers. Only limited acquisition types will be available"
9090
}
91+
92+
variable "deploy_acquisition_permissions" {
93+
description = "Whether to deploy the acquisition permissions"
94+
type = bool
95+
}
96+
97+
variable "enable_platform_updates" {
98+
description = "Enable platform updates, False requires updates via Terraform"
99+
type = bool
100+
}

‎gcp/modules/iam/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,13 @@ No modules.
2525

2626
| Name | Description | Type | Default | Required |
2727
|------|-------------|------|---------|:--------:|
28+
| <a name="input_deploy_acquisition_permissions"></a> [deploy\_acquisition\_permissions](#input\_deploy\_acquisition\_permissions) | Whether to deploy the acquisition permissions | `bool` | n/a | yes |
29+
| <a name="input_enable_platform_updates"></a> [enable\_platform\_updates](#input\_enable\_platform\_updates) | Enable platform updates, False requires updates via Terraform | `bool` | n/a | yes |
30+
| <a name="input_local_workers"></a> [local\_workers](#input\_local\_workers) | Deploy without scalable workers. Only limited acquisition types will be available | `bool` | n/a | yes |
2831
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | The Google Cloud project ID where the resources will be created | `string` | n/a | yes |
2932
| <a name="input_role"></a> [role](#input\_role) | The role to assign to the service account | `string` | `""` | no |
3033
| <a name="input_unique_name"></a> [unique\_name](#input\_unique\_name) | n/a | `string` | n/a | yes |
34+
| <a name="input_use_secrets_manager"></a> [use\_secrets\_manager](#input\_use\_secrets\_manager) | Use GCP Secret Manager for storing secrets | `bool` | n/a | yes |
3135

3236
## Outputs
3337

‎gcp/modules/iam/main.tf

Lines changed: 84 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,69 @@ locals {
44
account_id_suffix = length(local.split_unique_name) > 1 ? "-${local.split_unique_name[length(local.split_unique_name) - 1]}" : ""
55
}
66

7-
resource "google_service_account" "user_service_account" {
8-
account_id = "sa-${local.split_unique_name[0]}${local.account_id_suffix}"
9-
display_name = "CadoResponse Service Account ${var.unique_name}"
10-
project = var.project_id
11-
}
7+
locals {
8+
base_permissions = [
9+
// Minimal Permissions To Run
10+
"iam.serviceAccounts.actAs",
11+
"iam.serviceAccounts.get",
12+
"iam.serviceAccounts.getAccessToken",
13+
"iam.serviceAccounts.getIamPolicy",
14+
15+
// Cado Host
16+
"iam.serviceAccounts.signBlob",
17+
18+
// Bucket Acquisition
19+
"storage.buckets.get",
20+
"storage.buckets.list",
21+
"storage.objects.create",
22+
"storage.objects.delete",
23+
"storage.objects.get",
24+
"storage.objects.list",
25+
]
26+
27+
workers_permissions = [
28+
// Worker Permissions
29+
"compute.disks.create",
30+
"compute.instances.create",
31+
"compute.instances.setMetadata",
32+
"compute.instances.setServiceAccount",
33+
"compute.addresses.use",
34+
"compute.instances.addAccessConfig",
35+
"compute.instances.delete",
36+
"compute.instances.setLabels",
37+
"compute.subnetworks.use",
38+
"compute.networks.get",
39+
"compute.networks.list",
40+
41+
// Adjusting Settings
42+
"compute.machineTypes.get",
43+
"compute.machineTypes.list",
44+
"compute.regions.get",
45+
]
46+
47+
upgrade_permissions = [
48+
// Upgrade Permissions
49+
"compute.disks.create",
50+
"compute.instances.attachDisk",
51+
"compute.images.useReadOnly",
52+
"compute.instances.create",
53+
"compute.addresses.use",
54+
"compute.instances.detachDisk",
55+
"compute.instances.deleteAccessConfig",
56+
"compute.zoneOperations.get",
57+
"compute.subnetworks.useExternalIp",
58+
]
59+
60+
secretmanager_permissions = [
61+
// Secret Management
62+
"secretmanager.secrets.create",
63+
"secretmanager.versions.access",
64+
"secretmanager.versions.add"
65+
]
66+
67+
acquisition_permissions = [
68+
"resourcemanager.projects.get",
1269

13-
resource "google_project_iam_custom_role" "custom_role" {
14-
count = var.role == "" ? 1 : 0
15-
role_id = replace("myCadoResponseRole_${var.unique_name}", "-", "_")
16-
title = "myCadoResponseRole-${var.unique_name}"
17-
description = "CadoResponse Role"
18-
permissions = [
1970
// Instance Acquisition
2071
"cloudbuild.builds.get",
2172
"cloudbuild.builds.create",
@@ -30,69 +81,39 @@ resource "google_project_iam_custom_role" "custom_role" {
3081
"compute.images.delete",
3182
"compute.images.get",
3283
"compute.instances.getSerialPortOutput",
33-
34-
// Compute Management
35-
"compute.disks.create",
36-
"compute.disks.setLabels",
37-
"compute.images.useReadOnly",
38-
"compute.instances.attachDisk",
39-
"compute.instances.create",
40-
"compute.instances.delete",
41-
"compute.instances.setLabels",
42-
"compute.instances.setMetadata",
43-
"compute.instances.setServiceAccount",
44-
"compute.machineTypes.list",
45-
"compute.machineTypes.get",
46-
"compute.regions.get",
47-
"compute.subnetworks.use",
48-
"compute.subnetworks.useExternalIp",
49-
"compute.networks.get",
50-
"compute.networks.list",
51-
"compute.zones.list",
52-
"compute.zoneOperations.get",
53-
54-
55-
// Platform Update
56-
"compute.addresses.use",
57-
"compute.instances.addAccessConfig",
58-
"compute.instances.detachDisk",
59-
"compute.instances.deleteAccessConfig",
84+
"compute.projects.get",
6085

6186
// GKE Acquisition
6287
"container.clusters.get",
6388
"container.clusters.list",
6489
"container.pods.exec",
6590
"container.pods.get",
6691
"container.pods.list",
92+
]
6793

68-
// IAM & Authentication
69-
"iam.serviceAccounts.actAs",
70-
"iam.serviceAccounts.create",
71-
"iam.serviceAccounts.enable",
72-
"iam.serviceAccounts.get",
73-
"iam.serviceAccounts.getAccessToken",
74-
"iam.serviceAccounts.getIamPolicy",
75-
"iam.serviceAccounts.implicitDelegation",
76-
"iam.serviceAccounts.list",
77-
"iam.serviceAccounts.signBlob",
7894

79-
// Project Management
80-
"resourcemanager.projects.get",
81-
"compute.projects.get",
95+
# Generate the full list of permissions
96+
permissions = concat(
97+
local.base_permissions,
98+
var.deploy_acquisition_permissions ? local.acquisition_permissions : [],
99+
var.use_secrets_manager ? local.secretmanager_permissions : [],
100+
var.enable_platform_updates ? local.upgrade_permissions : [],
101+
!var.local_workers ? local.workers_permissions : []
102+
)
103+
}
82104

83-
// Secret Management
84-
"secretmanager.versions.access",
85-
"secretmanager.versions.add",
86-
"secretmanager.secrets.create",
105+
resource "google_service_account" "user_service_account" {
106+
account_id = "sa-${local.split_unique_name[0]}${local.account_id_suffix}"
107+
display_name = "CadoResponse Service Account ${var.unique_name}"
108+
project = var.project_id
109+
}
87110

88-
// Bucket Acquisition
89-
"storage.buckets.get",
90-
"storage.buckets.list",
91-
"storage.objects.create",
92-
"storage.objects.delete",
93-
"storage.objects.get",
94-
"storage.objects.list",
95-
]
111+
resource "google_project_iam_custom_role" "custom_role" {
112+
count = var.role == "" ? 1 : 0
113+
role_id = replace("myCadoResponseRole_${var.unique_name}", "-", "_")
114+
title = "myCadoResponseRole-${var.unique_name}"
115+
description = "CadoResponse Role"
116+
permissions = local.permissions
96117
}
97118

98119
resource "google_project_iam_member" "project_iam_member_cado" {

‎gcp/modules/iam/variables.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,23 @@ variable "role" {
1212
type = string
1313
default = "" # DO NOT CHANGE
1414
}
15+
16+
variable "use_secrets_manager" {
17+
description = "Use GCP Secret Manager for storing secrets"
18+
type = bool
19+
}
20+
21+
variable "local_workers" {
22+
type = bool
23+
description = "Deploy without scalable workers. Only limited acquisition types will be available"
24+
}
25+
26+
variable "deploy_acquisition_permissions" {
27+
description = "Whether to deploy the acquisition permissions"
28+
type = bool
29+
}
30+
31+
variable "enable_platform_updates" {
32+
description = "Enable platform updates, False requires updates via Terraform"
33+
type = bool
34+
}

0 commit comments

Comments
 (0)