Add support for tenant factory CI/CD

fast/stages/0-bootstrap/automation.tf

@@ -17,8 +17,10 @@
 # tfdoc:file:description Automation project and resources.
 
 locals {
-  cicd_resman_sa   = try(module.automation-tf-cicd-sa["resman"].iam_email, "")
-  cicd_resman_r_sa = try(module.automation-tf-cicd-r-sa["resman"].iam_email, "")
+  cicd_resman_sa    = try(module.automation-tf-cicd-sa["resman"].iam_email, "")
+  cicd_resman_r_sa  = try(module.automation-tf-cicd-r-sa["resman"].iam_email, "")
+  cicd_tenants_sa   = try(module.automation-tf-cicd-sa["tenants"].iam_email, "")
+  cicd_tenants_r_sa = try(module.automation-tf-cicd-r-sa["tenants"].iam_email, "")
 }
 
 module "automation-project" {
@@ -269,12 +271,18 @@ module "automation-tf-resman-sa" {
   prefix       = local.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
-  iam_bindings_additive = (
+  iam_bindings_additive = merge(
     local.cicd_resman_sa == "" ? {} : {
       cicd_token_creator = {
         member = local.cicd_resman_sa
         role   = "roles/iam.serviceAccountTokenCreator"
       }
+    },
+    local.cicd_tenants_sa == "" ? {} : {
+      cicd_token_creator = {
+        member = local.cicd_tenants_sa
+        role   = "roles/iam.serviceAccountTokenCreator"
+      }
     }
   )
   iam_storage_roles = {
@@ -290,12 +298,18 @@ module "automation-tf-resman-r-sa" {
   prefix       = local.prefix
   # allow SA used by CI/CD workflow to impersonate this SA
   # we use additive IAM to allow tenant CI/CD SAs to impersonate it
-  iam_bindings_additive = (
+  iam_bindings_additive = merge(
     local.cicd_resman_r_sa == "" ? {} : {
       cicd_token_creator = {
         member = local.cicd_resman_r_sa
         role   = "roles/iam.serviceAccountTokenCreator"
       }
+    },
+    local.cicd_tenants_r_sa == "" ? {} : {
+      cicd_token_creator = {
+        member = local.cicd_tenants_r_sa
+        role   = "roles/iam.serviceAccountTokenCreator"
+      }
     }
   )
   # we grant organization roles here as IAM bindings have precedence over

fast/stages/0-bootstrap/cicd.tf

@@ -55,13 +55,19 @@ locals {
     bootstrap_r = "0-bootstrap-r-providers.tf"
     resman      = "1-resman-providers.tf"
     resman_r    = "1-resman-r-providers.tf"
+    tenants     = "1-tenant-factory-providers.tf"
+    tenants_r   = "1-tenant-factory-r-providers.tf"
   }
   cicd_workflow_var_files = {
     bootstrap = []
     resman = [
       "0-bootstrap.auto.tfvars.json",
       "0-globals.auto.tfvars.json"
     ]
+    tenants = [
+      "0-bootstrap.auto.tfvars.json",
+      "0-globals.auto.tfvars.json"
+    ]
   }
 }
 

fast/stages/0-bootstrap/organization-iam.tf

@@ -99,6 +99,7 @@ locals {
     (module.automation-tf-bootstrap-sa.iam_email) = {
       authoritative = [
         "roles/essentialcontacts.admin",
+        "roles/iam.workforcePoolAdmin",
         "roles/logging.admin",
         "roles/resourcemanager.organizationAdmin",
         "roles/resourcemanager.projectCreator",
@@ -108,7 +109,6 @@ locals {
       additive = concat(
         [
           "roles/iam.organizationRoleAdmin",
-          "roles/iam.workforcePoolAdmin",
           "roles/orgpolicy.policyAdmin"
         ],
         local.billing_mode != "org" ? [] : [

fast/stages/0-bootstrap/outputs.tf

@@ -73,15 +73,11 @@ locals {
       name          = "tenant-factory"
       sa            = module.automation-tf-resman-sa.email
     })
-    "0-bootstrap-tenant" = templatefile(local._tpl_providers, {
-      backend_extra = join("\n", [
-        "# remove the newline between quotes and set the tenant name as prefix",
-        "prefix = \"",
-        "\""
-      ])
-      bucket = module.automation-tf-resman-gcs.name
-      name   = "bootstrap-tenant"
-      sa     = module.automation-tf-resman-sa.email
+    "1-tenant-factory-r" = templatefile(local._tpl_providers, {
+      backend_extra = "prefix = \"tenant-factory\""
+      bucket        = module.automation-tf-resman-gcs.name
+      name          = "tenant-factory"
+      sa            = module.automation-tf-resman-r-sa.email
     })
   }
   tfvars = {

fast/stages/0-bootstrap/variables.tf

@@ -45,6 +45,12 @@ variable "cicd_repositories" {
       branch            = optional(string)
       identity_provider = optional(string)
     }))
+    tenants = optional(object({
+      name              = string
+      type              = string
+      branch            = optional(string)
+      identity_provider = optional(string)
+    }))
   })
   default = null
   validation {

tests/fast/stages/s0_bootstrap/checklist.yaml

@@ -96,6 +96,7 @@ values:
     condition: [ ]
     members:
       - group:[email protected]
+      - serviceAccount:fast-prod-bootstrap-0@fast-prod-iac-core-0.iam.gserviceaccount.com
     org_id: '123456789012'
     role: roles/iam.workforcePoolAdmin
   module.organization.google_organization_iam_binding.authoritative["roles/logging.admin"]:
@@ -301,11 +302,6 @@ values:
     member: serviceAccount:fast-prod-bootstrap-0r@fast-prod-iac-core-0.iam.gserviceaccount.com
     org_id: '123456789012'
     role: roles/iam.organizationRoleViewer
-  ? module.organization.google_organization_iam_member.bindings["roles/iam.workforcePoolAdmin-serviceAccount:fast-prod-bootstrap-0@fast-prod-iac-core-0.iam.gserviceaccount.com"]
-  : condition: [ ]
-    member: serviceAccount:fast-prod-bootstrap-0@fast-prod-iac-core-0.iam.gserviceaccount.com
-    org_id: '123456789012'
-    role: roles/iam.workforcePoolAdmin
   ? module.organization.google_organization_iam_member.bindings["roles/iam.workforcePoolViewer-serviceAccount:fast-prod-bootstrap-0r@fast-prod-iac-core-0.iam.gserviceaccount.com"]
   : condition: [ ]
     member: serviceAccount:fast-prod-bootstrap-0r@fast-prod-iac-core-0.iam.gserviceaccount.com
@@ -382,7 +378,7 @@ counts:
   google_org_policy_policy: 22
   google_organization_iam_binding: 28
   google_organization_iam_custom_role: 7
-  google_organization_iam_member: 38
+  google_organization_iam_member: 37
   google_project: 3
   google_project_iam_audit_config: 1
   google_project_iam_binding: 19
@@ -399,4 +395,4 @@ counts:
   google_tags_tag_key: 1
   google_tags_tag_value: 1
   modules: 18
-  resources: 207
+  resources: 206

tests/fast/stages/s0_bootstrap/simple.yaml

@@ -45,7 +45,7 @@ counts:
   google_org_policy_policy: 22
   google_organization_iam_binding: 28
   google_organization_iam_custom_role: 7
-  google_organization_iam_member: 25
+  google_organization_iam_member: 24
   google_project: 3
   google_project_iam_audit_config: 1
   google_project_iam_binding: 19
@@ -63,7 +63,7 @@ counts:
   google_tags_tag_value: 1
   local_file: 8
   modules: 17
-  resources: 199
+  resources: 198
 
 outputs:
   custom_roles: