Add Cloud Run service for PYATS

Author: Sparrow0hawk

cloud/plan/README.md

@@ -13,3 +13,4 @@ To provision the cloud infrastructure:
 1. Provision the [Terraform backend](tf-backend/README.md)
 1. Provision the [Docker repository](docker-repository/README.md)
 1. Provision the [storage bucket](storage-bucket/README.md)
+1. Provision the [service](service/README.md)

cloud/plan/service/.terraform.lock.hcl

@@ -0,0 +1,109 @@
+# Service
+
+This root module provisions the resources required for the service.
+
+## Environments
+
+There are multiple environments that replicate the resources which are represented as Terraform workspaces:
+
+* `dev`
+* `test`
+* `prod`
+
+Set the target environment, for example:
+
+```bash
+export ENVIRONMENT=dev
+```
+
+## Provisioning
+
+1. Change directory:
+
+   ```bash
+   cd cloud/plan/service
+   ```
+
+1. Authenticate with Google Cloud:
+
+   ```bash
+   gcloud auth application-default login
+   ```
+
+1. Initialise Terraform:
+
+   ```bash
+   terraform init
+   ```
+
+1. Create a Terraform workspace for the environment:
+
+   ```bash
+   terraform workspace new ${ENVIRONMENT}
+   ```
+
+1. Apply the changes:
+
+   ```bash
+   terraform apply
+   ```
+## Configuring GitHub Actions
+
+For the Dev environment only, configure the [CI workflow](../../.github/workflows/ci.yml) with credentials to deploy
+images to the service:
+
+1. Obtain the Cloud Run service account private key:
+
+   ```bash
+   terraform output -raw github_action_deploy_private_key
+   ```
+   
+1. [Set the GitHub Actions environment secret](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-an-environment) `GCP_CREDENTIALS_DEPLOY` to the private key
+
+
+## Destroying
+
+1. Change directory:
+
+   ```bash
+   cd cloud/plan/service
+   ```
+
+1. Authenticate with Google Cloud:
+
+   ```bash
+   gcloud auth application-default login
+   ```
+
+1. Select the Terraform workspace for the environment:
+
+   ```bash
+   terraform workspace select ${ENVIRONMENT}
+   ```
+
+1. Disable deletion protection for the service by modifying `cloud/plan/service/application/main.tf`:
+
+   ```diff
+    resource "google_cloud_run_v2_service" "plan" {
+   +  deletion_protection = false
+      ...
+    }
+   ```
+
+1. Apply the change:
+
+   ```bash
+   terraform apply
+   ```
+
+1. Revert the modification:
+
+   ```bash
+   git checkout application/main.tf
+   ```
+   
+1. Delete the resources:
+
+   ```bash
+   terraform destroy
+   ```

cloud/plan/service/README.md

@@ -0,0 +1,63 @@
+resource "google_cloud_run_v2_service" "plan" {
+  name     = "plan"
+  project  = var.project
+  location = var.region
+  ingress  = "INGRESS_TRAFFIC_ALL"
+
+  scaling {
+    min_instance_count = var.keep_idle ? 1 : 0
+    max_instance_count = 10
+  }
+
+  template {
+    service_account = google_service_account.cloud_run_plan.email
+
+    containers {
+      image = "${var.docker_repository_url}/plan:latest"
+      env {
+        name  = "GCS_BUCKET"
+        value = var.gcs_bucket_name
+      }
+      env {
+        name  = "USE_IAP"
+        value = var.use_iap
+      }
+      ports {
+        container_port = 8080
+      }
+    }
+  }
+
+  depends_on = [
+    google_project_iam_member.cloud_run_artifact_registry_reader
+  ]
+}
+
+resource "google_service_account" "cloud_run_plan" {
+  account_id = "cloud-run-plan"
+}
+
+resource "google_cloud_run_v2_service_iam_binding" "plan_run_invoker" {
+  name     = google_cloud_run_v2_service.plan.name
+  project  = var.project
+  location = var.region
+
+  role    = "roles/run.invoker"
+  members = ["allUsers"]
+}
+
+data "google_project" "main" {
+  project_id = var.project
+}
+
+resource "google_project_iam_member" "cloud_run_artifact_registry_reader" {
+  project = var.docker_repository_project
+  role    = "roles/artifactregistry.reader"
+  member  = "serviceAccount:service-${data.google_project.main.number}@serverless-robot-prod.iam.gserviceaccount.com"
+}
+
+resource "google_storage_bucket_iam_member" "cloud_run_storage_bucket_reader" {
+  bucket = var.gcs_bucket_name
+  role   = "roles/storage.objectViewer"
+  member = "serviceAccount:${google_service_account.cloud_run_plan.email}"
+}

cloud/plan/service/application/main.tf

@@ -0,0 +1,9 @@
+output "cloud_run_url" {
+  description = "Cloud Run URI"
+  value       = google_cloud_run_v2_service.plan.uri
+}
+
+output "service_account_id" {
+  description = "Cloud Run service account ID"
+  value       = google_service_account.cloud_run_plan.id
+}

cloud/plan/service/application/outputs.tf

@@ -0,0 +1,34 @@
+variable "project" {
+  description = "GCP project"
+  type        = string
+}
+
+variable "region" {
+  description = "GCP region"
+  type        = string
+}
+
+variable "docker_repository_project" {
+  description = "Docker repository GCP project"
+  type        = string
+}
+
+variable "docker_repository_url" {
+  description = "Docker repository URL"
+  type        = string
+}
+
+variable "keep_idle" {
+  description = "Whether to keep an instance idle to prevent cold starts"
+  type        = bool
+}
+
+variable "gcs_bucket_name" {
+  description = "GCS bucket name for assets"
+  type        = string
+}
+
+variable "use_iap" {
+  description = "Boolean on whether to use IAP or not"
+  type        = bool
+}

cloud/plan/service/application/variables.tf

@@ -0,0 +1,59 @@
+terraform {
+  backend "gcs" {
+    bucket = "dft-rlg-schemes-gis-dev-tf-backend"
+    prefix = "service"
+  }
+}
+
+provider "google" {
+  project = local.project
+}
+
+locals {
+  env     = terraform.workspace
+  project = "${var.project_prefix}-${local.env}"
+  config = {
+    dev = {
+      use_iap   = false
+      keep_idle = false
+    }
+  }
+}
+
+
+data "terraform_remote_state" "docker_repository" {
+  backend = "gcs"
+  config = {
+    bucket = "${var.project_prefix}-dev-tf-backend"
+    prefix = "docker-repository"
+  }
+}
+
+data "terraform_remote_state" "storage_bucket" {
+  backend = "gcs"
+  config = {
+    bucket = "${var.project_prefix}-dev-tf-backend"
+    prefix = "storage-bucket"
+  }
+  workspace = local.env
+}
+
+resource "google_project_service" "run" {
+  project = local.project
+  service = "run.googleapis.com"
+}
+
+module "application" {
+  source                    = "./application"
+  project                   = local.project
+  region                    = var.location
+  docker_repository_project = data.terraform_remote_state.docker_repository.outputs.project
+  docker_repository_url     = data.terraform_remote_state.docker_repository.outputs.url
+  keep_idle                 = local.config[local.env].keep_idle
+  gcs_bucket_name           = data.terraform_remote_state.storage_bucket.outputs.bucket_name
+  use_iap                   = local.config[local.env].use_iap
+
+  depends_on = [
+    google_project_service.run,
+  ]
+}

cloud/plan/service/main.tf

@@ -0,0 +1,4 @@
+output "cloud_run_url" {
+  description = "Cloud run URI"
+  value       = module.application.cloud_run_url
+}

cloud/plan/service/outputs.tf

@@ -0,0 +1,11 @@
+variable "project_prefix" {
+  description = "GCP project prefix"
+  type        = string
+  default     = "dft-rlg-schemes-gis"
+}
+
+variable "location" {
+  description = "GCP location"
+  type        = string
+  default     = "europe-west1"
+}