95 lines
2.4 KiB
HCL
95 lines
2.4 KiB
HCL
provider "google" {
|
|
project = var.project_id
|
|
region = var.region
|
|
}
|
|
|
|
resource "google_project_service" "apis" {
|
|
for_each = toset([
|
|
"aiplatform.googleapis.com",
|
|
"storage.googleapis.com",
|
|
"cloudbilling.googleapis.com",
|
|
"cloudresourcemanager.googleapis.com",
|
|
"iam.googleapis.com",
|
|
"run.googleapis.com",
|
|
"artifactregistry.googleapis.com",
|
|
"cloudbuild.googleapis.com",
|
|
"cloudbuildv2.googleapis.com",
|
|
"secretmanager.googleapis.com",
|
|
"monitoring.googleapis.com",
|
|
"logging.googleapis.com",
|
|
"cloudtrace.googleapis.com",
|
|
"pubsub.googleapis.com",
|
|
"cloudfunctions.googleapis.com",
|
|
])
|
|
service = each.key
|
|
disable_dependent_services = true
|
|
}
|
|
|
|
resource "google_service_account" "agent_sa" {
|
|
account_id = "osvauco-agent-sa"
|
|
display_name = "OSVauco Agent Runner SA"
|
|
}
|
|
|
|
resource "google_project_iam_member" "agent_sa_roles" {
|
|
for_each = toset([
|
|
"roles/aiplatform.user",
|
|
"roles/storage.objectAdmin",
|
|
"roles/logging.logWriter",
|
|
"roles/cloudtrace.agent",
|
|
"roles/monitoring.metricWriter",
|
|
"roles/secretmanager.secretAccessor",
|
|
"roles/run.invoker",
|
|
])
|
|
project = var.project_id
|
|
role = each.key
|
|
member = "serviceAccount:${google_service_account.agent_sa.email}"
|
|
}
|
|
|
|
resource "google_pubsub_topic" "billing_alerts" {
|
|
name = "billing-alert-auto-teardown"
|
|
}
|
|
|
|
resource "google_pubsub_subscription" "billing_alerts_sub" {
|
|
name = "billing-alert-subscription"
|
|
topic = google_pubsub_topic.billing_alerts.name
|
|
|
|
# Push to an email address
|
|
push_config {
|
|
push_endpoint = "mailto:${var.alert_email}"
|
|
}
|
|
}
|
|
|
|
resource "google_artifact_registry_repository" "repo" {
|
|
location = var.artifact_region
|
|
repository_id = var.artifact_repo_name
|
|
format = "DOCKER"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service" "agent_service" {
|
|
name = var.cloud_run_service_name
|
|
location = var.cloud_run_region
|
|
|
|
template {
|
|
service_account = google_service_account.agent_sa.email
|
|
|
|
containers {
|
|
image = var.container_image
|
|
env {
|
|
name = "CUSTOMER_ID"
|
|
value = var.customer_id
|
|
}
|
|
}
|
|
}
|
|
|
|
depends_on = [google_project_service.apis]
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "invoker" {
|
|
project = var.project_id
|
|
location = google_cloud_run_v2_service.agent_service.location
|
|
name = google_cloud_run_v2_service.agent_service.name
|
|
role = "roles/run.invoker"
|
|
member = "user:chris.christiansen@vauco.no"
|
|
}
|
|
|