94 lines
2.5 KiB
HCL
94 lines
2.5 KiB
HCL
provider "google" {
|
|
project = var.project_id
|
|
region = var.region
|
|
}
|
|
|
|
resource "google_project_service" "apis" {
|
|
for_each = toset([
|
|
"aiplatform.googleapis.com",
|
|
"storage.googleapis.com",
|
|
"cloudbilling.googleapis.com",
|
|
"cloudresourcemanager.googleapis.com",
|
|
"iam.googleapis.com",
|
|
"run.googleapis.com",
|
|
"artifactregistry.googleapis.com",
|
|
"cloudbuild.googleapis.com",
|
|
"secretmanager.googleapis.com",
|
|
"monitoring.googleapis.com",
|
|
"logging.googleapis.com",
|
|
"cloudtrace.googleapis.com",
|
|
"pubsub.googleapis.com",
|
|
"cloudfunctions.googleapis.com",
|
|
])
|
|
service = each.key
|
|
disable_dependent_services = true
|
|
}
|
|
|
|
resource "google_service_account" "agent_sa" {
|
|
account_id = "osvauco-agent-sa"
|
|
display_name = "OSVauco Agent Runner SA"
|
|
}
|
|
|
|
resource "google_project_iam_member" "agent_sa_roles" {
|
|
for_each = toset([
|
|
"roles/aiplatform.user",
|
|
"roles/storage.objectAdmin",
|
|
"roles/logging.logWriter",
|
|
"roles/cloudtrace.agent",
|
|
"roles/monitoring.metricWriter",
|
|
"roles/secretmanager.secretAccessor",
|
|
"roles/run.invoker",
|
|
])
|
|
project = var.project_id
|
|
role = each.key
|
|
member = "serviceAccount:${google_service_account.agent_sa.email}"
|
|
}
|
|
|
|
resource "google_pubsub_topic" "billing_alerts" {
|
|
name = "billing-alert-auto-teardown"
|
|
}
|
|
|
|
resource "google_pubsub_subscription" "billing_alerts_sub" {
|
|
name = "billing-alert-subscription"
|
|
topic = google_pubsub_topic.billing_alerts.name
|
|
|
|
# Push to an email address
|
|
push_config {
|
|
push_endpoint = "mailto:${var.alert_email}"
|
|
}
|
|
}
|
|
|
|
resource "google_artifact_registry_repository" "repo" {
|
|
location = var.artifact_region
|
|
repository_id = var.artifact_repo_name
|
|
format = "DOCKER"
|
|
}
|
|
|
|
# Managed via Cloud Build CI/CD — not Terraform
|
|
# resource "google_cloud_run_v2_service" "agent_service" {
|
|
# name = var.cloud_run_service_name
|
|
# location = var.cloud_run_region
|
|
#
|
|
# template {
|
|
# service_account = google_service_account.agent_sa.email
|
|
#
|
|
# containers {
|
|
# image = var.container_image
|
|
# env {
|
|
# name = "CUSTOMER_ID"
|
|
# value = var.customer_id
|
|
# }
|
|
# }
|
|
# }
|
|
#
|
|
# depends_on = [google_project_service.apis]
|
|
# }
|
|
#
|
|
# resource "google_cloud_run_v2_service_iam_member" "invoker" {
|
|
# project = var.project_id
|
|
# location = google_cloud_run_v2_service.agent_service.location
|
|
# name = google_cloud_run_v2_service.agent_service.name
|
|
# role = "roles/run.invoker"
|
|
# member = "user:chris.christiansen@vauco.no"
|
|
# }
|