Move org policies to their own directory

[markmandel]

This means we don't have the extra API requirement (which take a long time to propagate?), and can mark it as an optional step on our README, which can be skipped over for most (?) of our end users.

[markmandel]

@bbhuston please confirm my additions to the README make sense / are correct.

@abmarcum please take a look - I'm fairly sure this is the approach we had discussed the other day.

[bbhuston]

@markmandel I just tested this branch and it does not work for me. (Example error below.)

What's missing still is the user_project_override = true attribute in the google provider. Without this, terraform will throw 403s for all org-level resource creation attempts.

provider "google" {
  project = var.project
  user_project_override = true
}

ERROR for PR

│ Error: Error creating Policy: failed to create a diff: failed to retrieve Policy resource: googleapi: Error 403: Your application has authenticated using end user credentials from the Google Cloud SDK or Google Cloud Shell which are not supported by the orgpolicy.googleapis.com. We recommend configuring the billing/quota_project setting in gcloud or using a service account through the auth/impersonate_service_account setting. For more information about service accounts and how to use them in your application, see https://cloud.google.com/docs/authentication/. If you are getting this error with curl or similar tools, you may need to specify 'X-Goog-User-Project' HTTP header for quota and billing purposes. For more information regarding 'X-Goog-User-Project' header, please check https://cloud.google.com/apis/docs/system-parameters.
│ Details:
│ [
│   {
│     "@type": "type.googleapis.com/google.rpc.ErrorInfo",
│     "domain": "googleapis.com",
│     "metadata": {
│       "consumer": "projects/618104708054",
│       "service": "orgpolicy.googleapis.com"
│     },
│     "reason": "SERVICE_DISABLED"
│   }
│ ]
│ 
│   with module.gcp_org_policy_v2_vmExternalIpAccess.google_org_policy_policy.project_policy[0],
│   on .terraform/modules/gcp_org_policy_v2_vmExternalIpAccess/modules/org_policy_v2/list_constraints.tf line 92, in resource "google_org_policy_policy" "project_policy":
│   92: resource "google_org_policy_policy" "project_policy" {

Let me do some more testing on your branch using brand new GCP projects to get everything sorted out. Also, I'd like to move the org policies directory inside of the infra directory. (Logically, this keeps all the terraform in the same top-level folder, which I think is cleaner.) Thoughts on that approach?

[bbhuston]

One more catch. I think that you copied a stale version of the org-policies.tf file into your PR. This has some misconfigurations in it that we need to tweak.

[markmandel]

Let me do some more testing on your branch using brand new GCP projects to get everything sorted out. Also, I'd like to move the org policies directory inside of the infra directory. (Logically, this keeps all the terraform in the same top-level folder, which I think is cleaner.) Thoughts on that approach?

Thanks for doing all the testing!

It pulls in a lot of dependencies (and extra commands, like gcloud auth application-default set-quota-project ${PROJECT_ID} (I still don't remember why we need this?)) , and also I am concerned this (a) won't apply to many people, and (b) a lot of people won't be able to apply it if they don't have permission to do so, and the repercussions therein? But it's possible that's just FUD on my end.

That being said, the alternate approach may be to use the approach in terraform-google-modules/terraform-google-project-factory#564

And use that to fix all the API enablement race conditions. If you have a play and see that that does fix things, maybe that's the better approach.

[markmandel]

@bbhuston we can close this PR now, yeah?

[bbhuston]

Nope. That's not merged yet. 2023年3月6日(月) 15:27 Mark Mandel ***@***.***>:

…

@bbhuston <https://github.com/bbhuston> we can close this PR now, yeah? — Reply to this email directly, view it on GitHub <#103 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFYTD6OVT7XVOZGUQOUXT3TW2V7W7ANCNFSM6AAAAAAVPE7UWI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[markmandel]

That's right, that's right - you were going to work on this branch to get it all working. Got it, got it!

Thanks for the reminder.

[markmandel]

Should we close this PR for now, just to keep things clean, and file an issue on it to track the upcoming work?

This branch is just falling farther and farther behind at this point.

[bbhuston]

Should we close this PR for now, just to keep things clean, and file an issue on it to track the upcoming work?

This branch is just falling farther and farther behind at this point.

@markmandel

Apologies for the delay on this. Been slammed recently but now have bandwidth to push things over the finish line. Here's my plan to minimize clunky git history baggage as I do this.

• Close this PR
• Split new branch of main and cherry-pick from locally stashed commits there
• Update issue tracker to include additional need for standalone README on org policies, pre-req org IAM permissions etc from both Platform Admin and Platform User perspective. (i.e., something that a user can show to an admin to get Org settings configured correctly.)
• Update issue tracker to use the terraform gcp module that ensures orgpolicy APIs are fully active prior to provisioning other assets. etc
• Put all content (docs and TF assets) into separate standalone org-policy top-level directory.
• Structure terraform manifests to work as a completely independent (and optional) module

TL/DR would like to use this PR and issue to explicitly document/address the "how should your GCP organization be confirmed for this demo to work" question

[markmandel]

That sounds fantastic! And no worries on the delay - happens to all of us.

Shall I move the above comment into an issue for tracking? (happy to do it for you) or did you want to?

[bbhuston]

That sounds fantastic! And no worries on the delay - happens to all of us.

Shall I move the above comment into an issue for tracking? (happy to do it for you) or did you want to?

@markmandel Just wrote this up in #158