damondouglas commented on a change in pull request #16549: URL: https://github.com/apache/beam/pull/16549#discussion_r792041617
########## File path: playground/terraform/modules/memorystore/main.tf ########## @@ -0,0 +1,43 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + + +data "terraform_remote_state" "remote_state_vpc" { + backend = "gcs" + config = { + bucket = "${var.beam_playground_terraform}" + } +} + + +resource "google_redis_instance" "cache" { + provider = google-beta Review comment: Why is the provider `google-beta`? ########## File path: playground/terraform/modules/account.tf ########## @@ -0,0 +1,50 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +# need enable api +# https://console.developers.google.com/apis/api/iam.googleapis.com/overview?project=750903720791 +resource "google_service_account" "account" { + project = "${var.project_id}" + account_id = "${var.service_account}" + display_name = "${var.service_account}" +} + + +output "playground_service_account_id" { + value = "${google_service_account.account.account_id}" +} + + +resource "google_project_iam_binding" "account_iam_binding" { + for_each = toset([ + "roles/dataflow.admin", Review comment: Is `roles/dataflow.admin` the minimal necessary to achieve the job function of the service account? ########## File path: .github/workflows/build_playground_backend.yml ########## @@ -69,7 +69,7 @@ jobs: if: startsWith(github.ref, 'ref/tags/') - name: Preapre Build Python run: ./gradlew playground:backend:containers:python:dockerPush -Pdocker-repository-root='${{ secrets.REGISTRY_NAME}}/${{ secrets.PROJECT_ID }}/playground-repository' -Pbase-image='apache/beam_java8_sdk:${{ env.BEAM_VERSION }}' - - name: Preapre Build Go + - name: Preapre Build Go Review comment: Can we correct the spelling here to `Prepare`? ########## File path: playground/terraform/modules/account.tf ########## @@ -0,0 +1,50 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +# need enable api +# https://console.developers.google.com/apis/api/iam.googleapis.com/overview?project=750903720791 Review comment: Two comments: 1) Could we not hardcode specific Google Cloud artifact references such as projects in comments or the code? 2) Could we consider instead using the `google_project_service` block? If so, one would need to unfortunately provide a `depends_on` meta-argument to resources depending on the `google_project_service`. Alternatively, the API enablement could be added in the README as one of the pre-requisites documented prior to running the terraform workflow solution. ########## File path: playground/terraform/modules/memorystore/main.tf ########## @@ -0,0 +1,43 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + + +data "terraform_remote_state" "remote_state_vpc" { + backend = "gcs" + config = { + bucket = "${var.beam_playground_terraform}" + } +} + + +resource "google_redis_instance" "cache" { + provider = google-beta + project = "${var.project_id}" +# region = "${data.terraform_remote_state.remote_state_vpc.outputs.subnet_region}" + region = "us-central1" + name = "playground-backend-cache" + tier = "BASIC" Review comment: Since `BASIC` is default is this necessary? More importantly, shouldn't we use `STANDARD_HA`? ########## File path: playground/terraform/modules/memorystore/main.tf ########## @@ -0,0 +1,43 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + + +data "terraform_remote_state" "remote_state_vpc" { + backend = "gcs" + config = { + bucket = "${var.beam_playground_terraform}" + } +} + + +resource "google_redis_instance" "cache" { + provider = google-beta + project = "${var.project_id}" +# region = "${data.terraform_remote_state.remote_state_vpc.outputs.subnet_region}" + region = "us-central1" + name = "playground-backend-cache" + tier = "BASIC" + memory_size_gb = 16 Review comment: Can `memory_size_gb` be provided using a variable and that variable default to `16`? Why was `16` chosen specifically? ########## File path: playground/terraform/modules/memorystore/main.tf ########## @@ -0,0 +1,43 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + + +data "terraform_remote_state" "remote_state_vpc" { + backend = "gcs" + config = { + bucket = "${var.beam_playground_terraform}" + } +} + + +resource "google_redis_instance" "cache" { + provider = google-beta + project = "${var.project_id}" +# region = "${data.terraform_remote_state.remote_state_vpc.outputs.subnet_region}" + region = "us-central1" + name = "playground-backend-cache" + tier = "BASIC" + memory_size_gb = 16 + +# authorized_network = "${data.terraform_remote_state.remote_state_vpc.outputs.vpc_id}" Review comment: Why are we no longer using a custom virtual private network? ########## File path: playground/terraform/modules/memorystore/main.tf ########## @@ -0,0 +1,43 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + + +data "terraform_remote_state" "remote_state_vpc" { + backend = "gcs" + config = { + bucket = "${var.beam_playground_terraform}" + } +} + + +resource "google_redis_instance" "cache" { Review comment: Could we provide a comment describing the purpose caching is achieving for the Playground application? ########## File path: playground/terraform/modules/account.tf ########## @@ -0,0 +1,50 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +# need enable api +# https://console.developers.google.com/apis/api/iam.googleapis.com/overview?project=750903720791 +resource "google_service_account" "account" { + project = "${var.project_id}" + account_id = "${var.service_account}" + display_name = "${var.service_account}" +} + + +output "playground_service_account_id" { + value = "${google_service_account.account.account_id}" +} + + +resource "google_project_iam_binding" "account_iam_binding" { + for_each = toset([ + "roles/dataflow.admin", + "roles/compute.storageAdmin", + "roles/iam.serviceAccountTokenCreator" Review comment: What other service account is `google_service_account.account` impersonating? Shouldn't we bind this directly to the service account to which we want `google_service_account.account` to impersonate? ########## File path: playground/terraform/modules/account.tf ########## @@ -0,0 +1,50 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +# need enable api +# https://console.developers.google.com/apis/api/iam.googleapis.com/overview?project=750903720791 +resource "google_service_account" "account" { + project = "${var.project_id}" + account_id = "${var.service_account}" + display_name = "${var.service_account}" +} + + +output "playground_service_account_id" { + value = "${google_service_account.account.account_id}" +} + + +resource "google_project_iam_binding" "account_iam_binding" { + for_each = toset([ + "roles/dataflow.admin", + "roles/compute.storageAdmin", Review comment: Is `roles/compute.storageAdmin` the minimal necessary to achieve the job function of the service account? ########## File path: playground/terraform/modules/account.tf ########## @@ -0,0 +1,50 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +# need enable api +# https://console.developers.google.com/apis/api/iam.googleapis.com/overview?project=750903720791 +resource "google_service_account" "account" { Review comment: Please provide a `description` to communicate the intent of the service account. ########## File path: playground/terraform/modules/memorystore/main.tf ########## @@ -0,0 +1,43 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + + +data "terraform_remote_state" "remote_state_vpc" { + backend = "gcs" + config = { + bucket = "${var.beam_playground_terraform}" + } +} + + +resource "google_redis_instance" "cache" { + provider = google-beta + project = "${var.project_id}" +# region = "${data.terraform_remote_state.remote_state_vpc.outputs.subnet_region}" + region = "us-central1" Review comment: Can `region` be provided using a variable and that variable default to `us-central1`? ########## File path: playground/terraform/modules/memorystore/main.tf ########## @@ -0,0 +1,43 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + + +data "terraform_remote_state" "remote_state_vpc" { + backend = "gcs" + config = { + bucket = "${var.beam_playground_terraform}" + } +} + + +resource "google_redis_instance" "cache" { + provider = google-beta + project = "${var.project_id}" +# region = "${data.terraform_remote_state.remote_state_vpc.outputs.subnet_region}" Review comment: Instead of commenting out, should this be deleted? ########## File path: playground/terraform/modules/memorystore/variables.tf ########## @@ -0,0 +1,31 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +variable "project_id" { + description = "The GCP Project ID where Playground Applications will be created" +} + +variable "redis_version" { + description = "The GCP Project ID where Playground Applications will be created" + default = "REDIS_6_X" +} + +variable "beam_playground_terraform" { Review comment: Should this just be a `local` instead? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
