refactor factories config variable in net a

fast/stages/2-networking-a-simple/README.md

@@ -509,7 +509,7 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS
 | [custom_roles](variables-fast.tf#L40) | Custom roles defined at the org level, in key => id format. | <code title="object&#40;&#123;&#10;  project_iam_viewer &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> | <code>0-bootstrap</code> |
 | [dns](variables.tf#L48) | DNS configuration. | <code title="object&#40;&#123;&#10;  resolvers &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [essential_contacts](variables.tf#L57) | Email used for essential contacts, unset if null. | <code>string</code> |  | <code>null</code> |  |
-| [factories_config](variables.tf#L63) | Configuration for network resource factories. | <code title="object&#40;&#123;&#10;  data_dir              &#61; optional&#40;string, &#34;data&#34;&#41;&#10;  dns_policy_rules_file &#61; optional&#40;string, &#34;data&#47;dns-policy-rules.yaml&#34;&#41;&#10;  firewall_policy_name  &#61; optional&#40;string, &#34;net-default&#34;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  data_dir &#61; &#34;data&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |  |
+| [factories_config](variables.tf#L63) | Configuration for network resource factories. | <code title="object&#40;&#123;&#10;  dashboards       &#61; optional&#40;string, &#34;data&#47;dashboards&#34;&#41;&#10;  dns_policy_rules &#61; optional&#40;string, &#34;data&#47;dns-policy-rules.yaml&#34;&#41;&#10;  firewall &#61; optional&#40;object&#40;&#123;&#10;    cidr_file     &#61; optional&#40;string, &#34;data&#47;cidrs.yaml&#34;&#41;&#10;    classic_rules &#61; optional&#40;string, &#34;data&#47;firewall-rules&#34;&#41;&#10;    hierarchical &#61; optional&#40;object&#40;&#123;&#10;      egress_rules  &#61; optional&#40;string, &#34;data&#47;hierarchical-egress-rules.yaml&#34;&#41;&#10;      ingress_rules &#61; optional&#40;string, &#34;data&#47;hierarchical-ingress-rules.yaml&#34;&#41;&#10;      policy_name   &#61; optional&#40;string, &#34;net-default&#34;&#41;&#10;    &#125;&#41;, &#123;&#125;&#41;&#10;    policy_rules &#61; optional&#40;string, &#34;data&#47;firewall-policies&#34;&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  subnets &#61; optional&#40;string, &#34;data&#47;subnets&#34;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [outputs_location](variables.tf#L84) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | <code>string</code> |  | <code>null</code> |  |
 | [psa_ranges](variables.tf#L90) | IP ranges used for Private Service Access (CloudSQL, etc.). | <code title="object&#40;&#123;&#10;  dev &#61; optional&#40;list&#40;object&#40;&#123;&#10;    ranges         &#61; map&#40;string&#41;&#10;    export_routes  &#61; optional&#40;bool, false&#41;&#10;    import_routes  &#61; optional&#40;bool, false&#41;&#10;    peered_domains &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;  prod &#61; optional&#40;list&#40;object&#40;&#123;&#10;    ranges         &#61; map&#40;string&#41;&#10;    export_routes  &#61; optional&#40;bool, false&#41;&#10;    import_routes  &#61; optional&#40;bool, false&#41;&#10;    peered_domains &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |  |
 | [regions](variables.tf#L110) | Region definitions. | <code title="object&#40;&#123;&#10;  primary   &#61; string&#10;  secondary &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  primary   &#61; &#34;europe-west1&#34;&#10;  secondary &#61; &#34;europe-west4&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |  |

fast/stages/2-networking-a-simple/dns-landing.tf

@@ -68,7 +68,7 @@ module "landing-dns-policy-googleapis" {
   project_id = module.landing-project.project_id
   name       = "googleapis"
   factories_config = {
-    rules = var.factories_config.dns_policy_rules_file
+    rules = var.factories_config.dns_policy_rules
   }
   networks = {
     landing = module.landing-vpc.self_link

fast/stages/2-networking-a-simple/main.tf

@@ -67,11 +67,11 @@ module "folder" {
 
 module "firewall-policy-default" {
   source    = "../../../modules/net-firewall-policy"
-  name      = var.factories_config.firewall_policy_name
+  name      = var.factories_config.firewall.hierarchical.policy_name
   parent_id = module.folder.id
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/hierarchical-ingress-rules.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    ingress_rules_file_path = var.factories_config.firewall.hierarchical.ingress_rules
   }
 }
 

fast/stages/2-networking-a-simple/monitoring.tf

@@ -17,11 +17,10 @@
 # tfdoc:file:description Network monitoring dashboards.
 
 locals {
-  dashboard_path  = "${var.factories_config.data_dir}/dashboards"
-  dashboard_files = fileset(local.dashboard_path, "*.json")
+  dashboard_files = fileset(var.factories_config.dashboards, "*.json")
   dashboards = {
     for filename in local.dashboard_files :
-    filename => "${local.dashboard_path}/${filename}"
+    filename => "${var.factories_config.dashboards}/${filename}"
   }
 }
 

fast/stages/2-networking-a-simple/net-dev.tf

@@ -94,7 +94,7 @@ module "dev-spoke-vpc" {
   }
   factories_config = {
     context        = { regions = var.regions }
-    subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
+    subnets_folder = "${var.factories_config.subnets}/dev"
   }
   firewall_policy_enforcement_order = local.dev_cfg.fw_order
   psa_configs                       = var.psa_ranges.dev
@@ -122,8 +122,8 @@ module "dev-spoke-firewall" {
     disabled = true
   }
   factories_config = {
-    cidr_tpl_file = "${var.factories_config.data_dir}/cidrs.yaml"
-    rules_folder  = "${var.factories_config.data_dir}/firewall-rules/dev"
+    cidr_tpl_file = var.factories_config.firewall.cidr_file
+    rules_folder  = "${var.factories_config.firewall.classic_rules}/dev"
   }
 }
 
@@ -138,9 +138,9 @@ module "dev-firewall-policy" {
   }
   # TODO: add context for security groups
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    egress_rules_file_path  = "${var.factories_config.data_dir}/firewall-policies/dev/egress.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/firewall-policies/dev/ingress.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/dev/egress.yaml"
+    ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/dev/ingress.yaml"
   }
 }
 

fast/stages/2-networking-a-simple/net-landing.tf

@@ -78,7 +78,7 @@ module "landing-vpc" {
   }
   factories_config = {
     context        = { regions = var.regions }
-    subnets_folder = "${var.factories_config.data_dir}/subnets/landing"
+    subnets_folder = "${var.factories_config.subnets}/landing"
   }
   firewall_policy_enforcement_order = local.landing_cfg.fw_order
   routes = {
@@ -100,8 +100,8 @@ module "landing-firewall" {
     disabled = true
   }
   factories_config = {
-    cidr_tpl_file = "${var.factories_config.data_dir}/cidrs.yaml"
-    rules_folder  = "${var.factories_config.data_dir}/firewall-rules/landing"
+    cidr_tpl_file = var.factories_config.firewall.cidr_file
+    rules_folder  = "${var.factories_config.firewall.classic_rules}/landing"
   }
 }
 
@@ -116,9 +116,9 @@ module "landing-firewall-policy" {
   }
   # TODO: add context for security groups
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    egress_rules_file_path  = "${var.factories_config.data_dir}/firewall-policies/landing/egress.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/firewall-policies/landing/ingress.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/landing/egress.yaml"
+    ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/landing/ingress.yaml"
   }
 }
 

fast/stages/2-networking-a-simple/net-prod.tf

@@ -94,7 +94,7 @@ module "prod-spoke-vpc" {
   }
   factories_config = {
     context        = { regions = var.regions }
-    subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
+    subnets_folder = "${var.factories_config.subnets}/prod"
   }
   firewall_policy_enforcement_order = local.prod_cfg.fw_order
   psa_configs                       = var.psa_ranges.prod
@@ -117,8 +117,8 @@ module "prod-spoke-firewall" {
     disabled = true
   }
   factories_config = {
-    cidr_tpl_file = "${var.factories_config.data_dir}/cidrs.yaml"
-    rules_folder  = "${var.factories_config.data_dir}/firewall-rules/prod"
+    cidr_tpl_file = var.factories_config.firewall.cidr_file
+    rules_folder  = "${var.factories_config.firewall.classic_rules}/prod"
   }
 }
 
@@ -133,9 +133,9 @@ module "prod-firewall-policy" {
   }
   # TODO: add context for security groups
   factories_config = {
-    cidr_file_path          = "${var.factories_config.data_dir}/cidrs.yaml"
-    egress_rules_file_path  = "${var.factories_config.data_dir}/firewall-policies/prod/egress.yaml"
-    ingress_rules_file_path = "${var.factories_config.data_dir}/firewall-policies/prod/ingress.yaml"
+    cidr_file_path          = var.factories_config.firewall.cidr_file
+    egress_rules_file_path  = "${var.factories_config.firewall.policy_rules}/prod/egress.yaml"
+    ingress_rules_file_path = "${var.factories_config.firewall.policy_rules}/prod/ingress.yaml"
   }
 }
 

fast/stages/2-networking-a-simple/variables.tf

@@ -63,22 +63,22 @@ variable "essential_contacts" {
 variable "factories_config" {
   description = "Configuration for network resource factories."
   type = object({
-    data_dir              = optional(string, "data")
-    dns_policy_rules_file = optional(string, "data/dns-policy-rules.yaml")
-    firewall_policy_name  = optional(string, "net-default")
+    dashboards       = optional(string, "data/dashboards")
+    dns_policy_rules = optional(string, "data/dns-policy-rules.yaml")
+    firewall = optional(object({
+      cidr_file     = optional(string, "data/cidrs.yaml")
+      classic_rules = optional(string, "data/firewall-rules")
+      hierarchical = optional(object({
+        egress_rules  = optional(string, "data/hierarchical-egress-rules.yaml")
+        ingress_rules = optional(string, "data/hierarchical-ingress-rules.yaml")
+        policy_name   = optional(string, "net-default")
+      }), {})
+      policy_rules = optional(string, "data/firewall-policies")
+    }), {})
+    subnets = optional(string, "data/subnets")
   })
-  default = {
-    data_dir = "data"
-  }
+  default  = {}
   nullable = false
-  validation {
-    condition     = var.factories_config.data_dir != null
-    error_message = "Data folder needs to be non-null."
-  }
-  validation {
-    condition     = var.factories_config.firewall_policy_name != null
-    error_message = "Firewall policy name needs to be non-null."
-  }
 }
 
 variable "outputs_location" {