decomposer: generate deliverable files for Discover and structure the solution's functional requirements, non-functional requirements, constraints, assumptions, and open questions without selecting cloud products.; Select Google Cloud products from the confirmed requirements and produce the solution architecture, Mermaid diagram, architecture description, and Terraform infrastructure-as-code.; Validate the Terraform infrastructure and architecture artifacts without deploying resources by running formatting checks, Terraform validation, and a dry-run or plan-oriented deployment check.; Package the approved requirements, architecture, Mermaid diagram, Terraform IaC, and validation results into solution-architecture-guide.md in the gcp_solution_architecture_agent repository.; Verify that the gcp_solution_architecture_agent repository contains the packaged solution-architecture-guide.md with the approved workflow outputs.; Verify that the repository is derived from the workflow_agent template and implements the complete four-phase Google Cloud solution architecture workflow alongside the packaged guide.; Publish the verified gcp_solution_architecture_agent repository with its completed workflow implementation and solution architecture guide.; Verify that the published repository revision contains the completed workflow implementation and solution architecture guide.
This commit is contained in:
@@ -1,5 +1,5 @@
|
||||
terraform {
|
||||
required_version = ">= 1.6.0, < 2.0.0"
|
||||
required_version = ">= 1.6.0"
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
@@ -13,83 +13,115 @@ provider "google" {
|
||||
region = var.region
|
||||
}
|
||||
|
||||
resource "google_project_service" "services" {
|
||||
resource "google_project_service" "required" {
|
||||
for_each = toset([
|
||||
"artifactregistry.googleapis.com",
|
||||
"logging.googleapis.com",
|
||||
"monitoring.googleapis.com",
|
||||
"pubsub.googleapis.com",
|
||||
"run.googleapis.com",
|
||||
"storage.googleapis.com",
|
||||
"pubsub.googleapis.com",
|
||||
"sqladmin.googleapis.com",
|
||||
"secretmanager.googleapis.com",
|
||||
"artifactregistry.googleapis.com",
|
||||
"vpcaccess.googleapis.com",
|
||||
])
|
||||
project = var.project_id
|
||||
service = each.value
|
||||
disable_on_destroy = false
|
||||
}
|
||||
|
||||
resource "google_compute_network" "app" {
|
||||
name = "${var.name}-network"
|
||||
auto_create_subnetworks = false
|
||||
}
|
||||
|
||||
resource "google_vpc_access_connector" "app" {
|
||||
name = "${var.name}-vpc"
|
||||
region = var.region
|
||||
network = google_compute_network.app.name
|
||||
ip_cidr_range = var.connector_cidr
|
||||
depends_on = [google_project_service.required]
|
||||
}
|
||||
|
||||
resource "google_sql_database_instance" "orders" {
|
||||
name = "${var.name}-postgres"
|
||||
database_version = "POSTGRES_15"
|
||||
region = var.region
|
||||
settings {
|
||||
tier = var.sql_tier
|
||||
availability_type = "ZONAL"
|
||||
ip_configuration { ipv4_enabled = false }
|
||||
backup_configuration { enabled = true }
|
||||
}
|
||||
deletion_protection = false
|
||||
depends_on = [google_project_service.required]
|
||||
}
|
||||
|
||||
resource "google_sql_database" "orders" {
|
||||
name = "orders"
|
||||
instance = google_sql_database_instance.orders.name
|
||||
}
|
||||
|
||||
resource "google_sql_user" "orders" {
|
||||
name = var.db_user
|
||||
instance = google_sql_database_instance.orders.name
|
||||
password = var.db_password
|
||||
}
|
||||
|
||||
resource "google_pubsub_topic" "orders" {
|
||||
name = "${var.name}-orders"
|
||||
}
|
||||
|
||||
resource "google_pubsub_topic" "dead_letter" {
|
||||
name = "${var.name}-orders-dead-letter"
|
||||
}
|
||||
|
||||
resource "google_pubsub_subscription" "worker" {
|
||||
name = "${var.name}-worker"
|
||||
topic = google_pubsub_topic.orders.name
|
||||
dead_letter_policy { dead_letter_topic = google_pubsub_topic.dead_letter.id max_delivery_attempts = 5 }
|
||||
ack_deadline_seconds = 60
|
||||
}
|
||||
|
||||
resource "google_service_account" "runtime" {
|
||||
account_id = "event-runtime"
|
||||
display_name = "Event runtime identity"
|
||||
depends_on = [google_project_service.services]
|
||||
account_id = "${var.name}-runtime"
|
||||
display_name = "Order service runtime identity"
|
||||
}
|
||||
|
||||
resource "google_storage_bucket" "raw_events" {
|
||||
name = "${var.project_id}-${var.environment}-raw-events"
|
||||
location = var.region
|
||||
storage_class = "STANDARD"
|
||||
uniform_bucket_level_access = true
|
||||
force_destroy = false
|
||||
retention_policy { retention_period = var.retention_seconds }
|
||||
lifecycle_rule {
|
||||
condition { age = var.retention_days }
|
||||
action { type = "Delete" }
|
||||
}
|
||||
versioning { enabled = true }
|
||||
depends_on = [google_project_service.services]
|
||||
resource "google_project_iam_member" "publisher" {
|
||||
project = var.project_id
|
||||
role = "roles/pubsub.publisher"
|
||||
member = "serviceAccount:${google_service_account.runtime.email}"
|
||||
}
|
||||
|
||||
resource "google_pubsub_topic" "events" {
|
||||
name = "${var.environment}-events"
|
||||
depends_on = [google_project_service.services]
|
||||
resource "google_secret_manager_secret" "db_password" {
|
||||
secret_id = "${var.name}-db-password"
|
||||
replication { auto {} }
|
||||
}
|
||||
|
||||
resource "google_pubsub_subscription" "events" {
|
||||
name = "${var.environment}-event-worker"
|
||||
topic = google_pubsub_topic.events.id
|
||||
ack_deadline_seconds = 60
|
||||
message_retention_duration = "604800s"
|
||||
retry_policy {
|
||||
minimum_backoff = "10s"
|
||||
maximum_backoff = "600s"
|
||||
}
|
||||
resource "google_secret_manager_secret_version" "db_password" {
|
||||
secret = google_secret_manager_secret.db_password.id
|
||||
secret_data = var.db_password
|
||||
}
|
||||
|
||||
resource "google_artifact_registry_repository" "containers" {
|
||||
location = var.region
|
||||
repository_id = "${var.environment}-containers"
|
||||
format = "DOCKER"
|
||||
depends_on = [google_project_service.services]
|
||||
}
|
||||
|
||||
resource "google_cloud_run_v2_service" "ingress" {
|
||||
name = "${var.environment}-event-ingress"
|
||||
resource "google_cloud_run_v2_service" "api" {
|
||||
name = "${var.name}-api"
|
||||
location = var.region
|
||||
ingress = "INGRESS_TRAFFIC_ALL"
|
||||
template {
|
||||
service_account = google_service_account.runtime.email
|
||||
scaling { max_instance_count = var.max_instances }
|
||||
containers {
|
||||
image = var.container_image
|
||||
env { name = "EVENT_TOPIC" value = google_pubsub_topic.events.id }
|
||||
env { name = "RAW_BUCKET" value = google_storage_bucket.raw_events.name }
|
||||
}
|
||||
scaling { max_instance_count = var.api_max_instances }
|
||||
vpc_access { connector = google_vpc_access_connector.app.id egress = "PRIVATE_RANGES_ONLY" }
|
||||
containers { image = var.api_image env { name = "ORDERS_TOPIC" value = google_pubsub_topic.orders.id } }
|
||||
}
|
||||
depends_on = [google_project_service.services]
|
||||
depends_on = [google_project_service.required]
|
||||
}
|
||||
|
||||
resource "google_cloud_run_v2_service_iam_member" "ingress_invoker" {
|
||||
name = google_cloud_run_v2_service.ingress.name
|
||||
location = google_cloud_run_v2_service.ingress.location
|
||||
role = "roles/run.invoker"
|
||||
member = "serviceAccount:${var.invoker_service_account}"
|
||||
resource "google_cloud_run_v2_service" "worker" {
|
||||
name = "${var.name}-worker"
|
||||
location = var.region
|
||||
template {
|
||||
service_account = google_service_account.runtime.email
|
||||
scaling { max_instance_count = var.worker_max_instances }
|
||||
vpc_access { connector = google_vpc_access_connector.app.id egress = "PRIVATE_RANGES_ONLY" }
|
||||
containers { image = var.worker_image }
|
||||
}
|
||||
depends_on = [google_project_service.required]
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user