Skip to content

Commit 2896200

Browse files
barney-sbarney-s
authored
Merge pull request #257 from barney-s/eventarc
Examples: Add GCP Eventarc example
2 parents fb53f0d + e7c78b6 commit 2896200

File tree

7 files changed

+542
-3
lines changed

7 files changed

+542
-3
lines changed

‎examples/gcp/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,9 @@ gcloud services enable \
7878
gcloud iam service-accounts add-iam-policy-binding kcc-operator@${PROJECT_ID}.iam.gserviceaccount.com \
7979
--member="serviceAccount:${PROJECT_ID}.svc.id.goog[cnrm-system/cnrm-controller-manager]" \
8080
--role="roles/iam.workloadIdentityUser"
81+
gcloud projects add-iam-policy-binding ${PROJECT_ID}\
82+
--member="serviceAccount:kcc-operator@${PROJECT_ID}.iam.gserviceaccount.com" \
83+
--role="roles/storage.admin"
8184
```
8285
3. [Configure Config Connector](https://cloud.google.com/config-connector/docs/how-to/install-manually#addon-configuring)
8386
```

‎examples/gcp/eventarc/README.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# GCSBucketWithFinalizerTrigger
2+
3+
A **Platform Administrator** wants to give end users in their organization self-service access to creating GCS Buckets that triggers a Cloud Workflow when any object in it is finalized. The platform administrator creates a kro ResourceGraphDefinition called *gcsbucketwithfinalizertrigger.kro.run* that defines the required Kubernetes resources and a CRD called *GCSBucketWithFinalizertrigger* that exposes only the options they want to be configurable by end users.
4+
5+
The following KCC objects are created by this RGD:
6+
* IAMServiceAccount, IAMPolicyMember: Service Account with necessary permissions for Eventarc and Pub/Sub.
7+
* StorageBucket
8+
* PubSubTopic
9+
* EventArcTrigger
10+
* StorageNotification: To publish events from the GCS bucket to a Pub/Sub topic.
11+
12+
Pre-requisites:
13+
* Workflow: The workflow to be triggered on Finalizer event.
14+
15+
Everything related to these resources would be hidden from the end user, simplifying their experience.
16+
17+
![GCS EventArc Stack](gcsbucket-with-finalizer-trigger.png)
18+
19+
<!--
20+
meta {
21+
title "GCS Bucket Finalizer Event Processing"
22+
}
23+
24+
elements {
25+
gcp {
26+
card iam {
27+
name "EventArc, Workflow"
28+
}
29+
group storageA {
30+
name ""
31+
card gcs {
32+
name "bucket"
33+
}
34+
card pubsub {
35+
name "finalizer topic"
36+
}
37+
card eventarc {
38+
name "trigger"
39+
}
40+
card workflows {
41+
name "finalizer workflow"
42+
}
43+
}
44+
}
45+
}
46+
47+
paths {
48+
gcs \-\-> pubsub
49+
pubsub \-\-> eventarc
50+
eventarc \-\-> workflows
51+
}
52+
-->
53+
54+
55+
56+
## End User: GCSBucketWithFinalizerTrigger
57+
58+
The administrator needs to install the RGD first.
59+
The end user creates a `GCSBucketWithFinalizerTrigger` resource something like this:
60+
61+
```yaml
62+
apiVersion: kro.run/v1alpha1
63+
kind: GCSBucketWithFinalizerTrigger
64+
metadata:
65+
name: gcsevent-test
66+
namespace: config-connector
67+
spec:
68+
name: demo-gcs # used as name or prefix for KCC objects
69+
workflowName: gcs-finalizer-workflow # Replace with your workflow path
70+
location: us-central1 # desired location
71+
project: my-project-name # Replace with your project name
72+
```
73+
74+
They can then check the status of the applied resource:
75+
76+
```
77+
kubectl get gcsbucketwithfinalizertrigger -n config-connector
78+
kubectl get gcsbucketwithfinalizertrigger gcsevent-test -n config-connector -o yaml
79+
```
80+
81+
Navigate to GCS page in the GCP Console and verify the bucket creation. Also verify that the Triggers are setup correctly in the EventArc page.
82+
83+
Once done, the user can delete the `GCSBucketWithFinalizerTrigger` instance:
84+
85+
```
86+
kubectl delete gcsbucketwithfinalizertrigger gcsevent-test -n config-connector
87+
```
88+
89+
## Administrator: ResourceGraphDefinition
90+
The administrator needs to install the RGD in the cluster first before the user can consume it:
91+
92+
```
93+
kubectl apply -f rgd.yaml
94+
```
95+
96+
Validate the RGD is installed correctly:
97+
98+
```
99+
kubectl get rgd gcsbucketwithfinalizertrigger.kro.run
100+
```
101+
102+
Once all user created instances are deleted, the administrator can choose to deleted the RGD.

‎examples/gcp/eventarc/gcsbucket-with-finalizer-trigger.png‎

51.6 KB
Loading

‎examples/gcp/eventarc/rgd.yaml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
apiVersion: kro.run/v1alpha1
2+
kind: ResourceGraphDefinition
3+
metadata:
4+
name: gcsbucketwithfinalizertrigger.kro.run
5+
spec:
6+
schema:
7+
apiVersion: v1alpha1
8+
kind: GCSBucketWithFinalizerTrigger
9+
spec:
10+
name: string
11+
workflowName: string
12+
location: string
13+
project: string
14+
status:
15+
url: ${bucket.status.url}
16+
resources:
17+
- id: storageEnable
18+
template:
19+
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
20+
kind: Service
21+
metadata:
22+
annotations:
23+
cnrm.cloud.google.com/deletion-policy: "abandon"
24+
cnrm.cloud.google.com/disable-dependent-services: "false"
25+
name: storage-enablement
26+
spec:
27+
resourceID: storage.googleapis.com
28+
- id: iamEnable
29+
template:
30+
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
31+
kind: Service
32+
metadata:
33+
annotations:
34+
cnrm.cloud.google.com/deletion-policy: "abandon"
35+
cnrm.cloud.google.com/disable-dependent-services: "false"
36+
name: iam-enablement
37+
spec:
38+
resourceID: iam.googleapis.com
39+
- id: pubsubEnable
40+
template:
41+
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
42+
kind: Service
43+
metadata:
44+
annotations:
45+
cnrm.cloud.google.com/deletion-policy: "abandon"
46+
cnrm.cloud.google.com/disable-dependent-services: "false"
47+
name: pubsub-enablement
48+
spec:
49+
resourceID: pubsub.googleapis.com
50+
- id: eventarcEnable
51+
template:
52+
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
53+
kind: Service
54+
metadata:
55+
annotations:
56+
cnrm.cloud.google.com/deletion-policy: "abandon"
57+
cnrm.cloud.google.com/disable-dependent-services: "false"
58+
name: eventarc-enablement
59+
spec:
60+
resourceID: eventarc.googleapis.com
61+
- id: iamsa
62+
template:
63+
apiVersion: iam.cnrm.cloud.google.com/v1beta1
64+
kind: IAMServiceAccount
65+
metadata:
66+
labels:
67+
enabled-service: ${iamEnable.metadata.name}
68+
#annotations:
69+
# cnrm.cloud.google.com/project-id: ${schema.spec.project}
70+
name: ${schema.spec.name}
71+
spec:
72+
displayName: ${schema.spec.name}-eventarc-workflow
73+
- id: iampmEventarc
74+
template:
75+
apiVersion: iam.cnrm.cloud.google.com/v1beta1
76+
kind: IAMPolicyMember
77+
metadata:
78+
labels:
79+
enabled-service: ${iamEnable.metadata.name}
80+
name: ${schema.spec.name}-eventarc
81+
spec:
82+
memberFrom:
83+
serviceAccountRef:
84+
name: ${iamsa.metadata.name}
85+
role: roles/eventarc.admin
86+
resourceRef:
87+
kind: Project
88+
external: ${schema.spec.project}
89+
- id: iampmWorkflow
90+
template:
91+
apiVersion: iam.cnrm.cloud.google.com/v1beta1
92+
kind: IAMPolicyMember
93+
metadata:
94+
labels:
95+
enabled-service: ${iamEnable.metadata.name}
96+
name: ${schema.spec.name}-workflow
97+
spec:
98+
memberFrom:
99+
serviceAccountRef:
100+
name: ${iamsa.metadata.name}
101+
role: roles/workflows.admin
102+
resourceRef:
103+
kind: Project
104+
external: ${schema.spec.project}
105+
- id: topic
106+
template:
107+
apiVersion: pubsub.cnrm.cloud.google.com/v1beta1
108+
kind: PubSubTopic
109+
metadata:
110+
labels:
111+
enabled-service: ${pubsubEnable.metadata.name}
112+
name: ${schema.spec.name}-gcs-finalizer-topic
113+
- id: bucket
114+
template:
115+
apiVersion: storage.cnrm.cloud.google.com/v1beta1
116+
kind: StorageBucket
117+
metadata:
118+
labels:
119+
enabled-service: ${storageEnable.metadata.name}
120+
name: ${schema.spec.name}-${schema.spec.project}
121+
spec:
122+
uniformBucketLevelAccess: true
123+
- id: eventTrigger
124+
template:
125+
apiVersion: eventarc.cnrm.cloud.google.com/v1beta1
126+
kind: EventarcTrigger
127+
metadata:
128+
labels:
129+
enabled-service: ${eventarcEnable.metadata.name}
130+
name: ${schema.spec.name}-gcsfinalizer
131+
spec:
132+
destination:
133+
workflowRef:
134+
external: "projects/${schema.spec.project}/locations/${schema.spec.location}/workflows/${schema.spec.workflowName}"
135+
location: ${schema.spec.location}
136+
serviceAccountRef:
137+
name: ${iamsa.metadata.name}
138+
transport:
139+
pubsub:
140+
topicRef:
141+
name: ${topic.metadata.name}
142+
namespace: config-connector
143+
matchingCriteria:
144+
- attribute: "type"
145+
value: "google.cloud.pubsub.topic.v1.messagePublished"
146+
projectRef:
147+
external: "projects/${schema.spec.project}"
148+
- id: storageNotification
149+
template:
150+
apiVersion: storage.cnrm.cloud.google.com/v1beta1
151+
kind: StorageNotification
152+
metadata:
153+
name: ${schema.spec.name}-gcs
154+
spec:
155+
bucketRef:
156+
name: ${bucket.metadata.name}
157+
topicRef:
158+
name: ${topic.metadata.name}
159+
eventTypes:
160+
- "OBJECT_FINALIZE"
161+
payloadFormat: JSON_API_V1

0 commit comments

Comments
 (0)