project_onboarding — version 1.1

Source: presets/project-onboarding.satz

Purpose

The projects on the estate, one entry of projects each. Per entry a Google project with its own IaC service account and state bucket, and the interface that publishes them to the project.

A project is an estate beside this one, in its own repository, that reads this estate through interfaces/<name>/. Onboarding one is an entry in projects, { name = "payments" owner_group = "payments-owners@example.com" } — bound in the estate, or requested by the project as contributes_projects in a small pack of its own, checked with satz check-request and vendored into the estate by pull request. The entry's name is the interface's name and a folder name: lowercase letters, digits and -, starting with a letter. Its owner_group is the group's address, <name>@<domain>. The request point's patterns refuse either at compile, naming the entry and the value.

PER ENTRY. The Google project {customer_shortname}-<name>-001, billed to the infrastructure billing account, with the five APIs a project's estate needs to run. Its IaC service account svc-iac-<name>, which holds the project's IAM and its services and the state bucket {customer_shortname}-<name>-001-state — what the project's own estate grants itself the rest from (satz update-prerequisites there). The owner group reads the project and may become its IaC service account, that account only. interface "<name>" publishes project_id (an attach point for google_project_iam_member), project_number, iac_account and state_bucket; satz init --project <name> --interface interfaces/<name>/<name>/satz/interface.satz writes the project's estate from them and the core export default_region.

WHERE THE PROJECTS GO. project_onboarding_folder names the parent: empty is the organisation; the workload folder satz init --workload-folder-name writes is google_folder.workload_folder.name.

MORE IN AN INTERFACE. An interface declared in two files is one interface, so the estate adds to a project's interface by writing a block of the same name in its own file: interface "payments" { use interface "network" }.

NO CLAIM. The projects are workloads, not controls: this pack witnesses nothing.

Use it

params {
  use_project_onboarding = true

  // the pack's own defaults — copy only the lines you change
  projects = []
  project_onboarding_folder = ""
}

use "presets/project-onboarding.satz" when use_project_onboarding

use_project_onboarding is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by estate_map, and the estate's own binding wins.

Needs from outside the pack:

• billing_account_infra — declared by estate_core; use one of them alongside, or declare it in the estate.
• customer_shortname — declared by estate_core; use one of them alongside, or declare it in the estate.
• default_region — declared by estate_core; use one of them alongside, or declare it in the estate.

Params

Questions

What to ask before this pack is configured, and what changing the answer costs.

project_onboarding_folder — It decides the policies and the grants every project inherits. Changing it afterwards moves every live project between parents.

Contributes

Exports

Outputs of the root module and values of the interfaces under interfaces/ in every estate that uses this pack: a core export is carried by every interface, another one by its own interface and every interface that uses it. An interface a pack declares is common: every project's folder carries it.

{each.name} is written once per entry of projects, named by the entry's name, and each is one project's own interface, not a common one.

Requests

What a project may add to this pack's lists, through contributes_<param> in a file the estate uses after a reviewed pull request; satz check-request checks such a file.

Claims

None — this pack proves no control by itself.

History

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

No notes yet.