Package: idem-gcp
GCP Cloud Provider for Idem.Aboutidem-gcphelps manage GCP withidem.idem-gcp source codeidem-gcp documentationWhat is POP?This project is built withpop, a Python-based
implementation ofPlugin Oriented Programming (POP). POP seeks to bring
together concepts and wisdom from the history of computing in new ways to solve
modern computing problems.For more information:Intro to Plugin Oriented Programming (POP)pop-awesomepop-createWhat is Idem?This project is built withidem, an idempotent,
imperatively executed, declarative programming language written in Python. This project extends
idem!For more information:Idem Project WebsiteIdem Project docs portalGetting StartedPrerequisitesPython 3.8+git(if installing from source, or contributing to the project)IdemNoteIt is recommended that you install Idem using Poetry. Poetry is a tool for virtual environment and dependency management. See theIdem Getting Started guidefor more information.InstallationInstall from PyPIYou can installidem-gcpfrom PyPI, a source repository, or a local directory.Before you installidem-gcp, ensure that you are in the same directory as yourpyproject.tomlfile. Optionally, you can specify the directory containing yourpyproject.tomlfile by using the--directory=DIRECTORY(-C)option.Install from PyPITo installidem-gcpfrom PyPI, run the following command:poetryaddidem-gcpInstall from sourceYou can also installidem-gcpdirectly from the source repository:poetryaddgit+https://gitlab.com/vmware/idem/idem-gcp.gitIf you don’t specify a branch, Poetry uses the latest commit on themasterbranch.Install from a local directoryClone theidem-gcprepository. Then run the following command to install from the cloned directory:poetryadd~/path/to/idem-gcpSetupAfter installation GCP Idem Provider execution and state modules will be accessible to the pophub.
In order to use them we need to set up our credentials.Create a new file calledcredentials.yamland populate it with your credential profiles.To provide your GCP credentials in the file, use the “gcp” provider key.
Under that key, add different profiles as needed.
A profile specifies authentication parameters for GCP.
Thedefaultprofile will be automatically used byidem,
but the other ones could be explicitly specified for each run or SLS file.
This is done through the–acct-profileidemcli flag or theacct_profileSLS property.There is currently one GCP authentication mechanism supported by idem-gcp -
providing service account keys.
The following example gives the overall structure of the authentication
parameters’ expected format.credentials.yamlgcp:default:type:service_accountproject_id:“<project>”private_key_id:“<key_id>”private_key:"-----BEGINPRIVATEKEY-----\n<private_key>\n-----ENDPRIVATEKEY-----\n"client_email:“<service_account_email>“client_id:“<client_id>”auth_uri:https://accounts.google.com/o/oauth2/authtoken_uri:https://oauth2.googleapis.com/tokenauth_provider_x509_cert_url:https://www.googleapis.com/oauth2/v1/certsclient_x509_cert_url:“<certificate_url>“universe_domain:googleapis.com<other_profile_name>:...The values of these parameters can be obtained through the GCP console after creating a service account and generating a service account key in JSON format.
Be sure to assign appropriate roles for the service account, such that it has the rights to access and manage the needed resources.
For a better security posture, follow the principal of least privilege and do not use service accounts with excessive rights.
For more information on the authentication parameters used, refer to theCredentialsdocs.Encrypt the created credentials file:acctencryptcredentials.yamlThe output of this command is the ACCT_KEY which needs to be securely stored.
Acredentials.yaml.fernetencrypted file is also created in the working directory, whose path should be used as ACCT_FILE.
These could be given to idem either through environment variables or directly asidemrun parameters.Setting environment variablesexportACCT_KEY="<ACCT_KEY>"exportACCT_FILE=$PWD/credentials.yaml.fernetProviding acct parameters to the idem runidem<subcommand>--acct-key"<ACCT_KEY>"--acct-file"$PWD/credentials.yaml.fernet"--acct-profile"<profile_name>"Specifying account profile in SLS filesensure_resource:gcp.<service>.<resource>.present:-acct_profile:<profile_name>-name:resource_name-kwarg1:val1For more information on the Idem ACCT authentication management subsystem, refer to the following resources:Account credentials file docMultiple Account ManagementACCT advanced features