feat: Add an importing plan README #1
Conversation
modules/autokey/main.tf
Outdated
| @@ -39,7 +39,7 @@ resource "google_kms_key_handle" "primary" { | |||
| provider = google-beta | |||
|
|
|||
| project = each.value.project | |||
| name = "${each.value.name}-${random_string.suffix[0].result}" | |||
| name = each.value.name | |||
There was a problem hiding this comment.
We don't actually need to append the random here. I'm removing in order to turn the import process feasible.
There was a problem hiding this comment.
Does apply -> destroy -> apply works for your module if you drop the randomness? I thought we would run into existing resource conflicts if we don't, because KeyHandles (like other KMS resources) are not actually deleted on terraform destroy, but really just dropped from the tf state.
There was a problem hiding this comment.
Hmmm you're right... good catch, thanks!
I'll need to modify the import instructions then. User will need to manually append the random suffix into .tfvars, otherwise the resource will be created instead of imported.
| 1. Identify your existing Autokey folder number used to configure [Autokey configuration](https://cloud.google.com/kms/docs/enable-autokey#enable-autokey-folder). | ||
| 1. This value will be referenced as: `AUTOKEY-FOLDER-NUMBER` | ||
| 1. Identify your existing project ID used to [configure Cloud KMS resources created by Autokey](https://cloud.google.com/kms/docs/enable-autokey#set-up-key-project). | ||
| 1. This value will be referenced as: `AUTOKEY-KMS-PROJECT-ID` | ||
| 1. Indentify your existing [Autokey Key Handle](https://cloud.google.com/kms/docs/resource-hierarchy#key_handles) configuration. It's composed by the following: | ||
| 1. Autokey Resource Project ID; (e.g: A Cloud Storage Bucket project ID configured with Autokey); | ||
| 1. This value will be referenced as: `AUTOKEY-RESOURCE-PROJECT-ID`; | ||
| 1. Key Handle location; (e.g: A Cloud Storage Bucket location configured with Autokey); | ||
| 1. This value will be referenced as: `AUTOKEY-LOCATION`; | ||
| 1. Key Handle name; (e.g: The Key Handle name configured for Cloud Storage Bucket); | ||
| 1. This value will be referenced as: `AUTOKEY-KEYHANDLE-NAME`; |
There was a problem hiding this comment.
Could a example be added with:
- Terraform commands on how to get these values from an existing state
gcloudcommands to get these values from GCP
There was a problem hiding this comment.
+1, if we can provide a bash script that would be helpful.
There was a problem hiding this comment.
or if you want to try creating some simple go code using the templating library for the KH's
| 1. Key Handle name; (e.g: The Key Handle name configured for Cloud Storage Bucket); | ||
| 1. This value will be referenced as: `AUTOKEY-KEYHANDLE-NAME`; | ||
| 1. Run `cd` to your [autokey submodule](../modules/autokey/README.md) folder; | ||
| 1. Create a `terraform.tfvars` file with the following code, replacing all the values in caps lock with your info: |
There was a problem hiding this comment.
".... replace all the placeholder values in all caps"
|
|
||
| ## Importing from terraform-google-autokey considerations | ||
| 1. **WARNING:** [terraform-google-autokey](https://registry.terraform.io/modules/GoogleCloudPlatform/autokey/google) module can be used to create your Autokey folder, Autokey KMS project, Autokey resource project and additional resources (e.g: a Cloud Storage Bucket configured with Autokey), so **DO NOT RUN** a `terraform destroy` for the module, even after the Key Handle import, unless you just used the module for Autokey configuration and the Key Handle creations only. | ||
| 1. If you are migrating from [terraform-google-autokey](https://registry.terraform.io/modules/GoogleCloudPlatform/autokey/google) module, you should copy the terraform outputs provided by the module and jump directly to step 4. |
There was a problem hiding this comment.
let's not make it an "if statement" but rather indicate that it's recommended to transition from that repo.
| 1. Identify your existing Autokey folder number used to configure [Autokey configuration](https://cloud.google.com/kms/docs/enable-autokey#enable-autokey-folder). | ||
| 1. This value will be referenced as: `AUTOKEY-FOLDER-NUMBER` | ||
| 1. Identify your existing project ID used to [configure Cloud KMS resources created by Autokey](https://cloud.google.com/kms/docs/enable-autokey#set-up-key-project). | ||
| 1. This value will be referenced as: `AUTOKEY-KMS-PROJECT-ID` | ||
| 1. Indentify your existing [Autokey Key Handle](https://cloud.google.com/kms/docs/resource-hierarchy#key_handles) configuration. It's composed by the following: | ||
| 1. Autokey Resource Project ID; (e.g: A Cloud Storage Bucket project ID configured with Autokey); | ||
| 1. This value will be referenced as: `AUTOKEY-RESOURCE-PROJECT-ID`; | ||
| 1. Key Handle location; (e.g: A Cloud Storage Bucket location configured with Autokey); | ||
| 1. This value will be referenced as: `AUTOKEY-LOCATION`; | ||
| 1. Key Handle name; (e.g: The Key Handle name configured for Cloud Storage Bucket); | ||
| 1. This value will be referenced as: `AUTOKEY-KEYHANDLE-NAME`; |
There was a problem hiding this comment.
+1, if we can provide a bash script that would be helpful.
| 1. Identify your existing Autokey folder number used to configure [Autokey configuration](https://cloud.google.com/kms/docs/enable-autokey#enable-autokey-folder). | ||
| 1. This value will be referenced as: `AUTOKEY-FOLDER-NUMBER` | ||
| 1. Identify your existing project ID used to [configure Cloud KMS resources created by Autokey](https://cloud.google.com/kms/docs/enable-autokey#set-up-key-project). | ||
| 1. This value will be referenced as: `AUTOKEY-KMS-PROJECT-ID` | ||
| 1. Indentify your existing [Autokey Key Handle](https://cloud.google.com/kms/docs/resource-hierarchy#key_handles) configuration. It's composed by the following: | ||
| 1. Autokey Resource Project ID; (e.g: A Cloud Storage Bucket project ID configured with Autokey); | ||
| 1. This value will be referenced as: `AUTOKEY-RESOURCE-PROJECT-ID`; | ||
| 1. Key Handle location; (e.g: A Cloud Storage Bucket location configured with Autokey); | ||
| 1. This value will be referenced as: `AUTOKEY-LOCATION`; | ||
| 1. Key Handle name; (e.g: The Key Handle name configured for Cloud Storage Bucket); | ||
| 1. This value will be referenced as: `AUTOKEY-KEYHANDLE-NAME`; |
There was a problem hiding this comment.
or if you want to try creating some simple go code using the templating library for the KH's
Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
| @@ -0,0 +1,118 @@ | |||
| # Importing Autokey Key Handles Guidance | |||
|
|
|||
There was a problem hiding this comment.
Perhaps some confusion from last comment. Please make an actual bash script in a tools directory that can be run. We don't need a doc that describes the bash script helper
Instead have this doc talk about the general steps, what changes they should make based on resources, and how to successfully run the script.
| 1. Run `cd REPLACE-WITH-YOUR-PATH` to your `terraform-google-autokey/examples/cloud_autokey_example` module path; | ||
| 1. If you didn't use `examples/cloud_autokey_example`, make sure you update the output names below according your terraform files. | ||
| 1. Run `terraform output` to get the name of the Autokey folder number and Autokey Key project: | ||
| ```bash |
There was a problem hiding this comment.
Consider using a style guide for your bash. Can even use a linter if follow a guide
For example:
https://google.github.io/styleguide/shellguide.html
The goal of this PR is to provide proper instructions to import existing Key Handles into new autokey submodule