1 files changed, 113 insertions, 0 deletions
diff --git a/ops/tf-gcs-init/tf-gcs-init.sh b/ops/tf-gcs-init/tf-gcs-init.sh
new file mode 100755
index 0000000..f675381
--- /dev/null
+++ b/ops/tf-gcs-init/tf-gcs-init.sh
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+
+# This script creates a bucket in GCS that will be used to store
+# terraform state. It also creates a service account 'terraform' to
+# perform the actions. It ensures the admin of the account can
+# impersonate the 'terraform' service account, so we don't need to
+# generate keys. The roles for the SA are also set.
+
+# TODO:
+# gcloud projects add-iam-policy-binding fcuny-backups --member="serviceAccount:terraform@fcuny-homelab.iam.gserviceaccount.com" --role="roles/viewer"
+# gcloud projects add-iam-policy-binding fcuny-backups
+# --member="serviceAccount:terraform@fcuny-homelab.iam.gserviceaccount.com"
+# --role="roles/owner"
+# I need to perform some actions on all the projects, not just the
+# first one, need to expand the script for that part.
+
+set -u
+set -e
+set -o pipefail
+
+# I'm the admin of the project
+GCP_ADMIN_ACCOUNT="franck.cuny@gmail.com"
+
+# this is the main project that is used for "core" infra
+GCP_PROJECT="fcuny-homelab"
+GCP_PROJECTS="$(gcloud projects list --format 'value(projectId)')"
+GCS_LOCATION="us-west1"
+GCS_BUCKET_NAME="world-tf-state"
+GCP_SERVICE_ACCOUNT_NAME="terraform"
+GCP_SERVICE_ACCOUNT="${GCP_SERVICE_ACCOUNT_NAME}@${GCP_PROJECT}.iam.gserviceaccount.com"
+GCP_SERVICE_ACCOUNT_ROLES=(
+  "roles/editor"
+  "roles/owner"
+)
+
+function bucket:exist() {
+  if gsutil ls gs://${1} &>/dev/null; then
+    true
+  else
+    false
+  fi
+}
+
+function bucket() {
+  if ! bucket:exist "${GCS_BUCKET_NAME}"; then
+    echo "creating GCS bucket $GCS_BUCKET_NAME ..."
+    (
+      set -x
+      gsutil mb -p ${GCP_PROJECT} -l ${GCS_LOCATION} gs://${GCS_BUCKET_NAME}
+      gsutil versioning set on gs://${GCS_BUCKET_NAME}
+    )
+  else
+    echo "GCS bucket $GCS_BUCKET_NAME already created"
+  fi
+}
+
+function service_account:exist() {
+  if gcloud iam service-accounts describe "${1}" &>/dev/null; then
+    true
+  else
+    false
+  fi
+}
+
+function service_account() {
+  if ! service_account:exist "${GCP_SERVICE_ACCOUNT}"; then
+    echo "creating service account ..."
+    (
+      set -x
+      gcloud iam service-accounts create "${GCP_SERVICE_ACCOUNT_NAME}" --display-name="Terraform Service Account"
+    )
+  else
+    echo "service account already created"
+  fi
+}
+
+function service_account:has_role() {
+  [[ $(gcloud projects get-iam-policy ${1} --flatten=bindings --filter="bindings.members=serviceAccount:${2} AND bindings.role=$3" 2>/dev/null | wc -l) -ne 0 ]]
+}
+
+function service_account:admins_token_creator() {
+  [[ $(gcloud --project=${1} iam service-accounts get-iam-policy ${GCP_SERVICE_ACCOUNT} --flatten=bindings --filter="bindings.members=user:${GCP_ADMIN_ACCOUNT} AND bindings.role=roles/iam.serviceAccountTokenCreator" 2>/dev/null | wc -l) -ne 0 ]]
+}
+
+function roles() {
+  for project in $GCP_PROJECTS; do
+    for role in "${GCP_SERVICE_ACCOUNT_ROLES[@]}"; do
+      if ! service_account:has_role "${project}" "${GCP_SERVICE_ACCOUNT}" "${role}" ; then
+        echo "granting ${role##*/} role to service account for project ${project} ..."
+        (
+          set -x
+          gcloud projects add-iam-policy-binding "${project}" --member="serviceAccount:${GCP_SERVICE_ACCOUNT}" --role="${role}"
+        ) 1>/dev/null
+      else
+        echo "service account already has ${role##*/} role for project ${project}"
+      fi
+    done
+
+    if ! service_account:admins_token_creator "${project}" ; then
+      echo "adding AccountTokenCreator role to admin account for project ${project} ..."
+      (
+        set -x
+        gcloud --project="${project}" iam service-accounts add-iam-policy-binding "${GCP_SERVICE_ACCOUNT}" --member user:${GCP_ADMIN_ACCOUNT} --role="roles/iam.serviceAccountTokenCreator"
+      ) 1>/dev/null
+    else
+      echo "admin account has already AccountTokenCreator role for project ${project}"
+    fi
+  done
+}
+
+bucket
+service_account
+roles