https://pulumi.com logo
Join Slack
Powered by
This message was deleted.
# google-cloud
s
This message was deleted.
b
Hi @damp-elephant-82829 So the GCP provider and SDK require a project to work in - it doesn't give the top level ability to create a project - it assumes, one has already been created 😕
You could create a dynamic provider that shells out to te gcp cli to create a project as part of your pulumi up
d
the one annoying thing with that is that you cannot use projects as environments in GCP
which is what you would expect, especially if you use ephemeral environments
@broad-dog-22463 do you believe it makes sense for me to create that dynamic provider or am I overlooking something?
g
You can create projects within Pulumi... No problems with that The thing is, you need credentials to do so. What we do is have one project called The Creators which only has service accounts. One of this accounts has Project Creator role in a folder of the organization, therefore it can create projects in that folder and be the owner of them, having full access.
d
I have that , @green-school-95910 . So you suggest I keep going that way with a custom resource
g
What would be the custom resource? I don't see why you would need one
d
Ti veste a new project dinamically in Gcp. One project per stack
To create
g
Still, why a custom resource? You can just create the project with Pulumi normally as I said before
No need to reinvent the wheel
If you want better audit logs create a service account in the new project, use it on a new provider and make all your resource a child of it. I have a ComponentResource that does all that and configure AppEngine and those extras. Then I just use the component resource as parent to what would be root resources. It becomes quite neat and simple
Also easy to add more projects per stack
I can share it if you like
d
If you can, that would be great
g
Here you go.
project_ts.ts
I was just removing some things specific for our need and adding the comments to help you out There is one dependency, the 
pulumi-gcp-components
, which is a package that I made with some utilities. You could just replace it with a loop receiving all the APIs that should be enabled
Ooo, just now I got what was your original confusion. You ware looking for a 
gcp.projects.Project
resource, but it is actually 
gcp.organizations.Project
Indeed that is confusing, especially because there is a 
gcp.projects.getProject
The 
gcp.organizations
is for organization-wide IAM and resources (Policy and Projects) and for getting Organization and BillingAccount info. The 
gcp.projects
module is for project-level IAM and enabling APIs. And there is the 
gcp.folder
to organize those in (surprise surprise) folders. Sending it on the channel too in case someone else find this confusing
💯 3
d
Thanks! I will try to do that in Python it shouldn’t be very difficult
@green-school-95910 is it possible to spin off those project starting from another one? What I mean is that I would like to specify the project id of a root “qa” project, and use the billing account of that project
Additionally, I’d like to make it “per branch” but unfortunately the second time the stack runs it fails: Requested entity already exists. Can this be done in an idempotent manner / if the project already exists, do not create it?
g
You can use the getProject to get the billing account of the project you are using to create. And you can create a stack for each branch (dinamically). On the example I added it includes a random suffix after the stack, so no name overlap even if you recreate a branch after it is destroyed
d
I should call the getProject after I create the project ? It won’t have any billing account if I created it without billing account
g
You can call it to get the project you are creating a new one with. And copy the billing account from it
d
I did it, excellent
2 Views
Open in Slack
PreviousNext
Powered by