osv.dev/deployment/terraform/environments/oss-vdb/main.tf at e6baddbea4e7718810f764c4453435746345c019 · google/osv.dev · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
locals {
  env_kustomization_path  = "../../../clouddeploy/gke-workers/environments/oss-vdb"
  base_kustomization_path = "../../../clouddeploy/gke-workers/base"
  env_kustomization       = yamldecode(file("${local.env_kustomization_path}/kustomization.yaml"))
  base_kustomization      = yamldecode(file("${local.base_kustomization_path}/kustomization.yaml"))

  all_resources = concat(
    [for resource in local.env_kustomization.resources : "${local.env_kustomization_path}/${resource}" if can(regex("\\.yaml$", resource))],
    [for resource in local.base_kustomization.resources : "${local.base_kustomization_path}/${resource}" if can(regex("\\.yaml$", resource))],
  )

  # Iterate of each yaml configuration and create a key based on kind and name in the yaml file.
  # Break apart by --- first as default yamldecode does not support parsing multiple documents in a single file.
  kube_manifests = {
    for manifest in flatten([
      for file_path in local.all_resources : [
        # Split content by separator, creating a list of string documents
        for doc in split("\n---\n", file(file_path)) :
        yamldecode(doc)
        # Filter out empty strings caused by trailing separators
        if trimspace(doc) != ""
      ]
    ]) :
    "${try(manifest.kind, "")}--${try(manifest.metadata.name, "")}" => manifest
    if try(manifest.kind, "") == "CronJob"
  }
}

module "osv" {
  source = "../../modules/osv"

  project_id = "oss-vdb"

  public_import_logs_bucket                      = "osv-public-import-logs"
  vulnerabilities_export_bucket                  = "osv-vulnerabilities"
  cve_osv_conversion_bucket                      = "cve-osv-conversion"
  debian_osv_conversion_bucket                   = "debian-osv"
  logs_bucket                                    = "osv-logs"
  osv_dev_sitemap_bucket                         = "osv-dev-sitemap"
  backups_bucket                                 = "osv-backup"
  backups_bucket_retention_days                  = 60
  affected_commits_backups_bucket                = "osv-affected-commits"
  affected_commits_backups_bucket_retention_days = 3
  gcs_log_dir                                    = "gs://oss-vdb-tf/apply-logs"

  website_domain = "osv.dev"
  api_url        = "api.osv.dev"
  esp_version    = "2.55.3"

  extra_work_pools = [
    "reimport",
    "cves",
  ]
}

module "oss_fuzz" {
  source                       = "../../modules/oss_fuzz"
  project_id                   = "oss-vdb"
  tasks_topic_id               = module.osv.tasks_topic_id
  failed_tasks_topic_id        = module.osv.failed_tasks_topic_id
  pubsub_service_account_email = module.osv.pubsub_service_account_email
}

module "k8s_cron_alert" {
  for_each                         = local.kube_manifests
  source                           = "../../modules/k8s_cron_alert"
  project_id                       = module.osv.project_id
  cronjob_name                     = each.value.metadata.name
  cronjob_expected_latency_minutes = lookup(each.value.metadata.labels, "cronLastSuccessfulTimeMins", null)
  notification_channel             = "projects/oss-vdb/notificationChannels/17648103713296264012"
}

import {
  to = module.osv.google_firestore_database.datastore
  id = "oss-vdb/(default)"
}

output "website_dns_records" {
  description = "DNS records that need to be created for the osv.dev website"
  value       = module.osv.website_dns_records
}

terraform {
  backend "gcs" {
    bucket = "oss-vdb-tf"
    prefix = "oss-vdb"
  }
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 7.38.0"
    }
    google-beta = {
      source  = "hashicorp/google-beta"
      version = "~> 7.38.0"
    }
    external = {
      source  = "hashicorp/external"
      version = "~> 2.4.0"
    }
    null = {
      source  = "hashicorp/null"
      version = "~> 3.3.0"
    }
  }
}