The objective of this module is to deploy a Google Cloud Platform project prj-b-cicd to host a Jenkins Agent that can connect with your current Jenkins Controller on-prem. This module is a replica of the deprecated cloudbuild module, but re-purposed to use Jenkins instead. This module creates:

• The prj-b-cicd project, which includes:
  • GCE Instance for the Jenkins Agent, which you will configure to connect to your current Jenkins Controller using SSH.
  • VPC to connect the Jenkins GCE Instance to
  • FW rules to allow communication over port 22
  • VPN connection with on-prem (or where ever your Jenkins Controller is located)
  • Custom service account [email protected] for the GCE instance. This service account is granted the access to generate tokens on the provided Terraform custom service account Please note this module does not include an option to create a Jenkins Controller. To deploy a Jenkins Controller, you should follow one of the available user guides about Jenkins in GCP.

If you don't have a Jenkins implementation and don't want one, then we recommend you to use the Cloud Build module instead.

Basic usage of this sub-module is as follows:

module "jenkins_bootstrap" {
  source                                    = "./modules/jenkins-agent"
  org_id                                    = "<ORGANIZATION_ID>"
  folder_id                                 = "<FOLDER_ID>"
  billing_account                           = "<BILLING_ACCOUNT_ID>"
  group_org_admins                          = "[email protected]"
  default_region                            = "us-central1"
  terraform_sa_names                        = "<SERVICE_ACCOUNT_NAMES>"
  terraform_state_bucket                    = "<GCS_STATE_BUCKET_NAME>"
  sa_enable_impersonation                   = true
  jenkins_controller_subnetwork_cidr_range  = ["10.1.0.6/32"]
  jenkins_agent_gce_subnetwork_cidr_range   = "172.16.1.0/24"
  jenkins_agent_gce_private_ip_address      = "172.16.1.6"
  nat_bgp_asn                               = "BGP_ASN_FOR_NAT_CLOUD_ROUTE"
  jenkins_agent_sa_email                    = "jenkins-agent-gce" # service_account_prefix will be added
  jenkins_agent_gce_ssh_pub_key             = var.jenkins_agent_gce_ssh_pub_key
}

1. Creates a new GCP project using project_prefix
2. Enables APIs in the project using activate_apis
3. Creates a GCE Instance to run the Jenkins Agent with SSH access using the supplied public key
4. Creates a Service Account (jenkins_agent_sa_email) to run the Jenkins Agent GCE instance
5. Creates a GCS bucket for Jenkins Artifacts using project_prefix
6. Allows jenkins_agent_sa_email service account permissions to impersonate terraform service account (which exists in the seed project) using sa_enable_impersonation and supplied value for terraform_sa_names
7. Adds Cloud NAT for the Agent to be able to download updates and necessary binaries.

[
  "serviceusage.googleapis.com",
  "servicenetworking.googleapis.com",
  "compute.googleapis.com",
  "logging.googleapis.com",
  "bigquery.googleapis.com",
  "cloudresourcemanager.googleapis.com",
  "cloudbilling.googleapis.com",
  "iam.googleapis.com",
  "admin.googleapis.com",
  "appengine.googleapis.com",
  "storage-api.googleapis.com",
  "dns.googleapis.com"
]

• gcloud sdk >= 393.0.0
• Terraform = 1.3.10
  • The scripts in this codebase use Terraform v1.3.10. You should use the same version in the manual steps to avoid Terraform State Snapshot Lock errors caused by differences in terraform versions.

• Jenkins Controller: You need a Jenkins Controller, since this module does not include an option to create one. To deploy a Jenkins Controller, you should follow one of the available user guides about Jenkins in GCP. If you don't have a Jenkins implementation and don't want one, then we recommend you to use the Cloud Build module instead.

• VPN Connectivity with on-prem: Once you run this module, a Jenkins Agent is created in the CI/CD project in GCP. Please add VPN connectivity manually by following our user guide about how to deploy a VPN tunnel in GCP. This VPN is necessary to allow communication between the Jenkins Controller (on prem or in a cloud environment) with the Jenkins Agent in the CI/CD project.

• Binaries and packages for the Jenkins Agent: The Jenkins Agent is a new GCE instance created by this module. After creation, the startup script needs to fetch several binaries for later use, during pipelines execution. These binaries include java, terraform and any other binary you use in your own scripts. You have several options to make these binaries and libraries available to the Jenkins Agent:

  • allow the Jenkins Agent Internet access (ideally through Cloud NAT, implemented by default).
  • allow the Jenkins Agent access to local package repositories on your premises, ideally through the VPN connection.
  • preparing a golden image for the Jenkins Agent (and assign the image to the jenkins_agent_gce_instance.boot_disk.initialize_params.image terraform variable). You can create the golden images with tools like Packer. Although, you might still need network access to download dependencies while running a pipeline.

An account that has the following permissions:

• roles/billing.user on supplied billing account
• roles/resourcemanager.organizationAdmin on GCP Organization
• roles/resourcemanager.projectCreator on GCP Organization or folder

This is especially important as you might face one of the errors below:

Error: google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.
   on <empty> line 0:
  (source code not available)

Error: Error setting billing account "aaaaaa-bbbbbb-cccccc" for project "projects/prj-jenkins-dc3a": googleapi: Error 400: Precondition check failed., failedPrecondition
      on .terraform/modules/jenkins/terraform-google-project-factory-7.1.0/modules/core_project_factory/main.tf line 96, in resource "google_project" "main":
      96: resource "google_project" "main" {

Error: failed pre-requisites: missing permission on "billingAccounts/aaaaaa-bbbbbb-cccccc": billing.resourceAssociations.create
  on .terraform/modules/jenkins/terraform-google-project-factory-7.1.0/modules/core_project_factory/main.tf line 96, in resource "google_project" "main":
  96: resource "google_project" "main" {

A project with the following APIs enabled must be used to host the resources of this module:

• Google Cloud Resource Manager API: cloudresourcemanager.googleapis.com
• Google Cloud Billing API: cloudbilling.googleapis.com
• Google Cloud IAM API: iam.googleapis.com
• Google Cloud Storage API storage-api.googleapis.com
• Google Cloud Service Usage API: serviceusage.googleapis.com
• Google Cloud Compute API: compute.googleapis.com
• Google Cloud KMS API: cloudkms.googleapis.com

This API can be enabled in the default project created during establishing an organization.

Refer to the contribution guidelines for information on contributing to this module.