---
# System prepended metadata

title: Bender GCP Common Infrastructure

---

# Bender GCP Common Infrastructure
* Admins and Developers id lists
* VPC Configuration.
* CloudSQL Single instance for all Price Track countries for DEV. UAT and PROD have a single instances per country
* VPC Connector for Price Track Cloud Functions.
* K8S Role policies and bindings for users.
* Service Account and IAM To Pull and Push Docker images for CI.
* Service Account for GKE Deployments in CI.
* IAM Bindings for users Project scope.
* Project GKE Cluster
    * Remote Module Call
    * Kubeapi Whitelisting
    * Ingress Controller Setup
* QA E2E Project wide permissions.(To be reviewed).
## Product Track Infrastructure
This project is holding all IaaC to generate and maintain with a *gitops* approach in Product Track Infratruscture using gitlab-ci and terraform.

All environments are in form of folders that make usage of modules on `master` branch.

The gitflow is feature => master.
### List of Modules
#### API-PIM-Product
* Microservice Service Account.
* Subcription to PIM updates topic. This has a filter considering country and few event types.
* Optional ODBMS subcription.
* Stackdriver Log based metrics and associated dashboards.
* Workload Identity configuration.
* IAM Permissions.
#### Product (XML)
* Service Accounts for microservice.
* Service Account for BackOffice(BO) team to send XML files.
* GCS to receive XML files.
* Outgoing Product Topic for subscribers(catalyst) which are the following:
  * QA Internal subcription(Optional)
* IAM Permissions for both microservices and BO teams to perform their tasks.
* Stackdriver Log based metrics and associated dashboards.
* Slack Alerts:
    * ms_product_failed_cleaning_file
    * ms_product_failed_while_sending_event
    * ms_product_attribute_missing
#### Product Events
* Service Accounts for microservice.
* Service Account for BackOffice(BO) team to send events to corp topic.
* IAM Permissions for both microservices and BO teams to perform their tasks.
* Microservice Subcription to corp topic using country code as filter.
* Workload Identity configuration.
### Environments
Each environment is represented in a folder. This folder has terraform code for common Price track infra and all the corresponding calls to the previous stated modules.

Each sub-track has its own .tf file with the corresponding module call and all is parameters.

## Pipeline Description

### Stages
* validate: Terraform Validate syntax and format.
* build: Terraform plan.
* deploy: Terraform apply(Only Master, Manual)
* postconfig: Jobs to initialize schema and db users. (Only Master, Manual)
* audit: 
    * Secret Detection. (Hardcoded secret detection)
    * IaaC Compliance. (Terraform code best practices)
    * security-benchmark. (GKE)
    * check-scopes (GKE)
    * check-autoupgrade (GKE)
    * heal (GKE, security team GKE auto heal)
* destroy: Terraform destroy(Only Master, Manual)