Merge pull request #26 from Datatamer/fix_startup_script

DSD-2248: Allow users to specify custom metadata

Author: creynolds15

.gitleaks.toml

@@ -1,5 +1,11 @@
 # GCP Tamr VM module
 
+## v2.1.0 - April 25th 2023
+* Following optional input variables now available
+  * metadata
+* Allows flexibility for the user of this module to supply custom metadata
+* Creates configuration file as Tamr functional user to avoid permissions issues
+
 ## v2.0.0 - July 18th 2022
 * Remove overlap with config module
 

CHANGELOG.md

@@ -38,6 +38,7 @@ This modules creates:
 | tamr\_instance\_zone | zone to deploy tamr vm | `string` | n/a | yes |
 | tamr\_zip\_uri | gcs location to download tamr zip from | `string` | n/a | yes |
 | labels | labels to attach to created resources | `map(string)` | `{}` | no |
+| metadata | custom metadata to attach to created VM | `map(string)` | `{}` | no |
 | tamr\_external\_ip | Create and attach an external ip to tamr VM | `bool` | `false` | no |
 | tamr\_instance\_deletion\_protection | Enabled deletion protection for the tamr VM | `bool` | `true` | no |
 | tamr\_instance\_disk\_size | size of the boot disk | `number` | `100` | no |

README.md

@@ -1 +1 @@
-2.0.0
+2.1.0

VERSION

@@ -40,13 +40,15 @@ resource "google_compute_address" "external_ip" {
 }
 
 # tamr vm
+#tfsec:ignore:google-compute-enable-shielded-vm-im tfsec:ignore:google-compute-enable-shielded-vm-vtpm tfsec:ignore:google-compute-no-project-wide-ssh-keys
 resource "google_compute_instance" "tamr" {
   name                = var.tamr_instance_name
   machine_type        = var.tamr_instance_machine_type
   zone                = var.tamr_instance_zone
   project             = var.tamr_instance_project
   deletion_protection = var.tamr_instance_deletion_protection
 
+  #tfsec:ignore:google-compute-vm-disk-encryption-customer-key
   boot_disk {
     initialize_params {
       image = var.tamr_instance_image
@@ -74,14 +76,17 @@ resource "google_compute_instance" "tamr" {
     { "role" = "tamr" },
   )
 
+  #tfsec:ignore:google-compute-no-default-service-account
   service_account {
     scopes = ["cloud-platform"]
     email  = var.tamr_instance_service_account
   }
 
-  metadata = {
-    shutdown-script-url = "gs://${var.tamr_filesystem_bucket}/${google_storage_bucket_object.shutdown_script.name}"
-  }
+  metadata = merge(var.metadata,
+    {
+      shutdown-script-url = "gs://${var.tamr_filesystem_bucket}/${google_storage_bucket_object.shutdown_script.name}"
+    }
+  )
 
   # NOTE: we are using the startup_script field instead of the `startup-script-url` pair in metadata, in order to force
   # a recreation of the tamr VM after a configuration change. We want the tamr vm to be fully declarative and to not be

main.tf

@@ -20,7 +20,7 @@ if [[ ! -f ${tamr_home_directory}/tamr/start.sh ]]; then
     sudo -S -u tamr -i /bin/bash -c 'unzip ${tamr_home_directory}/unify.zip -d ${tamr_home_directory}'
 
     # apply custom config
-    echo -e "$${TAMR_CONFIG}" > ${tamr_home_directory}/tamr/conf/unify-custom-config.yaml
+    sudo -S -u tamr -i /bin/bash -c 'echo -e "$${TAMR_CONFIG}" > ${tamr_home_directory}/tamr/conf/unify-custom-config.yaml'
     chown -R tamr:tamr ${tamr_home_directory}/tamr/conf/unify-custom-config.yaml
 fi
 

templates/dataproc.yaml.tmpl

@@ -91,6 +91,12 @@ variable "labels" {
   description = "labels to attach to created resources"
 }
 
+variable "metadata" {
+  default     = {}
+  type        = map(string)
+  description = "custom metadata to attach to created VM"
+}
+
 variable "tamr_config_file" {
   type        = string
   description = "Override generated tamr configuration. The tamr configuration is specified using a yaml file, in the format that is documented (https://docs.tamr.com/previous/docs/configuration-configuring-unify#section-setting-configuration-variables) for configuring “many variables” at once."