bitbucket-pipelines.yml

image: google/cloud-sdk
pipelines:
  default:
    - step:
        name: setup terraform
        script:
          - apt-get update && apt-get install unzip wget -y 
          - wget https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip || echo fine...
          - unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip 
          - yes | cp terraform /usr/bin/
          - ls /usr/bin
        artifacts:
          - terraform
    - step: 
        name: terraform init
        oidc: true
        script:
          - cp terraform /usr/bin/
          - ls . /usr/bin/
          - ./get_oidctoken.sh
          - export GOOGLE_APPLICATION_CREDENTIALS=`pwd`/.gcp_temp_cred.json
          - /usr/bin/terraform init -backend-config="bucket=${STATE_BUCKET}" -backend-config="prefix=${BITBUCKET_REPO_FULL_NAME}" 
          - /usr/bin/terraform plan
  branches: 
    feature/*:
      - step:
          name: setup terraform
          script:
            - apt-get update && apt-get install unzip wget -y 
            - wget https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip || echo fine...
            - unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip 
            - yes | cp terraform /usr/bin/
            - ls /usr/bin
          artifacts:
            - terraform
      - step:
          name: main branch execution tf-apply
          oidc: true
          script: 
            - cp terraform /usr/bin/
            - ls . /usr/bin/
            - export SERVICE_ACCOUNT_EMAIL="${GCP_SERVICE_ACCOUNT}"
            - ./get_oidctoken.sh
            - export GOOGLE_APPLICATION_CREDENTIALS=`pwd`/.gcp_temp_cred.json
            - /usr/bin/terraform init -backend-config="bucket=${STATE_BUCKET}" -backend-config="prefix=${BITBUCKET_REPO_FULL_NAME}" 
            - /usr/bin/terraform plan
            - /usr/bin/terraform apply -auto-approve
    dev:
      - step:
          name: setup terraform
          script:
            - apt-get update && apt-get install unzip wget -y 
            - wget https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip || echo fine...
            - unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip 
            - yes | cp terraform /usr/bin/
            - ls /usr/bin
          artifacts:
            - terraform
      - step:
          name: dev branch execution tf-apply
          oidc: true
          script: 
            - cp terraform /usr/bin/
            - ls . /usr/bin/
            - export SERVICE_ACCOUNT_EMAIL="${GCP_SERVICE_ACCOUNT}"
            - ./get_oidctoken.sh
            - export GOOGLE_APPLICATION_CREDENTIALS=`pwd`/.gcp_temp_cred.json
            - /usr/bin/terraform init -backend-config="bucket=${STATE_BUCKET}" -backend-config="prefix=${BITBUCKET_REPO_FULL_NAME}" 
            - /usr/bin/terraform plan
            - /usr/bin/terraform apply -auto-approve
    main:
      - step:
          name: setup terraform
          script:
            - apt-get update && apt-get install unzip wget -y 
            - wget https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip || echo fine...
            - unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip 
            - yes | cp terraform /usr/bin/
            - ls /usr/bin
          artifacts:
            - terraform
      - step:
          name: tf-policy validate 
          oidc: true
          script: 
            - if [[ "$TERRAFORM_POLICY_VALIDATE" == "true" ]]; then
            - cp terraform /usr/bin/
            - export TF_PLAN_NAME=plan.out
            - export TF_ROOT=tf_root 
            - mkdir -p $TF_ROOT
            - ls . /usr/bin/
            - export SERVICE_ACCOUNT_EMAIL="${GCP_SERVICE_ACCOUNT}"
            - ./get_oidctoken.sh
            - export GOOGLE_APPLICATION_CREDENTIALS=`pwd`/.gcp_temp_cred.json
            - apt-get install google-cloud-sdk-terraform-tools -y
            - git clone $POLICY_LIBRARY_REPO $TF_ROOT/policy-repo
            - /usr/bin/terraform init -backend-config="bucket=${STATE_BUCKET}" -backend-config="prefix=${BITBUCKET_REPO_FULL_NAME}" 
            - /usr/bin/terraform plan -out $TF_PLAN_NAME 
            - /usr/bin/terraform show --json $TF_PLAN_NAME  > $TF_ROOT/tfplan.json
            - violations=$(gcloud beta terraform vet $TF_ROOT/tfplan.json --policy-library=$TF_ROOT/policy-repo --format=json)
            - ret_val=$?
            - if [ $ret_val -eq 2 ]; then
            -    if [ "$violations" != "[]" ] ; then 
            -      echo "$violations"
            -      echo "Violations found, not proceeding with terraform apply" 
            -      exit 1
            -    fi
            -  elif [ $ret_val -ne 0 ]; then
            -    echo "Error during gcloud beta terraform vet; not proceeding with terraform apply"
            -    exit 1
            -  else
            -    echo "No policy violations detected; proceeding with terraform apply"
            -  fi
            - fi
      - step:
          name: prod branch execution tf-apply
          oidc: true
          script: 
            - cp terraform /usr/bin/
            - ls . /usr/bin/
            - export SERVICE_ACCOUNT_EMAIL="${GCP_SERVICE_ACCOUNT}"
            - ./get_oidctoken.sh
            - export GOOGLE_APPLICATION_CREDENTIALS=`pwd`/.gcp_temp_cred.json
            - /usr/bin/terraform init -backend-config="bucket=${STATE_BUCKET}" -backend-config="prefix=${BITBUCKET_REPO_FULL_NAME}" 
            - /usr/bin/terraform plan
            - /usr/bin/terraform apply -auto-approve