add owner label to everything

Author: Jeffreyhung

functions/main.tf

@@ -10,6 +10,7 @@ variable "region" {}
 variable "secret_ids" {}
 variable "deploy_sa_email" {}
 variable "local_variables" {}
+variable "owner" {}
 
 module "cloud_function_gen2" {
   source   = "../modules/cloud-function-gen2"
@@ -40,6 +41,7 @@ module "cloud_function_gen2" {
   project         = var.project
   secret_ids      = var.secret_ids
   deploy_sa_email = var.deploy_sa_email
+  owner           = var.owner
 }
 
 module "cronjob-gen2" {
@@ -58,6 +60,7 @@ module "cronjob-gen2" {
   target_project  = var.project
   target_region   = var.region
   deploy_sa_email = var.deploy_sa_email
+  owner           = var.owner
 
   depends_on = [
     module.cloud_function_gen2

index.tf

@@ -5,6 +5,7 @@ module "infrastructure" {
   region          = var.region
   project_id      = var.project_id
   deploy_sa_email = var.deploy_sa_email
+  owner           = var.owner
 }
 
 module "functions" {
@@ -16,6 +17,7 @@ module "functions" {
   secret_ids      = module.infrastructure.secret_ids
   deploy_sa_email = var.deploy_sa_email != null ? var.deploy_sa_email : module.infrastructure.deploy_sa_email
   local_variables = local.local_variables
+  owner           = var.owner
 
   depends_on = [
     module.infrastructure
@@ -29,9 +31,11 @@ module "workflows" {
   region          = var.region
   project_id      = var.project_id
   deploy_sa_email = var.deploy_sa_email != null ? var.deploy_sa_email : module.infrastructure.deploy_sa_email
+  owner           = var.owner
 
   depends_on = [
-    module.infrastructure
+    module.infrastructure,
+    module.functions
   ]
 }
 
@@ -44,6 +48,7 @@ module "pubsubs" {
   bucket_location = var.bucket_location
   zone            = var.zone
   deploy_sa_email = var.deploy_sa_email != null ? var.deploy_sa_email : module.infrastructure.deploy_sa_email
+  owner           = var.owner
 
   depends_on = [
     module.infrastructure

infrastructure/main.tf

@@ -3,6 +3,10 @@ resource "google_storage_bucket" "staging_bucket" {
   location                 = "US"
   force_destroy            = true
   public_access_prevention = "enforced"
+  labels = {
+    owner = var.owner
+    terraformed = "true"
+  }
 }
 
 resource "google_storage_bucket_iam_binding" "staging-bucket-iam" {
@@ -31,6 +35,10 @@ resource "google_storage_bucket" "tf-state" {
   versioning {
     enabled = true
   }
+  labels = {
+    owner = var.owner
+    terraformed = "true"
+  }
 }
 
 resource "google_storage_bucket_iam_binding" "tfstate-bucket-iam" {

infrastructure/secrets.tf

@@ -4,6 +4,10 @@ resource "google_secret_manager_secret" "secret" {
   replication {
     auto {}
   }
+  labels = {
+    owner = var.owner
+    terraformed = "true"
+  }
 }
 
 # since some of the secrets will be shared across functions and workflows

infrastructure/variables.tf

@@ -19,3 +19,8 @@ variable "deploy_sa_email" {
   description = "service account for deployment"
   default     = null
 }
+
+variable "owner" {
+  type        = string
+  description = "The owner of the project, used for tagging resources and future ownership tracking"
+}

infrastructure/workload_identity.tf

@@ -7,7 +7,7 @@ resource "google_service_account" "gha_cloud_functions_deployment" {
   count = var.deploy_sa_email != null ? 0 : 1
 
   account_id   = "gha-cloud-functions-deployment"
-  description  = "For use by Terraform and GitHub Actions to deploy cloud-functions"
+  description  = "For use by Terraform and GitHub Actions to deploy cloud-functions, owned by ${var.owner}, managed by Terraform"
   display_name = "gha-cloud-functions-deployment"
   project      = var.project
 }
@@ -17,7 +17,7 @@ resource "google_iam_workload_identity_pool" "gha_terraform_checker_pool" {
 
   workload_identity_pool_id = "${local.gha_name}-pool"
   display_name              = "GHA Terraform Checker Pool"
-  description               = "Identity pool for Terraform Plan GHA"
+  description               = "Identity pool for Terraform Plan GHA, owned by ${var.owner}, managed by Terraform"
 }
 
 resource "google_iam_workload_identity_pool_provider" "gha_terraform_checker_provider" {
@@ -26,7 +26,7 @@ resource "google_iam_workload_identity_pool_provider" "gha_terraform_checker_pro
   workload_identity_pool_id          = google_iam_workload_identity_pool.gha_terraform_checker_pool[0].workload_identity_pool_id
   workload_identity_pool_provider_id = "${local.gha_name}-provider"
   display_name                       = "GHA Terraform Checker Provider"
-  description                        = "OIDC identity pool provider for Terraform Plan GHA"
+  description                        = "OIDC identity pool provider for Terraform Plan GHA, owned by ${var.owner}, managed by Terraform"
 
   attribute_mapping = {
     "google.subject"       = "assertion.${local.attribute_scope}"

modules/cloud-function-gen2/main.tf

@@ -1,6 +1,7 @@
 resource "google_service_account" "function_sa" {
   account_id   = "cf-${var.name}"
   display_name = "Cloud Function Service Account for ${var.name}"
+  description = "Service account for ${var.name}, owned by ${var.owner}, managed by Terraform"
 }
 
 
@@ -65,6 +66,10 @@ data "archive_file" "source" {
 resource "google_storage_bucket_object" "zip" {
   source       = data.archive_file.source.output_path
   content_type = "application/zip"
+  metadata = {
+    owner = var.owner
+    terraformed = "true"
+  }
 
   # Append to the MD5 checksum of the files's content
   # to force the zip to be updated as soon as a change occurs
@@ -76,6 +81,10 @@ resource "google_cloudfunctions2_function" "function" {
   name        = var.name
   location    = var.location
   description = var.description
+  labels      = {
+    owner = var.owner
+    terraformed = "true"
+  }
 
   build_config {
     runtime           = var.runtime

modules/cloud-function-gen2/variables.tf

@@ -117,3 +117,8 @@ variable "allow_unauthenticated" {
   nullable    = false
   default     = false
 }
+
+variable "owner" {
+  type        = string
+  description = "The owner of the project, used for tagging resources and future ownership tracking"
+}

modules/cloud-workflow/main.tf

@@ -1,6 +1,7 @@
 resource "google_service_account" "workflow_sa" {
   account_id   = "wf-${var.name}"
   display_name = "Workflow Service Account for ${var.name}"
+  description = "Service account for ${var.name}, owned by ${var.owner}, managed by Terraform"
 }
 
 resource "google_service_account_iam_member" "workflow_sa_actas_iam" {
@@ -20,6 +21,11 @@ resource "google_workflows_workflow" "workflow" {
   description     = var.description
   service_account = google_service_account.workflow_sa.id
   source_contents = templatefile("${var.workflow_yaml_file}", {})
+  labels = {
+    owner = var.owner
+    terraformed = "true"
+  }
+  
   depends_on = [
     google_service_account_iam_member.workflow_sa_actas_iam,
     google_service_account_iam_member.deploy_sa_actas_iam

modules/cloud-workflow/variables.tf

@@ -40,9 +40,16 @@ variable "deploy_sa_email" {
 variable "project" {
   type = string
 }
+
 variable "project_id" {
   type = string
 }
+
 variable "region" {
   type = string
 }
+
+variable "owner" {
+  type        = string
+  description = "The owner of the project, used for tagging resources and future ownership tracking"
+}