Skip to content

Dodanie cloud-run - #10

Merged
skibinstein merged 1 commit into
mainfrom
feature/add-cloud-run
Jan 28, 2026
Merged

Dodanie cloud-run#10
skibinstein merged 1 commit into
mainfrom
feature/add-cloud-run

Conversation

@skibinstein

Copy link
Copy Markdown
Collaborator

No description provided.

Comment on lines +1 to +48
module "cloud_run" {
source = "github.com/GoogleCloudPlatform/cloud-foundation-fabric//modules/cloud-run-v2?ref=v51.0.0"

project_id = var.project_id
region = var.region
name = "${var.name.app}-${var.name.component}-${var.name.env}"

containers = {
app = {
image = var.cloud_run_image
volume_mounts = {
cloudsql = "/cloudsql"
}
resources = {
limits = {
cpu = var.cloud_run_cpu_limit
memory = var.cloud_run_memory_limit
}
}
}
}

volumes = {
cloudsql = {
cloud_sql_instances = [module.cloudsql.instance_connection_name]
}
}

service_account_config = {
roles = var.cloud_run_service_account_roles
}

# Terraform does the initial deployment only; CI/CD manages revisions after.
managed_revision = false

service_config = {
ingress = "INGRESS_TRAFFIC_ALL"
scaling = {
min_instance_count = var.cloud_run_min_instances
max_instance_count = var.cloud_run_max_instances
}
}

depends_on = [
module.vpc,
module.cloudsql
]
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 [Checkov] <CKV_TF_1> reported by reviewdog 🐶
Ensure Terraform module sources use a commit hash

@github-actions

Copy link
Copy Markdown

Project: kj-pola-web-prod

Terraform Format and Style 🖌 ✅

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ✅

Show Plan
terraform
Acquiring state lock. This may take a few moments...
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-web-prod/locations/global/workloadIdentityPools/github-actions-pool]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/monitoring.googleapis.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/serviceusage.googleapis.com]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/logging.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-web-prod/serviceAccounts/terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/storage.googleapis.com]
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/iam.googleapis.com]
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-web-prod/cloudresourcemanager.googleapis.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-prod=>roles/viewer"]: Refreshing state... [id=kj-pola-web-prod/roles/viewer/serviceAccount:terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-prod=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-web-prod/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-prod=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-web-prod/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-prod=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-web-prod/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-web-prod/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-web-prod/serviceAccounts/terraform-runner@kj-pola-web-prod.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/288124577198/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-web-prod, Workflow: Terraform

@github-actions

Copy link
Copy Markdown

Project: kj-pola-backend-prod

Terraform Format and Style 🖌 ✅

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ✅

Show Plan
terraform
Acquiring state lock. This may take a few moments...
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/cloudresourcemanager.googleapis.com]
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/iam.googleapis.com]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/monitoring.googleapis.com]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/storage.googleapis.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/serviceusage.googleapis.com]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-backend-prod/logging.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-backend-prod/serviceAccounts/terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-backend-prod/locations/global/workloadIdentityPools/github-actions-pool]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-prod=>roles/viewer"]: Refreshing state... [id=kj-pola-backend-prod/roles/viewer/serviceAccount:terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-prod=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-backend-prod/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-prod=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-backend-prod/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-prod=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-backend-prod/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-backend-prod/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-backend-prod/serviceAccounts/terraform-runner@kj-pola-backend-prod.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/306379713727/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-backend-prod, Workflow: Terraform

@github-actions

Copy link
Copy Markdown

Project: kj-pola-shared-prod

Terraform Format and Style 🖌 ✅

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ✅

Show Plan
terraform
Acquiring state lock. This may take a few moments...
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-shared-prod/locations/global/workloadIdentityPools/github-actions-pool]
module.docker_registry.google_artifact_registry_repository.repo: Refreshing state... [id=projects/kj-pola-shared-prod/locations/europe-central2/repositories/pola]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/storage.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-shared-prod/serviceAccounts/terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/logging.googleapis.com]
module.project_services.google_project_service.project_services["artifactregistry.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/artifactregistry.googleapis.com]
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/iam.googleapis.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/serviceusage.googleapis.com]
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/cloudresourcemanager.googleapis.com]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-shared-prod/monitoring.googleapis.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-shared-prod/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/viewer"]: Refreshing state... [id=kj-pola-shared-prod/roles/viewer/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-shared-prod/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-shared-prod/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/artifactregistry.admin"]: Refreshing state... [id=kj-pola-shared-prod/roles/artifactregistry.admin/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-shared-prod=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-shared-prod/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-shared-prod/serviceAccounts/terraform-runner@kj-pola-shared-prod.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/802307596796/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-shared-prod, Workflow: Terraform

@github-actions

Copy link
Copy Markdown

Project: kj-pola-backend-stg

Terraform Format and Style 🖌 ✅

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ✅

Show Plan
terraform
Acquiring state lock. This may take a few moments...
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-backend-stg/locations/global/workloadIdentityPools/github-actions-pool]
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/iam.googleapis.com]
module.vpc.google_compute_network.network[0]: Refreshing state... [id=projects/kj-pola-backend-stg/global/networks/pola-backend-stg-vpc]
module.project_services.google_project_service.project_services["sqladmin.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/sqladmin.googleapis.com]
module.project_services.google_project_service.project_services["compute.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/compute.googleapis.com]
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/cloudresourcemanager.googleapis.com]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/monitoring.googleapis.com]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/storage.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-backend-stg/serviceAccounts/terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.project_services.google_project_service.project_services["servicenetworking.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/servicenetworking.googleapis.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/serviceusage.googleapis.com]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/logging.googleapis.com]
module.project_services.google_project_service.project_services["run.googleapis.com"]: Refreshing state... [id=kj-pola-backend-stg/run.googleapis.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-backend-stg/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/artifactregistry.reader"]: Refreshing state... [id=kj-pola-backend-stg/roles/artifactregistry.reader/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/servicenetworking.networksAdmin"]: Refreshing state... [id=kj-pola-backend-stg/roles/servicenetworking.networksAdmin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-backend-stg/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/cloudsql.admin"]: Refreshing state... [id=kj-pola-backend-stg/roles/cloudsql.admin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/compute.networkAdmin"]: Refreshing state... [id=kj-pola-backend-stg/roles/compute.networkAdmin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-backend-stg/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/run.admin"]: Refreshing state... [id=kj-pola-backend-stg/roles/run.admin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-backend-stg/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-backend-stg=>roles/viewer"]: Refreshing state... [id=kj-pola-backend-stg/roles/viewer/serviceAccount:terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-backend-stg/serviceAccounts/terraform-runner@kj-pola-backend-stg.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/901165314592/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]
module.vpc.google_compute_global_address.psa_ranges["servicenetworking-googleapis-com-pola-backend-stg-psa-range"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/addresses/servicenetworking-googleapis-com-pola-backend-stg-psa-range]
module.vpc.google_compute_route.gateway["directpath-googleapis"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/routes/pola-backend-stg-vpc-directpath-googleapis]
module.vpc.google_compute_route.gateway["private-googleapis"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/routes/pola-backend-stg-vpc-private-googleapis]
module.vpc.google_compute_route.gateway["restricted-googleapis"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/routes/pola-backend-stg-vpc-restricted-googleapis]
module.vpc.google_service_networking_connection.psa_connection["servicenetworking.googleapis.com"]: Refreshing state... [id=projects%2Fkj-pola-backend-stg%2Fglobal%2Fnetworks%2Fpola-backend-stg-vpc:servicenetworking.googleapis.com]
module.vpc.google_compute_subnetwork.subnetwork["europe-central2/pola-backend-stg-subnet"]: Refreshing state... [id=projects/kj-pola-backend-stg/regions/europe-central2/subnetworks/pola-backend-stg-subnet]
module.vpc.google_compute_network_peering_routes_config.psa_routes["servicenetworking.googleapis.com"]: Refreshing state... [id=projects/kj-pola-backend-stg/global/networks/pola-backend-stg-vpc/networkPeerings/servicenetworking-googleapis-com]
module.cloudsql.data.google_compute_zones.available: Reading...
module.cloudsql.null_resource.module_depends_on: Refreshing state... [id=4401079993938560727]
module.cloudsql.google_sql_database_instance.default: Refreshing state... [id=pola-backend-stg-db]
module.cloudsql.data.google_compute_zones.available: Read complete after 0s [id=projects/kj-pola-backend-stg/regions/europe-central2]
module.cloudsql.random_password.user-password[0]: Refreshing state... [id=none]
module.cloudsql.google_sql_database.default[0]: Refreshing state... [id=projects/kj-pola-backend-stg/instances/pola-backend-stg-db/databases/default]
module.cloudsql.google_sql_user.default[0]: Refreshing state... [id=default//pola-backend-stg-db]

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.cloudsql.google_sql_database_instance.default has changed
  ~ resource "google_sql_database_instance" "default" {
        id                             = "pola-backend-stg-db"
        name                           = "pola-backend-stg-db"
        # (22 unchanged attributes hidden)

      ~ settings {
          ~ version                          = 1 -> 2
            # (20 unchanged attributes hidden)

          ~ ip_configuration {
              + custom_subject_alternative_names              = []
                # (7 unchanged attributes hidden)
            }

            # (8 unchanged blocks hidden)
        }

        # (2 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # google_project_iam_member.cloud_run_sa_artifact_registry_reader will be created
  + resource "google_project_iam_member" "cloud_run_sa_artifact_registry_reader" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com"
      + project = "kj-pola-shared-prod"
      + role    = "roles/artifactregistry.reader"
    }

  # module.cloud_run.google_cloud_run_v2_service.service_unmanaged[0] will be created
  + resource "google_cloud_run_v2_service" "service_unmanaged" {
      + conditions              = (known after apply)
      + create_time             = (known after apply)
      + creator                 = (known after apply)
      + delete_time             = (known after apply)
      + deletion_protection     = true
      + effective_annotations   = (known after apply)
      + effective_labels        = {
          + "goog-terraform-provisioned" = "true"
        }
      + etag                    = (known after apply)
      + expire_time             = (known after apply)
      + generation              = (known after apply)
      + iap_enabled             = false
      + id                      = (known after apply)
      + ingress                 = "INGRESS_TRAFFIC_ALL"
      + invoker_iam_disabled    = false
      + last_modifier           = (known after apply)
      + latest_created_revision = (known after apply)
      + latest_ready_revision   = (known after apply)
      + launch_stage            = (known after apply)
      + location                = "europe-central2"
      + name                    = "pola-backend-stg"
      + observed_generation     = (known after apply)
      + project                 = "kj-pola-backend-stg"
      + reconciling             = (known after apply)
      + terminal_condition      = (known after apply)
      + terraform_labels        = {
          + "goog-terraform-provisioned" = "true"
        }
      + traffic_statuses        = (known after apply)
      + uid                     = (known after apply)
      + update_time             = (known after apply)
      + uri                     = (known after apply)
      + urls                    = (known after apply)

      + scaling (known after apply)

      + template {
          + execution_environment            = "EXECUTION_ENVIRONMENT_GEN1"
          + max_instance_request_concurrency = (known after apply)
          + service_account                  = "pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com"
          + timeout                          = (known after apply)

          + containers {
              + build_info = (known after apply)
              + image      = "europe-central2-docker.pkg.dev/kj-pola-shared-prod/pola/pola-backend:latest"
              + name       = "app"

              + ports (known after apply)

              + resources {
                  + limits = {
                      + "cpu"    = "1000m"
                      + "memory" = "512Mi"
                    }
                }

              + startup_probe (known after apply)

              + volume_mounts {
                  + mount_path = "/cloudsql"
                  + name       = "cloudsql"
                }
            }

          + scaling {
              + max_instance_count = 1
              + min_instance_count = 0
            }

          + volumes {
              + name = "cloudsql"

              + cloud_sql_instance {
                  + instances = [
                      + "kj-pola-backend-stg:europe-central2:pola-backend-stg-db",
                    ]
                }
            }
        }

      + traffic (known after apply)
    }

  # module.cloud_run.google_project_iam_member.default["roles/artifactregistry.reader"] will be created
  + resource "google_project_iam_member" "default" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com"
      + project = "kj-pola-backend-stg"
      + role    = "roles/artifactregistry.reader"
    }

  # module.cloud_run.google_project_iam_member.default["roles/cloudsql.client"] will be created
  + resource "google_project_iam_member" "default" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com"
      + project = "kj-pola-backend-stg"
      + role    = "roles/cloudsql.client"
    }

  # module.cloud_run.google_project_iam_member.default["roles/logging.logWriter"] will be created
  + resource "google_project_iam_member" "default" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com"
      + project = "kj-pola-backend-stg"
      + role    = "roles/logging.logWriter"
    }

  # module.cloud_run.google_project_iam_member.default["roles/monitoring.metricWriter"] will be created
  + resource "google_project_iam_member" "default" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com"
      + project = "kj-pola-backend-stg"
      + role    = "roles/monitoring.metricWriter"
    }

  # module.cloud_run.google_project_iam_member.default["roles/storage.objectAdmin"] will be created
  + resource "google_project_iam_member" "default" {
      + etag    = (known after apply)
      + id      = (known after apply)
      + member  = "serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com"
      + project = "kj-pola-backend-stg"
      + role    = "roles/storage.objectAdmin"
    }

  # module.cloud_run.google_service_account.service_account[0] will be created
  + resource "google_service_account" "service_account" {
      + account_id   = "pola-backend-stg"
      + disabled     = false
      + display_name = "pola-backend-stg"
      + email        = "pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com"
      + id           = (known after apply)
      + member       = "serviceAccount:pola-backend-stg@kj-pola-backend-stg.iam.gserviceaccount.com"
      + name         = (known after apply)
      + project      = "kj-pola-backend-stg"
      + unique_id    = (known after apply)
    }

Plan: 8 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-backend-stg, Workflow: Terraform

@github-actions

Copy link
Copy Markdown

Project: kj-pola-web-stg

Terraform Format and Style 🖌 ✅

Checkov Security Scan 🔒 ❌

Terraform Initialization ⚙️ ✅

Terraform Validation 🤖 ✅

Terraform Plan 📖 ✅

Show Plan
terraform
module.gh_oidc.google_iam_workload_identity_pool.main: Refreshing state... [id=projects/kj-pola-web-stg/locations/global/workloadIdentityPools/github-actions-pool]
module.project_services.google_project_service.project_services["cloudresourcemanager.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/cloudresourcemanager.googleapis.com]
module.project_services.google_project_service.project_services["storage.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/storage.googleapis.com]
module.project_services.google_project_service.project_services["logging.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/logging.googleapis.com]
module.project_services.google_project_service.project_services["iam.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/iam.googleapis.com]
module.project_services.google_project_service.project_services["monitoring.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/monitoring.googleapis.com]
module.project_services.google_project_service.project_services["serviceusage.googleapis.com"]: Refreshing state... [id=kj-pola-web-stg/serviceusage.googleapis.com]
module.service_account.google_service_account.service_accounts["terraform-runner"]: Refreshing state... [id=projects/kj-pola-web-stg/serviceAccounts/terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.gh_oidc.google_iam_workload_identity_pool_provider.main: Refreshing state... [id=projects/kj-pola-web-stg/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-stg=>roles/iam.serviceAccountUser"]: Refreshing state... [id=kj-pola-web-stg/roles/iam.serviceAccountUser/serviceAccount:terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-stg=>roles/storage.objectAdmin"]: Refreshing state... [id=kj-pola-web-stg/roles/storage.objectAdmin/serviceAccount:terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-stg=>roles/viewer"]: Refreshing state... [id=kj-pola-web-stg/roles/viewer/serviceAccount:terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.service_account.google_project_iam_member.project-roles["terraform-runner-kj-pola-web-stg=>roles/serviceusage.serviceUsageAdmin"]: Refreshing state... [id=kj-pola-web-stg/roles/serviceusage.serviceUsageAdmin/serviceAccount:terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com]
module.gh_oidc.google_service_account_iam_member.wif-sa["terraform-runner"]: Refreshing state... [id=projects/kj-pola-web-stg/serviceAccounts/terraform-runner@kj-pola-web-stg.iam.gserviceaccount.com/roles/iam.workloadIdentityUser/principalSet://iam.googleapis.com/projects/345026739965/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/KlubJagiellonski/pola-terraform]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

Pusher: @skibinstein, Action: pull_request, Working Directory: stacks/projects/kj-pola-web-stg, Workflow: Terraform

@skibinstein
skibinstein merged commit aedc92e into main Jan 28, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant