Skip to content

Commit 345aa16

Browse files
Huzefaaa2Huzefaaa2
committed
Scaffold Apigee enterprise stack
1 parent 122207c commit 345aa16

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

84 files changed

+2850
-2
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: ci
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches: ["main"]
7+
8+
jobs:
9+
terraform:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v4
13+
- uses: hashicorp/setup-terraform@v3
14+
with:
15+
terraform_version: "1.6.6"
16+
- name: Terraform fmt
17+
run: terraform fmt -recursive -check
18+
- name: Terraform validate (examples)
19+
run: |
20+
for d in examples/*; do
21+
if [ -d "$d" ]; then
22+
echo "Validating $d"
23+
(cd "$d" && terraform init -backend=false -input=false && terraform validate)
24+
fi
25+
done

‎.github/workflows/docs.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: docs
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
publish:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
- uses: actions/setup-python@v5
17+
with:
18+
python-version: "3.x"
19+
- name: Install MkDocs
20+
run: pip install mkdocs
21+
- name: Build site
22+
run: mkdocs build --clean
23+
- name: Deploy to GitHub Pages
24+
uses: peaceiris/actions-gh-pages@v4
25+
with:
26+
github_token: ${{ secrets.GITHUB_TOKEN }}
27+
publish_dir: site

‎.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
.terraform/
2+
*.tfstate
3+
*.tfstate.*
4+
.terraform.lock.hcl
5+
.DS_Store
6+
*.log

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Changelog
2+
3+
## v0.1.0
4+
- Initial scaffold

‎CONTRIBUTING.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Contributing
2+
3+
Thanks for contributing!
4+
5+
- Use `terraform fmt -recursive`
6+
- Add docs updates in `docs/`
7+
- Add diagrams in `diagrams/`

‎README.md‎

Lines changed: 169 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,169 @@
1-
# terraform-apigee-enterprise-stack
2-
Production-grade Terraform Stack for Apigee X on GCP (Enterprise-ready, opinionated, secure-by-default)
1+
# Terraform Apigee Enterprise Stack (GCP) - Production-Grade Terraform Stacks Reference Architecture
2+
3+
**terraform-apigee-enterprise-stack** is an opinionated, **enterprise-ready** reference implementation for deploying **Apigee X on Google Cloud (GCP)** using **Terraform Stacks**.
4+
It gives platform teams a repeatable way to provision **Apigee Org, Instances, Environments, EnvGroups, networking, DNS, IAM, and KMS (CMEK)** with secure-by-default patterns.
5+
6+
> Keywords: Terraform Apigee X, Apigee Terraform, Apigee X Terraform Stack, GCP API Management Terraform, Apigee enterprise architecture, Apigee landing zone, Apigee private ingress, Apigee CMEK, Apigee multi-region HA.
7+
8+
---
9+
10+
## Why this repository exists
11+
12+
Many Apigee Terraform examples are either low-level or incomplete for enterprise rollouts. This stack provides:
13+
14+
- **Terraform Stacks-first** structure for platform engineering and multi-environment workflows
15+
- **Secure-by-default** networking patterns (private ingress, controlled egress, IAM least privilege)
16+
- **Enterprise readiness**: CMEK, logging/monitoring hooks, clear separation of duties, production checklists
17+
- **Battle-tested repo hygiene**: examples, docs, diagrams, changelog, CI scaffolding
18+
19+
---
20+
21+
## What you can deploy
22+
23+
### Apigee control plane (platform)
24+
- Apigee Org (existing Google Cloud Org / project model)
25+
- Apigee X Instances (single region or multi-region)
26+
- Apigee Environments and EnvGroups
27+
- Hostnames + DNS record structure (authoritative DNS external to this repo is supported)
28+
29+
### Enterprise foundations
30+
- Networking patterns for Apigee runtime access (**private ingress** supported)
31+
- **Cloud KMS (CMEK)** for supported resources (where applicable)
32+
- IAM roles and service accounts for platform vs application teams
33+
34+
---
35+
36+
## Architecture diagrams
37+
38+
- **Single-region production**: `diagrams/png/apigee-single-region.png`
39+
- **Multi-region HA**: `diagrams/png/apigee-multi-region-ha.png`
40+
- **CI/CD + Policy**: `diagrams/png/apigee-cicd-policy.png`
41+
42+
Mermaid sources:
43+
- `diagrams/mermaid/apigee-single-region.mmd`
44+
- `diagrams/mermaid/apigee-multi-region-ha.mmd`
45+
- `diagrams/mermaid/apigee-cicd-policy.mmd`
46+
47+
## Docs (MkDocs)
48+
49+
The docs live in `docs/` and can be published with MkDocs.
50+
51+
Local preview:
52+
53+
```
54+
mkdocs serve
55+
```
56+
57+
Deploy to GitHub Pages:
58+
59+
```
60+
mkdocs gh-deploy --force
61+
```
62+
63+
---
64+
65+
## Repository layout
66+
67+
```text
68+
terraform-apigee-enterprise-stack/
69+
├── stacks/
70+
│ ├── apigee-platform/ # Apigee control plane + foundation components
71+
│ │ ├── stack.hcl # Terraform Stacks entrypoint
72+
│ │ ├── variables.tf
73+
│ │ ├── outputs.tf
74+
│ │ └── components/
75+
│ │ ├── iam/
76+
│ │ ├── kms/
77+
│ │ ├── networking/
78+
│ │ ├── org/
79+
│ │ ├── instances/
80+
│ │ ├── environments/
81+
│ │ └── envgroups/
82+
│ └── runtime/ # Optional runtime ingress/DNS patterns
83+
│ ├── stack.hcl
84+
│ ├── components/
85+
│ │ ├── ingress/
86+
│ │ ├── dns/
87+
│ │ └── observability/
88+
├── policies/ # Policy-as-code examples (OPA/Conftest-ready)
89+
├── examples/ # End-to-end example deployments
90+
├── docs/ # Enterprise documentation
91+
├── diagrams/ # Mermaid + PNG diagrams
92+
└── .github/workflows/ # CI scaffolding (fmt, validate, docs)
93+
```
94+
95+
---
96+
97+
## Quickstart (10-15 minutes)
98+
99+
> This repo is designed for **platform engineering teams**. If you are new to Apigee X, start with the docs: `docs/01-overview.md`.
100+
101+
### Prerequisites
102+
- Terraform >= 1.6
103+
- Google Cloud project(s) + permissions
104+
- Apigee API enabled
105+
- A VPC strategy decided (shared VPC recommended for enterprises)
106+
107+
### Steps
108+
1. Clone and enter the repo
109+
2. Copy an example:
110+
- `examples/single-region/` (recommended first)
111+
3. Populate `terraform.tfvars`
112+
4. Run:
113+
- `terraform init`
114+
- `terraform plan`
115+
- `terraform apply`
116+
117+
> Terraform Stacks workflow depends on your Terraform Stacks runtime (Terraform Cloud/Enterprise, or local stacks toolchain if available in your environment).
118+
> This repo includes both **Stacks structure** and **plain Terraform module execution** paths.
119+
120+
---
121+
122+
## Production checklist
123+
124+
See: `docs/06-production-checklist.md`
125+
126+
Highlights:
127+
- Enable CMEK where supported
128+
- Separate projects for platform vs app teams
129+
- Centralized logging/monitoring and alerting
130+
- Define hostname strategy and certificate lifecycle
131+
- Adopt policy-as-code and drift detection
132+
133+
---
134+
135+
## Security & compliance
136+
137+
- Least-privilege IAM patterns in `stacks/apigee-platform/components/iam`
138+
- CMEK/KMS scaffolding in `stacks/apigee-platform/components/kms`
139+
- Policy examples in `policies/`
140+
141+
See: `docs/05-security.md`
142+
143+
---
144+
145+
## Examples
146+
147+
- `examples/single-region/` - single region baseline (prod-ready starter)
148+
- `examples/multi-region-ha/` - multi-region HA pattern (active/active-ish routing patterns)
149+
150+
---
151+
152+
## Roadmap
153+
154+
- v1.0: Single-region platform stack + private ingress patterns + docs
155+
- v1.1: Multi-region HA reference + runbooks
156+
- v1.2: GitHub/GitLab CI templates + policy gate examples
157+
- v2.0: Apigee Edge -> X migration helper docs and scripts
158+
159+
---
160+
161+
## Contributing
162+
163+
PRs welcome. Please read `CONTRIBUTING.md` and open an issue for architectural changes.
164+
165+
---
166+
167+
## License
168+
169+
MIT. See `LICENSE`.

‎ci-templates/github-actions.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
name: terraform-enterprise-template
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches: ["main"]
7+
8+
env:
9+
TF_VERSION: "1.6.6"
10+
TF_DIR: "examples/single-region"
11+
12+
jobs:
13+
fmt-validate:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v4
17+
- uses: hashicorp/setup-terraform@v3
18+
with:
19+
terraform_version: ${{ env.TF_VERSION }}
20+
- name: Terraform fmt
21+
run: terraform fmt -recursive -check
22+
- name: Terraform validate
23+
run: |
24+
cd "${TF_DIR}"
25+
terraform init -backend=false -input=false
26+
terraform validate
27+
28+
tflint:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/checkout@v4
32+
- uses: terraform-linters/setup-tflint@v3
33+
- name: TFLint
34+
run: |
35+
tflint --init
36+
tflint -f compact
37+
38+
checkov:
39+
runs-on: ubuntu-latest
40+
steps:
41+
- uses: actions/checkout@v4
42+
- name: Checkov
43+
uses: bridgecrewio/checkov-action@v12
44+
with:
45+
directory: .
46+
47+
policy:
48+
runs-on: ubuntu-latest
49+
steps:
50+
- uses: actions/checkout@v4
51+
- name: Install Conftest
52+
run: |
53+
curl -L -o conftest.tar.gz https://github.com/open-policy-agent/conftest/releases/latest/download/conftest_Linux_x86_64.tar.gz
54+
tar -xzf conftest.tar.gz
55+
sudo mv conftest /usr/local/bin
56+
- name: Conftest policy gate
57+
run: conftest test -p policies "${TF_DIR}"
58+
59+
plan:
60+
runs-on: ubuntu-latest
61+
needs: [fmt-validate, tflint, checkov, policy]
62+
steps:
63+
- uses: actions/checkout@v4
64+
- uses: hashicorp/setup-terraform@v3
65+
with:
66+
terraform_version: ${{ env.TF_VERSION }}
67+
- name: Terraform plan
68+
run: |
69+
cd "${TF_DIR}"
70+
terraform init -input=false
71+
terraform plan -out=tfplan
72+
- name: Upload plan artifact
73+
uses: actions/upload-artifact@v4
74+
with:
75+
name: tfplan
76+
path: ${{ env.TF_DIR }}/tfplan
77+
78+
apply:
79+
runs-on: ubuntu-latest
80+
needs: [plan]
81+
environment: production
82+
steps:
83+
- uses: actions/checkout@v4
84+
- uses: hashicorp/setup-terraform@v3
85+
with:
86+
terraform_version: ${{ env.TF_VERSION }}
87+
- name: Download plan artifact
88+
uses: actions/download-artifact@v4
89+
with:
90+
name: tfplan
91+
path: ${{ env.TF_DIR }}
92+
- name: Terraform apply
93+
run: |
94+
cd "${TF_DIR}"
95+
terraform apply -input=false tfplan

‎ci-templates/gitlab-ci.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
stages:
2+
- validate
3+
- policy
4+
- plan
5+
- approval
6+
- apply
7+
8+
variables:
9+
TF_VERSION: "1.6.6"
10+
TF_DIR: "examples/single-region"
11+
12+
validate:
13+
stage: validate
14+
image: hashicorp/terraform:${TF_VERSION}
15+
script:
16+
- terraform fmt -recursive -check
17+
- cd "${TF_DIR}"
18+
- terraform init -backend=false -input=false
19+
- terraform validate
20+
21+
policy:
22+
stage: policy
23+
image: alpine:3.19
24+
script:
25+
- apk add --no-cache curl tar
26+
- curl -L -o conftest.tar.gz https://github.com/open-policy-agent/conftest/releases/latest/download/conftest_Linux_x86_64.tar.gz
27+
- tar -xzf conftest.tar.gz
28+
- mv conftest /usr/local/bin/conftest
29+
- conftest test -p policies "${TF_DIR}"
30+
31+
plan:
32+
stage: plan
33+
image: hashicorp/terraform:${TF_VERSION}
34+
script:
35+
- cd "${TF_DIR}"
36+
- terraform init -input=false
37+
- terraform plan -out=tfplan
38+
artifacts:
39+
paths:
40+
- ${TF_DIR}/tfplan
41+
42+
approval:
43+
stage: approval
44+
when: manual
45+
script:
46+
- echo "Manual approval required"
47+
48+
apply:
49+
stage: apply
50+
image: hashicorp/terraform:${TF_VERSION}
51+
dependencies:
52+
- plan
53+
script:
54+
- cd "${TF_DIR}"
55+
- terraform apply -input=false tfplan
56+
when: manual

0 commit comments

Comments
 (0)