Terraform 検証：手元から GCP GAE のNext.jsアプリをデプロイする

terraform --help                                                                                                    
Usage: terraform [global options] <subcommand> [args]

 terraform --version
Terraform v0.15.3
on darwin_amd64

Your version of Terraform is out of date! The latest version
is 1.0.0. You can update by downloading from https://www.terraform.io/downloads.html

terraform --version
Terraform v1.0.0
on darwin_amd64

gcloud config set project waddy

# サービスアカウント作成
gcloud iam service-accounts create terraform-serviceaccount --display-name "Account for Terraform"

# サービスアカウントに権限付与
# 使う範囲によりとなりますが、一旦「editor」ロールの権限を付与します。
gcloud projects add-iam-policy-binding waddy \
  --member serviceAccount:terraform-serviceaccount@waddy.iam.gserviceaccount.com \
  --role roles/editor

# アカウントのCredential発行
# Credentialのファイル名は「account.json」とする
gcloud iam service-accounts keys create credentials/account.json \
  --iam-account terraform-serviceaccount@waddy.iam.gserviceaccount.com

# 専用の環境変数にCredentialファイルを設定する
export GOOGLE_CLOUD_KEYFILE_JSON=credentials/account.json

## project ##
provider "google" {
  project     = "${var.project_name}"
  region      = "asia-northeast1"
  zone      = "asia-northeast1-a"
}

## App Engine ##
resource "google_app_engine_application" "app" {
  project     = "${var.project_name}"
  location_id = "asia-northeast1"
}

terraform apply

google_app_engine_application.app: Creating...
╷
│ Error: Error creating App Engine application: googleapi: Error 403: The caller does not have permission, forbidden
│
│   with google_app_engine_application.app,
│   on main.tf line 9, in resource "google_app_engine_application" "app":
│    9: resource "google_app_engine_application" "app" {

IAM authority does not have the permission 'appengine.applications.create' required for action Applications_CreateApplication on resource ...

## project ##
provider "google" {
  project     = "${var.project_name}"
  region      = "asia-northeast1"
  zone      = "asia-northeast1-a"
}

## App Engine ##
resource "google_app_engine_application" "app" {
  project     = "${var.project_name}"
  location_id = "asia-northeast2"
}

> terraform import google_app_engine_application.app waddy

Import successful!

The resources that were imported are shown above. These resources are now in
your Terraform state and will henceforth be managed by Terraform.

>  terraform plan
google_app_engine_application.app: Refreshing state... 

No changes. Infrastructure is up-to-date.

# fish shell につき
PROJECT_ID=(gcloud config get-value project) gsutil mb gs://$PROJECT_ID-artifact

# バージョニングを有効にする
PROJECT_ID=(gcloud config get-value project) gsutil versioning set on gs://{$PROJECT_ID}-artifact

{
    "lifecycle": {
        "rule": [
            {
                "action": {
                    "type": "Delete"
                },
                "condition": {
                    "age": 30,
                    "isLive": true
                }
            },
            {
                "action": {
                    "type": "Delete"
                },
                "condition": {
                    "numNewerVersions": 2
                }
            },
            {
                "action": {
                    "type": "Delete"
                },
                "condition": {
                    "age": 35,
                    "isLive": false
                }
            }
        ]
    }
}

PROJECT_ID=(gcloud config get-value project) gsutil lifecycle set bootstrap/bucket_lifecycle_config.json gs://{$PROJECT_ID}-artifact


PROJECT_ID=(gcloud config get-value project) gsutil lifecycle get gs://{$PROJECT_ID}-artifact
{"rule": [{"action": {"type": "Delete"}, "condition": {"age": 30, "isLive": true}}, {"action": {"type": "Delete"}, "condition": {"numNewerVersions": 2}}, {"action": {"type": "Delete"}, "condition": {"age": 35, "isLive": false}}]}

terraform plan
Backend reinitialization required. Please run "terraform init".
Reason: Initial configuration of the requested backend "gcs"

 terraform init

Initializing the backend...
╷
│ Error: Variables not allowed

terraform init -backend-config="bucket=artifact" 

Initializing the backend...
Do you want to copy existing state to the new backend?
  Pre-existing state was found while migrating the previous "local" backend to the
  newly configured "gcs" backend. No existing state was found in the newly
  configured "gcs" backend. Do you want to copy this state to the new "gcs"
  backend? Enter "yes" to copy and "no" to start with an empty state.

  Enter a value: yes


Successfully configured the backend "gcs"! Terraform will automatically
use this backend unless the backend configuration changes.

## App Engine ##
resource "google_app_engine_application" "app" {
  project = var.project_name
  location_id = "asia-northeast2"
}

## Frontend Service Builder ##
resource "google_cloudbuild_trigger" "build-trigger" {
  name = "build-frontend"
  filename = "build-frontend.yaml"

  github {
    owner = "cm-wada-yusuke"
    name = "apprunner-nextjs-ssr"
    push {
      branch = "main"
    }
  }

}

## Frontend Service Builder ##
resource "google_cloudbuild_trigger" "build-trigger" {
  name = "build-frontend"

  github {
    owner = "cm-wada-yusuke"
    name = "apprunner-nextjs-ssr"
    push {
      branch = "main"
    }
  }

  build {
    timeout = "600s"
    step {
      name = "node:14"
      entrypoint = "yarn"
      args = [
        "install"]
      dir = "."
    }
    step {
      name = "node:14"
      entrypoint = "yarn"
      args = [
        "build"]
      dir = "."
    }
    step {
      name = "gcr.io/cloud-builders/docker"
      args = [
        "build",
        "-t",
        "gcr.io/$PROJECT_ID/zip",
        "."]
      dir = "infra-terraform/modules/cicd/docker_zip"
    }
    images = [
      "gcr.io/$PROJECT_ID/zip"]
    step {
      name = "gcr.io/$PROJECT_ID/zip"
      args = [
        "-r",
        "artifact.zip",
        ".",
        "-x",
        "*/.git/*"]
      dir = "."
    }
    step {
      name = "bash"
      args = [
        "ls",
        "-la",
        ]
      dir = "."
    }
    artifacts {
      objects {
        location = var.artifacts_location
        paths = [
          "artifact.zip"]
      }
    }
  }
}

FROM ubuntu
RUN apt-get -q update && \
apt-get -qqy install zip bzip2 gzip

ENTRYPOINT ["zip"]

## App Engine ##
resource "google_app_engine_application" "app" {
  project = var.project_name
  location_id = "asia-northeast2"
  serving_status = "USER_DISABLED"
}

## App Engine ##
resource "google_app_engine_application" "app" {
  project = var.project_name
  location_id = "asia-northeast2"
  serving_status = "SERVING"
}

resource "google_app_engine_standard_app_version" "next-ssr" {
  version_id = "v1"
  service = "next-ssr"
  runtime = "nodejs14"

  deployment {
    zip {
      source_url = var.artifacts_url
    }
  }

  env_variables = {
    port = "3000"
  }

  handlers {
    url_regex = "/.*"
    security_level = "SECURE_ALWAYS"
    script {
      script_path = "auto"
    }
  }

  automatic_scaling {
    max_concurrent_requests = 10
    min_idle_instances = 0
    max_idle_instances = 0
    min_pending_latency = "1s"
    max_pending_latency = "5s"
    standard_scheduler_settings {
      target_cpu_utilization = 0.5
      target_throughput_utilization = 0.75
      min_instances = 1
      max_instances = 2
    }
  }

  delete_service_on_destroy = true
}

terraform import google_app_engine_standard_app_version.next-ssr apps/waddy/services/next-ssr/versions/v1
Error: resource address "google_app_engine_standard_app_version.next-ssr" does not exist in the configuration.

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
  - destroy

│ Error: Error when reading or editing AppVersion: googleapi: Error 400: Cannot delete the final version of a service (module). Please delete the whole service (module) in order to delete this version.