### Full GKE Hub Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/gke-hub/README.md

This example demonstrates the complete setup of a GKE Hub, including project creation, VPC network configuration, a GKE cluster, and the GKE Hub itself with Config Management and Policy Controller enabled.

```hcl
module "project" {
  source          = "./fabric/modules/project"
  billing_account = var.billing_account_id
  name            = "gkehub-test"
  parent          = "folders/12345"
  services = [
    "anthosconfigmanagement.googleapis.com",
    "container.googleapis.com",
    "gkeconnect.googleapis.com",
    "gkehub.googleapis.com",
    "multiclusteringress.googleapis.com",
    "multiclusterservicediscovery.googleapis.com",
    "mesh.googleapis.com"
  ]
}

module "vpc" {
  source     = "./fabric/modules/net-vpc"
  project_id = module.project.project_id
  name       = "network"
  subnets = [{
    ip_cidr_range = "10.0.0.0/24"
    name          = "cluster-1"
    region        = "europe-west1"
    secondary_ip_range = {
      pods     = { ip_cidr_range = "10.1.0.0/16" }
      services = { ip_cidr_range = "10.2.0.0/24" }
    }
  }]
}

module "cluster_1" {
  source     = "./fabric/modules/gke-cluster-standard"
  project_id = module.project.project_id
  name       = "cluster-1"
  location   = "europe-west1"
  access_config = {
    ip_access = {
      authorized_ranges = {
        rfc1918_10_8 = "10.0.0.0/8"
      }
    }
  }
  vpc_config = {
    network    = module.vpc.self_link
    subnetwork = module.vpc.subnet_self_links["europe-west1/cluster-1"]
  }
  enable_features = {
    dataplane_v2      = true
    workload_identity = true
  }
  cluster_autoscaling = {
    enabled = true
  }
}

module "hub" {
  source     = "./fabric/modules/gke-hub"
  project_id = module.project.project_id
  location   = "europe-west1"
  clusters = {
    cluster-1 = {
      id                = module.cluster_1.id
      configmanagement  = "default"
      policycontroller  = "default"
      servicemesh       = null
      workload_identity = false
    }
  }
  features = {
    configmanagement = true
    policycontroller = true
  }
  configmanagement_templates = {
    default = {
      config_sync = {
        git = {
          policy_dir    = "configsync"
          source_format = "hierarchy"
          sync_branch   = "main"
          sync_repo     = "https://github.com/danielmarzini/configsync-platform-example"
        }
        source_format = "hierarchy"
      }
      hierarchy_controller = {
        enable_hierarchical_resource_quota = true
        enable_pod_tree_labels             = true
      }
      version = "v1"
    }
  }
  policycontroller_templates = {
    default = {
      version = "v1.17.3"
      policy_controller_hub_config = {
        audit_interval_seconds    = 120
        exemptable_namespaces     = ["kube-system", "kube-public"]
        log_denies_enabled        = true
        referential_rules_enabled = true
      }
    }
  }
}

# tftest inventory=full.yaml

```

--------------------------------

### Complete Project Automation Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/project-factory/README.md

A comprehensive example of project configuration including billing, parent, services, IAM roles, service accounts, and GCS bucket setup. This snippet shows the full structure for defining a project with automation resources.

```yaml
# file name: prod-app-example-0
# prefix via factory defaults: foo
# project id: foo-prod-app-example-0
billing_account: 012345-67890A-BCDEF0
parent: folders/12345678
services:
  - compute.googleapis.com
  - stackdriver.googleapis.com
iam:
  roles/owner:
    - $iam_principals:service_accounts/iac-core-0/rw
  roles/viewer:
    - $iam_principals:service_accounts/iac-core-0/ro
automation:
  project: $project_ids:iac-core-0
  service_accounts:
    # sa name: foo-prod-app-example-0-rw
    rw:
      description: Read/write automation sa for app example 0.
    # sa name: foo-prod-app-example-0-ro
    ro:
      description: Read-only automation sa for app example 0.
  bucket:
    # bucket name: foo-prod-app-example-0-tf-state
    description: Terraform state bucket for app example 0.
    iam:
      roles/storage.objectCreator:
        - $iam_principals:service_accounts/iac-core-0/rw
      roles/storage.objectViewer:
        - $iam_principals:service_accounts/iac-core-0/rw
        - $iam_principals:service_accounts/iac-core-0/ro
        - group:devops@example.org

```

--------------------------------

### Setup AlloyDB Cluster with Project and VPC

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/alloydb/README.md

This example demonstrates setting up a project, VPC, and an AlloyDB cluster with a primary instance. It configures Private Service Access for the AlloyDB network.

```hcl
module "project" {
  source          = "./fabric/modules/project"
  billing_account = var.billing_account_id
  parent          = var.folder_id
  name            = "alloydb"
  prefix          = var.prefix
  services = [
    "servicenetworking.googleapis.com",
    "alloydb.googleapis.com",
  ]
}

module "vpc" {
  source     = "./fabric/modules/net-vpc"
  project_id = module.project.project_id
  name       = "my-network"
  # need only one - psa_config or subnets_psc
  psa_configs = [{
    ranges = { alloydb = "10.60.0.0/16" }
  }]
  subnets_psc = [{
    ip_cidr_range = "10.0.3.0/24"
    name          = "psc"
    region        = var.region
  }]
}

module "alloydb" {
  source         = "./fabric/modules/alloydb"
  project_id     = module.project.project_id
  project_number = var.project_number
  cluster_name   = "db"
  instance_name  = "db"
  location       = var.region
  network_config = {
    psa_config = {
      network = module.vpc.id
    }
  }

  deletion_protection = false
}
# tftest modules=3 resources=17 inventory=simple.yaml e2e

```

--------------------------------

### Full Looker Core Deployment Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/looker-core/README.md

A comprehensive example demonstrating the setup of a Looker Core instance with advanced configurations, including project creation, VPC network with PSA, KMS encryption, and IAM roles. Requires OAuth client ID and secret, and specifies the platform edition.

```hcl
module "project" {
  source          = "./fabric/modules/project"
  billing_account = var.billing_account_id
  parent          = var.folder_id
  name            = "looker"
  prefix          = var.prefix
  services = [
    "cloudkms.googleapis.com",
    "iap.googleapis.com",
    "looker.googleapis.com",
    "servicenetworking.googleapis.com"
  ]
}

module "vpc" {
  source     = "./fabric/modules/net-vpc"
  project_id = module.project.project_id
  name       = "my-network"
  psa_configs = [
    {
      ranges = { looker = "10.60.0.0/16" }
    }
  ]
}

module "kms" {
  source     = "./fabric/modules/kms"
  project_id = module.project.project_id
  keyring = {
    location = var.region
    name     = "keyring"
  }
  keys = {
    "key-regional" = {
    }
  }
  iam = {
    "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
      module.project.service_agents.looker.iam_email
    ]
  }
}

module "looker" {
  source     = "./fabric/modules/looker-core"
  project_id = module.project.project_id
  region     = var.region
  name       = "looker"
  admin_settings = {
    allowed_email_domains = ["google.com"]
  }
  encryption_config = {
    kms_key_name = module.kms.keys.key-regional.id
  }
  network_config = {
    psa_config = {
      network = module.vpc.id
    }
  }
  oauth_config = {
    client_id     = "xxxxxxxxx"
    client_secret = "xxxxxxxx"
  }
  platform_edition = "LOOKER_CORE_ENTERPRISE_ANNUAL"
}
# tftest modules=4 resources=23 inventory=full.yaml
```

--------------------------------

### Initial SSM Instance Configuration

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/secure-source-manager-instance/README.md

Configure a new Secure Source Manager instance with a default branch and gitignore settings for a repository. This example demonstrates the basic setup for a new instance.

```hcl
module "ssm_instance" {
  source      = "./fabric/modules/secure-source-manager-instance"
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
  repositories = {
    my-repository = {
      initial_config = {
        default_branch = "main"
        gitignores     = ["terraform.tfstate"]
      }
    }
  }
}
# tftest inventory=initial-config.yaml

```

--------------------------------

### Create a Simple Managed Instance Group

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/compute-mig/README.md

This example demonstrates the basic setup for a Managed Instance Group (MIG) using a pre-defined instance template. It sets the target size for the MIG.

```hcl
module "cos-nginx" {
  source = "./fabric/modules/cloud-config-container/nginx"
}

module "nginx-template" {
  source     = "./fabric/modules/compute-vm"
  project_id = var.project_id
  name       = "nginx-template"
  zone       = "${var.region}-b"
  tags       = ["http-server", "ssh"]
  network_interfaces = [{
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
    nat        = false
    addresses  = null
  }]
  boot_disk = {
    source = {
      image = "projects/cos-cloud/global/images/family/cos-stable"
    }
  }
  create_template = {}
  metadata = {
    user-data = module.cos-nginx.cloud_config
  }
}

module "nginx-mig" {
  source            = "./fabric/modules/compute-mig"
  project_id        = var.project_id
  location          = "${var.region}-b"
  name              = "mig-test"
  target_size       = 2
  instance_template = module.nginx-template.template.self_link
}
# tftest modules=2 resources=2 inventory=simple.yaml e2e
```

--------------------------------

### Extract IAM Bindings for Organization

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/fast/stages/README.md

This example demonstrates how to get IAM bindings at the organization level, specifically for use in organization setup configurations.

```shell
gcloud organizations get-iam-policy 12345 | yq '.bindings | map({"key": .role, "value": .members}) | from_entries'
```

--------------------------------

### Configure Managed Instance Group Backend

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/net-lb-app-ext/README.md

This example demonstrates configuring a managed instance group (MIG) as a backend. It includes the setup for the MIG itself and its integration with the load balancer module.

```hcl
module "win-template" {
  source          = "./fabric/modules/compute-vm"
  project_id      = var.project_id
  zone            = "${var.region}-a"
  name            = "win-template"
  machine_type    = "n2d-standard-2"
  create_template = {}
  boot_disk = {
    initialize_params = {
      size = 70
    }
    source = {
      image = "projects/windows-cloud/global/images/windows-server-2019-dc-v20221214"
    }
  }
  network_interfaces = [{
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
    nat        = false
    addresses  = null
  }]
}

module "win-mig" {
  source            = "./fabric/modules/compute-mig"
  project_id        = var.project_id
  location          = "${var.region}-a"
  name              = "win-mig"
  instance_template = module.win-template.template.self_link
  autoscaler_config = {
    max_replicas    = 3
    min_replicas    = 1
    cooldown_period = 30
    scaling_signals = {
      cpu_utilization = {
        target = 0.80
      }
    }
  }
  named_ports = {
    http = 80
  }
}

module "glb-0" {
  source     = "./fabric/modules/net-lb-app-ext"
  project_id = var.project_id
  name       = "glb-test-0"
  backend_service_configs = {
    default = {
      backends = [
        { backend = module.win-mig.group_manager.instance_group }
      ]
    }
  }
}
# tftest modules=3 resources=8 inventory=managed-instance-groups.yaml e2e
```

--------------------------------

### FAQ on Installing Fast on Non-Empty Org

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/CHANGELOG.0.md

Provides a Frequently Asked Questions (FAQ) document addressing the installation of 'Fast' on an organization that is not empty. This guide helps users navigate potential complexities.

```Markdown
- FAQ on installing Fast on a non-empty org.
```

--------------------------------

### Complex Load Balancer Configuration Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/net-lb-app-ext/README.md

This example demonstrates a complex load balancer setup using the net-lb-app-ext module. It configures backend buckets, multiple backend services with different backend types (instance groups and NEGs), health checks, and URL maps to route traffic based on hosts and paths. It also shows how to set HTTPS for specific backends.

```hcl
module "glb-0" {
  source     = "./fabric/modules/net-lb-app-ext"
  project_id = var.project_id
  name       = "glb-test-0"
  backend_buckets_config = {
    gcs-0 = {
      bucket_name = var.bucket
    }
  }
  backend_service_configs = {
    default = {
      backends = [
        { backend = "group-zone-b" },
        { backend = "group-zone-c" },
      ]
    }
    neg-gce-0 = {
      backends = [{
        balancing_mode = "RATE"
        backend        = "neg-zone-c"
        max_rate       = { per_endpoint = 10 }
      }]
    }
    neg-hybrid-0 = {
      backends = [{
        balancing_mode = "RATE"
        backend        = "neg-hello"
        max_rate       = { per_endpoint = 10 }
      }]
      health_checks = ["neg"]
      protocol      = "HTTPS"
    }
  }
  group_configs = {
    group-zone-b = {
      zone = "${var.region}-b"
      instances = [
        module.compute-vm-group-b.id
      ]
      named_ports = { http = 80 }
    }
    group-zone-c = {
      zone = "${var.region}-c"
      instances = [
        module.compute-vm-group-c.id
      ]
      named_ports = { http = 80 }
    }
  }
  health_check_configs = {
    default = {
      http = {
        port = 80
      }
    }
    neg = {
      https = {
        host = "hello.example.com"
        port = 443
      }
    }
  }
  neg_configs = {
    neg-zone-c = {
      gce = {
        network    = var.vpc.self_link
        subnetwork = var.subnet.self_link
        zone       = "${var.region}-c"
        endpoints = {
          e-0 = {
            instance   = "my-ig-c"
            ip_address = module.compute-vm-group-c.internal_ip
            port       = 80
          }
        }
      }
    }
    neg-hello = {
      hybrid = {
        network = var.vpc.self_link
        zone    = "${var.region}-b"
        endpoints = {
          e-0 = {
            ip_address = "192.168.0.3"
            port       = 443
          }
        }
      }
    }
  }
  urlmap_config = {
    default_service = "default"
    host_rules = [
      {
        hosts        = ["*"]
        path_matcher = "gce"
      },
      {
        hosts        = ["hello.example.com"]
        path_matcher = "hello"
      },
      {
        hosts        = ["static.example.com"]
        path_matcher = "static"
      }
    ]
    path_matchers = {
      gce = {
        default_service = "default"
        path_rules = [
          {
            paths   = ["/gce-neg", "/gce-neg/*"]
            service = "neg-gce-0"
          }
        ]
      }
      hello = {
        default_service = "neg-hybrid-0"
      }
      static = {
        default_service = "gcs-0"
      }
    }
  }
}
# tftest modules=3 resources=19 fixtures=fixtures/compute-vm-group-bc.tf inventory=complex-example.yaml e2e

```

--------------------------------

### Simple VM Creation with Defaults

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/CONTRIBUTING.md

Demonstrates creating a basic VM instance using default boot disk settings. This is suitable for quick experimentation when specific disk configurations are not required.

```hcl
module "simple-vm-example" {
  source     = "./modules/compute-vm"
  project_id = var.project_id
  zone     = "europe-west1-b"
  name       = "test"
}
```

--------------------------------

### Data Playground Terraform Setup Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/CHANGELOG.0.md

This snippet presents a new example showcasing a Terraform setup for a data playground. It provides a template for creating a dedicated environment for data analysis and experimentation on Google Cloud.

```Terraform
No specific code provided in the text for this example.
```

--------------------------------

### Create VM with Hyperdisk and Storage Pool

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/compute-vm/README.md

This example demonstrates creating a VM with a boot disk and attached disks configured with hyperdisk and a storage pool. Ensure the storage pool is defined separately.

```hcl
resource "google_compute_storage_pool" "default" {
  project                      = var.project_id
  name                         = "storage-pool-basic"
  pool_provisioned_capacity_gb = "20480"
  pool_provisioned_iops        = "10000"
  pool_provisioned_throughput  = 1024
  storage_pool_type            = "hyperdisk-balanced"
  zone                         = "${var.region}-c"
  deletion_protection          = false
}

module "vm-disk-options-example" {
  source       = "./fabric/modules/compute-vm"
  project_id   = var.project_id
  zone         = "${var.region}-c"
  name         = "test"
  machine_type = "c4d-standard-2"
  network_interfaces = [
    {
      network    = var.vpc.self_link
      subnetwork = var.subnet.self_link
    }
  ]
  boot_disk = {
    use_independent_disk = {}
    initialize_params = {
      type = "hyperdisk-balanced"
      hyperdisk = {
        provisioned_iops       = 3000
        provisioned_throughput = 140
        storage_pool           = google_compute_storage_pool.default.id
      }
    }
    source = {
      image = "projects/debian-cloud/global/images/family/debian-12"
    }
  }
  attached_disks = {
    data1 = {
      initialize_params = {
        type = "hyperdisk-balanced"
        hyperdisk = {
          storage_pool = google_compute_storage_pool.default.id
        }
      }
    }
    data2 = {
      initialize_params = {
        type = "hyperdisk-balanced"
        hyperdisk = {
          provisioned_iops       = 5000
          provisioned_throughput = 500
        }
      }
      source = {
        image = "projects/debian-cloud/global/images/family/debian-12"
      }
    }
  }
  service_account = {
    auto_create = true
  }
  shielded_config = {}
}
```

--------------------------------

### Create ARM VM with Hyperdisk Configuration

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/compute-vm/README.md

This example shows how to configure a VM for ARM64 architecture with hyperdisk boot and attached disks, specifying performance parameters like IOPS and throughput.

```hcl
module "vm-arm" {
  source       = "./fabric/modules/compute-vm"
  project_id   = var.project_id
  zone         = "${var.region}-c"
  name         = "test"
  machine_type = "c4a-standard-1"
  network_interfaces = [{
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }]
  boot_disk = {
    architecture = "ARM64"
    initialize_params = {
      type = "hyperdisk-balanced"
      hyperdisk = {
        provisioned_iops       = 3000
        provisioned_throughput = 140
      }
    }
    source = {
      image = "projects/debian-cloud/global/images/family/debian-12-arm64"
    }
  }
  attached_disks = {
    data1 = {
      initialize_params = {
        type = "hyperdisk-balanced"
        hyperdisk = {
          provisioned_iops       = 3000
          provisioned_throughput = 140
        }
      }
    }
    data2 = {
      initialize_params = {
        type = "hyperdisk-balanced"
        hyperdisk = {
          provisioned_iops       = 5000
          provisioned_throughput = 500
        }
      }
      source = {
        image = "projects/debian-cloud/global/images/family/debian-12-arm64"
      }
    }
  }
  service_account = {
    auto_create = true
  }
  shielded_config = {}
}

# tftest inventory=disk-hyperdisk-arm.yaml e2e
```

--------------------------------

### Boot Disk Example: Default (from image)

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/adrs/modules/20260323-compute-vm-refactoring.md

Configures a default boot disk using an image source. `initialize_params` specify size and type, while `source.image` points to the desired image.

```hcl
boot_disk = {
  auto_delete = true
  source = {
    image = "projects/debian-cloud/global/images/family/debian-11"
  }
  initialize_params = {
    size = 20
    type = "pd-ssd"
  }
}
```

--------------------------------

### Nginx Reverse Proxy Cluster Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/CHANGELOG.0.md

This example demonstrates the setup of an Nginx reverse proxy cluster using Managed Instance Groups (MIGs). It showcases how to configure load balancing and auto-scaling for a web application.

```HCL
resource "google_compute_instance_template" "nginx_template" {
  name_prefix  = "nginx-template-"
  machine_type = "e2-small"

  disk {
    source_image = "debian-cloud\/debian-11"
  }

  network_interface {
    network = "default"
  }
}

resource "google_compute_autoscaler" "nginx_autoscaler" {
  name   = "nginx-autoscaler"
  zone   = "us-central1-a"
  target = google_compute_instance_group_manager.nginx_manager.id

  autoscaling_policy {
    max_replicas = 5
    min_replicas = 1

    cpu_utilization {
      target = 0.6
    }
  }
}
```

--------------------------------

### Create VM Instance Using Defaults

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/compute-vm/README.md

This snippet demonstrates the simplest way to create a VM instance, relying on default settings for the boot disk and utilizing a module-created service account. It's suitable for basic deployments where custom configurations are not immediately required. The `instance_count` variable can be used to manage multiple instances.

```hcl
module "simple-vm-example" {
  source     = "./fabric/modules/compute-vm"
  project_id = var.project_id
  zone       = "${var.region}-b"
  name       = "test"
  network_interfaces = [{
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }]
}
# tftest modules=1 resources=1 inventory=defaults.yaml e2e
```

--------------------------------

### IAM Bindings on Service Accounts Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/CHANGELOG.0.md

This snippet adds support for IAM bindings on service accounts to the project factory example. It demonstrates how to manage permissions for service accounts using Terraform within the project factory setup.

```Terraform
No specific code provided in the text for this example.
```

--------------------------------

### Default Nginx Instance Configuration

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/cloud-config-container/nginx/README.md

This example demonstrates the default module configuration, which sets up a basic Nginx web server using the `nginxdemos/hello` image. It also shows how to integrate this module with a Compute Engine instance resource.

```hcl
module "cos-nginx" {
  source = "./fabric/modules/cloud-config-container/nginx"
}

module "vm-nginx-tls" {
  source     = "./fabric/modules/compute-vm"
  project_id = "my-project"
  zone       = "europe-west8-b"
  name       = "cos-nginx"
  network_interfaces = [{
    network    = "default"
    subnetwork = "gce"
  }]
  metadata = {
    user-data              = module.cos-nginx.cloud_config
    google-logging-enabled = true
  }
  boot_disk = {
    source = {
      image = "projects/cos-cloud/global/images/family/cos-stable"
    }
    initialize_params = {
      type = "pd-ssd"
      size = 10
    }
  }
  tags = ["http-server", "ssh"]
}
# tftest modules=1 resources=1
```

--------------------------------

### Configure Spoke with Load-Balanced Router Appliances

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/ncc-spoke-ra/README.md

Example of configuring an NCC spoke with multiple router appliances for high availability. This setup allows for load balancing across the specified appliances.

```hcl
resource "google_network_connectivity_hub" "default" {
  name        = "Hub"
  description = "Hub"
  project     = var.project_id
}

module "spoke-ra" {
  source     = "./fabric/modules/ncc-spoke-ra"
  hub        = { id = google_network_connectivity_hub.default.id }
  name       = "spoke-ra"
  project_id = var.project_id
  region     = var.region
  router_appliances = [
    {
      internal_ip  = module.compute-vm-primary-b.internal_ip
      vm_self_link = module.compute-vm-primary-b.self_link
    },
    {
      internal_ip  = module.compute-vm-primary-c.internal_ip
      vm_self_link = module.compute-vm-primary-c.self_link
    }
  ]
  router_config = {
    asn = 65000
    custom_advertise = {
      all_subnets = true
      ip_ranges = {
        "10.10.0.0/24" = "peered-vpc"
      }
    }
    ip_interface0 = "10.0.16.14"
    ip_interface1 = "10.0.16.15"
    peer_asn      = 65001
  }
  vpc_config = {
    network_name     = var.vpc.self_link
    subnet_self_link = var.subnet.self_link
  }
}
# tftest modules=5 resources=13 fixtures=fixtures/compute-vm-nva.tf e2e
```

--------------------------------

### Deploy Default Squid Proxy

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/cloud-config-container/__need_fixing/squid/README.md

This example demonstrates setting up a Squid proxy that allows connections to `.github.com` from the `10.0.0.0/8` CIDR range. It also shows how to configure a Compute Engine instance to use the generated cloud-config.

```hcl
module "cos-squid" {
  source  = "./fabric/modules/cloud-config-container/__need_fixing/squid"
  allow   = [".github.com"]
  clients = ["10.0.0.0/8"]
}

module "vm" {
  source     = "./fabric/modules/compute-vm"
  project_id = "my-project"
  zone       = "europe-west8-b"
  name       = "cos-squid"
  network_interfaces = [{
    network    = "default"
    subnetwork = "gce"
  }]
  metadata = {
    user-data              = module.cos-squid.cloud_config
    google-logging-enabled = true
  }
  boot_disk = {
    initialize_params = {
      image = "projects/cos-cloud/global/images/family/cos-stable"
      type  = "pd-ssd"
      size  = 10
    }
  }
  tags = ["http-server", "ssh"]
}
# tftest modules=1 resources=1
```

--------------------------------

### Create VM with Independent Boot Disk

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/compute-vm/README.md

This example shows how to create a VM where the boot disk is managed as an independent resource. This allows for instance recreation while preserving the boot disk's state.

```hcl
module "simple-vm-example" {
  source     = "./fabric/modules/compute-vm"
  project_id = var.project_id
  zone       = "${var.region}-b"
  name       = "test"
  boot_disk = {
    use_independent_disk = {}
  }
  network_interfaces = [{
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }]
  service_account = {
    auto_create = true
  }
}
# tftest inventory=independent-boot-disk.yaml e2e
```

--------------------------------

### Hybrid NAT Configuration

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/net-cloudnat/README.md

This example demonstrates a hybrid NAT setup, enabling NAT for private subnets within a VPC. It configures dynamic port allocation and specifies rules for hybrid traffic.

```hcl
module "vpc1" {
  source     = "./fabric/modules/net-vpc"
  project_id = var.project_id
  name       = "vpc1"
  subnets = [
    {
      ip_cidr_range = "10.0.0.0/24"
      name          = "vpc1-subnet"
      region        = var.region
    }
  ]
  subnets_private_nat = [
    {
      ip_cidr_range = "192.168.15.0/24"
      name          = "vpc1-nat"
      region        = var.region
    }
  ]
}

module "vpc1-nat" {
  source         = "./fabric/modules/net-cloudnat"
  project_id     = var.project_id
  region         = var.region
  name           = "vpc1-nat"
  type           = "PRIVATE"
  router_network = module.vpc1.id
  config_source_subnetworks = {
    all = false
    subnetworks = [
      {
        self_link = module.vpc1.subnet_ids["${var.region}/vpc1-subnet"]
      }
    ]
  }
  config_port_allocation = {
    enable_endpoint_independent_mapping = false
    enable_dynamic_port_allocation      = true
  }
  rules = [
    {
      description = "private nat"
      match       = "nexthop.is_hybrid"
      source_ranges = [
        module.vpc1.subnets_private_nat["${var.region}/vpc1-nat"].id
      ]
    }
  ]
}
# tftest modules=2 resources=8 inventory=hybrid.yaml
```

--------------------------------

### Create a Managed Kafka Cluster with Topics

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/managed-kafka/README.md

This example shows how to provision a Managed Kafka cluster along with predefined topics and their configurations.

```hcl
module "kafka-cluster-with-topics" {
  source     = "./fabric/modules/managed-kafka"
  project_id = var.project_id
  location   = "europe-west1"
  cluster_id = "my-kafka-cluster-topics"

  capacity_config = {
    vcpu_count   = 6
    memory_bytes = 6442450944 # 6 GiB
  }

  subnets = [var.subnets.primary.id]

  topics = {
    topic-a = {
      partition_count    = 3
      replication_factor = 3
      configs = {
        "cleanup.policy" = "delete"
      }
    }
    topic-b = {
      partition_count    = 6
      replication_factor = 3
    }
  }
}
# tftest modules=1 resources=3 inventory=topics.yaml
```

--------------------------------

### Dockerfile for Azure DevOps Agent with GCP Tools

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/fast/project-templates/devops-azure-wif/self-hosted-agents/README.md

Customize the Dockerfile to embed gcloud and terraform within the agent container. This example uses a different base image and installs necessary packages and tools.

```dockerfile
# FROM python:3-alpine

FROM gcr.io/google.com/cloudsdktool/google-cloud-cli:alpine

ARG TERRAFORM_VERSION=1.14.0
ENV TARGETARCH="linux-musl-x64"

# Another option:
# FROM arm64v8/alpine
# ENV TARGETARCH="linux-musl-arm64"

# Alpine packages

RUN apk update && \
  apk upgrade && \
  apk add \
    bash curl gcc git icu-libs jq musl-dev python3-dev libffi-dev \
    openssl-dev cargo make py-pip unzip

# Terraform
RUN curl -LO https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip && \
    unzip terraform_${TERRAFORM_VERSION}_linux_amd64.zip && \
    mv terraform /usr/local/bin/ && \
    rm terraform_${TERRAFORM_VERSION}_linux_amd64.zip

# Azure CLI

RUN pip install --break-system-packages azure-cli

WORKDIR /azp/

COPY ./start.sh ./ 
RUN chmod 755 ./start.sh

RUN adduser -D agent
RUN chown agent ./
USER agent

# Another option is to run the agent as root.
# ENV AGENT_ALLOW_RUNASROOT="true"

ENTRYPOINT [ "./start.sh" ]
```

--------------------------------

### Create vault and plan

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/backup-dr/README.md

This example shows how to create both a backup vault and a backup plan with daily and monthly backup rules. It requires a project ID, location, vault name, and detailed backup plan configuration.

```hcl
module "dr_example" {
  source     = "./fabric/modules/backup-dr"
  project_id = "your-gcp-project-id"
  location   = "us-central1"
  name       = "backup-vault"

  backup_plans = {
    my-backup-plan = {
      resource_type = "compute.googleapis.com/Instance"
      description   = "Backup Plan for GCE Instances."
      backup_rules = [
        {
          rule_id               = "daily-backup-rule"
          backup_retention_days = 30
          standard_schedule = {
            recurrence_type  = "HOURLY"
            hourly_frequency = 6
            time_zone        = "America/Los_Angeles"
            backup_window = {
              start_hour_of_day = 1
              end_hour_of_day   = 5
            }
          }
        },
        {
          rule_id               = "monthly-backup-rule"
          backup_retention_days = 30
          standard_schedule = {
            recurrence_type = "MONTHLY"
            time_zone       = "America/Los_Angeles"
            week_day_of_month = {
              week_of_month = "FIRST"
              day_of_week   = "MONDAY"
            }
            backup_window = {
              start_hour_of_day = 1
              end_hour_of_day   = 5
            }
          }
        }
      ]
    }
  }
}
# tftest inventory=vault-plan.yaml
```

--------------------------------

### Cross-Project Backend Services Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/net-lb-app-int-cross-region/README.md

Illustrates configuring cross-project backend services for Internal Load Balancers, suitable for Shared VPC setups. Note the explicit `project_id` for both backend services and health checks.

```hcl
module "ilb-l7" {
  source     = "./fabric/modules/net-lb-app-int-cross-region"
  name       = "ilb-test"
  project_id = "prj-host"
  backend_service_configs = {
    default = {
      project_id = "prj-svc"
      backends = [{
        group = "projects/prj-svc/zones/europe-west1-a/instanceGroups/my-ig-ew1"
        }, {
        group = "projects/prj-svc/zones/europe-west4-a/instanceGroups/my-ig-ew4"
      }]
    }
  }
  health_check_configs = {
    default = {
      project_id = "prj-svc"
      http = {
        port_specification = "USE_SERVING_PORT"
      }
    }
  }
  vpc_config = {
    network = var.vpc.self_link
    subnetworks = {
      europe-west1 = var.subnet1.self_link
      europe-west4 = var.subnet2.self_link
    }
  }
}
# tftest modules=1 resources=6
```

--------------------------------

### Create Folder with IAM Bindings

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/folder/README.md

Example of creating a folder with multiple IAM configurations including additive and principal-based bindings. Ensure variable keys for `iam_by_principals` are static.

```hcl
module "folder" {
  source = "./fabric/modules/folder"
  parent = var.folder_id
  name   = "Folder name"
  iam_by_principals = {
    "group:${var.group_email}" = [
      "roles/owner",
      "roles/resourcemanager.folderAdmin",
      "roles/resourcemanager.projectCreator"
    ]
  }
  iam = {
    "roles/owner" = ["serviceAccount:${var.service_account.email}"]
  }
  iam_bindings_additive = {
    am1-storage-admin = {
      member = "serviceAccount:${var.service_account.email}"
      role   = "roles/storage.admin"
    }
  }
}
# tftest modules=1 resources=5 inventory=iam.yaml e2e
```

--------------------------------

### Single Region HA VPN over Interconnect Setup

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/net-ipsec-over-interconnect/README.md

This example demonstrates how to configure a single-region HA VPN gateway with multiple tunnels over Interconnect. It includes the creation of a Google Cloud Router and an external VPN gateway, and defines the interconnect attachments and tunnel configurations.

```hcl
resource "google_compute_router" "encrypted-interconnect-overlay-router" {
  name    = "encrypted-interconnect-overlay-router"
  project = "myproject"
  network = "mynet"
  region  = "europe-west8"
  bgp {
    asn               = 64514
    advertise_mode    = "CUSTOM"
    advertised_groups = ["ALL_SUBNETS"]
    advertised_ip_ranges {
      range = "10.255.255.0/24"
    }
    advertised_ip_ranges {
      range = "192.168.255.0/24"
    }
  }
}

resource "google_compute_external_vpn_gateway" "default" {
  name        = "peer-vpn-gateway"
  project     = "myproject"
  description = "Peer IPSec over Interconnect VPN gateway"
  interface {
    id         = 0
    ip_address = "10.0.0.1"
  }
  interface {
    id         = 1
    ip_address = "10.0.0.2"
  }
}

module "vpngw-a" {
  source     = "./fabric/modules/net-ipsec-over-interconnect"
  project_id = "myproject"
  network    = "mynet"
  region     = "europe-west8"
  name       = "vpngw-a"
  interconnect_attachments = {
    a = "attach-01"
    b = "attach-02"
  }
  peer_gateway_config = {
    create = false
    id     = google_compute_external_vpn_gateway.default.id
  }
  router_config = {
    create = false
    name   = google_compute_router.encrypted-interconnect-overlay-router.name
  }
  tunnels = {
    remote-0 = {
      bgp_peer = {
        address = "169.254.1.2"
        asn     = 64514
        # MD5 Authentication is optional
        md5_authentication_key = {
          name = "foo"
          key  = "bar"
        }
      }
      bgp_session_range     = "169.254.1.1/30"
      shared_secret         = "foobar"
      vpn_gateway_interface = 0
    }
    remote-1 = {
      bgp_peer = {
        address = "169.254.1.6"
        asn     = 64514
      }
      bgp_session_range     = "169.254.1.5/30"
      shared_secret         = "foobar"
      vpn_gateway_interface = 1
    }
    remote-2 = {
      bgp_peer = {
        address = "169.254.1.10"
        asn     = 64514
      }
      bgp_session_range     = "169.254.1.9/30"
      shared_secret         = "foobar"
      vpn_gateway_interface = 0
    }
    remote-3 = {
      bgp_peer = {
        address = "169.254.1.14"
        asn     = 64514
      }
      bgp_session_range     = "169.254.1.13/30"
      shared_secret         = "foobar"
      vpn_gateway_interface = 1
    }
  }
}
# tftest modules=1 resources=16

```

--------------------------------

### Configure Repositories for Creation and Population

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/fast/extras/0-cicd-github/README.md

Configure repositories to be created and specify which ones should be populated with initial files. This example creates repositories for stages 00 and 01, and populates initial files for stages 00, 01, and 02.

```tfvars
repositories = {
  fast_00_org_setup = {
    create_options = {
      description = "FAST org setup."
      features = {
        issues = true
      }
    }
    populate_from = "../../stages/0-org-setup"
  }
}
```

--------------------------------

### Create a Search Engine Agent

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/ai-applications/README.md

A minimal example to set up a Search Engine agent. This configuration focuses solely on creating the search engine without additional data store configurations.

```hcl
module "ai-applications" {
  source     = "./fabric/modules/ai-applications"
  name       = "my-search-app"
  project_id = var.project_id
  data_stores_configs = {
    data-store-1 = {
      solution_types = ["SOLUTION_TYPE_SEARCH"]
    }
  }
  engines_configs = {
    data_store_ids       = ["data-store-1"]
    search_engine_config = {}
  }
}
```

--------------------------------

### Filtering Proxy Networking Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/CHANGELOG.0.md

Introduces a new `filtering_proxy` networking example. This example likely demonstrates how to set up a proxy for filtering network traffic.

```Terraform
new `filtering_proxy` networking example
```

--------------------------------

### Replace GCS to BQ Dataflow Example

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/CHANGELOG.0.md

The GCS to BQ with Dataflow example has been removed and replaced by a more efficient 'GCS to BQ with least privileges' example.

```Terraform
remove GCS to BQ with Dataflow example, replace by GCS to BQ with least privileges
```

--------------------------------

### Boot Disk Example: Attaching Existing Disk

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/adrs/modules/20260323-compute-vm-refactoring.md

Configures a boot disk by attaching an existing disk. `source.attach` specifies the existing disk, and `initialize_params` are omitted as they are not applicable for attachment.

```hcl
boot_disk = {
  auto_delete = false
  source = {
    attach = "projects/my-project/zones/europe-west1-b/disks/my-existing-boot-disk"
  }
  # initialize_params are omitted/ignored when attaching
}
```

--------------------------------

### Project Module Outputs

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/project/README.md

This example demonstrates how to define a project using the module and output its default service accounts. This allows referencing project outputs in other modules or resources.

```hcl
module "project" {
  source          = "./fabric/modules/project"
  billing_account = var.billing_account_id
  name            = "project"
  prefix          = var.prefix
  parent          = var.folder_id
  services = [
    "compute.googleapis.com"
  ]
}

output "default_service_accounts" {
  value = module.project.default_service_accounts
}
# tftest modules=1 resources=3 inventory=outputs.yaml e2e
```

--------------------------------

### Interpolation Examples

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/fast/stages/2-networking/README.md

Provides examples of how to reference various network resources using interpolation with different namespaces.

```plaintext
- $addresses:my_vpc/my_address
- $folder_ids:my_folder
- $locations:my_region
- $ncc_groups:my_hub/my_group
- $ncc_hubs:my_hub
- $networks:my_vpc
- $project_ids:my_project
- $routers:my_vpc/my_vpn
- $vpn_gateways:my_vpc/my_gateway
```

--------------------------------

### Extend Inventory-Based Testing to Examples

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/CHANGELOG.0.md

This change extends the inventory-based testing methodology to include example configurations. This allows for more comprehensive testing of the project's examples.

```Python
import json

def run_inventory_test(example_path):
    # Placeholder for inventory-based testing logic
    print(f"Running inventory test for: {example_path}")
    try:
        with open(os.path.join(example_path, 'inventory.json'), 'r') as f:
            inventory_data = json.load(f)
            # Process inventory_data for testing
            print("Inventory data loaded successfully.")
    except FileNotFoundError:
        print(f"Error: inventory.json not found in {example_path}", file=sys.stderr)
    except json.JSONDecodeError:
        print(f"Error: Invalid JSON in inventory.json for {example_path}", file=sys.stderr)

# Example usage:
# if __name__ == "__main__":
#     run_inventory_test("examples/simple_app")
```

--------------------------------

### Dataplex Instance with Lake, Zone, and Assets

Source: https://github.com/googlecloudplatform/cloud-foundation-fabric/blob/master/modules/dataplex/README.md

Use this example to set up a Dataplex instance with a lake, a RAW zone, and a CURATED zone, including GCS and BigQuery assets. The RAW zone is configured for discovery, while the CURATED zone is not.

```hcl
module "dataplex" {
  source     = "./fabric/modules/dataplex"
  name       = "terraform-lake"
  prefix     = "test"
  project_id = "myproject"
  region     = "europe-west2"
  zones = {
    landing = {
      type      = "RAW"
      discovery = true
      assets = {
        gcs_1 = {
          resource_name          = "gcs_bucket"
          cron_schedule          = "15 15 * * *"
          discovery_spec_enabled = true
          resource_spec_type     = "STORAGE_BUCKET"
        }
      }
    },
    curated = {
      type      = "CURATED"
      discovery = false
      assets = {
        bq_1 = {
          resource_name          = "bq_dataset"
          cron_schedule          = null
          discovery_spec_enabled = false
          resource_spec_type     = "BIGQUERY_DATASET"
        }
      }
    }
  }
}

# tftest modules=1 resources=5

```