Feat/enterprise landing zone expansion#152
Closed
ForeverYoung48 wants to merge 36 commits into
Closed
Conversation
added 30 commits
July 21, 2026 18:01
…hancements - Implement dynamic context interpolation engine (variable "context") across organization, folder, project, iam-service-account, logging-bucket, vpc-sc, gcs, pubsub, and net-vpc modules. - Enhance project module with shared VPC attachments, automated CMEK IAM service agent bindings, expanded service-agents registry, and tag bindings. - Add factory data-driven perimeter configuration and formal JSON schema validation for ingress/egress policies in vpc-sc module. - Add dedicated psc outputs for global and regional Private Service Connect endpoints in net-address module. - Enhance compute-vm with resource-policies support and attached disk snapshot policies. - Update subnet schemas and secondary IP range handling in net-vpc.
…print - Add modules/privileged-access-manager for Google Cloud native Just-In-Time (JIT) privileged access management. - Support organization, folder, and project level PAM entitlements. - Include approval workflows, manual/automated approvals, and notification integrations. - Add blueprints/experimental/privileged-access-manager demonstration blueprint.
…peline - Re-architect fast/stages-aw into a 6-stage lifecycle for regulated/enterprise environments: - 0-organization-bootstrap: Organization-level IAM, custom roles, billing account linkage, and mandatory policy constraints. - 1-assured-workload: Assured Workloads environment provisioning with compliance regime support. - 2-resman: Resource hierarchy for Core, NetSec, Shared Services, and Tenant folder structures. - 3-networking & 3-vpn: Hub-and-Spoke VPC topologies, Cloud Interconnect, Cross-Cloud VPN, and Cloud NGFW. - 4-security: VPC-SC perimeters, Cloud KMS keys, Secret Manager, Certificate Authority Service, and SCC. - 5-tenants: Tenant project factories and automated network/CMEK attachments. - shared-services: Modular stages for Active Directory (ad), DNS, NTP, SMTP, BCAP, and ACAS.
… blueprints - Add new IL5 & FedRAMP High blueprints: - blueprints/il5/acas: Assured Compliance Assessment Solution (Tenable SecurityCenter and Nessus). - blueprints/il5/cloudbuild-tf-automation: Terraform CI/CD automation pipeline on GCP. - blueprints/fedramp-high/cross-cloud-vpn: High-availability IPSec VPN connectivity between GCP and AWS. - blueprints/fedramp-high/vpc-peering-project: VPC network management and automated VPC Peering. - blueprints/fedramp-high/keycloak & keycloak-cac: Enterprise Keycloak IdP on GKE with Cloud SQL and CAC/PKI auth. - blueprints/third-party-solutions/gitlab: Production-ready GitLab Community Edition instance. - Upgrade provider versions, VPC-SC compatibility, and CMEK bindings across existing blueprints.
…k sorter, and GKE GitOps example - Add tools/latency: Python benchmarking tool (baseline.py, hybrid.py, hybridenvelope.py) for network latency, throughput, and jitter testing. - Add tools/sort_tf_file.awk: Gawk script to format and alphabetically sort Terraform configuration blocks. - Add examples/gke-gitops-deployment: End-to-end working demonstration for deploying FastAPI services on GKE using Cloud Build automation and GitOps workflows.
…ines, and architecture guides - Add .devcontainer environment with pre-installed Terraform, gcloud, tflint, checkov, and cspell. - Add modular .gitlab/ci pipelines and child-pipeline.yml for automated linting, security testing, and deployment. - Add documentation/netsec-services.md for NetSec landing zone services and shared governance architecture. - Add documentation/naming-convention.md for standardized Google Cloud resource naming guidelines.
…nding-zone-expansion
…ing-zone-expansion
…nding-zone-expansion
…-landing-zone-expansion
…ng-zone-expansion
…contexts, and fix relative doc links
…oject-config schema, and sample tenant
…onfig, and markdown documentation files
- Verify SHA-256 integrity of downloaded lego binary in generate_certs.sh - Pass Keycloak credentials via stdin in configure_keycloak.sh to avoid process list exposure - Refactor gem4gov.py HTTP requests to use native google.auth and urllib.request - Replace plaintext passwords in secret-manager examples with placeholders
…d Foundation Fabric - Sync 86 shared modules to latest Cloud Foundation Fabric codebase - Add 11 new modules (backup-dr, bigquery-connection, cloud-deploy, etc.) - Add FAST addons, extras, and project templates - Add updated developer tools and schema validators - Update provider constraints in default-versions.tf to >= 6.0.0, < 8.0.0 - Enforce 2026 Google LLC copyright headers across all files
- Remove duplicate header blocks in .tflint.hcl, branch-tenants.tf, and blueprint README files
…and notebook headers - Clean up depends_on comment bracket in load_balancer.tf - Fix raw string escape sequence warnings in state_iam.py - Update copyright headers in notebook and config template files
…, and FAST v2 stages - Add Architecture Decision Records (adrs/) covering CAA, load balancer interface standardization, tag bindings, and FAST v2 stage architecture - Add resource factory specification (FACTORIES.md), CFT integration guide (FABRIC-AND-CFT.md), and edge-case documentation (CURSED_KNOWLEDGE.md) - Add standard FAST v2 stages (fast/stages/) alongside Assured Workloads stages (fast/stages-aw/)
…nd doc links - Add tenant schema validation file (fast/assets/schemas/tenant.schema.yaml) - Add complete test suite and fixtures from Cloud Foundation Fabric (tests/) - Add missing 2026 Google LLC license headers across .gitlab/ci configuration files - Repair relative markdown documentation links across fast, docs, and modules
…26 Google LLC copyright headers - Genericize isolated network prompts and sample domains across deployment scripts and samples - Standardize all copyright headers to 2026 Google LLC across all source, test, script, and documentation files
… DNS and SMTP sample tfvars
…ional reference templates
added 6 commits
July 22, 2026 12:54
…lay boilerplate templates
…ity host and VPC references
…ges, and link test fixtures fabric
… across modules and stages
…te Assured Workloads API validation script
…ce scope APIs across all stages
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context.
Fixes # (GitHub issue id)
Type of Change
Deployment & Compliance Impact
Checklist
Code Quality & Reusability
modules/orfast/can be leveraged for this change.documentation/naming-convention.md.Documentation
README.mdof the modified module or blueprint.Security
Testing
Testing Performed
Please describe the tests that you ran to verify your changes.