Terraform i stor skala: Hantera 200+ resurser utan att tappa kontrollen

infrastructure/
├── modules/                    # Återanvändbara building blocks
│   ├── gcp-project/           # Skapar GCP-projekt med standardinst.
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   └── README.md
│   ├── bigquery-dataset/      # Dataset + IAM + tabeller
│   ├── cloud-function/        # Function + trigger + IAM
│   ├── vpc-network/           # VPC + subnets + firewall
│   ├── gke-cluster/           # GKE med node pools
│   └── cloud-sql/             # CloudSQL med replikor
│
├── environments/               # Kompositionsmoduler per miljö
│   ├── production/
│   │   ├── networking/        # VPC, VPN, DNS
│   │   │   ├── main.tf
│   │   │   ├── backend.tf
│   │   │   └── terraform.tfvars
│   │   ├── data-platform/     # BigQuery, Cloud Functions
│   │   ├── compute/           # GKE, VMs
│   │   └── security/          # IAM, secrets, KMS
│   ├── staging/
│   └── development/
│
├── shared/                     # Delad infrastruktur (DNS, billing)
└── scripts/                    # CI/CD-hjälp, validering

# modules/cloud-function/main.tf

resource "google_cloudfunctions2_function" "function" {
  name        = var.function_name
  location    = var.region
  description = var.description
  project     = var.project_id

  build_config {
    runtime     = var.runtime
    entry_point = var.entry_point
    source {
      storage_source {
        bucket = var.source_bucket
        object = var.source_object
      }
    }
  }

  service_config {
    max_instance_count    = var.max_instances
    min_instance_count    = var.min_instances
    available_memory      = var.memory
    timeout_seconds       = var.timeout
    service_account_email = var.service_account

    environment_variables = merge(
      var.environment_variables,
      {
        SENTRY_DSN     = var.sentry_dsn
        ENVIRONMENT    = var.environment
        FUNCTION_NAME  = var.function_name
      }
    )
  }

  labels = merge(var.labels, {
    managed_by  = "terraform"
    environment = var.environment
    team        = var.team
  })
}

# Alltid skapa en alert policy för felprocent
resource "google_monitoring_alert_policy" "error_rate" {
  display_name = "${var.function_name} error rate"
  project      = var.project_id
  combiner     = "OR"

  conditions {
    display_name = "Error rate > 5%"
    condition_threshold {
      filter          = <<-EOT
        resource.type = "cloud_function"
        AND resource.labels.function_name = "${var.function_name}"
        AND metric.type = "cloudfunctions.googleapis.com/function/execution_count"
        AND metric.labels.status != "ok"
      EOT
      duration        = "300s"
      comparison      = "COMPARISON_GT"
      threshold_value = 0.05
    }
  }

  notification_channels = var.notification_channels
}

# Användning av modulen i produktionsmiljön

module "ingest_bolagsregister" {
  source = "../../../modules/cloud-function"

  function_name  = "ingest-bolagsregister"
  project_id     = var.project_id
  region         = "europe-north1"
  runtime        = "nodejs20"
  entry_point    = "handler"
  memory         = "1Gi"
  timeout        = 540
  max_instances  = 5
  min_instances  = 0
  environment    = "production"
  team           = "data-platform"

  environment_variables = {
    BQ_DATASET    = module.raw_dataset.dataset_id
    BQ_TABLE      = "stg_bolagsregister"
    PROXY_POOL    = "proxytjänst-residential-se"
    BATCH_SIZE    = "500"
  }

  service_account        = module.sa_data_ingestion.email
  sentry_dsn            = var.sentry_dsn
  notification_channels = [var.slack_channel_id]
  source_bucket         = var.functions_bucket
  source_object         = "ingest-bolagsregister-v12.zip"
}

# Samma modul för alla andra ingest-funktioner
module "ingest_företagskatalog" {
  source = "../../../modules/cloud-function"
  # ... (samma struktur, andra parametrar)
}

module "ingest_bolagsverket" {
  source = "../../../modules/cloud-function"
  # ...
}

terraform {
  backend "gcs" {
    bucket = "enterprise-tf-state"
    prefix = "production/data-platform"
  }

  required_version = ">= 1.7.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.20"
    }
  }
}

# I data-platform/main.tf - läsa nätverksinformation
data "terraform_remote_state" "networking" {
  backend = "gcs"
  config = {
    bucket = "enterprise-tf-state"
    prefix = "production/networking"
  }
}

# Använd output från nätverkslayern
resource "google_compute_network_endpoint_group" "functions" {
  network = data.terraform_remote_state.networking.outputs.vpc_id
  subnetwork = data.terraform_remote_state.networking.outputs.functions_subnet_id
  # ...
}

name: Terraform CI/CD
on:
  pull_request:
    paths: ['infrastructure/**']
  push:
    branches: [main]
    paths: ['infrastructure/**']

env:
  TF_VERSION: "1.7.4"
  GOOGLE_CREDENTIALS: ${{ secrets.GCP_SA_KEY }}

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      workspaces: ${{ steps.changes.outputs.workspaces }}
    steps:
      - uses: actions/checkout@v4
      - id: changes
        run: |
          # Hitta vilka workspaces som ändrats
          CHANGED=$(git diff --name-only HEAD~1 | \
            grep "^infrastructure/environments/" | \
            cut -d'/' -f3,4 | sort -u | jq -R . | jq -s .)
          echo "workspaces=$CHANGED" >> $GITHUB_OUTPUT

  validate:
    needs: detect-changes
    runs-on: ubuntu-latest
    strategy:
      matrix:
        workspace: ${{ fromJson(needs.detect-changes.outputs.workspaces) }}
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Terraform Init
        working-directory: infrastructure/environments/${{ matrix.workspace }}
        run: terraform init -backend=false

      - name: Terraform Validate
        working-directory: infrastructure/environments/${{ matrix.workspace }}
        run: terraform validate

      - name: TFLint
        run: |
          curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash
          cd infrastructure/environments/${{ matrix.workspace }}
          tflint --init && tflint

      - name: Checkov Security Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: infrastructure/environments/${{ matrix.workspace }}
          framework: terraform

  plan:
    needs: [detect-changes, validate]
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    strategy:
      matrix:
        workspace: ${{ fromJson(needs.detect-changes.outputs.workspaces) }}
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Terraform Plan
        working-directory: infrastructure/environments/${{ matrix.workspace }}
        run: |
          terraform init
          terraform plan -out=tfplan -no-color 2>&1 | tee plan.txt

      - name: Kommentera på PR
        uses: actions/github-script@v7
        with:
          script: |
            const plan = require('fs').readFileSync(
              'infrastructure/environments/${{ matrix.workspace }}/plan.txt', 'utf8'
            );
            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: '## Terraform Plan: ${{ matrix.workspace }}\n\`\`\`\n' + plan + '\n\`\`\`'
            });

  apply:
    needs: [detect-changes, validate]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    environment: production
    strategy:
      matrix:
        workspace: ${{ fromJson(needs.detect-changes.outputs.workspaces) }}
      max-parallel: 1  # En workspace åt gången!
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ env.TF_VERSION }}

      - name: Terraform Apply
        working-directory: infrastructure/environments/${{ matrix.workspace }}
        run: |
          terraform init
          terraform apply -auto-approve

#!/bin/bash
# Interaktivt script för att köra terraform plan
# Användning: ./scripts/tf-plan.sh [environment] [workspace]

ENV=${1:-production}
WORKSPACE=${2:-}

if [ -z "$WORKSPACE" ]; then
  echo "Tillgängliga workspaces för $ENV:"
  ls -1 infrastructure/environments/$ENV/
  read -p "Välj workspace: " WORKSPACE
fi

DIR="infrastructure/environments/$ENV/$WORKSPACE"

if [ ! -d "$DIR" ]; then
  echo "Workspace finns inte: $DIR"
  exit 1
fi

echo ">>> Initierar Terraform i $DIR..."
cd "$DIR"
terraform init -upgrade

echo ">>> Kör plan..."
terraform plan -out=tfplan

echo ""
echo "För att applicera, kör:"
echo "  cd $DIR && terraform apply tfplan"

# Infrastructure ownership
infrastructure/modules/              @platform-team
infrastructure/environments/*/networking/  @platform-team
infrastructure/environments/*/compute/     @platform-team
infrastructure/environments/*/data-platform/ @data-team
infrastructure/environments/*/security/    @security-team @platform-team
infrastructure/shared/                     @platform-team