Skip to content

Commit f14dde2

Browse files
adela-bytebaseadela-bytebase
authored
add tutorial hcl (#123)
* add tutorial hcl * fix
1 parent 4387299 commit f14dde2

File tree

5 files changed

+329
-0
lines changed

5 files changed

+329
-0
lines changed

‎tutorials/0-provider.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
terraform {
2+
required_providers {
3+
bytebase = {
4+
version = "3.8.0"
5+
# For local development, please use "terraform.local/bytebase/bytebase" instead
6+
source = "registry.terraform.io/bytebase/bytebase"
7+
}
8+
}
9+
}
10+
11+
provider "bytebase" {
12+
service_account = "tf@service.bytebase.com"
13+
service_key = "bbs_xxxx"
14+
url = "https://xxx.xxx.xxx"
15+
}

‎tutorials/1-instances.tf

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Built-in Test Instance
2+
resource "bytebase_instance" "test" {
3+
depends_on = [bytebase_setting.environments]
4+
resource_id = "test-sample-instance"
5+
environment = "environments/test"
6+
title = "Test Sample Instance"
7+
engine = "POSTGRES"
8+
activation = true
9+
10+
data_sources {
11+
id = "admin data source test-sample-instance"
12+
type = "ADMIN"
13+
host = "/tmp"
14+
port = "8083"
15+
username = "bbsample"
16+
password = ""
17+
}
18+
}
19+
20+
# Built-in Prod Instance
21+
resource "bytebase_instance" "prod" {
22+
depends_on = [bytebase_setting.environments]
23+
resource_id = "prod-sample-instance"
24+
environment = "environments/prod"
25+
title = "Prod Sample Instance"
26+
engine = "POSTGRES"
27+
activation = true
28+
29+
data_sources {
30+
id = "admin data source prod-sample-instance"
31+
type = "ADMIN"
32+
host = "/tmp"
33+
port = "8084"
34+
username = "bbsample"
35+
password = ""
36+
}
37+
}

‎tutorials/2-projects.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Project One
2+
resource "bytebase_project" "project-one" {
3+
depends_on = [
4+
bytebase_instance.test
5+
]
6+
resource_id = "project-one"
7+
title = "Project One"
8+
9+
databases = bytebase_instance.test.databases
10+
}
11+
12+
# Project Two
13+
resource "bytebase_project" "project-two" {
14+
depends_on = [
15+
bytebase_instance.prod
16+
]
17+
resource_id = "project-two"
18+
title = "Project Two"
19+
20+
databases = [
21+
"instances/prod-sample-instance/databases/hr_prod"
22+
]
23+
}

‎tutorials/3-settings.tf

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Environment Settings
2+
resource "bytebase_setting" "environments" {
3+
name = "settings/ENVIRONMENT"
4+
5+
environment_setting {
6+
environment {
7+
id = "test"
8+
title = "Test"
9+
protected = false
10+
}
11+
environment {
12+
id = "prod"
13+
title = "Prod"
14+
protected = true
15+
}
16+
}
17+
}
18+
19+
# Step 1: Workspace profile configuration
20+
resource "bytebase_setting" "workspace_profile" {
21+
name = "settings/WORKSPACE_PROFILE"
22+
23+
workspace_profile {
24+
disallow_signup = true
25+
domains = ["example.com"]
26+
enforce_identity_domain = false
27+
external_url = "https://valid-just-tadpole.ngrok-free.app"
28+
}
29+
}
30+
31+
# Step 2: Approval flow settings
32+
resource "bytebase_setting" "approval_flow" {
33+
name = "settings/WORKSPACE_APPROVAL"
34+
35+
approval_flow {
36+
rules {
37+
flow {
38+
title = "Project Owner → DBA → Admin"
39+
description = "Need DBA and workspace admin approval"
40+
41+
steps { role = "roles/projectOwner" }
42+
steps { role = "roles/workspaceDBA" }
43+
steps { role = "roles/workspaceAdmin" }
44+
}
45+
conditions {
46+
source = "DML"
47+
level = "MODERATE"
48+
}
49+
conditions {
50+
source = "DDL"
51+
level = "HIGH"
52+
}
53+
}
54+
}
55+
}
56+
57+
# Step 3: Risk management policies
58+
resource "bytebase_risk" "dml_moderate" {
59+
title = "DML Moderate Risk"
60+
source = "DML"
61+
level = 200
62+
active = true
63+
condition = "environment_id == \"prod\" && affected_rows >= 100"
64+
}
65+
66+
resource "bytebase_risk" "ddl_high" {
67+
title = "DDL High Risk"
68+
source = "DDL"
69+
level = 300
70+
active = true
71+
condition = "environment_id == \"prod\""
72+
}

‎tutorials/4-user-iam.tf

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
# Create users and groups
2+
resource "bytebase_user" "workspace_admin" {
3+
email = "admin@example.com"
4+
title = "Workspace Admin"
5+
type = "USER"
6+
}
7+
8+
resource "bytebase_user" "tf_service_account" {
9+
email = "tf@service.bytebase.com"
10+
title = "Terraform Service Account"
11+
type = "SERVICE_ACCOUNT"
12+
}
13+
14+
resource "bytebase_user" "workspace_dba1" {
15+
email = "dba@example.com"
16+
title = "Database Administrator 1"
17+
type = "USER"
18+
}
19+
20+
resource "bytebase_user" "workspace_dba2" {
21+
email = "dba2@example.com"
22+
title = "Database Administrator 2"
23+
type = "USER"
24+
}
25+
26+
resource "bytebase_user" "dev1" {
27+
email = "dev1@example.com"
28+
title = "Developer 1"
29+
type = "USER"
30+
}
31+
32+
resource "bytebase_user" "dev2" {
33+
email = "dev2@example.com"
34+
title = "Developer 2"
35+
type = "USER"
36+
}
37+
38+
resource "bytebase_user" "dev3" {
39+
email = "dev3@example.com"
40+
title = "Developer 3"
41+
type = "USER"
42+
}
43+
44+
resource "bytebase_user" "qa1" {
45+
email = "qa1@example.com"
46+
title = "QA Tester 1"
47+
type = "USER"
48+
}
49+
50+
resource "bytebase_user" "qa2" {
51+
email = "qa2@example.com"
52+
title = "QA Tester 2"
53+
type = "USER"
54+
}
55+
56+
# Create groups
57+
resource "bytebase_group" "developers" {
58+
email = "developers@example.com"
59+
title = "Developer Team"
60+
description = "Group for all developers"
61+
62+
members {
63+
member = "users/${bytebase_user.dev1.email}"
64+
role = "OWNER"
65+
}
66+
67+
members {
68+
member = "users/${bytebase_user.dev2.email}"
69+
role = "MEMBER"
70+
}
71+
72+
members {
73+
member = "users/${bytebase_user.dev3.email}"
74+
role = "MEMBER"
75+
}
76+
}
77+
78+
resource "bytebase_group" "qa" {
79+
email = "qa@example.com"
80+
title = "QA Team"
81+
description = "Group for all QA testers"
82+
83+
members {
84+
member = "users/${bytebase_user.qa1.email}"
85+
role = "OWNER"
86+
}
87+
88+
members {
89+
member = "users/${bytebase_user.qa2.email}"
90+
role = "MEMBER"
91+
}
92+
}
93+
94+
resource "bytebase_iam_policy" "workspace_iam" {
95+
depends_on = [
96+
bytebase_user.workspace_admin,
97+
bytebase_user.tf_service_account,
98+
bytebase_user.workspace_dba1,
99+
bytebase_user.workspace_dba2,
100+
bytebase_group.qa
101+
]
102+
103+
parent = "workspaces/-"
104+
105+
iam_policy {
106+
107+
binding {
108+
role = "roles/workspaceAdmin"
109+
members = [
110+
format("user:%s", bytebase_user.workspace_admin.email),
111+
format("user:%s", bytebase_user.tf_service_account.email),
112+
]
113+
}
114+
115+
binding {
116+
role = "roles/workspaceDBA"
117+
members = [
118+
format("user:%s", bytebase_user.workspace_dba1.email),
119+
format("user:%s", bytebase_user.workspace_dba2.email)
120+
]
121+
}
122+
123+
binding {
124+
role = "roles/workspaceMember"
125+
members = [
126+
format("user:%s", bytebase_user.dev1.email),
127+
format("user:%s", bytebase_user.dev2.email),
128+
format("user:%s", bytebase_user.dev3.email)
129+
]
130+
}
131+
132+
binding {
133+
role = "roles/projectViewer"
134+
members = [
135+
format("group:%s", bytebase_group.qa.email),
136+
]
137+
}
138+
}
139+
}
140+
141+
resource "bytebase_iam_policy" "project_iam" {
142+
depends_on = [
143+
bytebase_group.developers,
144+
bytebase_user.workspace_dba1,
145+
bytebase_user.workspace_dba2
146+
]
147+
148+
parent = bytebase_project.project-two.name
149+
150+
iam_policy {
151+
152+
binding {
153+
role = "roles/projectOwner"
154+
members = [
155+
format("user:%s", bytebase_user.workspace_dba1.email),
156+
format("user:%s", bytebase_user.workspace_dba2.email)
157+
]
158+
}
159+
160+
binding {
161+
role = "roles/projectDeveloper"
162+
members = [
163+
"allUsers",
164+
format("group:%s", bytebase_group.developers.email)
165+
]
166+
}
167+
168+
binding {
169+
role = "roles/sqlEditorUser"
170+
members = [
171+
format("group:%s", bytebase_group.developers.email)
172+
]
173+
condition {
174+
database = "instances/prod-sample-instance/databases/hr_prod"
175+
schema = "public"
176+
tables = ["employee","department"]
177+
expire_timestamp = "2027-07-10T16:17:49Z"
178+
}
179+
}
180+
181+
}
182+
}

0 commit comments

Comments
 (0)