refactor(terraform): migrate worker gke to osv_pipeline module

deployment/clouddeploy/gke-workers/environments/oss-vdb-test/workers-cves.yaml

@@ -5,12 +5,6 @@ metadata:
 spec:
   template:
     spec:
-      tolerations:
-      - key: workloadType
-        operator: Equal
-        value: worker-pool
-      nodeSelector:
-        workloadType: worker-pool
       containers:
       - name: workers-cves
         env:

deployment/clouddeploy/gke-workers/environments/oss-vdb-test/workers-reimport.yaml

@@ -5,12 +5,6 @@ metadata:
 spec:
   template:
     spec:
-      tolerations:
-      - key: workloadType
-        operator: Equal
-        value: worker-pool
-      nodeSelector:
-        workloadType: worker-pool
       containers:
       - name: workers-reimport
         env:

deployment/clouddeploy/gke-workers/environments/oss-vdb-test/workers.yaml

@@ -5,12 +5,6 @@ metadata:
 spec:
   template:
     spec:
-      tolerations:
-      - key: workloadType
-        operator: Equal
-        value: worker-pool
-      nodeSelector:
-        workloadType: worker-pool
       containers:
       - name: worker-private
         env:

deployment/clouddeploy/gke-workers/environments/private/workers.yaml

@@ -5,12 +5,6 @@ metadata:
 spec:
   template:
     spec:
-      tolerations:
-      - key: workloadType
-        operator: Equal
-        value: worker-pool
-      nodeSelector:
-        workloadType: worker-pool
       containers:
       - name: worker-private
         env:

deployment/terraform/environments/oss-vdb-test/main.tf

@@ -26,33 +26,40 @@ locals {
   }
 }
 
-module "osv_test" {
-  source = "../../modules/osv"
-
-  project_id = "oss-vdb-test"
+module "osv_pipeline" {
+  source = "../../modules/osv_pipeline"
 
-  public_import_logs_bucket                      = "osv-test-public-import-logs"
+  project_id                                     = "oss-vdb-test"
   vulnerabilities_export_bucket                  = "osv-test-vulnerabilities"
-  logs_bucket                                    = "osv-test-logs"
-  cve_osv_conversion_bucket                      = "osv-test-cve-osv-conversion"
-  debian_osv_conversion_bucket                   = "osv-test-debian-osv"
-  osv_dev_sitemap_bucket                         = "test-osv-dev-sitemap"
-  backups_bucket                                 = "osv-test-backup"
-  backups_bucket_retention_days                  = 5
   affected_commits_backups_bucket                = "osv-test-affected-commits"
   affected_commits_backups_bucket_retention_days = 2
-  gcs_log_dir                                    = "gs://oss-vdb-tf/apply-logs"
-
-  website_domain = "test.osv.dev"
-  api_url        = "api.test.osv.dev"
-  esp_version    = "2.55.3"
+  logs_bucket                                    = "osv-test-logs"
 
   extra_work_pools = [
     "reimport",
     "cves",
   ]
 }
 
+module "osv_test" {
+  source = "../../modules/osv"
+
+  project_id = "oss-vdb-test"
+
+  public_import_logs_bucket     = "osv-test-public-import-logs"
+  logs_bucket                   = "osv-test-logs"
+  cve_osv_conversion_bucket     = "osv-test-cve-osv-conversion"
+  debian_osv_conversion_bucket  = "osv-test-debian-osv"
+  osv_dev_sitemap_bucket        = "test-osv-dev-sitemap"
+  backups_bucket                = "osv-test-backup"
+  backups_bucket_retention_days = 5
+  gcs_log_dir                   = "gs://oss-vdb-tf/apply-logs"
+
+  website_domain = "test.osv.dev"
+  api_url        = "api.test.osv.dev"
+  esp_version    = "2.55.3"
+}
+
 module "k8s_cron_alert" {
   for_each                         = local.kube_manifests
   source                           = "../../modules/k8s_cron_alert"
@@ -63,7 +70,7 @@ module "k8s_cron_alert" {
 }
 
 import {
-  to = module.osv_test.google_firestore_database.datastore
+  to = module.osv_pipeline.google_firestore_database.datastore
   id = "oss-vdb-test/(default)"
 }
 

deployment/terraform/environments/oss-vdb-test/moved.tf

@@ -0,0 +1,100 @@
+# Migration of pipeline resources from module.osv_test to module.osv_pipeline
+
+# Datastore & Storage
+moved {
+  from = module.osv_test.google_firestore_database.datastore
+  to   = module.osv_pipeline.google_firestore_database.datastore
+}
+
+moved {
+  from = module.osv_test.google_storage_bucket.osv_vulnerabilities_export
+  to   = module.osv_pipeline.google_storage_bucket.osv_vulnerabilities_export
+}
+
+moved {
+  from = module.osv_test.google_storage_bucket.affected_commits_backups_bucket
+  to   = module.osv_pipeline.google_storage_bucket.affected_commits_backups_bucket
+}
+
+# GKE Cluster & Node Pools & Gitter Disk
+moved {
+  from = module.osv_test.google_container_cluster.workers
+  to   = module.osv_pipeline.google_container_cluster.workers
+}
+
+moved {
+  from = module.osv_test.google_container_node_pool.default_pool
+  to   = module.osv_pipeline.google_container_node_pool.default_pool
+}
+
+moved {
+  from = module.osv_test.google_container_node_pool.highend
+  to   = module.osv_pipeline.google_container_node_pool.highend
+}
+
+moved {
+  from = module.osv_test.google_compute_disk.gitter_disk
+  to   = module.osv_pipeline.google_compute_disk.gitter_disk
+}
+
+# Network
+moved {
+  from = module.osv_test.google_compute_subnetwork.my_subnet_0
+  to   = module.osv_pipeline.google_compute_subnetwork.my_subnet_0
+}
+
+moved {
+  from = module.osv_test.google_compute_router.router
+  to   = module.osv_pipeline.google_compute_router.router
+}
+
+moved {
+  from = module.osv_test.google_compute_router_nat.nat_config
+  to   = module.osv_pipeline.google_compute_router_nat.nat_config
+}
+
+# Pub/Sub
+moved {
+  from = module.osv_test.google_pubsub_topic.tasks
+  to   = module.osv_pipeline.google_pubsub_topic.tasks
+}
+
+moved {
+  from = module.osv_test.google_pubsub_topic.failed_tasks
+  to   = module.osv_pipeline.google_pubsub_topic.failed_tasks
+}
+
+moved {
+  from = module.osv_test.google_pubsub_subscription.default_work
+  to   = module.osv_pipeline.google_pubsub_subscription.default_work
+}
+
+moved {
+  from = module.osv_test.google_pubsub_subscription.work_pools
+  to   = module.osv_pipeline.google_pubsub_subscription.work_pools
+}
+
+moved {
+  from = module.osv_test.google_project_service_identity.pubsub
+  to   = module.osv_pipeline.google_project_service_identity.pubsub
+}
+
+moved {
+  from = module.osv_test.google_pubsub_subscription_iam_member.default_work_service_subscriber
+  to   = module.osv_pipeline.google_pubsub_subscription_iam_member.default_work_service_subscriber
+}
+
+moved {
+  from = module.osv_test.google_pubsub_topic_iam_member.failed_tasks_service_publisher
+  to   = module.osv_pipeline.google_pubsub_topic_iam_member.failed_tasks_service_publisher
+}
+
+moved {
+  from = module.osv_test.google_pubsub_subscription.recovery
+  to   = module.osv_pipeline.google_pubsub_subscription.recovery
+}
+
+moved {
+  from = module.osv_test.google_pubsub_subscription_iam_member.recovery_service_subscriber
+  to   = module.osv_pipeline.google_pubsub_subscription_iam_member.recovery_service_subscriber
+}

deployment/terraform/environments/oss-vdb/main.tf

@@ -26,26 +26,14 @@ locals {
   }
 }
 
-module "osv" {
-  source = "../../modules/osv"
-
-  project_id = "oss-vdb"
+module "osv_pipeline" {
+  source = "../../modules/osv_pipeline"
 
-  public_import_logs_bucket                      = "osv-public-import-logs"
+  project_id                                     = "oss-vdb"
   vulnerabilities_export_bucket                  = "osv-vulnerabilities"
-  cve_osv_conversion_bucket                      = "cve-osv-conversion"
-  debian_osv_conversion_bucket                   = "debian-osv"
-  logs_bucket                                    = "osv-logs"
-  osv_dev_sitemap_bucket                         = "osv-dev-sitemap"
-  backups_bucket                                 = "osv-backup"
-  backups_bucket_retention_days                  = 60
   affected_commits_backups_bucket                = "osv-affected-commits"
   affected_commits_backups_bucket_retention_days = 3
-  gcs_log_dir                                    = "gs://oss-vdb-tf/apply-logs"
-
-  website_domain = "osv.dev"
-  api_url        = "api.osv.dev"
-  esp_version    = "2.55.3"
+  logs_bucket                                    = "osv-logs"
 
   extra_work_pools = [
     "reimport",
@@ -55,18 +43,32 @@ module "osv" {
   create_oss_fuzz_subnet = true
 }
 
+module "osv" {
+  source = "../../modules/osv"
+
+  project_id = "oss-vdb"
+
+  public_import_logs_bucket     = "osv-public-import-logs"
+  cve_osv_conversion_bucket     = "cve-osv-conversion"
+  debian_osv_conversion_bucket  = "debian-osv"
+  logs_bucket                   = "osv-logs"
+  osv_dev_sitemap_bucket        = "osv-dev-sitemap"
+  backups_bucket                = "osv-backup"
+  backups_bucket_retention_days = 60
+  gcs_log_dir                   = "gs://oss-vdb-tf/apply-logs"
+
+  website_domain = "osv.dev"
+  api_url        = "api.osv.dev"
+  esp_version    = "2.55.3"
+}
+
 module "oss_fuzz" {
   source                       = "../../modules/oss_fuzz"
   project_id                   = "oss-vdb"
-  tasks_topic_id               = module.osv.tasks_topic_id
-  failed_tasks_topic_id        = module.osv.failed_tasks_topic_id
-  pubsub_service_account_email = module.osv.pubsub_service_account_email
-  subnetwork                   = module.osv.oss_fuzz_subnet_self_link
-}
-
-moved {
-  from = module.oss_fuzz.google_compute_subnetwork.oss_fuzz_subnet
-  to   = module.osv.google_compute_subnetwork.oss_fuzz_subnet[0]
+  tasks_topic_id               = module.osv_pipeline.tasks_topic_id
+  failed_tasks_topic_id        = module.osv_pipeline.failed_tasks_topic_id
+  pubsub_service_account_email = module.osv_pipeline.pubsub_service_account_email
+  subnetwork                   = module.osv_pipeline.oss_fuzz_subnet_self_link
 }
 
 module "k8s_cron_alert" {
@@ -79,7 +81,7 @@ module "k8s_cron_alert" {
 }
 
 import {
-  to = module.osv.google_firestore_database.datastore
+  to = module.osv_pipeline.google_firestore_database.datastore
   id = "oss-vdb/(default)"
 }