merge develop

README.md

@@ -15,9 +15,7 @@ This README is organized into four parts:  <br>
 
 Tag Engine v2 comes with two Cloud Run services. One service is for the API (`tag-engine-api`) and the other is for the UI (`tag-engine-ui`). 
 
-The Cloud Run API service uses Bearer token headers for authentication. 
-
-The Cloud Run UI service uses OAuth for authentication. It also uses the OAuth client's credentials (`client_secret.json`) for impersonation. 
+Both services use access tokens for authorization. The API service expects the client to pass in an access token when calling the API functions whereas the UI service uses OAuth to authorize the client from the front end. The client secret file is required for the OAuth flow.  
 
 Follow the 6 steps below to deploy Tag Engine v2 with Terraform and without a load balancer. 
 

deploy/external_load_balancer/cloud_run.tf

@@ -57,8 +57,15 @@ resource "google_cloud_run_v2_service" "api_service" {
 	}
 
     containers {
-      image = null_resource.build_api_image.triggers.full_image_path
-    }
+        image = null_resource.build_api_image.triggers.full_image_path
+
+	    resources {
+	        limits = {
+	           memory = "1024Mi"
+		    }
+	        cpu_idle = true
+	    }
+     }
   }
   depends_on = [null_resource.build_api_image]
 }
@@ -126,9 +133,16 @@ resource "google_cloud_run_v2_service" "ui_service" {
 	}
 
     containers {
-
-	  image = null_resource.build_ui_image.triggers.full_image_path
+        image = null_resource.build_ui_image.triggers.full_image_path
+
+	    resources {
+	        limits = {
+	           memory = "1024Mi"
+		    }
+	        cpu_idle = true
+	    }
     }
+
 	vpc_access {
 	    connector = google_vpc_access_connector.connector.id
 	    egress = "PRIVATE_RANGES_ONLY"

deploy/external_load_balancer/iam_bindings.tf

@@ -148,7 +148,7 @@ resource "google_project_iam_binding" "PolicyTagReader" {
 }
 
 resource "google_project_iam_binding" "BigQuerySchemaUpdate" {
-  project = var.tag_engine_project
+  project = var.bigquery_project
   role    = "projects/${var.bigquery_project}/roles/BigQuerySchemaUpdate"
   members = ["serviceAccount:${var.tag_creator_sa}"]
   depends_on = [google_project_service.tag_engine_project]

deploy/external_load_balancer/task_queues.tf

@@ -33,7 +33,7 @@ resource "google_cloud_tasks_queue" "work_queue" {
     }
 
     retry_config {
-      max_attempts = 1
+      max_attempts = 2
     }
 
   stackdriver_logging_config {

deploy/without_load_balancer/cloud_run.tf

@@ -6,7 +6,6 @@ resource "google_artifact_registry_repository" "image_registry" {
   depends_on = [google_project_service.tag_engine_project]
 }
 
-
 # ************************************************************ #
 # Create the Cloud Run API service
 # ************************************************************ #
@@ -57,8 +56,15 @@ resource "google_cloud_run_v2_service" "api_service" {
 	}
 
     containers {
-      image = null_resource.build_api_image.triggers.full_image_path
-    }
+        image = null_resource.build_api_image.triggers.full_image_path
+
+	    resources {
+	        limits = {
+	           memory = "1024Mi"
+		    }
+	        cpu_idle = true
+	    }
+     }
   }
   depends_on = [null_resource.build_api_image]
 }
@@ -118,9 +124,15 @@ resource "google_cloud_run_v2_service" "ui_service" {
 	}
 
     containers {
-
-	  image = null_resource.build_ui_image.triggers.full_image_path
-    }
+        image = null_resource.build_ui_image.triggers.full_image_path
+
+	    resources {
+	        limits = {
+	           memory = "1024Mi"
+		    }
+	        cpu_idle = true
+	    }
+     }
   }
   depends_on = [null_resource.build_ui_image]
 }

deploy/without_load_balancer/iam_bindings.tf

@@ -148,7 +148,7 @@ resource "google_project_iam_binding" "PolicyTagReader" {
 }
 
 resource "google_project_iam_binding" "BigQuerySchemaUpdate" {
-  project = var.tag_engine_project
+  project = var.bigquery_project
   role    = "projects/${var.bigquery_project}/roles/BigQuerySchemaUpdate"
   members = ["serviceAccount:${var.tag_creator_sa}"]
   depends_on = [google_project_service.tag_engine_project]

deploy/without_load_balancer/task_queues.tf

@@ -33,7 +33,7 @@ resource "google_cloud_tasks_queue" "work_queue" {
     }
 
     retry_config {
-      max_attempts = 1
+      max_attempts = 2
     }
 
   stackdriver_logging_config {