google / google/stellar-engine
[Feature Request] Multi-Regime Deployments Through Dynamic Prefixing
- Dominant language
- HCL
- Stars
- 49
- Forks
- 20
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 28
Description
# Multi-Regime Deployments Request Through Dynamic Prefixing
By default, Stellar Engine **does not** support deploying environments for multiple compliance regimes (e.g., FedRAMP High and IL5) side-by-side using the same configured `prefix` within the same Google Cloud Organization.
## The Problem
When attempting to deploy multiple compliance regimes (like FedRAMP High and IL5) in the same organization using the same `prefix`, you will encounter naming collisions.
GCP Project IDs must be globally unique across all of Google Cloud. While you might assume Google Cloud will automatically append a random string to your Project Name to create a unique Project ID (which it does in the web console), Terraform and the Stellar Engine modules **explicitly define** the `project_id`.
For example, when creating the core automation project, the module explicitly tells GCP to name the ID exactly `[prefix]-prod-iac-core-0` (e.g... `stlr-prod-iac-core-0`). If you deploy FedRAMP High and then try to deploy IL5 using the same `prefix = "stlr"`, Terraform will attempt to create a project with the exact same ID. This will result in an immediate `409 Already Exists` error, blocking the deployment.
Unless the administrator manually creates distinct and totally separate `prefix` names for every compliance regime they wish to deploy, the default configuration inherently creates naming collisions.
## The Solution: Dynamic Regime Prefixing
To elegantly solve this limitation without forcing the administrator to invent disjoint configurations and manually track distinct prefixes per deployment, we implemented **Dynamic Regime Prefixing** into the codebase.
When you deploy a Stellar Engine environment, the Stage 0 bootstrap pulls your `prefix` defined in `terraform.tfvars` and automatically augments it using a short code corresponding to your chosen `assured_workloads.regime`.
For example, if your configuration defines:
```hcl
prefix = "stlr"
assured_workloads = {
regime = "IL5"
}
```
The bootstrap stage injects the `-il5` short code and computes the `effective_prefix` as `stlr-il5`. All core automation projects will then be dynamically named and assigned a unique Project ID (e.g., `stlr-il5-prod-iac-core-0` instead of a generic `stlr-prod-iac-core-0`).
This applies to all regimes defined in the `regime_mapping` variable. For example:
* **FedRAMP High:** Generates the suffix `-frh`.
* **FedRAMP Moderate:** Generates the suffix `-frm`.
* **Impact Level 4 (IL4):** Generates the suffix `-il4`.
This augmented prefix is exported as a global variable so that when you move to Stage 1, Stage 2, and Stage 3, the subsequent Terraform configurations automatically inherit the `stlr-il5` (or `stlr-frh`, etc.) prefix. This seamless injection completely eliminates naming collisions and allows you to spin up FedRAMP High, IL5, and other regimes synchronously in the same organization.
Contributor guide
Assessment
This issue has not been assessed yet.