Deploy on Google Cloud

# Create service account for DB Audit
gcloud iam service-accounts create dbaudit-collector \
  --display-name="DB Audit Collector" \
  --description="Service account for DB Audit database auditing"

# Get the service account email
SA_EMAIL="dbaudit-collector@${PROJECT_ID}.iam.gserviceaccount.com"

# Grant Cloud SQL Client role
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member="serviceAccount:${SA_EMAIL}" \
  --role="roles/cloudsql.client"

# Grant Cloud SQL Viewer role (for instance metadata)
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member="serviceAccount:${SA_EMAIL}" \
  --role="roles/cloudsql.viewer"

# Grant Cloud Logging Writer role
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member="serviceAccount:${SA_EMAIL}" \
  --role="roles/logging.logWriter"

# Grant Secret Manager Accessor role
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member="serviceAccount:${SA_EMAIL}" \
  --role="roles/secretmanager.secretAccessor"

# Grant Cloud Monitoring Metric Writer role
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member="serviceAccount:${SA_EMAIL}" \
  --role="roles/monitoring.metricWriter"

# Deploy using gcloud to Cloud Run

# Build and push the container (optional, if using custom config)
gcloud builds submit --tag gcr.io/${PROJECT_ID}/dbaudit-collector

# Deploy to Cloud Run
gcloud run deploy dbaudit-collector \
  --image dbaudit/collector:latest \
  --platform managed \
  --region us-central1 \
  --service-account dbaudit-collector@${PROJECT_ID}.iam.gserviceaccount.com \
  --set-env-vars "GCP_PROJECT_ID=${PROJECT_ID}" \
  --set-env-vars "DBAUDIT_ENDPOINT=https://api.dbaudit.ai" \
  --set-secrets "DBAUDIT_API_KEY=dbaudit-api-key:latest" \
  --add-cloudsql-instances ${PROJECT_ID}:us-central1:production-db \
  --min-instances 1 \
  --max-instances 3 \
  --cpu 1 \
  --memory 512Mi \
  --no-allow-unauthenticated

# Deploy DB Audit collector on GKE with Workload Identity

# Create namespace
kubectl create namespace dbaudit

# Create Kubernetes service account
kubectl create serviceaccount dbaudit-collector -n dbaudit

# Bind Kubernetes SA to GCP SA for Workload Identity
gcloud iam service-accounts add-iam-policy-binding \
  dbaudit-collector@${PROJECT_ID}.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="serviceAccount:${PROJECT_ID}.svc.id.goog[dbaudit/dbaudit-collector]"

# Annotate the Kubernetes service account
kubectl annotate serviceaccount dbaudit-collector \
  -n dbaudit \
  iam.gke.io/gcp-service-account=dbaudit-collector@${PROJECT_ID}.iam.gserviceaccount.com

# Create secret for API key
kubectl create secret generic dbaudit-credentials \
  --from-literal=api-key=${DBAUDIT_API_KEY} \
  -n dbaudit

# Install using Helm
helm install dbaudit-collector dbaudit/collector \
  --namespace dbaudit \
  --set provider=gcp \
  --set gcp.projectId=${PROJECT_ID} \
  --set gcp.workloadIdentity=true \
  --set serviceAccount.name=dbaudit-collector \
  --set apiKeySecretName=dbaudit-credentials

# Terraform configuration for DB Audit on GCP

provider "google" {
  project = var.project_id
  region  = var.region
}

# Service Account
resource "google_service_account" "dbaudit" {
  account_id   = "dbaudit-collector"
  display_name = "DB Audit Collector"
  description  = "Service account for DB Audit database auditing"
}

# IAM bindings
resource "google_project_iam_member" "cloudsql_client" {
  project = var.project_id
  role    = "roles/cloudsql.client"
  member  = "serviceAccount:${google_service_account.dbaudit.email}"
}

resource "google_project_iam_member" "logging_writer" {
  project = var.project_id
  role    = "roles/logging.logWriter"
  member  = "serviceAccount:${google_service_account.dbaudit.email}"
}

resource "google_project_iam_member" "secret_accessor" {
  project = var.project_id
  role    = "roles/secretmanager.secretAccessor"
  member  = "serviceAccount:${google_service_account.dbaudit.email}"
}

# Secret Manager secret for API key
resource "google_secret_manager_secret" "dbaudit_api_key" {
  secret_id = "dbaudit-api-key"

  replication {
    auto {}
  }
}

resource "google_secret_manager_secret_version" "dbaudit_api_key" {
  secret      = google_secret_manager_secret.dbaudit_api_key.id
  secret_data = var.dbaudit_api_key
}

# Cloud KMS key ring and key
resource "google_kms_key_ring" "dbaudit" {
  name     = "dbaudit"
  location = var.region
}

resource "google_kms_crypto_key" "audit_key" {
  name     = "audit-key"
  key_ring = google_kms_key_ring.dbaudit.id

  rotation_period = "7776000s" # 90 days
}

# Cloud Run service for collector
resource "google_cloud_run_service" "dbaudit" {
  name     = "dbaudit-collector"
  location = var.region

  template {
    spec {
      service_account_name = google_service_account.dbaudit.email

      containers {
        image = "dbaudit/collector:latest"

        env {
          name  = "GCP_PROJECT_ID"
          value = var.project_id
        }

        env {
          name = "DBAUDIT_API_KEY"
          value_from {
            secret_key_ref {
              name = google_secret_manager_secret.dbaudit_api_key.secret_id
              key  = "latest"
            }
          }
        }

        resources {
          limits = {
            cpu    = "1000m"
            memory = "512Mi"
          }
        }
      }
    }

    metadata {
      annotations = {
        "autoscaling.knative.dev/minScale" = "1"
        "autoscaling.knative.dev/maxScale" = "3"
        "run.googleapis.com/cloudsql-instances" = var.cloudsql_connection_name
      }
    }
  }
}

output "service_account_email" {
  value = google_service_account.dbaudit.email
}

output "cloud_run_url" {
  value = google_cloud_run_service.dbaudit.status[0].url
}