Self-Service VM Ordering with Approval Gate and Terraform on Google Cloud

id: gcp-create-vm-approval-gate
namespace: company.team
description: |
  Self-service VM ordering with a human approval gate. A requester fills a form,
  an approver gets a Slack message, the run pauses until approved, then Terraform
  provisions the Google Cloud VM, the inventory is updated, and Slack is notified.

inputs:
  - id: billingAccount
    type: SELECT
    displayName: Billing Account
    description: GCP project ID that owns the VM.
    values:
      - kestra-sandbox
      - kestra-dev
    defaults: kestra-sandbox

  - id: region
    type: SELECT
    displayName: Region
    values:
      - us-central1
      - us-east1
    defaults: us-central1

  - id: zone
    type: SELECT
    displayName: Zone
    values:
      - us-central1-a
      - us-central1-b
    dependsOn:
      inputs:
        - region
      condition: "{{ inputs.region == 'us-central1' }}"
    defaults: us-central1-a

  - id: osFlavor
    displayName: OS Image
    type: SELECT
    values:
      - ubuntu-os-cloud/ubuntu-2404-lts-amd64
      - ubuntu-os-cloud/ubuntu-2204-lts
    defaults: ubuntu-os-cloud/ubuntu-2204-lts

  - id: vmSize
    displayName: VM Size
    type: SELECT
    values:
      - n1-standard-1
      - n1-standard-2
      - n1-standard-4
    defaults: n1-standard-1

  - id: network
    displayName: Network
    type: STRING
    defaults: default

  - id: subnet
    displayName: Subnet
    type: STRING
    defaults: default

  - id: env
    type: SELECT
    displayName: Environment
    values:
      - dev
      - stg
      - prd
    defaults: dev

  - id: vmType
    type: SELECT
    displayName: Type of VM
    values:
      - app
      - db
      - srv
    defaults: app

tasks:
  - id: requestApproval
    type: io.kestra.plugin.notifications.slack.SlackIncomingWebhook
    description: Notify approvers that a VM order is waiting for review.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "A VM order has been placed (execution {{ execution.id }}).\nSize: {{ inputs.vmSize }} | Zone: {{ inputs.zone }} | Env: {{ inputs.env }}\nOpen the paused execution in the Kestra UI to approve or reject."
      }

  - id: waitForApproval
    type: io.kestra.plugin.core.flow.Pause
    description: Hold the order until an approver resumes the execution.
    onResume:
      - id: approved
        description: Whether to approve the request
        type: BOOL
        defaults: false
      - id: reason
        description: Reason for approval or rejection
        type: STRING
        defaults: Auto reject

  - id: proceedIfApproved
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.waitForApproval.onResume.approved == false }}"
    then:
      - id: isRejected
        type: io.kestra.plugin.core.execution.Fail
        errorMessage: "Request was not approved. Reason: {{
          outputs.waitForApproval.onResume.reason }}"
    else:
      - id: generateHostname
        type: io.kestra.plugin.scripts.python.Script
        description: Build a standardized hostname from environment and VM type.
        beforeCommands:
          - pip install kestra
        script: |
          import random
          from kestra import Kestra

          # Replace with a lookup against your CMDB or IPAM to get the next free index
          index = random.randint(10, 99)
          hostname = f"gcp{{ inputs.env }}lnx{{ inputs.vmType }}{index:02d}"
          ip_address = f"10.128.10.{index}"
          Kestra.outputs({"hostname": hostname, "ipAddress": ip_address})

      - id: createVM
        type: io.kestra.plugin.terraform.cli.TerraformCLI
        description: Provision the approved VM with Terraform.
        env:
          GOOGLE_APPLICATION_CREDENTIALS: gcp-svc-account.json
        inputFiles:
          gcp-svc-account.json: "{{ secret('GCP_SERVICE_ACCOUNT_JSON') }}"
          main.tf: |
            # Replace with your real configuration; a remote backend such as GCS
            # is recommended so a later destroy can reuse the same state.
            resource "google_compute_instance" "default" {
              name         = "{{ outputs.generateHostname.vars.hostname }}"
              machine_type = "{{ inputs.vmSize }}"
              zone         = "{{ inputs.zone }}"
              project      = "{{ inputs.billingAccount }}"

              boot_disk {
                initialize_params {
                  image = "{{ inputs.osFlavor }}"
                }
              }

              network_interface {
                network            = "{{ inputs.network }}"
                subnetwork         = "{{ inputs.subnet }}"
                subnetwork_project = "{{ inputs.billingAccount }}"
                access_config {}
              }
            }

            output "external_ip" {
              value       = google_compute_instance.default.network_interface[0].access_config[0].nat_ip
              description = "The external IP address of the VM"
            }
        beforeCommands:
          - terraform init
        commands:
          - terraform plan
          - terraform apply -auto-approve -json
          - terraform output -raw external_ip > external_ip.txt
        outputFiles:
          - "*.txt"

      - id: updateInventory
        type: io.kestra.plugin.core.kv.Set
        description: Record the new VM in the KV-backed inventory.
        key: "vm_{{ outputs.generateHostname.vars.hostname }}"
        kvType: JSON
        value: |
          {
            "hostname": "{{ outputs.generateHostname.vars.hostname }}",
            "account": "{{ inputs.billingAccount }}",
            "region": "{{ inputs.region }}",
            "zone": "{{ inputs.zone }}",
            "size": "{{ inputs.vmSize }}",
            "os": "{{ inputs.osFlavor }}",
            "environment": "{{ inputs.env }}",
            "vmType": "{{ inputs.vmType }}",
            "ipAddress": "{{ outputs.generateHostname.vars.ipAddress }}",
            "externalIp": "{{ read(outputs.createVM.outputFiles['external_ip.txt']) }}"
          }

      - id: notifyChannel
        type: io.kestra.plugin.notifications.slack.SlackIncomingWebhook
        description: Confirm the VM creation to the requesting channel.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": "{{ outputs.generateHostname.vars.hostname }} created successfully.\nExternal IP: {{ read(outputs.createVM.outputFiles['external_ip.txt']) }}\nZone: {{ inputs.zone }} | Size: {{ inputs.vmSize }} | Env: {{ inputs.env }}"
          }

outputs:
  - id: externalIPAddress
    type: STRING
    value: "{{ read(outputs.createVM.outputFiles['external_ip.txt']) ?? 'Failed' }}"