From 6f5704aec064e09f0effa90ce12fe0a7c7649158 Mon Sep 17 00:00:00 2001
From: Philippe Boneff <phb@google.com>
Date: Thu, 29 Oct 2026 12:34:26 +0000
Subject: [PATCH] Remove unused staging Cloud Build and preloader modules

These modules were only used by the Arche staging log configs, removed in
#977. cloudbuild/tesseract also builds cmd/tesseract/gcp/staging/Dockerfile,
which #977 deleted.

Follow-up to #790.
---
 .../modules/gcp/cloudbuild/preloader/main.tf  | 126 ------------
 .../gcp/cloudbuild/preloader/variables.tf     |  44 -----
 .../modules/gcp/cloudbuild/tesseract/main.tf  | 186 ------------------
 .../gcp/cloudbuild/tesseract/variables.tf     |  34 ----
 deployment/modules/gcp/gce/preloader/main.tf  | 114 -----------
 .../modules/gcp/gce/preloader/variables.tf    |  45 -----
 6 files changed, 549 deletions(-)
 delete mode 100644 deployment/modules/gcp/cloudbuild/preloader/main.tf
 delete mode 100644 deployment/modules/gcp/cloudbuild/preloader/variables.tf
 delete mode 100644 deployment/modules/gcp/cloudbuild/tesseract/main.tf
 delete mode 100644 deployment/modules/gcp/cloudbuild/tesseract/variables.tf
 delete mode 100644 deployment/modules/gcp/gce/preloader/main.tf
 delete mode 100644 deployment/modules/gcp/gce/preloader/variables.tf

diff --git a/deployment/modules/gcp/cloudbuild/preloader/main.tf b/deployment/modules/gcp/cloudbuild/preloader/main.tf
deleted file mode 100644
index 007033da6..000000000
--- a/deployment/modules/gcp/cloudbuild/preloader/main.tf
+++ /dev/null
@@ -1,126 +0,0 @@
-terraform {
-  backend "gcs" {}
-
-  required_providers {
-    google = {
-      source  = "hashicorp/google"
-      version = "6.50.0"
-    }
-  }
-}
-
-# Cloud Build
-
-locals {
-  cloudbuild_service_account = "cloudbuild-${var.env}-sa@${var.project_id}.iam.gserviceaccount.com"
-  scheduler_service_account  = "scheduler-${var.env}-sa@${var.project_id}.iam.gserviceaccount.com"
-}
-
-resource "google_project_service" "cloudbuild_api" {
-  service            = "cloudbuild.googleapis.com"
-  disable_on_destroy = false
-}
-
-## Service usage API is required on the project to enable APIs.
-## https://cloud.google.com/apis/docs/getting-started#enabling_apis
-## serviceusage.googleapis.com acts as a central point for managing the API 
-## lifecycle within your project. By ensuring the required APIs are enabled 
-## and accessible, it allows Cloud Build to function seamlessly and interact 
-## with other Google Cloud services as needed.
-## 
-## The Cloud Build service account also needs roles/serviceusage.serviceUsageViewer.
-resource "google_project_service" "serviceusage_api" {
-  service            = "serviceusage.googleapis.com"
-  disable_on_destroy = false
-}
-
-resource "google_cloudbuild_trigger" "preloader_trigger" {
-  name            = "preloader-${var.base_name}"
-  service_account = "projects/${var.project_id}/serviceAccounts/${local.cloudbuild_service_account}"
-  location        = var.location
-
-  # TODO(phboneff): use a better mechanism to trigger releases that re-uses Docker containters, or based on branches rather.
-  # This is a temporary mechanism to speed up development.
-  github {
-    owner = var.github_owner
-    name  = "tesseract"
-    push {
-      tag = "^staging-deploy-(.+)$"
-    }
-  }
-
-  build {
-    ## Since TesseraCT's infrastructure is not publicly accessible, we need to use 
-    ## bearer tokens for the test to access them.
-    ## This step creates those, and stores them for later use.
-    step {
-      id     = "bearer_token"
-      name   = "gcr.io/cloud-builders/gcloud"
-      script = <<EOT
-        gcloud auth print-access-token > /workspace/cb_access
-        curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/${local.cloudbuild_service_account}/identity?audience=${var.submission_url}" > /workspace/cb_identity
-      EOT
-    }
-
-    ## TODO(phboneff): move to its own container / cloudrun / batch job.
-    ## Preload entries.
-    ## Leave enough time for the preloader to run, until the token expires.
-    ## Stop after 360k entries, this is what gets copied within 60 minutes.
-    timeout = "4200s" // 60 minutes
-    step {
-      id       = "ct_preloader"
-      name     = "golang"
-      script   = <<EOT
-	      START_INDEX=$(($(curl -H "Authorization: Bearer $(cat /workspace/cb_access)" ${var.monitoring_url}/checkpoint | head -2 | tail -1)+${var.start_index_offset}))
-	      END_INDEX=$(($START_INDEX+360000))
-	      echo "Will run preloader between $START_INDEX and $END_INDEX"
-        go run github.com/google/certificate-transparency-go/preload/preloader@master \
-          --target_log_uri=${var.submission_url}/ \
-          --target_bearer_token="$(cat /workspace/cb_identity)" \
-          --source_log_uri=${var.source_log_uri} \
-          --start_index=$START_INDEX \
-          --end_index=$END_INDEX \
-          --num_workers=400 \
-          --parallel_fetch=40 \
-          --parallel_submit=400
-      EOT
-      wait_for = ["bearer_token"]
-      timeout  = "3420s" // 57 minutes, since token validity if of 60 min.
-    }
-
-    options {
-      logging      = "CLOUD_LOGGING_ONLY"
-      machine_type = "E2_HIGHCPU_8"
-    }
-  }
-}
-
-// TODO(phboneff): replace with a long running job once the log is public.
-resource "google_cloud_scheduler_job" "deploy_cron" {
-  paused  = false
-  project = var.project_id
-  region  = var.location
-  name    = "deploy-cron-${var.base_name}"
-
-  schedule  = "50 * * * *"
-  time_zone = "America/Los_Angeles"
-
-  attempt_deadline = "120s"
-
-  http_target {
-    http_method = "POST"
-    uri         = "https://cloudbuild.googleapis.com/v1/projects/${var.project_id}/locations/${var.location}/triggers/${google_cloudbuild_trigger.preloader_trigger.trigger_id}:run"
-    body = base64encode(jsonencode({
-      source = {
-        branchName = "main"
-      }
-    }))
-    headers = {
-      "Content-Type" = "application/json"
-    }
-
-    oauth_token {
-      service_account_email = local.scheduler_service_account
-    }
-  }
-}
diff --git a/deployment/modules/gcp/cloudbuild/preloader/variables.tf b/deployment/modules/gcp/cloudbuild/preloader/variables.tf
deleted file mode 100644
index d162cdbc6..000000000
--- a/deployment/modules/gcp/cloudbuild/preloader/variables.tf
+++ /dev/null
@@ -1,44 +0,0 @@
-variable "project_id" {
-  description = "GCP project ID where the log is hosted"
-  type        = string
-}
-
-variable "location" {
-  description = "Location in which to create resources"
-  type        = string
-}
-
-variable "env" {
-  description = "Unique identifier for the env, e.g. dev or ci or prod"
-  type        = string
-}
-
-variable "base_name" {
-  description = "Base name to use when naming resources"
-  type        = string
-}
-
-variable "github_owner" {
-  description = "GitHub owner used in Cloud Build trigger repository mapping"
-  type        = string
-}
-
-variable "submission_url" {
-  description = "Submission URL of the destination static-ct-api log"
-  type        = string
-}
-
-variable "monitoring_url" {
-  description = "Monitoring URL of the destination static-ct-api log"
-  type        = string
-}
-
-variable "source_log_uri" {
-  description = "URL of the source RFC6962 log"
-  type        = string
-}
-
-variable "start_index_offset" {
-  description = "Offset to apply to the start index"
-  type        = number
-}
diff --git a/deployment/modules/gcp/cloudbuild/tesseract/main.tf b/deployment/modules/gcp/cloudbuild/tesseract/main.tf
deleted file mode 100644
index 92cb2c57e..000000000
--- a/deployment/modules/gcp/cloudbuild/tesseract/main.tf
+++ /dev/null
@@ -1,186 +0,0 @@
-terraform {
-  backend "gcs" {}
-
-  required_providers {
-    google = {
-      source  = "hashicorp/google"
-      version = "6.50.0"
-    }
-  }
-}
-
-# Artifact Registry
-
-module "artifactregistry" {
-  source = "../../artifactregistry"
-
-  location   = var.location
-  docker_env = var.docker_env
-}
-
-# Cloud Build
-
-locals {
-  cloudbuild_service_account = "cloudbuild-${var.env}-sa@${var.project_id}.iam.gserviceaccount.com"
-  artifact_repo              = "${var.location}-docker.pkg.dev/${var.project_id}/${module.artifactregistry.docker.name}"
-  ## TODO(phbnf): this should include the name of the log since it contains roots
-  tesseract_gcp_docker_image = "${local.artifact_repo}/tesseract-gcp"
-}
-
-resource "google_project_service" "cloudbuild_api" {
-  service            = "cloudbuild.googleapis.com"
-  disable_on_destroy = false
-}
-
-## Service usage API is required on the project to enable APIs.
-## https://cloud.google.com/apis/docs/getting-started#enabling_apis
-## serviceusage.googleapis.com acts as a central point for managing the API 
-## lifecycle within your project. By ensuring the required APIs are enabled 
-## and accessible, it allows Cloud Build to function seamlessly and interact 
-## with other Google Cloud services as needed.
-## 
-## The Cloud Build service account also needs roles/serviceusage.serviceUsageViewer.
-resource "google_project_service" "serviceusage_api" {
-  service            = "serviceusage.googleapis.com"
-  disable_on_destroy = false
-}
-
-resource "google_cloudbuild_trigger" "build_trigger" {
-  name            = "build-docker-${var.docker_env}"
-  service_account = "projects/${var.project_id}/serviceAccounts/${local.cloudbuild_service_account}"
-  location        = var.location
-  tags            = ["preloader"] // allow Cloud Build to talk to the public internet to fetch OpenTofu resources. 
-
-  # TODO(phboneff): use a better mechanism to trigger releases that re-uses Docker containters, or based on branches rather.
-  # This is a temporary mechanism to speed up development.
-  github {
-    owner = var.github_owner
-    name  = "tesseract"
-    push {
-      tag = var.git_tag_trigger_regexp
-    }
-  }
-
-  build {
-    ## This overall timeout is complete overkill, but there seems to be a bug in terraform/GCB which means that this number needs
-    ## to be larger than the sum of all build steps below, _even_ if the build steps run in parallel.
-    timeout = "3000s"
-    ## Install Terragrunt and OpenTofu in alpine container.
-    step {
-      id   = "prepare_terragrunt_opentofu_container"
-      name = "gcr.io/cloud-builders/docker"
-      args = [
-        "build",
-        "-t", "terragrunt-opentofu",
-        "-f", "./deployment/terragrunt-opentofu/Dockerfile",
-        "."
-      ]
-    }
-
-    ## Build TesseraCT GCP Docker container image, without roots.
-    step {
-      id   = "docker_build_tesseract_gcp"
-      name = "gcr.io/cloud-builders/docker"
-      args = [
-        "build",
-        "-t", "tesseract-gcp:$SHORT_SHA",
-        "-t", "tesseract-gcp:latest",
-        "-f", "./cmd/tesseract/gcp/Dockerfile",
-        "."
-      ]
-    }
-
-    ## Build TesseraCT GCP Docker container image, with roots.
-    ## TODO(phbnf): make the docker file path a var.
-    step {
-      id   = "docker_build_tesseract_with_roots_gcp"
-      name = "gcr.io/cloud-builders/docker"
-      args = [
-        "build",
-        "-t", "${local.tesseract_gcp_docker_image}:$SHORT_SHA",
-        "-t", "${local.tesseract_gcp_docker_image}:latest",
-        "-f", "./cmd/tesseract/gcp/staging/Dockerfile",
-        "."
-      ]
-      wait_for = ["docker_build_tesseract_gcp"]
-    }
-
-    ## Push TesseraCT's Docker container image to Artifact Registry.
-    step {
-      id   = "docker_push_tesseract_gcp"
-      name = "gcr.io/cloud-builders/docker"
-      args = [
-        "push",
-        "--all-tags",
-        local.tesseract_gcp_docker_image
-      ]
-      wait_for = ["docker_build_tesseract_with_roots_gcp"]
-    }
-
-    ## Apply the deployment/live/gcp/static-staging/logs/XXX terragrunt configs.
-    ## This will bring up or update TesseraCT's infrastructure, including a service
-    ## running the server docker image built above.
-    ##
-    ## We run these in parallel because each one can take up to 10+ minutes to apply.
-    dynamic "step" {
-      for_each = var.logs_terragrunts
-      iterator = tg_path
-
-      content {
-        id     = "terraform_apply_tesseract_${tg_path.key}"
-        name   = "terragrunt-opentofu"
-        ## Terragrunt apply can take up to 10+ minutes, give it 15m to be safe.
-        timeout = "900s"
-        script = <<EOT
-          terragrunt --terragrunt-non-interactive --terragrunt-no-color apply -auto-approve -no-color 2>&1
-        EOT
-        dir    = tg_path.value
-        env = [
-          "GOOGLE_PROJECT=${var.project_id}",
-          "TF_IN_AUTOMATION=1",
-          "TF_INPUT=false",
-          "TF_VAR_project_id=${var.project_id}",
-          "DOCKER_CONTAINER_TAG=$SHORT_SHA"
-        ]
-        wait_for = ["prepare_terragrunt_opentofu_container", "docker_push_tesseract_gcp"]
-      }
-    }
-
-    ## Print terraform output.
-    dynamic "step" {
-      for_each = var.logs_terragrunts
-      iterator = tg_path
-
-      content {
-        id     = "terraform_print_output_${tg_path.key}"
-        name   = "terragrunt-opentofu"
-        script = <<EOT
-          terragrunt --terragrunt-no-color output --raw tesseract_url -no-color > /workspace/tesseract_url
-          terragrunt --terragrunt-no-color output --raw tesseract_bucket_name -no-color > /workspace/tesseract_bucket_name
-          terragrunt --terragrunt-no-color output --raw ecdsa_p256_public_key_data -no-color > /workspace/tesseract_log_public_key.pem
-          cat /workspace/tesseract_url
-          cat /workspace/tesseract_bucket_name
-          cat /workspace/tesseract_log_public_key.pem
-        EOT
-        dir    = tg_path.value
-        env = [
-          "GOOGLE_PROJECT=${var.project_id}",
-          "TF_IN_AUTOMATION=1",
-          "TF_INPUT=false",
-          "TF_VAR_project_id=${var.project_id}",
-          "DOCKER_CONTAINER_TAG=$SHORT_SHA"
-        ]
-        wait_for = ["terraform_apply_tesseract_${tg_path.key}"]
-      }
-    }
-
-    options {
-      logging      = "CLOUD_LOGGING_ONLY"
-      machine_type = "E2_HIGHCPU_8"
-    }
-  }
-
-  depends_on = [
-    module.artifactregistry
-  ]
-}
diff --git a/deployment/modules/gcp/cloudbuild/tesseract/variables.tf b/deployment/modules/gcp/cloudbuild/tesseract/variables.tf
deleted file mode 100644
index 9be20f5c4..000000000
--- a/deployment/modules/gcp/cloudbuild/tesseract/variables.tf
+++ /dev/null
@@ -1,34 +0,0 @@
-variable "project_id" {
-  description = "GCP project ID where the log is hosted"
-  type        = string
-}
-
-variable "location" {
-  description = "Location in which to create resources"
-  type        = string
-}
-
-variable "env" {
-  description = "Unique identifier for the env, e.g. dev or ci or prod"
-  type        = string
-}
-
-variable "docker_env" {
-  description = "Unique identifier for the Docker env, e.g. dev or ci or prod"
-  type        = string
-}
-
-variable "github_owner" {
-  description = "GitHub owner used in Cloud Build trigger repository mapping"
-  type        = string
-}
-
-variable "logs_terragrunts" {
-  description = "Paths of the log terragrunt configs to deploy, from the root of the repository"
-  type        = list(any)
-}
-
-variable "git_tag_trigger_regexp" {
-  description = "Regular expression Git tags must match to trigger a build"
-  type        = string
-}
diff --git a/deployment/modules/gcp/gce/preloader/main.tf b/deployment/modules/gcp/gce/preloader/main.tf
deleted file mode 100644
index c149668ff..000000000
--- a/deployment/modules/gcp/gce/preloader/main.tf
+++ /dev/null
@@ -1,114 +0,0 @@
-terraform {
-  backend "gcs" {}
-  required_providers {
-    google = {
-      source  = "hashicorp/google"
-      version = "6.50.0"
-    }
-  }
-}
-
-locals {
-  preloader_service_account_id = var.env == "" ? "preloader-sa" : "preloader-${var.env}-sa"
-
-  preloader_container_name = "preloader-${var.env}"
-
-  # docker_run_args are provided to the docker run command.
-  # Use this to configure docker-specific things.
-  docker_run_args = join(" ", compact([
-    # Ensure that TesseraCT logs are delivered to GCP logging.
-    "--log-driver=gcplogs",
-  ]))
-
-  # Args for the preloader command.
-  preloader_args = join(" ", [
-    "--target_log_uri=${var.target_log_uri}",
-    "--source_log_uri=${var.source_log_uri}",
-    "--start_index=${var.start_index}",
-    "--continuous=true",
-    "--num_workers=500",
-    "--parallel_fetch=20",
-    "--parallel_submit=1500",
-    "--v=2",
-  ])
-
-  preloader_cloud_init = <<EOT
-    #cloud-config
-
-    users:
-      - name: preloader
-        uid: 2000
-        groups: docker # Add the user to the Docker group
-
-    write_files:
-      - path: /etc/systemd/system/preloader.service
-        permissions: 0644
-        owner: root
-        content: |
-          [Unit]
-          Description=Run Preloader
-
-          [Service]
-          ExecStartPre=sudo -u preloader /usr/bin/docker-credential-gcr configure-docker --registries ${var.location}-docker.pkg.dev
-          ExecStart=sudo -u preloader -E /usr/bin/docker run --rm -u 2000 --name=${local.preloader_container_name} ${local.docker_run_args} ${var.server_docker_image} ${local.preloader_args}
-          ExecStop=sudo -u preloader /usr/bin/docker stop ${local.preloader_container_name}
-          ExecStopPost=sudo -u /usr/bin/docker rm ${local.preloader_container_name}
-          StandardOutput=journal
-          StandardError=journal
-
-    runcmd:
-      - systemctl daemon-reload
-      - systemctl start preloader.service
-    EOT
-
-}
-
-data "google_compute_image" "cos" {
-  family  = "cos-121-lts"
-  project = "cos-cloud"
-}
-
-resource "google_compute_instance" "preloader" {
-  name         = "${var.base_name}-preloader"
-  machine_type = var.machine_type
-  zone         = "${var.location}-f"
-
-  tags = ["preloader"]
-
-  network_interface {
-    network = "default"
-    access_config {
-      // Ephemeral public IP for outbound witness requests.
-    }
-  }
-
-  boot_disk {
-    initialize_params {
-      image = data.google_compute_image.cos.self_link
-    }
-  }
-
-  labels = {
-    environment = var.env
-  }
-
-  # Come back to this: the start_index needs to be manually edited
-  # when the prelaoder restarts.
-  scheduling {
-    automatic_restart   = true
-    on_host_maintenance = "MIGRATE"
-  }
-  allow_stopping_for_update = true
-
-  metadata = {
-    google-logging-enabled    = "true"
-    google-monitoring-enabled = "true"
-    user-data                 = local.preloader_cloud_init
-  }
-
-  service_account {
-    # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
-    email  = "${local.preloader_service_account_id}@${var.project_id}.iam.gserviceaccount.com"
-    scopes = ["cloud-platform"] # Allows using service accounts and OAuth.
-  }
-}
diff --git a/deployment/modules/gcp/gce/preloader/variables.tf b/deployment/modules/gcp/gce/preloader/variables.tf
deleted file mode 100644
index b1334c1c1..000000000
--- a/deployment/modules/gcp/gce/preloader/variables.tf
+++ /dev/null
@@ -1,45 +0,0 @@
-variable "project_id" {
-  description = "GCP project ID where the log is hosted"
-  type        = string
-}
-
-variable "base_name" {
-  description = "Base name to use when naming resources"
-  type        = string
-}
-
-variable "location" {
-  description = "Location in which to create resources"
-  type        = string
-}
-
-variable "env" {
-  description = "Unique identifier for the env, e.g. dev or ci or prod"
-  type        = string
-}
-
-variable "machine_type" {
-  description = "GCP Compute Engine machine type to run the TesseraCT container on"
-  type        = string
-  default     = "n2-standard-4"
-}
-
-variable "server_docker_image" {
-  description = "The full image URL (path & tag) for the Docker image to deploy in Cloud Run"
-  type        = string
-}
-
-variable "target_log_uri" {
-  description = "URL of the destination log to preload to."
-  type        = string
-}
-
-variable "source_log_uri" {
-  description = "URL of the source RFC6962 log."
-  type        = string
-}
-
-variable "start_index" {
-  description = "Index to start preloading from on the source log."
-  type        = number
-}