Funch関連インフラの撤去（参照削除）

[kantacky]

背景

Funch 関連のインフラを撤去する。本 PR はその第 1 段階として、Funch Service を参照している周辺リソースの定義を削除する。

Funch Service 本体（terraform/google/server/funch-service）は、参照が残ったままだと terraform_remote_state の解決に失敗するため、本 PR の apply 後に別途 destroy する。

変更点

• app-api / admin-api: funch_service の terraform_remote_state データソース、run.invoker の IAM バインディング、FUNCH_API_URL 環境変数を削除
• modules/cloud-sql: database_service_accounts から funch-svc / funch-svc-dev / funch-svc-stg を削除
• modules/monitoring: Service Server Error (Prd) のログフィルタから funch-api を除外

Firebase Remote Config の funch フラグは今回のスコープ外として残している。

確認事項

• terraform fmt -recursive -check が通ることを確認済み
• app-api / admin-api は新しいリビジョンが作成される。アプリ側が FUNCH_API_URL を必須で読み込んでいないこと
• Cloud SQL の IAM ユーザー削除は Funch Service が実質停止済みであることが前提

後続作業

1. 本 PR を apply 後、terraform/google/server/funch-service を dev → stg → prd の順に terraform destroy
2. funch-service ディレクトリと digger.yml の該当 project を削除する PR を作成
3. GCS の tfstate swift2023groupc-tfstate/server/funch-service-* を削除

🤖 Generated with Claude Code

[github-actions]

Digger run report at 2026-08-21 00:15:33 (UTC)

Plan output

Terraform will perform the following actions:

  # google_sql_user.service_account["funch-svc"] will be destroyed
  # (because key ["funch-svc"] is not in for_each map)
  - resource "google_sql_user" "service_account" {
      - database_roles          = [
          - "dotto_service",
        ] -> null
      - deletion_policy         = "DELETE" -> null
      - id                      = "funch-svc@swift2023groupc.iam//dotto" -> null
      - instance                = "dotto" -> null
      - name                    = "funch-svc@swift2023groupc.iam" -> null
      - password_wo             = (write-only attribute) -> null
      - project                 = "swift2023groupc" -> null
      - sql_server_user_details = [] -> null
      - type                    = "CLOUD_IAM_SERVICE_ACCOUNT" -> null
        # (2 unchanged attributes hidden)
    }

  # google_sql_user.service_account["funch-svc-dev"] will be destroyed
  # (because key ["funch-svc-dev"] is not in for_each map)
  - resource "google_sql_user" "service_account" {
      - database_roles          = [
          - "dotto_service",
        ] -> null
      - deletion_policy         = "DELETE" -> null
      - id                      = "funch-svc-dev@swift2023groupc.iam//dotto" -> null
      - instance                = "dotto" -> null
      - name                    = "funch-svc-dev@swift2023groupc.iam" -> null
      - password_wo             = (write-only attribute) -> null
      - project                 = "swift2023groupc" -> null
      - sql_server_user_details = [] -> null
      - type                    = "CLOUD_IAM_SERVICE_ACCOUNT" -> null
        # (2 unchanged attributes hidden)
    }

  # google_sql_user.service_account["funch-svc-stg"] will be destroyed
  # (because key ["funch-svc-stg"] is not in for_each map)
  - resource "google_sql_user" "service_account" {
      - database_roles          = [
          - "dotto_service",
        ] -> null
      - deletion_policy         = "DELETE" -> null
      - id                      = "funch-svc-stg@swift2023groupc.iam//dotto" -> null
      - instance                = "dotto" -> null
      - name                    = "funch-svc-stg@swift2023groupc.iam" -> null
      - password_wo             = (write-only attribute) -> null
      - project                 = "swift2023groupc" -> null
      - sql_server_user_details = [] -> null
      - type                    = "CLOUD_IAM_SERVICE_ACCOUNT" -> null
        # (2 unchanged attributes hidden)
    }

Plan: 0 to add, 0 to change, 3 to destroy.

Terraform plan validation check (modules-cloud-sql)

Terraform plan validation checks succeeded ✅

Plan summary

CHANGE	RESOURCE
delete	google_sql_user.service_account["funch-svc"]
	google_sql_user.service_account["funch-svc-dev"]
	google_sql_user.service_account["funch-svc-stg"]

Instructions

▶️ To apply these changes, run the following command:

digger apply -p modules-cloud-sql

⏩ To apply all changes in this PR:

digger apply

🚮 To unlock all projects in this PR:

digger unlock

Plan output

Terraform will perform the following actions:

  # google_monitoring_alert_policy.cloud_run_service_server_error_prd will be updated in-place
  ~ resource "google_monitoring_alert_policy" "cloud_run_service_server_error_prd" {
        id                    = "projects/swift2023groupc/alertPolicies/15636630131453410874"
        name                  = "projects/swift2023groupc/alertPolicies/15636630131453410874"
        # (9 unchanged attributes hidden)

      ~ conditions {
            name         = "projects/swift2023groupc/alertPolicies/15636630131453410874/conditions/15636630131453410703"
            # (1 unchanged attribute hidden)

          ~ condition_matched_log {
              ~ filter           = <<-EOT
                    resource.type="cloud_run_revision"
                    severity >= ERROR
                    (
                      resource.labels.service_name="announcement-api" OR
                      resource.labels.service_name="academic-api" OR
                  -   resource.labels.service_name="funch-api" OR
                      resource.labels.service_name="user-api"
                    )
                EOT
                # (1 unchanged attribute hidden)
            }
        }

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Terraform plan validation check (modules-monitoring)

Terraform plan validation checks succeeded ✅

Plan summary

CHANGE	RESOURCE
update	google_monitoring_alert_policy.cloud_run_service_server_error_prd

Instructions

▶️ To apply these changes, run the following command:

digger apply -p modules-monitoring

⏩ To apply all changes in this PR:

digger apply

🚮 To unlock all projects in this PR:

digger unlock

Locking failed

Project fun-dotto/infra#server-admin-api-dev locked by another PR #21(failed to acquire lock server-admin-api-dev). The locking plan must be applied or discarded before future plans can execute

Locking failed

Project fun-dotto/infra#server-admin-api-prd locked by another PR #21(failed to acquire lock server-admin-api-prd). The locking plan must be applied or discarded before future plans can execute

Locking failed

Project fun-dotto/infra#server-admin-api-stg locked by another PR #21(failed to acquire lock server-admin-api-stg). The locking plan must be applied or discarded before future plans can execute

Locking failed

Project fun-dotto/infra#server-app-api-dev locked by another PR #21(failed to acquire lock server-app-api-dev). The locking plan must be applied or discarded before future plans can execute

Locking failed

Project fun-dotto/infra#server-app-api-prd locked by another PR #21(failed to acquire lock server-app-api-prd). The locking plan must be applied or discarded before future plans can execute

Locking failed

Project fun-dotto/infra#server-app-api-stg locked by another PR #21(failed to acquire lock server-app-api-stg). The locking plan must be applied or discarded before future plans can execute