diff --git a/README.md b/README.md index d88f6601..1ca7ea49 100644 --- a/README.md +++ b/README.md @@ -43,12 +43,12 @@ No requirements. | Name | Source | Version | |------|--------|---------| -| [argocd\_helm\_values](#module\_argocd\_helm\_values) | git::https://github.com/GlueOps/docs-argocd.git | v0.12.1 | +| [argocd\_helm\_values](#module\_argocd\_helm\_values) | git::https://github.com/GlueOps/docs-argocd.git | v0.13.0 | | [captain\_repository](#module\_captain\_repository) | ./modules/github-captain-repository/0.1.0 | n/a | | [captain\_repository\_files](#module\_captain\_repository\_files) | ./modules/github-captain-repository-files/0.1.0 | n/a | | [common\_s3](#module\_common\_s3) | ./modules/multy-s3-bucket/0.1.0 | n/a | | [dnssec\_key](#module\_dnssec\_key) | git::https://github.com/GlueOps/terraform-module-cloud-aws-dnssec-kms-key.git | v0.3.0 | -| [glueops\_platform\_helm\_values](#module\_glueops\_platform\_helm\_values) | git::https://github.com/GlueOps/platform-helm-chart-platform.git | v0.42.0 | +| [glueops\_platform\_helm\_values](#module\_glueops\_platform\_helm\_values) | git::https://github.com/GlueOps/platform-helm-chart-platform.git | v0.43.0-rc10 | | [loki\_s3](#module\_loki\_s3) | ./modules/multy-s3-bucket/0.1.0 | n/a | | [opsgenie\_teams](#module\_opsgenie\_teams) | ./modules/opsgenie/0.1.0 | n/a | | [tenant\_readmes](#module\_tenant\_readmes) | ./modules/tenant-readme/0.1.0 | n/a | @@ -59,12 +59,14 @@ No requirements. |------|------| | [aws_iam_access_key.certmanager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | | [aws_iam_access_key.externaldns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | +| [aws_iam_access_key.fluentbit_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | | [aws_iam_access_key.loki_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | | [aws_iam_access_key.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | | [aws_iam_access_key.tls_cert_backup_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | | [aws_iam_access_key.tls_cert_restore_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | | [aws_iam_access_key.vault_init_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | | [aws_iam_access_key.vault_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | +| [aws_iam_policy.fluentbit_logs_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.loki_logs_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_policy.route53](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | @@ -74,6 +76,7 @@ No requirements. | [aws_iam_policy.vault_s3_backup](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_user.certmanager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | | [aws_iam_user.externaldns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | +| [aws_iam_user.fluentbit_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | | [aws_iam_user.loki_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | | [aws_iam_user.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | | [aws_iam_user.tls_cert_backup_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | @@ -82,6 +85,7 @@ No requirements. | [aws_iam_user.vault_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | | [aws_iam_user_policy_attachment.certmanager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | | [aws_iam_user_policy_attachment.externaldns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | +| [aws_iam_user_policy_attachment.fluentbit_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | | [aws_iam_user_policy_attachment.loki_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | | [aws_iam_user_policy_attachment.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | | [aws_iam_user_policy_attachment.tls_cert_backup_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | diff --git a/generate-helm-values.tf b/generate-helm-values.tf index 7bdb18db..2a98d142 100644 --- a/generate-helm-values.tf +++ b/generate-helm-values.tf @@ -35,14 +35,14 @@ resource "random_password" "grafana_admin_secret" { } locals { - vault_access_tokens_s3_key = "hashicorp-vault-init/vault_access.json" - tls_cert_backup_s3_key_prefix = "tls-cert-backups" + vault_access_tokens_s3_key = "hashicorp-vault-init/vault_access.json" + tls_cert_backup_s3_key_prefix = "tls-cert-backups" tls_cert_restore_exclude_namespaces = "kube-system" } module "glueops_platform_helm_values" { for_each = local.environment_map - source = "git::https://github.com/GlueOps/platform-helm-chart-platform.git?ref=v0.42.0" + source = "git::https://github.com/GlueOps/platform-helm-chart-platform.git?ref=v0.43.0-rc10" captain_repo_b64encoded_private_deploy_key = base64encode(module.captain_repository[each.value.environment_name].private_deploy_key) captain_repo_ssh_clone_url = module.captain_repository[each.value.environment_name].ssh_clone_url this_is_development = var.this_is_development @@ -58,6 +58,8 @@ module "glueops_platform_helm_values" { loki_aws_secret_key = aws_iam_access_key.loki_s3[each.value.environment_name].secret loki_exporter_aws_access_key = aws_iam_access_key.loki_log_exporter_s3[each.value.environment_name].id loki_exporter_aws_secret_key = aws_iam_access_key.loki_log_exporter_s3[each.value.environment_name].secret + fluentbit_exporter_aws_access_key = aws_iam_access_key.fluentbit_log_exporter_s3[each.value.environment_name].id + fluentbit_exporter_aws_secret_key = aws_iam_access_key.fluentbit_log_exporter_s3[each.value.environment_name].secret certmanager_aws_access_key = aws_iam_access_key.certmanager[each.value.environment_name].id certmanager_aws_secret_key = aws_iam_access_key.certmanager[each.value.environment_name].secret externaldns_aws_access_key = aws_iam_access_key.externaldns[each.value.environment_name].id @@ -104,7 +106,7 @@ resource "aws_s3_object" "platform_helm_values" { module "argocd_helm_values" { for_each = local.environment_map - source = "git::https://github.com/GlueOps/docs-argocd.git?ref=v0.12.1" + source = "git::https://github.com/GlueOps/docs-argocd.git?ref=v0.13.0" tenant_key = var.tenant_key cluster_environment = each.value.environment_name client_secret = random_password.dex_argocd_client_secret[each.value.environment_name].result diff --git a/iam-policy-fluentbit-xptr-s3.tf b/iam-policy-fluentbit-xptr-s3.tf new file mode 100644 index 00000000..7e4ed08d --- /dev/null +++ b/iam-policy-fluentbit-xptr-s3.tf @@ -0,0 +1,34 @@ +resource "aws_iam_policy" "fluentbit_logs_exporter_s3" { + provider = aws.clientaccount + for_each = aws_route53_zone.clusters + name = "fluentbit-xptr-s3-${aws_route53_zone.clusters[each.key].name}" + policy = <