From fbc29eabdf8e2cf376fa810d4c6c535fbe6eb029 Mon Sep 17 00:00:00 2001 From: Venkata Mutyala Date: Tue, 13 Jun 2023 18:55:03 -0700 Subject: [PATCH] MAJOR: adding hostNetwork mode toggle, new ports, and centralized version control for terraform providers (#51) feat: add toggle for host network mode and new port numbers for all hostNetwork services MAJOR: remove all pinned versions since they are now being centrally controlled by our provider versions module MAJOR: update glueops-platform chart to 0.16.0 --- README.md | 96 +++++++++---------- captain-repo.tf | 26 +++-- generate-helm-values.tf | 3 +- .../0.1.0/providers.tf | 5 +- modules/opsgenie/0.1.0/providers.tf | 5 +- modules/tenant-readme/0.1.0/readme.tf | 2 +- providers.tf | 10 +- variables.tf | 2 + 8 files changed, 78 insertions(+), 71 deletions(-) diff --git a/README.md b/README.md index 6582b39b..eb4278ad 100644 --- a/README.md +++ b/README.md @@ -28,20 +28,16 @@ Some dependencies for this module must be creates prior to its use, including: ## Requirements -| Name | Version | -|------|---------| -| [aws](#requirement\_aws) | 4.67.0 | -| [cloudflare](#requirement\_cloudflare) | 4.5.0 | -| [random](#requirement\_random) | 3.5.1 | +No requirements. ## Providers | Name | Version | |------|---------| -| [aws.clientaccount](#provider\_aws.clientaccount) | 4.67.0 | -| [aws.management-tenant-dns](#provider\_aws.management-tenant-dns) | 4.67.0 | -| [aws.primaryregion](#provider\_aws.primaryregion) | 4.67.0 | -| [random](#provider\_random) | 3.5.1 | +| [aws.clientaccount](#provider\_aws.clientaccount) | n/a | +| [aws.management-tenant-dns](#provider\_aws.management-tenant-dns) | n/a | +| [aws.primaryregion](#provider\_aws.primaryregion) | n/a | +| [random](#provider\_random) | n/a | ## Modules @@ -51,7 +47,7 @@ Some dependencies for this module must be creates prior to its use, including: | [captain\_repository](#module\_captain\_repository) | ./modules/github-captain-repository/0.1.0 | n/a | | [common\_s3](#module\_common\_s3) | ./modules/multy-s3-bucket/0.1.0 | n/a | | [dnssec\_key](#module\_dnssec\_key) | git::https://github.com/GlueOps/terraform-module-cloud-aws-dnssec-kms-key.git | v0.1.0 | -| [glueops\_platform\_helm\_values](#module\_glueops\_platform\_helm\_values) | git::https://github.com/GlueOps/platform-helm-chart-platform.git | v0.15.0 | +| [glueops\_platform\_helm\_values](#module\_glueops\_platform\_helm\_values) | git::https://github.com/GlueOps/platform-helm-chart-platform.git | v0.16.0 | | [loki\_s3](#module\_loki\_s3) | ./modules/multy-s3-bucket/0.1.0 | n/a | | [opsgenie\_teams](#module\_opsgenie\_teams) | ./modules/opsgenie/0.1.0 | n/a | | [tenant\_readmes](#module\_tenant\_readmes) | ./modules/tenant-readme/0.1.0 | n/a | @@ -60,52 +56,52 @@ Some dependencies for this module must be creates prior to its use, including: | Name | Type | |------|------| -| [aws_iam_access_key.certmanager](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_access_key) | resource | -| [aws_iam_access_key.externaldns](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_access_key) | resource | -| [aws_iam_access_key.loki_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_access_key) | resource | -| [aws_iam_access_key.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_access_key) | resource | -| [aws_iam_access_key.vault_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_access_key) | resource | -| [aws_iam_policy.loki_logs_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_policy) | resource | -| [aws_iam_policy.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_policy) | resource | -| [aws_iam_policy.route53](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_policy) | resource | -| [aws_iam_policy.vault_s3_backup](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_policy) | resource | -| [aws_iam_user.certmanager](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user) | resource | -| [aws_iam_user.externaldns](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user) | resource | -| [aws_iam_user.loki_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user) | resource | -| [aws_iam_user.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user) | resource | -| [aws_iam_user.vault_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user) | resource | -| [aws_iam_user_policy_attachment.certmanager](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user_policy_attachment) | resource | -| [aws_iam_user_policy_attachment.externaldns](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user_policy_attachment) | resource | -| [aws_iam_user_policy_attachment.loki_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user_policy_attachment) | resource | -| [aws_iam_user_policy_attachment.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user_policy_attachment) | resource | -| [aws_iam_user_policy_attachment.vault_s3](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/iam_user_policy_attachment) | resource | -| [aws_route53_hosted_zone_dnssec.cluster_zones](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_hosted_zone_dnssec) | resource | -| [aws_route53_hosted_zone_dnssec.parent_tenant_zone](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_hosted_zone_dnssec) | resource | -| [aws_route53_key_signing_key.cluster_zones](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_key_signing_key) | resource | -| [aws_route53_key_signing_key.parent_tenant_zone](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_key_signing_key) | resource | -| [aws_route53_record.cluster_zone_dnssec_records](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_record) | resource | -| [aws_route53_record.cluster_zone_ns_records](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_record) | resource | -| [aws_route53_record.delegation_to_parent_tenant_zone](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_record) | resource | -| [aws_route53_record.enable_dnssec_for_parent_tenant_zone](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_record) | resource | -| [aws_route53_record.wildcard_for_apps](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_record) | resource | -| [aws_route53_zone.clusters](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_zone) | resource | -| [aws_route53_zone.main](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/route53_zone) | resource | -| [aws_s3_object.argocd_helm_values](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/s3_object) | resource | -| [aws_s3_object.combined_outputs](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/s3_object) | resource | -| [aws_s3_object.platform_helm_values](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/resources/s3_object) | resource | -| [random_password.dex_argocd_client_secret](https://registry.terraform.io/providers/hashicorp/random/3.5.1/docs/resources/password) | resource | -| [random_password.dex_grafana_client_secret](https://registry.terraform.io/providers/hashicorp/random/3.5.1/docs/resources/password) | resource | -| [random_password.dex_pomerium_client_secret](https://registry.terraform.io/providers/hashicorp/random/3.5.1/docs/resources/password) | resource | -| [random_password.dex_vault_client_secret](https://registry.terraform.io/providers/hashicorp/random/3.5.1/docs/resources/password) | resource | -| [random_password.grafana_admin_secret](https://registry.terraform.io/providers/hashicorp/random/3.5.1/docs/resources/password) | resource | -| [aws_route53_zone.management_tenant_dns](https://registry.terraform.io/providers/hashicorp/aws/4.67.0/docs/data-sources/route53_zone) | data source | +| [aws_iam_access_key.certmanager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | +| [aws_iam_access_key.externaldns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | +| [aws_iam_access_key.loki_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | +| [aws_iam_access_key.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | +| [aws_iam_access_key.vault_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key) | resource | +| [aws_iam_policy.loki_logs_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_policy.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_policy.route53](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_policy.vault_s3_backup](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_user.certmanager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | +| [aws_iam_user.externaldns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | +| [aws_iam_user.loki_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | +| [aws_iam_user.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | +| [aws_iam_user.vault_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource | +| [aws_iam_user_policy_attachment.certmanager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | +| [aws_iam_user_policy_attachment.externaldns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | +| [aws_iam_user_policy_attachment.loki_log_exporter_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | +| [aws_iam_user_policy_attachment.loki_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | +| [aws_iam_user_policy_attachment.vault_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource | +| [aws_route53_hosted_zone_dnssec.cluster_zones](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_hosted_zone_dnssec) | resource | +| [aws_route53_hosted_zone_dnssec.parent_tenant_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_hosted_zone_dnssec) | resource | +| [aws_route53_key_signing_key.cluster_zones](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_key_signing_key) | resource | +| [aws_route53_key_signing_key.parent_tenant_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_key_signing_key) | resource | +| [aws_route53_record.cluster_zone_dnssec_records](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource | +| [aws_route53_record.cluster_zone_ns_records](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource | +| [aws_route53_record.delegation_to_parent_tenant_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource | +| [aws_route53_record.enable_dnssec_for_parent_tenant_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource | +| [aws_route53_record.wildcard_for_apps](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource | +| [aws_route53_zone.clusters](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource | +| [aws_route53_zone.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource | +| [aws_s3_object.argocd_helm_values](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource | +| [aws_s3_object.combined_outputs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource | +| [aws_s3_object.platform_helm_values](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource | +| [random_password.dex_argocd_client_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | +| [random_password.dex_grafana_client_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | +| [random_password.dex_pomerium_client_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | +| [random_password.dex_vault_client_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | +| [random_password.grafana_admin_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | +| [aws_route53_zone.management_tenant_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53_zone) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [backup\_region](#input\_backup\_region) | The secondary S3 region to create S3 bucket in used for backups. This should be different than the primary region and will have the data from the primary region replicated to it. | `string` | n/a | yes | -| [cluster\_environments](#input\_cluster\_environments) | The cluster environments and their respective github app ids | 
list(object({
    environment_name                     = string
    github_oauth_app_client_id           = string
    github_oauth_app_client_secret       = string
    github_tenant_app_id                 = string
    github_tenant_app_installation_id    = string
    github_tenant_app_b64enc_private_key = string
    admin_github_org_name                = string
    tenant_github_org_name               = string
    vault_github_org_team_policy_mappings = list(object({
      oidc_groups = list(string)
      policy_name = string
    }))
    argocd_rbac_policies = string

  }))
| 
[
  {
    "admin_github_org_name": "GlueOps",
    "argocd_rbac_policies": "      g, GlueOps:argocd_super_admins, role:admin\n      g, glueops-rocks:developers, role:developers\n      p, role:developers, clusters, get, *, allow\n      p, role:developers, *, get, development, allow\n      p, role:developers, repositories, *, development/*, allow\n      p, role:developers, applications, *, development/*, allow\n      p, role:developers, exec, *, development/*, allow\n",
    "environment_name": "test",
    "github_oauth_app_client_id": "oauth-app-id",
    "github_oauth_app_client_secret": "oauth-app-secret",
    "github_tenant_app_b64enc_private_key": "tenant-github-app-b64enc-private-key",
    "github_tenant_app_id": "tenant-github-app-id",
    "github_tenant_app_installation_id": "tenant-github-app-installation-id",
    "tenant_github_org_name": "glueops-rocks",
    "vault_github_org_team_policy_mappings": [
      {
        "oidc_groups": [
          "GlueOps:vault_super_admins"
        ],
        "policy_name": "editor"
      },
      {
        "oidc_groups": [
          "GlueOps:vault_super_admins",
          "testing-okta:developers"
        ],
        "policy_name": "reader"
      }
    ]
  }
]
| no | +| [cluster\_environments](#input\_cluster\_environments) | The cluster environments and their respective github app ids | 
list(object({
    environment_name                     = string
    host_network_enabled                 = bool
    github_oauth_app_client_id           = string
    github_oauth_app_client_secret       = string
    github_tenant_app_id                 = string
    github_tenant_app_installation_id    = string
    github_tenant_app_b64enc_private_key = string
    admin_github_org_name                = string
    tenant_github_org_name               = string
    vault_github_org_team_policy_mappings = list(object({
      oidc_groups = list(string)
      policy_name = string
    }))
    argocd_rbac_policies = string

  }))
| 
[
  {
    "admin_github_org_name": "GlueOps",
    "argocd_rbac_policies": "      g, GlueOps:argocd_super_admins, role:admin\n      g, glueops-rocks:developers, role:developers\n      p, role:developers, clusters, get, *, allow\n      p, role:developers, *, get, development, allow\n      p, role:developers, repositories, *, development/*, allow\n      p, role:developers, applications, *, development/*, allow\n      p, role:developers, exec, *, development/*, allow\n",
    "environment_name": "test",
    "github_oauth_app_client_id": "oauth-app-id",
    "github_oauth_app_client_secret": "oauth-app-secret",
    "github_tenant_app_b64enc_private_key": "tenant-github-app-b64enc-private-key",
    "github_tenant_app_id": "tenant-github-app-id",
    "github_tenant_app_installation_id": "tenant-github-app-installation-id",
    "host_network_enabled": true,
    "tenant_github_org_name": "glueops-rocks",
    "vault_github_org_team_policy_mappings": [
      {
        "oidc_groups": [
          "GlueOps:vault_super_admins"
        ],
        "policy_name": "editor"
      },
      {
        "oidc_groups": [
          "GlueOps:vault_super_admins",
          "testing-okta:developers"
        ],
        "policy_name": "reader"
      }
    ]
  }
]
| no | | [github\_owner](#input\_github\_owner) | The GitHub Owner where the tenant repo will be deployed. | `string` | n/a | yes | | [management\_tenant\_dns\_aws\_account\_id](#input\_management\_tenant\_dns\_aws\_account\_id) | The company AWS account id for the management-tenant-dns account | `string` | n/a | yes | | [management\_tenant\_dns\_zoneid](#input\_management\_tenant\_dns\_zoneid) | The Route53 ZoneID that all the delegation is coming from. | `string` | n/a | yes | diff --git a/captain-repo.tf b/captain-repo.tf index 888aaa1e..2cdc4f02 100644 --- a/captain-repo.tf +++ b/captain-repo.tf @@ -1,12 +1,26 @@ +locals { + + provider_versions_tf_file = <