feat: reconstruct infra module

projects/k8s/infra/configs/main.tf

@@ -0,0 +1,13 @@
+module "harbor-policy" {
+  source = "../../../../modules/infra/harbor/policy"
+  providers = {
+    harbor = harbor
+  }
+}
+
+module "argocd-application" {
+  source = "../../../../modules/infra/argocd/application"
+  providers = {
+    argocd = argocd
+  }
+}

projects/infra/provider.tf → projects/k8s/infra/configs/providers.tf

@@ -1,15 +1,10 @@
 terraform {
-  required_providers {
-    kubectl = {
-      source  = "gavinbunney/kubectl"
-      version = ">= 1.14.0"
-    }
-
-    vault = {
-      source  = "hashicorp/vault"
-      version = "4.6.0"
-    }
+  backend "gcs" {
+    bucket = "goboolean-450909-tfstate"
+    prefix = "452007/k8s/infra/configs"
+  }
 
+  required_providers {
     argocd = {
       source  = "argoproj-labs/argocd"
       version = "7.3.0"
@@ -23,6 +18,7 @@ terraform {
   required_version = ">= 0.14"
 }
 
+
 data "terraform_remote_state" "gcp" {
   backend = "gcs"
 
@@ -38,56 +34,42 @@ locals {
   gke_host                   = data.terraform_remote_state.gcp.outputs.kubernetes_provider_config.host
   gke_token                  = data.google_client_config.default.access_token
   gke_cluster_ca_certificate = data.terraform_remote_state.gcp.outputs.kubernetes_provider_config.cluster_ca_certificate
+}
 
-  vault_role_id = data.google_secret_manager_secret_version.vault_role_id.secret_data
-  vault_secret_id = data.google_secret_manager_secret_version.vault_secret_id.secret_data
+provider "kubernetes" {
+  host                   = local.gke_host
+  token                  = local.gke_token
+  cluster_ca_certificate = local.gke_cluster_ca_certificate
 }
 
 provider "google" {
   project = var.project_id
   region = var.region
 }
 
-data "google_secret_manager_secret_version" "vault_role_id" {
-  secret = "vault_role_id"
-}
+ephemeral "google_service_account_jwt" "vault_jwt" {
+  target_service_account = "atlantis@${var.project_id}.iam.gserviceaccount.com"
+
+  payload = jsonencode({
+    sub: "atlantis@${var.project_id}.iam.gserviceaccount.com",
+    aud: "vault/terraform",
+  })
 
-data "google_secret_manager_secret_version" "vault_secret_id" {
-  secret = "vault_secret_id"
+  expires_in = 1800
 }
 
 provider "vault" {
   address = "https://vault.goboolean.io"
+
   auth_login {
-    path = "auth/approle/login"
+    path = "auth/gcp/login"
     parameters = {
-      role_id   = local.vault_role_id
-      secret_id = local.vault_secret_id
+      jwt  = ephemeral.google_service_account_jwt.vault_jwt.jwt
+      role = "terraform"
     }
   }
 }
 
-provider "kubernetes" {
-  host                   = local.gke_host
-  token                  = local.gke_token
-  cluster_ca_certificate = local.gke_cluster_ca_certificate
-}
-
-provider "helm" {
-  kubernetes {
-    host                   = local.gke_host
-    token                  = local.gke_token
-    cluster_ca_certificate = local.gke_cluster_ca_certificate
-  }
-}
-
-provider "kubectl" {
-  host                   = local.gke_host
-  token                  = local.gke_token
-  cluster_ca_certificate = local.gke_cluster_ca_certificate
-  load_config_file       = false
-}
-
 data "vault_kv_secret_v2" "argocd" {
   mount = "kv"
   name = "infra/argocd"
@@ -99,6 +81,11 @@ provider "argocd" {
   password = data.vault_kv_secret_v2.argocd.data["password"]
 }
 
+data "vault_kv_secret_v2" "harbor" {
+  mount = "kv"
+  name = "infra/harbor"
+}
+
 provider "harbor" {
   url = "https://registry.goboolean.io"
   username = data.vault_kv_secret_v2.harbor.data["username"]

projects/core/variables.tf → projects/k8s/infra/configs/variables.tf

@@ -1,7 +1,7 @@
+# Google Cloud Platform
 variable "project_id" {
   description = "project id"
 }
-
 variable "region" {
   description = "region"
 }