Skip to content

enh: use flags to enabled/disable additional functionalities instead of using examples folder #176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Nov 15, 2021
Merged

enh: use flags to enabled/disable additional functionalities instead of using examples folder #176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
57ab818
feat: use flags to enabled/disable additional functionalities instead…
mglotov Nov 10, 2021
86230c6
enh: add count for all default releases
mglotov Nov 10, 2021
80663bd
merge from main branch to resolve conflicts
mglotov Nov 10, 2021
bc3411b
feature: introduce a new k8s storageclass and switch all PVC to it.
mglotov Nov 12, 2021
5a52034
fix helm_releases installation. add count to all releases
mglotov Nov 12, 2021
c354eb6
fix grammar mistake in README.md
mglotov Nov 12, 2021
8848567
fix: Use count for data.template_file too. Delete example folders
mglotov Nov 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
177 changes: 86 additions & 91 deletions README.md
View file
Open in desktop

Large diffs are not rendered by default.

165 changes: 98 additions & 67 deletions terraform/layer1-aws/README.md
View file
Open in desktop

Large diffs are not rendered by default.

4 changes: 3 additions & 1 deletion ...rm/layer1-aws/examples/aws-ec2-pritunl.tf → terraform/layer1-aws/aws-ec2-pritunl.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
#tfsec:ignore:aws-vpc-no-public-egress-sgr tfsec:ignore:aws-vpc-no-public-ingress-sgr
module "pritunl" {
source = "../modules/aws-ec2-pritunl"
count = var.pritunl_vpn_server_enable ? 1 : 0

source = "../modules/aws-ec2-pritunl"
environment = local.env
vpc_id = module.vpc.vpc_id
public_subnets = module.vpc.public_subnets
Expand Down
6 changes: 6 additions & 0 deletions terraform/layer1-aws/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,3 +245,9 @@ variable "eks_cluster_encryption_config_enable" {
default = false
description = "Enable or not encryption for k8s secrets with aws-kms"
}

variable "pritunl_vpn_server_enable" {
type = bool
default = false
description = "Indicates whether or not the Pritunl VPN server is deployed."
}
18 changes: 18 additions & 0 deletions terraform/layer2-k8s/.terraform.lock.hcl
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

201 changes: 169 additions & 32 deletions terraform/layer2-k8s/README.md
View file
Open in desktop

Large diffs are not rendered by default.

36 changes: 20 additions & 16 deletions terraform/layer2-k8s/eks-aws-loadbalancer-controller.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,15 @@
locals {
aws-load-balancer-controller = {
chart = local.helm_charts[index(local.helm_charts.*.id, "aws-load-balancer-controller")].chart
repository = lookup(local.helm_charts[index(local.helm_charts.*.id, "aws-load-balancer-controller")], "repository", null)
chart_version = lookup(local.helm_charts[index(local.helm_charts.*.id, "aws-load-balancer-controller")], "version", null)
aws_load_balancer_controller = {
name = local.helm_releases[index(local.helm_releases.*.id, "aws-load-balancer-controller")].id
enabled = local.helm_releases[index(local.helm_releases.*.id, "aws-load-balancer-controller")].enabled
chart = local.helm_releases[index(local.helm_releases.*.id, "aws-load-balancer-controller")].chart
repository = local.helm_releases[index(local.helm_releases.*.id, "aws-load-balancer-controller")].repository
chart_version = local.helm_releases[index(local.helm_releases.*.id, "aws-load-balancer-controller")].version
namespace = local.helm_releases[index(local.helm_releases.*.id, "aws-load-balancer-controller")].namespace
}
alb_ingress_controller = templatefile("${path.module}/templates/alb-ingress-controller-values.yaml",
{
role_arn = var.aws_loadbalancer_controller_enable ? module.aws_iam_aws_loadbalancer_controller[0].role_arn : "",
role_arn = local.aws_load_balancer_controller.enabled ? module.aws_iam_aws_loadbalancer_controller[0].role_arn : "",
region = local.region,
cluster_name = local.eks_cluster_id,
vpc_id = local.vpc_id
Expand All @@ -15,10 +18,10 @@ locals {

#tfsec:ignore:kubernetes-network-no-public-egress tfsec:ignore:kubernetes-network-no-public-ingress
module "aws_load_balancer_controller_namespace" {
count = var.aws_loadbalancer_controller_enable ? 1 : 0
count = local.aws_load_balancer_controller.enabled ? 1 : 0

source = "../modules/kubernetes-namespace"
name = "aws-load-balancer-controller"
name = local.aws_load_balancer_controller.namespace
network_policies = [
{
name = "default-deny"
Expand All @@ -34,7 +37,7 @@ module "aws_load_balancer_controller_namespace" {
{
namespace_selector = {
match_labels = {
name = "aws-load-balancer-controller"
name = local.aws_load_balancer_controller.namespace
}
}
}
Expand All @@ -48,7 +51,7 @@ module "aws_load_balancer_controller_namespace" {
match_expressions = {
key = "app.kubernetes.io/name"
operator = "In"
values = ["aws-load-balancer-controller"]
values = [local.aws_load_balancer_controller.name]
}
}
ingress = {
Expand Down Expand Up @@ -89,10 +92,10 @@ module "aws_load_balancer_controller_namespace" {

#tfsec:ignore:aws-iam-no-policy-wildcards
module "aws_iam_aws_loadbalancer_controller" {
count = var.aws_loadbalancer_controller_enable ? 1 : 0
count = local.aws_load_balancer_controller.enabled ? 1 : 0

source = "../modules/aws-iam-eks-trusted"
name = "${local.name}-alb-ingress"
name = "${local.name}-aws-lb-controller"
region = local.region
oidc_provider_arn = local.eks_oidc_provider_arn
policy = jsonencode({
Expand Down Expand Up @@ -305,16 +308,17 @@ module "aws_iam_aws_loadbalancer_controller" {
}

resource "helm_release" "aws_loadbalancer_controller" {
count = var.aws_loadbalancer_controller_enable ? 1 : 0
count = local.aws_load_balancer_controller.enabled ? 1 : 0

name = "aws-load-balancer-controller"
chart = local.aws-load-balancer-controller.chart
repository = local.aws-load-balancer-controller.repository
version = local.aws-load-balancer-controller.chart_version
name = local.aws_load_balancer_controller.name
chart = local.aws_load_balancer_controller.chart
repository = local.aws_load_balancer_controller.repository
version = local.aws_load_balancer_controller.chart_version
namespace = module.aws_load_balancer_controller_namespace[count.index].name
max_history = var.helm_release_history_size

values = [
local.alb_ingress_controller
]

}
30 changes: 18 additions & 12 deletions terraform/layer2-k8s/eks-aws-node-termination-handler.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,20 @@
locals {
aws-node-termination-handler = {
chart = local.helm_charts[index(local.helm_charts.*.id, "aws-node-termination-handler")].chart
repository = lookup(local.helm_charts[index(local.helm_charts.*.id, "aws-node-termination-handler")], "repository", null)
chart_version = lookup(local.helm_charts[index(local.helm_charts.*.id, "aws-node-termination-handler")], "version", null)
aws_node_termination_handler = {
name = local.helm_releases[index(local.helm_releases.*.id, "aws-node-termination-handler")].id
enabled = local.helm_releases[index(local.helm_releases.*.id, "aws-node-termination-handler")].enabled
chart = local.helm_releases[index(local.helm_releases.*.id, "aws-node-termination-handler")].chart
repository = local.helm_releases[index(local.helm_releases.*.id, "aws-node-termination-handler")].repository
chart_version = local.helm_releases[index(local.helm_releases.*.id, "aws-node-termination-handler")].version
namespace = local.helm_releases[index(local.helm_releases.*.id, "aws-node-termination-handler")].namespace
}
}

#tfsec:ignore:kubernetes-network-no-public-egress tfsec:ignore:kubernetes-network-no-public-ingress
module "aws_node_termination_handler_namespace" {
count = local.aws_node_termination_handler.enabled ? 1 : 0

source = "../modules/kubernetes-namespace"
name = "aws-node-termination-handler"
name = local.aws_node_termination_handler.namespace
network_policies = [
{
name = "default-deny"
Expand All @@ -25,7 +30,7 @@ module "aws_node_termination_handler_namespace" {
{
namespace_selector = {
match_labels = {
name = "aws-node-termination-handler"
name = local.aws_node_termination_handler.namespace
}
}
}
Expand Down Expand Up @@ -53,12 +58,13 @@ module "aws_node_termination_handler_namespace" {
}

resource "helm_release" "aws_node_termination_handler" {
name = "aws-node-termination-handler"
chart = local.aws-node-termination-handler.chart
repository = local.aws-node-termination-handler.repository
version = local.aws-node-termination-handler.chart_version
namespace = module.aws_node_termination_handler_namespace.name
wait = false
count = local.aws_node_termination_handler.enabled ? 1 : 0

name = local.aws_node_termination_handler.name
chart = local.aws_node_termination_handler.chart
repository = local.aws_node_termination_handler.repository
version = local.aws_node_termination_handler.chart_version
namespace = module.aws_node_termination_handler_namespace[count.index].name
max_history = var.helm_release_history_size

values = [
Expand Down
31 changes: 16 additions & 15 deletions terraform/layer2-k8s/eks-calico.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,25 +1,26 @@
locals {
aws-calico = {
chart = local.helm_charts[index(local.helm_charts.*.id, "aws-calico")].chart
repository = lookup(local.helm_charts[index(local.helm_charts.*.id, "aws-calico")], "repository", null)
chart_version = lookup(local.helm_charts[index(local.helm_charts.*.id, "aws-calico")], "version", null)
aws_calico = {
name = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].id
enabled = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].enabled
chart = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].chart
repository = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].repository
chart_version = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].version
namespace = local.helm_releases[index(local.helm_releases.*.id, "aws-calico")].namespace
}
}

data "template_file" "calico_daemonset" {
template = file("${path.module}/templates/calico-values.yaml")
}

resource "helm_release" "calico_daemonset" {
name = "aws-calico"
chart = local.aws-calico.chart
repository = local.aws-calico.repository
version = local.aws-calico.chart_version
namespace = "kube-system"
count = local.aws_calico.enabled ? 1 : 0

name = local.aws_calico.name
chart = local.aws_calico.chart
repository = local.aws_calico.repository
version = local.aws_calico.chart_version
namespace = local.aws_calico.namespace
max_history = var.helm_release_history_size
wait = false

values = [
data.template_file.calico_daemonset.rendered,
file("${path.module}/templates/calico-values.yaml")
]

}
33 changes: 0 additions & 33 deletions terraform/layer2-k8s/eks-cert-manager-certificate.tf
View file
Open in desktop

This file was deleted.

34 changes: 0 additions & 34 deletions terraform/layer2-k8s/eks-cert-manager-cluster-issuer.tf
View file
Open in desktop

This file was deleted.

Loading