diff --git a/ansible/Ananda/README.md b/ansible/Ananda/README.md deleted file mode 100644 index 91d6881..0000000 --- a/ansible/Ananda/README.md +++ /dev/null @@ -1,20 +0,0 @@ -## Usage -This playbook installs and configures the Ananda agent on the lab controllers to set them up as gateways. - -You need to install the amazon.aws collection (requires Ansible version 2.9+) and it's dependencies before being able to run the playbook: -``` -ansible-galaxy collection install amazon.aws -pip install botocore boto3 -``` - - -Since the Ananda tokens are saved as AWS Secrets you also have to login into the SSO account with id `289708231103`. It is required to set the following environment variables: -``` -export AWS_PROFILE="AdministratorAccess-289708231103" # Depends on your chosen profile name -export AWS_DEFAULT_REGION="us-east-2" -``` - - -Execute a dry-run with `ansible-playbook -i hosts.yml setup_gateways.yml --diff --check`. - -Apply the changes with `ansible-playbook -i hosts.yml setup_gateways.yml --diff`. diff --git a/ansible/Ananda/hosts.yml b/ansible/Ananda/hosts.yml deleted file mode 100644 index 043b99d..0000000 --- a/ansible/Ananda/hosts.yml +++ /dev/null @@ -1,53 +0,0 @@ -all: - hosts: - lab-ctlr: - lab-ctlr2: - lab_ctlr3: - lab-ctlr4: - lab-ctlr5: - lab-ctlr9: - children: - ananda_gateways: - hosts: - lab-ctlr: - ansible_host: 10.28.3.100 - ansible_user: lanforge - ansible_become_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_common_args: -J ubuntu@3.130.51.163 - ananda_token: "{{ lookup('amazon.aws.aws_secret', 'Ananda/GatewayTokens.lab-ctlr', nested=true) }}" - lab-ctlr2: - ansible_host: 10.28.3.101 - ansible_user: lanforge - ansible_become_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_common_args: -J ubuntu@3.130.51.163 - ananda_token: "{{ lookup('amazon.aws.aws_secret', 'Ananda/GatewayTokens.lab-ctlr2', nested=true) }}" - lab-ctlr3: - ansible_host: 10.28.3.102 - ansible_user: lanforge - ansible_become_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_common_args: -J ubuntu@3.130.51.163 - ananda_token: "{{ lookup('amazon.aws.aws_secret', 'Ananda/GatewayTokens.lab-ctlr3', nested=true) }}" - lab-ctlr4: - ansible_host: 10.28.3.103 - ansible_user: lanforge - ansible_become_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_common_args: -J ubuntu@3.130.51.163 - ananda_token: "{{ lookup('amazon.aws.aws_secret', 'Ananda/GatewayTokens.lab-ctlr4', nested=true) }}" - lab-ctlr5: - ansible_host: 10.28.3.104 - ansible_user: lanforge - ansible_become_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_common_args: -J ubuntu@3.130.51.163 - ananda_token: "{{ lookup('amazon.aws.aws_secret', 'Ananda/GatewayTokens.lab-ctlr5', nested=true) }}" - lab-ctlr9: - ansible_host: 10.28.3.115 - ansible_user: lanforge - ansible_become_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_pass: "{{ lookup('amazon.aws.aws_secret', 'Testbeds/UserCredentials.lanforge_user_password', nested=true) }}" - ansible_ssh_common_args: -J ubuntu@3.130.51.163 - ananda_token: "{{ lookup('amazon.aws.aws_secret', 'Ananda/GatewayTokens.lab-ctlr9', nested=true) }}" diff --git a/ansible/Ananda/roles/setup_gateways/tasks/main.yml b/ansible/Ananda/roles/setup_gateways/tasks/main.yml deleted file mode 100644 index 75b6440..0000000 --- a/ansible/Ananda/roles/setup_gateways/tasks/main.yml +++ /dev/null @@ -1,36 +0,0 @@ -- name: Add Ananda repository on Debian based systems - block: - - name: Check if repo is already added to apt sources - stat: - path: /etc/sources.list.d/Ananda_release.list - register: ananda_repo_debian - - - name: Add repo to apt sources if it wasn't added yet - ansible.builtin.shell: curl -s https://packagecloud.io/install/repositories/Ananda/release/script.deb.sh | bash - args: - warn: false - when: not ananda_repo_debian.stat.exists - when: ansible_facts['os_family] == "Debian" - -- name: Add Ananda repository on RedHat based systems - block: - - name: Check if repo is already added to yum repos - stat: - path: /etc/yum.repos.d/Ananda_release.repo - register: ananda_repo_redhat - - - name: Add repo to yum repos if it wasn't added yet - ansible.builtin.shell: curl -s https://packagecloud.io/install/repositories/Ananda/release/script.rpm.sh | bash - args: - warn: false - when: not ananda_repo_redhat.stat.exists - when: ansible_facts['os_family'] == "RedHat" - -- name: Install ananda-core - ansible.builtin.package: - name: ananda-core - state: present - -- name: Login with token - ansible.builtin.shell: /opt/ananda/core/ananda-cli --login "{{ hostvars[inventory_hostname]['ananda_token'] }}" - ignore_errors: yes diff --git a/ansible/Ananda/setup_gateways.yml b/ansible/Ananda/setup_gateways.yml deleted file mode 100644 index 30064b3..0000000 --- a/ansible/Ananda/setup_gateways.yml +++ /dev/null @@ -1,5 +0,0 @@ -- hosts: ananda_gateways - become: true - gather_facts: true - roles: - - setup_gateways diff --git a/helm-values/aws-cicd-testbed-deployment.yaml.sh b/helm-values/aws-cicd-testbed-deployment.yaml.sh deleted file mode 100755 index 05cad7f..0000000 --- a/helm-values/aws-cicd-testbed-deployment.yaml.sh +++ /dev/null @@ -1,196 +0,0 @@ -#!/bin/sh - -set -e - -if [ -z "$1" ]; -then - echo "testbed number has not been set" - exit 1 -fi -TESTBED_NUMBER=$1 - -if [ -z "$2" ]; -then - # using todays date - TODAY=1.0.0-SNAPSHOT-$(date -d "yesterday" +"%Y-%m-%d") -else - # using provided tag - TODAY=$2 -fi - - -cat < Public part - # File uploader - ucentral.fileuploader.host.0.name: sdk-ucentral-1.cicd.lab.wlan.tip.build - # rtty - rtty.enabled: "true" - rtty.server: rtty-ucentral-1.cicd.lab.wlan.tip.build - # Kafka - ucentral.kafka.enable: "true" - ucentral.kafka.group.id: 1 - ucentral.kafka.brokerlist: kafka:9092 - ucentral.kafka.auto.commit: false - ucentral.kafka.queue.buffering.max.ms: 50 - # Storage - storage.type: sqlite # (sqlite|postgresql|mysql|odbc) - ## SQLite - storage.type.sqlite.db: devices.db - storage.type.sqlite.idletime: 120 - storage.type.sqlite.maxsessions: 128 - -resources: - limits: - cpu: 100m - memory: 50Mi - requests: - cpu: 100m - memory: 50Mi diff --git a/helm-values/ucentralgw/values.ucentral-2.yaml b/helm-values/ucentralgw/values.ucentral-2.yaml deleted file mode 100644 index 0a1bde7..0000000 --- a/helm-values/ucentralgw/values.ucentral-2.yaml +++ /dev/null @@ -1,56 +0,0 @@ -services: - ucentralgw: - type: LoadBalancer - annotations: - service.beta.kubernetes.io/aws-load-balancer-type: "nlb-ip" - service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing - external-dns.alpha.kubernetes.io/hostname: sdk-ucentral-2.cicd.lab.wlan.tip.build - service.beta.kubernetes.io/aws-load-balancer-healthcheck-port: "15015" - service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl - service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-east-2:289708231103:certificate/bfa89c7a-5b64-4a8a-bcfe-ffec655b5285" - service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "16001,16003" - ports: - websocket: - servicePort: 15002 - targetPort: 15002 - protocol: TCP - restapi: - servicePort: 16001 - targetPort: 16001 - protocol: TCP - fileuploader: - servicePort: 16003 - targetPort: 16003 - protocol: TCP - -persistence: - enabled: true - storageClassName: "gp2" - -configProperties: - # -> Public part - # File uploader - ucentral.fileuploader.host.0.name: sdk-ucentral-2.cicd.lab.wlan.tip.build - # rtty - rtty.enabled: "true" - rtty.server: rtty-ucentral-2.cicd.lab.wlan.tip.build - # Kafka - ucentral.kafka.enable: "true" - ucentral.kafka.group.id: 1 - ucentral.kafka.brokerlist: kafka:9092 - ucentral.kafka.auto.commit: false - ucentral.kafka.queue.buffering.max.ms: 50 - # Storage - storage.type: sqlite # (sqlite|postgresql|mysql|odbc) - ## SQLite - storage.type.sqlite.db: devices.db - storage.type.sqlite.idletime: 120 - storage.type.sqlite.maxsessions: 128 - -resources: - limits: - cpu: 100m - memory: 50Mi - requests: - cpu: 100m - memory: 50Mi diff --git a/helmfile/cloud-sdk/helmfile.yaml b/helmfile/cloud-sdk/helmfile.yaml index 7f6145c..da730a4 100644 --- a/helmfile/cloud-sdk/helmfile.yaml +++ b/helmfile/cloud-sdk/helmfile.yaml @@ -31,25 +31,6 @@ repositories: url: https://ibm.github.io/core-dump-handler environments: - azure: - values: - - monitoring: - namespace: monitoring - - domain: tip.4c74356b41.com - - storageClass: default - - autoscaler: - enabled: true - - ingress: - enabled: true - - elastic: - enabled: true - - kibana: - enabled: true - - prometheus: - enabled: true - - external-dns: - enabled: true - amazon-cicd: secrets: - secrets/influxdb.yaml diff --git a/helmfile/custom-nginx-ingress-errors/404-screenshot.png b/helmfile/custom-nginx-ingress-errors/404-screenshot.png deleted file mode 100644 index 75403e4..0000000 Binary files a/helmfile/custom-nginx-ingress-errors/404-screenshot.png and /dev/null differ diff --git a/helmfile/custom-nginx-ingress-errors/Dockerfile b/helmfile/custom-nginx-ingress-errors/Dockerfile deleted file mode 100644 index b045e04..0000000 --- a/helmfile/custom-nginx-ingress-errors/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -FROM quay.io/kubernetes-ingress-controller/custom-error-pages-amd64:0.4 - -COPY www /www diff --git a/helmfile/custom-nginx-ingress-errors/README.md b/helmfile/custom-nginx-ingress-errors/README.md deleted file mode 100644 index 491eb33..0000000 --- a/helmfile/custom-nginx-ingress-errors/README.md +++ /dev/null @@ -1,31 +0,0 @@ -# IMPORTANT - -clone of: https://github.com/kenmoini/custom-nginx-ingress-errors with slight modifications -used dockerfile was built manually - -# custom-nginx-ingress-errors -Assets to build a container to provide a custom default backend to the nginx-ingress Kubernetes Ingress controller - -![404 Screenshot](https://github.com/kenmoini/custom-nginx-ingress-errors/raw/master/404-screenshot.png) - -## Editing Error Pages - -The container has a set of error HTML and JSON files that are returned based on the error code. These files are stored in the `www/` directory and are copied to the `/www/` directory in the container. - -1. Fork this repo, modify the error pages as you see fit. -2. Connect to Docker Hub/Quay.io to build an image you have access to. -3. Modify the `k8s-deployment.yaml` file to point to your custom built image. - -## Deploying a custom default-backend for Nginx Ingress - -***Note:*** This is for the Kubernetes Nginx Ingress, not the one made by Nginx. -If you haven't deployed it yet, here ya go: https://kubernetes.github.io/ingress-nginx/deploy/ - -These instructions assume that you deployed this in the default `ingress-nginx` namespace. - -1. Modify the `k8s-deployment.yaml` file to point to your custom built image, or use it as is for some snazzy error pages -2. Deploy to the Kubernetes cluster: `kubectl apply -f k8s-deployment.yaml` -3. Modify the `ingress-nginx/ingress-nginx-controller` Deployment and set the value of the `--default-backend-service` flag to the name of the newly created error backend, which should be `ingress-nginx/nginx-errors` by default. -4. Edit the `ingress-nginx/nginx-configuration` ConfigMap and add the key:value pair of `"custom-http-errors": "404,500,503"` -5. ?????? -6. PROFIT!!!!1 diff --git a/helmfile/custom-nginx-ingress-errors/k8s-deployment.yaml b/helmfile/custom-nginx-ingress-errors/k8s-deployment.yaml deleted file mode 100644 index ad07eeb..0000000 --- a/helmfile/custom-nginx-ingress-errors/k8s-deployment.yaml +++ /dev/null @@ -1,48 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - name: nginx-errors - namespace: ingress-nginx - labels: - app.kubernetes.io/name: nginx-errors - app.kubernetes.io/part-of: ingress-nginx -spec: - selector: - app.kubernetes.io/name: nginx-errors - app.kubernetes.io/part-of: ingress-nginx - ports: - - port: 80 - targetPort: 8080 - name: http ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: nginx-errors - namespace: ingress-nginx - labels: - app.kubernetes.io/name: nginx-errors - app.kubernetes.io/part-of: ingress-nginx -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: nginx-errors - app.kubernetes.io/part-of: ingress-nginx - template: - metadata: - labels: - app.kubernetes.io/name: nginx-errors - app.kubernetes.io/part-of: ingress-nginx - spec: - containers: - - name: nginx-error-server - image: kenmoini/custom-nginx-ingress-errors:latest - ports: - - containerPort: 8080 - # Setting the environment variable DEBUG we can see the headers sent - # by the ingress controller to the backend in the client response. - # env: - # - name: DEBUG - # value: "true" diff --git a/helmfile/custom-nginx-ingress-errors/www/404.html b/helmfile/custom-nginx-ingress-errors/www/404.html deleted file mode 100644 index 716c18c..0000000 --- a/helmfile/custom-nginx-ingress-errors/www/404.html +++ /dev/null @@ -1,34 +0,0 @@ - - - - - - - -Error 404 - - - - - - - - - -
-
-
-

404

-

Page not found

-
-
-
- - - - diff --git a/helmfile/custom-nginx-ingress-errors/www/500.html b/helmfile/custom-nginx-ingress-errors/www/500.html deleted file mode 100644 index e9a98e8..0000000 --- a/helmfile/custom-nginx-ingress-errors/www/500.html +++ /dev/null @@ -1,156 +0,0 @@ - - - - - - - - - Error 500 - - - - - - - - -
-
-
-

500

-

Internal Server Error

-

Most likely your email isnt verified, please verify your email and try - again

-
-
-
- - - - \ No newline at end of file diff --git a/helmfile/custom-nginx-ingress-errors/www/503.html b/helmfile/custom-nginx-ingress-errors/www/503.html deleted file mode 100644 index fb3a045..0000000 --- a/helmfile/custom-nginx-ingress-errors/www/503.html +++ /dev/null @@ -1,33 +0,0 @@ - - - - - - - -Error 503 - - - - - - - - -
-
-
-

503

-

Service Unavailable

-
-
-
- - - - diff --git a/helmfile/custom-nginx-ingress-errors/www/css/style.css b/helmfile/custom-nginx-ingress-errors/www/css/style.css deleted file mode 100644 index 22e5e3b..0000000 --- a/helmfile/custom-nginx-ingress-errors/www/css/style.css +++ /dev/null @@ -1 +0,0 @@ -*{-webkit-box-sizing:border-box;box-sizing:border-box}body{padding:0;margin:0}#notfound{position:relative;height:100vh;background:#030005}#notfound .notfound{position:absolute;left:50%;top:50%;-webkit-transform:translate(-50%,-50%);-ms-transform:translate(-50%,-50%);transform:translate(-50%,-50%)}.notfound{max-width:767px;width:100%;line-height:1.4;text-align:center}.notfound .notfound-404{position:relative;height:180px;margin-bottom:20px;z-index:-1}.notfound .notfound-404 h1{font-family:montserrat,sans-serif;position:absolute;left:50%;top:50%;-webkit-transform:translate(-50%,-50%);-ms-transform:translate(-50%,-50%);transform:translate(-50%,-50%);font-size:224px;font-weight:900;margin-top:0;margin-bottom:0;margin-left:-12px;color:#030005;text-transform:uppercase;text-shadow:-1px -1px 0 #8400ff,1px 1px 0 #ff005a;letter-spacing:-20px}.notfound .notfound-404 h2{font-family:montserrat,sans-serif;position:absolute;left:0;right:0;top:110px;font-size:42px;font-weight:700;color:#fff;text-transform:uppercase;text-shadow:0 2px 0 #8400ff;letter-spacing:13px;margin:0}.notfound a{font-family:montserrat,sans-serif;display:inline-block;text-transform:uppercase;color:#ff005a;text-decoration:none;border:2px solid;background:0 0;padding:10px 40px;font-size:14px;font-weight:700;-webkit-transition:.2s all;transition:.2s all}.notfound a:hover{color:#8400ff}@media only screen and (max-width:767px){.notfound .notfound-404 h2{font-size:24px}}@media only screen and (max-width:480px){.notfound .notfound-404 h1{font-size:182px}} diff --git a/helmfile/windows-support/Dockerfile b/helmfile/windows-support/Dockerfile deleted file mode 100644 index fa8f44d..0000000 --- a/helmfile/windows-support/Dockerfile +++ /dev/null @@ -1,77 +0,0 @@ -# Setup build arguments with default versions -ARG AWS_CLI_VERSION=1.18.105 -ARG TERRAFORM_VERSION=0.12.29 -ARG PYTHON_MAJOR_VERSION=3.7 -ARG KUBE_VERSION=v1.18.6 -ARG HELM_VERSION=v3.2.4 - -# Download Terraform binary -FROM debian:buster-20191224-slim as terraform -ARG TERRAFORM_VERSION -RUN apt-get update -RUN apt-get install --no-install-recommends -y curl=7.64.0-4+deb10u1 -RUN apt-get install --no-install-recommends -y ca-certificates=20190110 -RUN apt-get install --no-install-recommends -y unzip=6.0-23+deb10u1 -RUN apt-get install --no-install-recommends -y gnupg=2.2.12-1+deb10u1 -RUN curl -Os https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS -RUN curl -Os https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip -RUN curl -Os https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.sig -COPY hashicorp.asc hashicorp.asc -RUN gpg --import hashicorp.asc -RUN gpg --verify terraform_${TERRAFORM_VERSION}_SHA256SUMS.sig terraform_${TERRAFORM_VERSION}_SHA256SUMS -SHELL ["/bin/bash", "-o", "pipefail", "-c"] -RUN grep terraform_${TERRAFORM_VERSION}_linux_amd64.zip terraform_${TERRAFORM_VERSION}_SHA256SUMS | sha256sum -c - -RUN unzip -j terraform_${TERRAFORM_VERSION}_linux_amd64.zip - -# Install AWS CLI using PIP -FROM debian:buster-20191224-slim as aws-cli -ARG AWS_CLI_VERSION -ARG PYTHON_MAJOR_VERSION -RUN apt-get update -RUN apt-get install -y --no-install-recommends python3=${PYTHON_MAJOR_VERSION}.3-1 -RUN apt-get install -y --no-install-recommends python3-pip=18.1-5 -RUN pip3 install setuptools==46.1.3 -RUN pip3 install wheel==0.34.2 -RUN pip3 install pyyaml==5.3.1 -RUN pip3 install awscli==${AWS_CLI_VERSION} - -# Download Helm\Kubectl binary -FROM debian:buster-20191224-slim as wget -ARG KUBE_VERSION -ARG HELM_VERSION -RUN apt-get update && \ - apt-get install --no-install-recommends -y wget ca-certificates=20190110 -RUN wget -q https://storage.googleapis.com/kubernetes-release/release/${KUBE_VERSION}/bin/linux/amd64/kubectl -O /usr/local/bin/kubectl -RUN wget -q https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz -O - | tar -xzO linux-amd64/helm > /usr/local/bin/helm - -# Build final image -FROM debian:buster-20191224-slim -ARG PYTHON_MAJOR_VERSION -RUN apt-get update \ - && apt-get install -y --no-install-recommends \ - ca-certificates=20190110 \ - git \ - curl \ - jq=1.5+dfsg-2+b1 \ - python3=${PYTHON_MAJOR_VERSION}.3-1 \ - sudo \ - && apt-get clean \ - && rm -rf /var/lib/apt/lists/* \ - && update-alternatives --install /usr/bin/python python /usr/bin/python${PYTHON_MAJOR_VERSION} 1 - -COPY --from=terraform /terraform /usr/local/bin/terraform -COPY --from=aws-cli /usr/local/bin/aws* /usr/local/bin/ -COPY --from=aws-cli /usr/local/lib/python${PYTHON_MAJOR_VERSION}/dist-packages /usr/local/lib/python${PYTHON_MAJOR_VERSION}/dist-packages -COPY --from=aws-cli /usr/lib/python3/dist-packages /usr/lib/python3/dist-packages -COPY --from=wget /usr/local/bin/helm /usr/local/bin/helm -COPY --from=wget /usr/local/bin/kubectl /usr/local/bin/kubectl -# this requires helmfile binary in the same folder with the Dockerfile -COPY helmfile /usr/local/bin/ -RUN chmod +x /usr/local/bin/helmfile /usr/local/bin/helm /usr/local/bin/kubectl -RUN helm plugin install https://github.com/databus23/helm-diff --version v3.0.0-rc.7 && \ - helm plugin install https://github.com/futuresimple/helm-secrets && \ - helm plugin install https://github.com/hypnoglow/helm-s3.git && \ - helm plugin install https://github.com/aslafy-z/helm-git.git - -WORKDIR /workspace -CMD ["bash"] diff --git a/helmfile/windows-support/README.md b/helmfile/windows-support/README.md deleted file mode 100644 index 758d894..0000000 --- a/helmfile/windows-support/README.md +++ /dev/null @@ -1,5 +0,0 @@ -## purpose - -this is needed because helmfile didn't work properly for me on windows (the helm diff plugin), as well as helmfile docker files and helmfile make. hence this dockerfile that works on windows. I needed to include compiled helmfile for the same reason. - -Build this dockerfile like you normally would and after that you can just use the docker image to run helmfile. The provided dockerfile has got aws cli, kubectl, terraform, helm, helm plugins and helmfile. \ No newline at end of file diff --git a/helmfile/windows-support/dockerfile.v2 b/helmfile/windows-support/dockerfile.v2 deleted file mode 100644 index e156db1..0000000 --- a/helmfile/windows-support/dockerfile.v2 +++ /dev/null @@ -1,50 +0,0 @@ -# Setup build arguments with default versions -ARG TERRAFORM_VERSION=0.12.29 -ARG KUBE_VERSION=v1.18.8 -ARG HELM_VERSION=v3.3.0 -ARG HELMFILE_VERSION=v0.126.2 -ARG KUSTOMIZE_VERSION=v3.8.1 - -# Download Terraform\Kubectl\Helm binaries -FROM debian:buster-slim as binaries -ARG TERRAFORM_VERSION -ARG KUBE_VERSION -ARG HELM_VERSION -RUN apt-get update -RUN apt-get install --no-install-recommends -y curl=7.64.0-4+deb10u1 -RUN apt-get install --no-install-recommends -y ca-certificates=20190110 -RUN apt-get install --no-install-recommends -y unzip=6.0-23+deb10u1 -RUN apt-get install --no-install-recommends -y gnupg=2.2.12-1+deb10u1 -RUN apt-get install --no-install-recommends -y wget -RUN curl -Os https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS -RUN curl -Os https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip -RUN curl -Os https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS.sig -RUN wget -q https://storage.googleapis.com/kubernetes-release/release/${KUBE_VERSION}/bin/linux/amd64/kubectl -O /usr/local/bin/kubectl -RUN wget -q https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz -O - | tar -xzO linux-amd64/helm > /usr/local/bin/helm -COPY hashicorp.asc hashicorp.asc -RUN gpg --import hashicorp.asc -RUN gpg --verify terraform_${TERRAFORM_VERSION}_SHA256SUMS.sig terraform_${TERRAFORM_VERSION}_SHA256SUMS -SHELL ["/bin/bash", "-o", "pipefail", "-c"] -RUN grep terraform_${TERRAFORM_VERSION}_linux_amd64.zip terraform_${TERRAFORM_VERSION}_SHA256SUMS | sha256sum -c - -RUN unzip -j terraform_${TERRAFORM_VERSION}_linux_amd64.zip - -# Layer to get helmfile stuff -FROM quay.io/roboll/helmfile:${HELMFILE_VERSION} as helmfile -ARG KUSTOMIZE_VERSION -RUN curl -L https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz | \ - tar zxv && mv kustomize /usr/local/bin - -# Build final image -FROM amazon/aws-cli -WORKDIR /ci -ENV XDG_DATA_HOME=/home - -COPY --from=binaries /terraform /usr/local/bin/terraform -COPY --from=binaries /usr/local/bin/helm /usr/local/bin/helm -COPY --from=binaries /usr/local/bin/kubectl /usr/local/bin/kubectl -COPY --from=helmfile /usr/local/bin/helmfile /usr/local/bin -COPY --from=helmfile /usr/local/bin/kustomize /usr/local/bin -COPY --from=helmfile /root/.helm/cache/plugins/ /home/helm/plugins -RUN chmod +x /usr/local/bin/helmfile && chmod +x /usr/local/bin/helm && chmod +x /usr/local/bin/kubectl && chmod +x /usr/local/bin/kustomize -WORKDIR /ci -ENTRYPOINT ["/bin/bash"] diff --git a/helmfile/windows-support/hashicorp.asc b/helmfile/windows-support/hashicorp.asc deleted file mode 100644 index 5364dee..0000000 --- a/helmfile/windows-support/hashicorp.asc +++ /dev/null @@ -1,30 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- -Version: GnuPG v1 - -mQENBFMORM0BCADBRyKO1MhCirazOSVwcfTr1xUxjPvfxD3hjUwHtjsOy/bT6p9f -W2mRPfwnq2JB5As+paL3UGDsSRDnK9KAxQb0NNF4+eVhr/EJ18s3wwXXDMjpIifq -fIm2WyH3G+aRLTLPIpscUNKDyxFOUbsmgXAmJ46Re1fn8uKxKRHbfa39aeuEYWFA -3drdL1WoUngvED7f+RnKBK2G6ZEpO+LDovQk19xGjiMTtPJrjMjZJ3QXqPvx5wca -KSZLr4lMTuoTI/ZXyZy5bD4tShiZz6KcyX27cD70q2iRcEZ0poLKHyEIDAi3TM5k -SwbbWBFd5RNPOR0qzrb/0p9ksKK48IIfH2FvABEBAAG0K0hhc2hpQ29ycCBTZWN1 -cml0eSA8c2VjdXJpdHlAaGFzaGljb3JwLmNvbT6JATgEEwECACIFAlMORM0CGwMG -CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEFGFLYc0j/xMyWIIAIPhcVqiQ59n -Jc07gjUX0SWBJAxEG1lKxfzS4Xp+57h2xxTpdotGQ1fZwsihaIqow337YHQI3q0i -SqV534Ms+j/tU7X8sq11xFJIeEVG8PASRCwmryUwghFKPlHETQ8jJ+Y8+1asRydi -psP3B/5Mjhqv/uOK+Vy3zAyIpyDOMtIpOVfjSpCplVRdtSTFWBu9Em7j5I2HMn1w -sJZnJgXKpybpibGiiTtmnFLOwibmprSu04rsnP4ncdC2XRD4wIjoyA+4PKgX3sCO -klEzKryWYBmLkJOMDdo52LttP3279s7XrkLEE7ia0fXa2c12EQ0f0DQ1tGUvyVEW -WmJVccm5bq25AQ0EUw5EzQEIANaPUY04/g7AmYkOMjaCZ6iTp9hB5Rsj/4ee/ln9 -wArzRO9+3eejLWh53FoN1rO+su7tiXJA5YAzVy6tuolrqjM8DBztPxdLBbEi4V+j -2tK0dATdBQBHEh3OJApO2UBtcjaZBT31zrG9K55D+CrcgIVEHAKY8Cb4kLBkb5wM -skn+DrASKU0BNIV1qRsxfiUdQHZfSqtp004nrql1lbFMLFEuiY8FZrkkQ9qduixo -mTT6f34/oiY+Jam3zCK7RDN/OjuWheIPGj/Qbx9JuNiwgX6yRj7OE1tjUx6d8g9y -0H1fmLJbb3WZZbuuGFnK6qrE3bGeY8+AWaJAZ37wpWh1p0cAEQEAAYkBHwQYAQIA -CQUCUw5EzQIbDAAKCRBRhS2HNI/8TJntCAClU7TOO/X053eKF1jqNW4A1qpxctVc -z8eTcY8Om5O4f6a/rfxfNFKn9Qyja/OG1xWNobETy7MiMXYjaa8uUx5iFy6kMVaP -0BXJ59NLZjMARGw6lVTYDTIvzqqqwLxgliSDfSnqUhubGwvykANPO+93BBx89MRG -unNoYGXtPlhNFrAsB1VR8+EyKLv2HQtGCPSFBhrjuzH3gxGibNDDdFQLxxuJWepJ -EK1UbTS4ms0NgZ2Uknqn1WRU1Ki7rE4sTy68iZtWpKQXZEJa0IGnuI2sSINGcXCJ -oEIgXTMyCILo34Fa/C6VCm2WBgz9zZO8/rHIiQm1J5zqz0DrDwKBUM9C -=LYpS ------END PGP PUBLIC KEY BLOCK----- \ No newline at end of file diff --git a/terraform/root-162540680133/sops_key/.terraform.lock.hcl b/terraform/root-162540680133/sops_key/.terraform.lock.hcl new file mode 100644 index 0000000..353a40e --- /dev/null +++ b/terraform/root-162540680133/sops_key/.terraform.lock.hcl @@ -0,0 +1,25 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/aws" { + version = "4.40.0" + constraints = ">= 2.63.0" + hashes = [ + "h1:ZNYcP0N4WfRiuCmkXJkPrTS/4BG7PfkbXBUhbA77WTg=", + "zh:04ca7287b7f5a2a310b60308cc08df11e97714d32d1a10c34a94454d330af66e", + "zh:13c28ba9b324c526580783a3807007a296ce58c607c7bdc94ae2bb72b35b6495", + "zh:2c84dbc0701b9724802f7343f916f50b6914a044dfbfc6654f264c9347f02dac", + "zh:33255a22e1d1ecec2ad8ccfec1e4a54dc33a8d71f3edad098c25d822958a138b", + "zh:4583b5e92b8de3662c8d8ff8a6527572ec23ad8c64dd686ff9dd528bc6934a4f", + "zh:4a9f502c0b8abe45abda846e0601f8d8ef582e62e0b92cb747b4200a711ba739", + "zh:558959e19935ec5e7f0647e900fc8561f4961a377be0178496a6495805136721", + "zh:6b3dc4b034d34885db620d73c75d3bb9abeee539e61ca9d0670fb995353e165d", + "zh:72f0dac5dbba355bce88599ded2baabc7d109ee786b89c6648ae720cb00a4bbf", + "zh:77981b87e2bcbb278402e8ff863d5e50aafbdc03629d7a57273c06989884a22f", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:c5b4dd61558a4887a23847d23cd3b41a97ad03a9f3624d0687cb5461fee514b0", + "zh:c8949bc6600ec10ea5c0abdd4c1ffee8f82519c0cda8cc7a651e6258960e6249", + "zh:d1c88ab98f126d65cd0c7b6c9e1d06d59e766217ae374d5a908052817e3692a3", + "zh:ff2e921440bcbfd440ef84f5127ba881c930b2b70773e725de35c0fa3baddc4b", + ] +} diff --git a/terraform/root-162540680133/sops_key/kms.tf b/terraform/root-162540680133/sops_key/kms.tf new file mode 100644 index 0000000..cc98abe --- /dev/null +++ b/terraform/root-162540680133/sops_key/kms.tf @@ -0,0 +1,95 @@ +data "aws_iam_policy_document" "kms" { + statement { + sid = "Enable IAM User Permissions" + actions = ["kms:*"] + resources = ["arn:aws:s3:::*"] + effect = "Allow" + principals { + type = "AWS" + identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"] + } + } + + statement { + sid = "Allow access for Key Administrators" + actions = [ + "kms:Create*", + "kms:Describe*", + "kms:Enable*", + "kms:List*", + "kms:Put*", + "kms:Update*", + "kms:Revoke*", + "kms:Disable*", + "kms:Get*", + "kms:Delete*", + "kms:TagResource", + "kms:UntagResource", + "kms:ScheduleKeyDeletion", + "kms:CancelKeyDeletion" + ] + resources = ["*"] + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AdministratorAccess_91b52266e9732916", + "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_SystemAdministrator_2bf11eb9a2b37c20", + ] + } + } + + statement { + sid = "Allow use of the key" + actions = [ + "kms:Encrypt", + "kms:Decrypt", + "kms:ReEncrypt*", + "kms:GenerateDataKey*", + "kms:DescribeKey" + ] + resources = ["*"] + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AdministratorAccess_91b52266e9732916", + "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_SystemAdministrator_2bf11eb9a2b37c20", + ] + } + } + + statement { + sid = "Allow attachment of persistent resources" + actions = [ + "kms:CreateGrant", + "kms:ListGrants", + "kms:RevokeGrant" + ] + resources = ["*"] + effect = "Allow" + principals { + type = "AWS" + identifiers = [ + "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AdministratorAccess_91b52266e9732916", + "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_SystemAdministrator_2bf11eb9a2b37c20", + ] + } + condition { + test = "Bool" + variable = "kms:GrantIsForAWSResource" + values = ["true"] + } + } +} + +resource "aws_kms_key" "kms" { + description = "Helm secrets key" + policy = data.aws_iam_policy_document.kms.json +} + +resource "aws_kms_alias" "kms" { + name = "alias/helm-secrets" + target_key_id = aws_kms_key.kms.key_id +} + diff --git a/tf_modules/eks/main.tf b/terraform/root-162540680133/sops_key/main.tf similarity index 50% rename from tf_modules/eks/main.tf rename to terraform/root-162540680133/sops_key/main.tf index adf914c..0c49972 100644 --- a/tf_modules/eks/main.tf +++ b/terraform/root-162540680133/sops_key/main.tf @@ -1,16 +1,18 @@ provider "aws" { - version = ">= 2.59.0" + version = ">= 2.63.0" region = var.aws_region } terraform { - required_version = ">= 0.12.2" + required_version = ">= 1.0.0, < 2.0.0" backend "s3" { region = "us-east-1" - bucket = "tip-wifi-tfstate" - key = "wlan-main" + bucket = "tip-org-tfstate" + key = "tip-sops" dynamodb_table = "terraform-state-lock" encrypt = true } -} \ No newline at end of file +} + +data "aws_caller_identity" "current" {} diff --git a/terraform/root-162540680133/sops_key/terraform.tfvars b/terraform/root-162540680133/sops_key/terraform.tfvars new file mode 100644 index 0000000..bb891da --- /dev/null +++ b/terraform/root-162540680133/sops_key/terraform.tfvars @@ -0,0 +1 @@ +aws_region = "us-east-1" diff --git a/terraform/root-162540680133/sops_key/variables.tf b/terraform/root-162540680133/sops_key/variables.tf new file mode 100644 index 0000000..8d5410d --- /dev/null +++ b/terraform/root-162540680133/sops_key/variables.tf @@ -0,0 +1,4 @@ +variable "aws_region" { + description = "AWS region" + type = string +} diff --git a/terraform/root-162540680133/tf_organization/.sops.yaml b/terraform/root-162540680133/tf_organization/.sops.yaml new file mode 100644 index 0000000..7219e41 --- /dev/null +++ b/terraform/root-162540680133/tf_organization/.sops.yaml @@ -0,0 +1,2 @@ +creation_rules: +- kms: 'arn:aws:kms:us-east-1:162540680133:alias/helm-secrets' diff --git a/terraform/root-162540680133/tf_organization/billing_alarm.tf b/terraform/root-162540680133/tf_organization/billing_alarm.tf index af0da39..6580c89 100644 --- a/terraform/root-162540680133/tf_organization/billing_alarm.tf +++ b/terraform/root-162540680133/tf_organization/billing_alarm.tf @@ -1,5 +1,5 @@ resource "aws_budgets_budget" "default" { - for_each = var.org_accounts + for_each = jsondecode(data.sops_file.secrets.raw).org_accounts name = "${each.key}-budget" budget_type = "COST" limit_amount = each.value["monthly_budget"] diff --git a/terraform/root-162540680133/tf_organization/main.tf b/terraform/root-162540680133/tf_organization/main.tf index a361bbb..55f7c57 100644 --- a/terraform/root-162540680133/tf_organization/main.tf +++ b/terraform/root-162540680133/tf_organization/main.tf @@ -8,9 +8,20 @@ terraform { dynamodb_table = "terraform-state-lock" encrypt = true } + + required_providers { + sops = { + source = "carlpett/sops" + version = "~> 0.5" + } + } } provider "aws" { version = ">= 2.63.0" region = var.aws_region } + +data "sops_file" "secrets" { + source_file = "secrets.enc.json" +} diff --git a/terraform/root-162540680133/tf_organization/organization.tf b/terraform/root-162540680133/tf_organization/organization.tf index d9be499..cd55bbc 100644 --- a/terraform/root-162540680133/tf_organization/organization.tf +++ b/terraform/root-162540680133/tf_organization/organization.tf @@ -13,7 +13,7 @@ resource "aws_organizations_organizational_unit" "default" { } resource "aws_organizations_account" "default" { - for_each = var.org_accounts + for_each = jsondecode(data.sops_file.secrets.raw).org_accounts name = each.key email = each.value["email"] parent_id = aws_organizations_organizational_unit.default.id diff --git a/terraform/root-162540680133/tf_organization/secrets.enc.json b/terraform/root-162540680133/tf_organization/secrets.enc.json new file mode 100644 index 0000000..2196bdf --- /dev/null +++ b/terraform/root-162540680133/tf_organization/secrets.enc.json @@ -0,0 +1,48 @@ +{ + "org_accounts": { + "cicd": { + "email": "ENC[AES256_GCM,data:w+A2Y0Exkle7so5gWfIgnoCqRL8FH0+fXwG3yindZYNVZQ==,iv:9+pHL0zsbRJ+ysW0zoEA+/hfcWROEeLy7TCj0L+e7Eo=,tag:/Co2xGMjLqFEegmRm6LH5Q==,type:str]", + "monthly_budget": "ENC[AES256_GCM,data:7/+H+V0=,iv:/sGSwJEamMNWP0kD86k4rgWmlvaztCgqnve+amF1twA=,tag:slwv9fixGjI4+gVD2A65yA==,type:str]", + "billing_alarm_notify_emails": [ + "ENC[AES256_GCM,data:hJzTn6zBNHy21Xr/ebZt5TUB,iv:6vGbAvjblpXoGOG5INrY74IZAL3/3CZaCtOzCC7yjgo=,tag:lznl3K88QVrOCBgeb054iQ==,type:str]", + "ENC[AES256_GCM,data:U6GZrBV/7p0PnISLAtbDxUohhjE=,iv:8xvvjI6ypRdFKpZpkWq6GCKOe35Hl9GPElIbNXDNyLM=,tag:d2X8B7bTatIwsMG1o2Z7LA==,type:str]" + ] + }, + "wifi": { + "email": "ENC[AES256_GCM,data:ZF/RJC3iUY7r35k1n7X2InBqhwsiSzH1u+IAslKYYna9Yw==,iv:Ze9a7uCE7vQTvvxToTBB2njMIJUE+cWWSryhYQGwdDs=,tag:ntuOOx9S6z51E+zmNwosyw==,type:str]", + "monthly_budget": "ENC[AES256_GCM,data:Cx1RjR6z,iv:jKibjwHFaMHUC9S5k24Reww3nSBWrjphCZM0naYSnTI=,tag:bLjHZC4F2Vlf8fxOCoQ/0g==,type:str]", + "billing_alarm_notify_emails": [ + "ENC[AES256_GCM,data:gVZREZAFuDO70s6Psf9/AA+Z2g/IbuND,iv:pXj/RaRISryf5UPnJaHx/zAWT00GXxhY3zMUJAFnnJE=,tag:pSvqz6tODo9Qb1qt0FIG1w==,type:str]", + "ENC[AES256_GCM,data:3a3J1QJDH32TkLD5Qo8CTXUOVBYg2WI=,iv:btVPVNQUeoHvvCkeAp8u/PAJBbDcIEB1LLk0SPpq68U=,tag:72xpp+7I4OynvFpgoFV4tA==,type:str]", + "ENC[AES256_GCM,data:+Yye97K9a/14p0H6GyNfuNWuWQ==,iv:5qLSSl74dDNAGCG9fZrZH2pzIsLzw0Qi4GeZXtz4ybk=,tag:8/Wgm9URP8Q9YpGJJ/1mrg==,type:str]" + ] + }, + "openautomation": { + "email": "ENC[AES256_GCM,data:9IHAeBPnIo9W6JGtfd6twleqVBGu0TP4TrM1Rsj1+6s7S7An5g==,iv:uGocTojTHz/O8uxmFVv/4M3o7ma0C6FaCiqPmu6UaEE=,tag:NA0vY6wd32rDRs30VltQJw==,type:str]", + "monthly_budget": "ENC[AES256_GCM,data:WvG9Ijk=,iv:v+llc1tiuqwBBwDoFKcAagWjFhuoUuSSz5LH5Xt8Dbw=,tag:Mrfyllp+4+UgPzLXXR862g==,type:str]", + "billing_alarm_notify_emails": [ + "ENC[AES256_GCM,data:v9PEhhGfPiF0/BQyuFkKLhVL,iv:2MifI4GsP3ANt51Noymdebxybf+JZrd09lQb9OacR5w=,tag:kc4Jt545KllcTH6gD376Uw==,type:str]", + "ENC[AES256_GCM,data:89B2fcgDa+2nYbg1EfdafbHIZIc=,iv:c1NwTcLHHv7dBg5SIQ2GVwt1vAIcQDvV7HhWUYAthaM=,tag:hTiEWaIK01BlNPc9oInZXg==,type:str]" + ] + } + }, + "sops": { + "kms": [ + { + "arn": "arn:aws:kms:us-east-1:162540680133:alias/helm-secrets", + "created_at": "2022-11-21T14:26:23Z", + "enc": "AQICAHi1PeBBVgOTmYIxfm2OeQV6Js1L6sK2WYypQs3n0SEJtgH49MkfD5xT/GyTTOU4sOV7AAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMQLp3bASG3zvc2T8/AgEQgDtP58RwjvLOv830CZfdKMxxc58qwqaQrkpANmUYec/5j7uy807kz+mpvhY1ATZrtkVGUDjjUTFEZSnqbQ==", + "aws_profile": "" + } + ], + "gcp_kms": null, + "azure_kv": null, + "hc_vault": null, + "age": null, + "lastmodified": "2022-11-21T14:29:01Z", + "mac": "ENC[AES256_GCM,data:F1a6uJP2AJNjVLWITz7f41lglPlUassiqfjcylmdVXbJpY9sS7gnpYbxBO5h3KhSGshq5iRf2tmOhLpDSeb2SnznW5EhWf6V2d7G2kETsRm2Yk3z5RwUjp9eoixDEG0MWinrDRo0CnvBf+npLNg3SgOFWi0thwzSTs5uP3x7kcA=,iv:vNnD5+Oi2jsV28Zy+MWJPN26BbcZlW7nHsb/qtsOc6I=,tag:W1caIEvzTsiCnrvr8Iu7Bg==,type:str]", + "pgp": null, + "unencrypted_suffix": "_unencrypted", + "version": "3.7.3" + } +} \ No newline at end of file diff --git a/terraform/root-162540680133/tf_organization/terraform.tfvars b/terraform/root-162540680133/tf_organization/terraform.tfvars index 774bb9c..bb891da 100644 --- a/terraform/root-162540680133/tf_organization/terraform.tfvars +++ b/terraform/root-162540680133/tf_organization/terraform.tfvars @@ -1,40 +1 @@ aws_region = "us-east-1" - -billing_alarm_notify_emails = [ - "tip-alerts@opsfleet.com" -] - -budget_monthly_limit = { - "cicd" = "100.0" - "wifi" = "100.0" -} - -org_accounts = { - "cicd" = { - "email" = "cicd-admin@telecominfraproject.com" - "monthly_budget" = "500.0" - "billing_alarm_notify_emails" = [ - "dorongivoni@fb.com", - "jcrosby@launchcg.com", - ] - } - - "wifi" = { - "email" = "wifi-admin@telecominfraproject.com" - "monthly_budget" = "5000.0" - "billing_alarm_notify_emails" = [ - "jaspreetsachdev@meta.com", - "tip-alerts@opsfleet.com", - "chrisbusch@meta.com", - ] - } - - "openautomation" = { - "email" = "netauto-admin@telecominfraproject.com" - "monthly_budget" = "500.0" - "billing_alarm_notify_emails" = [ - "dorongivoni@fb.com", - "jcrosby@launchcg.com", - ] - } -} diff --git a/terraform/root-162540680133/tf_organization/variables.tf b/terraform/root-162540680133/tf_organization/variables.tf index 5628621..8d5410d 100644 --- a/terraform/root-162540680133/tf_organization/variables.tf +++ b/terraform/root-162540680133/tf_organization/variables.tf @@ -2,17 +2,3 @@ variable "aws_region" { description = "AWS region" type = string } - -variable "billing_alarm_notify_emails" { - description = "Billing alarm notification emails" - type = set(string) -} - -variable "budget_monthly_limit" { - description = "Monthly budget limit, USD" - type = map(string) -} - -variable "org_accounts" { - description = "Organization accounts" -} diff --git a/terraform/wifi-289708231103/atlantis/secrets.enc.json b/terraform/wifi-289708231103/atlantis/secrets.enc.json index 4f422ff..f276bb9 100644 --- a/terraform/wifi-289708231103/atlantis/secrets.enc.json +++ b/terraform/wifi-289708231103/atlantis/secrets.enc.json @@ -1,5 +1,5 @@ { - "atlantis_github_user_token": "ENC[AES256_GCM,data:x5ql3nUmjUaCrbRUmffJ1tuUEhGFsLmNkCVoUumGdfe4cFXI6gsw4g==,iv:QEw4hkrZrlhDOH+CMd/lni5aS+rTzCZgcZPNbL9Fw9I=,tag:dnKoKSPJMp8bO9tL/GmNrw==,type:str]", + "atlantis_github_user_token": "ENC[AES256_GCM,data:IIAaJizfK+PanRd7C27eQECQOHSvWonWY813b8z+xuXqGYA+2kIDfg==,iv:CoVriwQq2EjJP4lxjoaGypas9YWh1quLcLsrWYg0mNM=,tag:Ojfy91MO3CQ4mkrSCtSxlA==,type:str]", "sops": { "kms": [ { @@ -13,10 +13,10 @@ "azure_kv": null, "hc_vault": null, "age": null, - "lastmodified": "2021-05-31T11:59:27Z", - "mac": "ENC[AES256_GCM,data:Uqj1ZPhM0XWjxGiV+399F0rVC12cNWlXzpzRpUPjOemNfSREe2bGt3MnnoGdVVuNAy1rvPJHS3eNdTx089d31X4JAfo93osy0I7YQqKR2FmeUWHHPi8NJBkZ1f7/FEYzkN0ztWwxdHRc5ncokj3jEk0Uv1OEVuEWvhdCjiR7rzc=,iv:eymoHyUg0RhcOOQQ9B3/ifd9nx9bk9PfYHfA7egIz1A=,tag:nOejqTpSnDSz0aq67nUORw==,type:str]", + "lastmodified": "2022-11-17T11:32:47Z", + "mac": "ENC[AES256_GCM,data:59uh9D0z272tnpSTB/p0hFZgW7xoDg1HttEacSH/r9ko0vpEZK+MwtqLIRVdccNUHaKBI8cNCjbvBUEZSXA0cv6X22O2OQoxJWxiWSur9eIe9ENsZfsaBteYtPR14SsFu9fJuUxy1IPmeLB1f1O6c3UkbLMppAC/XUr1DdkXGM4=,iv:T7XS6Oxtrcrr/kxfMJFS+sZiKrAjclna+Ab5L8Y4jOA=,tag:6BbS4zgyQ0YiEgW6E9U+bw==,type:str]", "pgp": null, "unencrypted_suffix": "_unencrypted", - "version": "3.7.0" + "version": "3.7.3" } } \ No newline at end of file diff --git a/helm-values/rttys/.sops.yaml b/terraform/wifi-289708231103/tip-wifi-vpn/.sops.yaml similarity index 100% rename from helm-values/rttys/.sops.yaml rename to terraform/wifi-289708231103/tip-wifi-vpn/.sops.yaml diff --git a/terraform/wifi-289708231103/tip-wifi-vpn/.terraform.lock.hcl b/terraform/wifi-289708231103/tip-wifi-vpn/.terraform.lock.hcl index ac5243c..723020e 100644 --- a/terraform/wifi-289708231103/tip-wifi-vpn/.terraform.lock.hcl +++ b/terraform/wifi-289708231103/tip-wifi-vpn/.terraform.lock.hcl @@ -1,21 +1,40 @@ # This file is maintained automatically by "terraform init". # Manual edits may be lost in future updates. -provider "registry.terraform.io/hashicorp/aws" { - version = "3.71.0" - constraints = ">= 3.15.0" +provider "registry.terraform.io/carlpett/sops" { + version = "0.7.1" + constraints = "~> 0.5" hashes = [ - "h1:wnTd0krep3mqRz650U7TSv/tCkA0LoXKe0QFlnsg/7Q=", - "zh:173134d8861a33ed60a48942ad2b96b9d06e85c506d7f927bead47a28f4ebdd2", - "zh:2996c8e96930f526f1761e99d14c0b18d83e287b1362aa2fa1444cf848ece613", - "zh:43903da1e0a809a1fb5832e957dbe2321b86630d6bfdd8b47728647a72fd912d", - "zh:43e71fd8924e7f7b56a0b2a82e29edf07c53c2b41ee7bb442a2f1c27e03e86ae", - "zh:4f4c73711f64a3ff85f88bf6b2594e5431d996b7a59041ff6cbc352f069fc122", - "zh:5045241b8695ffbd0730bdcd91393b10ffd0cfbeaad6254036e42ead6687d8fd", - "zh:6a8811a0fb1035c09aebf1f9b15295523a9a7a2627fd783f50c6168a82e192dd", - "zh:8d273c04d7a8c36d4366329adf041c480a0f1be10a7269269c88413300aebdb8", - "zh:b90505897ae4943a74de2b88b6a9e7d97bf6dc325a0222235996580edff28656", - "zh:ea5e422942ac6fc958229d27d4381c89d21d70c5c2c67a6c06ff357bcded76f6", - "zh:f1536d7ff2d3bfd668e3ac33d8956b4f988f87fdfdcc371c7d94b98d5dba53e2", + "h1:/LNLI9qKgRjlHhyl1M/6BA+HVUMQ9RQApZgyfV4RAJ4=", + "zh:203d5ab6af38efb9fc84fdbb303218aa5012dc8d28e700642be41bbc4b1c2fa1", + "zh:5684a2dc65da50824fb4275c10ac452e6512dd0d60a9abd5f505e67e7b9d759a", + "zh:b4311d7cae0b29f2dcf5a18a8297ed0787f59b140102547da9f8b61af27e15b6", + "zh:bbf9e6956191a95dfbb8336b1cc8a059ceba4d3f1f22a83e4f08662cd1cabe9b", + "zh:cd8f244d26f9733b9b238db22b520e69cdc68262093db3389ec466b1df2cadd8", + "zh:d855e4dc2ad41d8a877dd5dcd51061233fc5976c5c9afceb5a973e6a9f76b1d9", + "zh:ed584cf42015e1f10359cc2d85b12e348c5c1581ae781be29e0e3dfb7f43590b", + ] +} + +provider "registry.terraform.io/hashicorp/aws" { + version = "4.40.0" + constraints = ">= 4.4.0" + hashes = [ + "h1:ZNYcP0N4WfRiuCmkXJkPrTS/4BG7PfkbXBUhbA77WTg=", + "zh:04ca7287b7f5a2a310b60308cc08df11e97714d32d1a10c34a94454d330af66e", + "zh:13c28ba9b324c526580783a3807007a296ce58c607c7bdc94ae2bb72b35b6495", + "zh:2c84dbc0701b9724802f7343f916f50b6914a044dfbfc6654f264c9347f02dac", + "zh:33255a22e1d1ecec2ad8ccfec1e4a54dc33a8d71f3edad098c25d822958a138b", + "zh:4583b5e92b8de3662c8d8ff8a6527572ec23ad8c64dd686ff9dd528bc6934a4f", + "zh:4a9f502c0b8abe45abda846e0601f8d8ef582e62e0b92cb747b4200a711ba739", + "zh:558959e19935ec5e7f0647e900fc8561f4961a377be0178496a6495805136721", + "zh:6b3dc4b034d34885db620d73c75d3bb9abeee539e61ca9d0670fb995353e165d", + "zh:72f0dac5dbba355bce88599ded2baabc7d109ee786b89c6648ae720cb00a4bbf", + "zh:77981b87e2bcbb278402e8ff863d5e50aafbdc03629d7a57273c06989884a22f", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:c5b4dd61558a4887a23847d23cd3b41a97ad03a9f3624d0687cb5461fee514b0", + "zh:c8949bc6600ec10ea5c0abdd4c1ffee8f82519c0cda8cc7a651e6258960e6249", + "zh:d1c88ab98f126d65cd0c7b6c9e1d06d59e766217ae374d5a908052817e3692a3", + "zh:ff2e921440bcbfd440ef84f5127ba881c930b2b70773e725de35c0fa3baddc4b", ] } diff --git a/terraform/wifi-289708231103/tip-wifi-vpn/alerts.tf b/terraform/wifi-289708231103/tip-wifi-vpn/alerts.tf index 048630c..3a9f9ee 100644 --- a/terraform/wifi-289708231103/tip-wifi-vpn/alerts.tf +++ b/terraform/wifi-289708231103/tip-wifi-vpn/alerts.tf @@ -128,7 +128,7 @@ resource "aws_cloudformation_stack" "atlassian_cloud_backup_email_notification" template_body = < 0 ? module.vpc_main.private_subnets : var.private_subnets - vpc_id = length(var.vpc_id) > 0 ? module.vpc_main.vpc_id : var.vpc_id - tags = { "Name" = var.cluster_name } - - node_groups_defaults = { - ami_type = "AL2_x86_64" - disk_size = var.node_group_settings["disk_size"] - } - - node_groups = { - main = { - desired_capacity = var.node_group_settings["desired_capacity"] - max_capacity = var.node_group_settings["max_capacity"] - min_capacity = var.node_group_settings["min_capacity"] - instance_type = var.node_group_settings["instance_type"] - k8s_labels = { - role = "default" - } - } - } - - enable_irsa = true - cluster_enabled_log_types = [ - "api", - "audit", - "authenticator", - "controllerManager", - "scheduler", - ] - - cluster_version = var.cluster_version - write_kubeconfig = false - cluster_log_retention_in_days = var.cluster_log_retention_in_days -} - -locals { - oidc_provider_url = split("https://", module.eks.cluster_oidc_issuer_url)[1] - cluster_main_node_group_asg = length(module.eks.node_groups) > 0 ? module.eks.node_groups["main"]["resources"][0]["autoscaling_groups"][0]["name"] : "" -} - -module "cluster_autoscaler_cluster_role" { - source = "git::https://github.com/terraform-aws-modules/terraform-aws-iam.git//modules/iam-assumable-role-with-oidc?ref=v2.12.0" - role_name = "${module.eks.cluster_id}-cluster-autoscaler" - provider_url = local.oidc_provider_url - role_policy_arns = [aws_iam_policy.cluster_autoscaler.arn] - create_role = true -} - -resource "aws_iam_policy" "cluster_autoscaler" { - name_prefix = "cluster-autoscaler" - description = "EKS cluster-autoscaler policy for cluster ${var.cluster_name}" - policy = data.aws_iam_policy_document.cluster_autoscaler.json -} - -data "aws_iam_policy_document" "cluster_autoscaler" { - statement { - sid = "clusterAutoscalerAll" - effect = "Allow" - - actions = [ - "autoscaling:DescribeAutoScalingGroups", - "autoscaling:DescribeAutoScalingInstances", - "autoscaling:DescribeLaunchConfigurations", - "autoscaling:DescribeTags", - "ec2:DescribeLaunchTemplateVersions", - ] - - resources = ["*"] - } - - statement { - sid = "clusterAutoscalerOwn" - effect = "Allow" - - actions = [ - "autoscaling:SetDesiredCapacity", - "autoscaling:TerminateInstanceInAutoScalingGroup", - "autoscaling:UpdateAutoScalingGroup", - ] - - resources = ["*"] - - condition { - test = "StringEquals" - variable = "autoscaling:ResourceTag/kubernetes.io/cluster/${var.cluster_name}" - values = ["owned"] - } - - condition { - test = "StringEquals" - variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled" - values = ["true"] - } - } -} - -output "cluster_autoscaler_role_arn" { - value = module.cluster_autoscaler_cluster_role.this_iam_role_arn -} - -output "kubeconfig" { - value = module.eks.kubeconfig -} diff --git a/tf_modules/eks/variables.tf b/tf_modules/eks/variables.tf deleted file mode 100644 index 6cf4c65..0000000 --- a/tf_modules/eks/variables.tf +++ /dev/null @@ -1,60 +0,0 @@ -variable "aws_region" { - description = "AWS zone" - type = string -} - -variable "vpc_cidr" { - type = string - default = "" -} - -variable "az" { - default = ["a", "b", "c"] -} - -variable "node_group_settings" { - description = "Cluster node group settings" - type = map(string) - default = { - desired_capacity = 1 - max_capacity = 1 - min_capacity = 1 - instance_type = "t3.small" - disk_size = 20 - } -} - -variable "cluster_log_retention_in_days" { - description = "Cloudwatch logs retention (days)" - type = number - default = 35 -} - -variable "cluster_version" { - description = "EKS cluster version" - type = string -} - -variable "vpc_id" { - description = "VPC id, will be created if parameter is omitted" - type = string - default = "" -} - -variable "cluster_name" { - description = "EKS cluster name" - type = string - default = "" -} - -variable "public_subnets" { - description = "List of public subnet ids" - type = set(string) - default = [""] -} - -variable "private_subnets" { - description = "List of private subnet ids" - type = set(string) - default = [""] -} \ No newline at end of file diff --git a/tf_modules/eks/vpc.tf b/tf_modules/eks/vpc.tf deleted file mode 100644 index 0169c38..0000000 --- a/tf_modules/eks/vpc.tf +++ /dev/null @@ -1,34 +0,0 @@ -module "vpc_main" { - source = "github.com/terraform-aws-modules/terraform-aws-vpc?ref=v2.33.0" - create_vpc = length(var.vpc_id) > 0 ? false : true - name = var.cluster_name - cidr = var.vpc_cidr - azs = [for az in var.az : format("%s%s", var.aws_region, az)] - public_subnets = [cidrsubnet(var.vpc_cidr, 9, 0), cidrsubnet(var.vpc_cidr, 9, 1), cidrsubnet(var.vpc_cidr, 9, 2)] - private_subnets = [cidrsubnet(var.vpc_cidr, 9, 10), cidrsubnet(var.vpc_cidr, 9, 11), cidrsubnet(var.vpc_cidr, 9, 12)] - enable_nat_gateway = true - single_nat_gateway = false - enable_dns_hostnames = true - - public_subnet_tags = { - "kubernetes.io/cluster/${var.cluster_name}" = "shared" - "kubernetes.io/role/elb" = "1" - } - - private_subnet_tags = { - "kubernetes.io/cluster/${var.cluster_name}" = "shared" - "kubernetes.io/role/internal-elb" = "1" - } -} - -output "public_subnets" { - value = module.vpc_main.public_subnets -} - -output "private_subnets" { - value = module.vpc_main.private_subnets -} - -output "vpc_id" { - value = module.vpc_main.vpc_id -} \ No newline at end of file