Skip to content

Commit

Permalink
refactor to align with aws-eks and add profiles (#23)
Browse files Browse the repository at this point in the history 
* refactor to align with aws-eks and add profiles

* feat: pass GitHub App credentials to terraform-validate action for SSH module pulls

- Pass GH_APP_PEM_FILE, GH_APP_INSTALLATION_ID, GH_APP_ID to CSVD/terraform-validate
- Action now handles gh-auth + insteadOf git config internally
- Fixes SSH host key verification failures during terraform init
- Resolves CSVDIES-10490

* use dns_name for aws_lb.lb

---------

Co-authored-by: Dave Arnold <user@example.com>
  • Loading branch information
@morga471
morga471 and Dave Arnold committed Jul 24, 2026
1 parent aff22dc commit dd63f6b
Show file tree
Hide file tree
Showing 7 changed files with 291 additions and 153 deletions.
7 changes: 5 additions & 2 deletions .github/workflows/terraform-validate.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ on:
workflow_dispatch:

jobs:

terraform-validate:
runs-on: "229685449397"
permissions:
Expand All @@ -16,11 +15,15 @@ jobs:
- name: Setup Terraform
uses: CSVD/gh-actions-setup-terraform@v2
with:
terraform_version: '1.10.5'
terraform_version: "1.10.5"

- name: Validate Terraform Configuration
id: validate
uses: CSVD/terraform-validate@main
with:
github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }}
github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }}
github_app_id: ${{ vars.GH_APP_ID }}

- name: Check Validation/Test Results
if: always()
Expand Down
43 changes: 26 additions & 17 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,54 +21,63 @@ Change logs are auto-generated with commitizen.
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.14.0 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 3.0 |
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.2.1 |

## Providers

| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.0.0 |
| <a name="provider_aws.route53_main"></a> [aws.route53\_main](#provider\_aws.route53\_main) | 6.0.0 |
| <a name="provider_aws.route53_main_legacy"></a> [aws.route53\_main\_legacy](#provider\_aws.route53\_main\_legacy) | 6.0.0 |
| <a name="provider_aws.route53_self"></a> [aws.route53\_self](#provider\_aws.route53\_self) | 6.0.0 |
| <a name="provider_null"></a> [null](#provider\_null) | 3.2.4 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.56.0 |
| <a name="provider_aws.east"></a> [aws.east](#provider\_aws.east) | 6.56.0 |
| <a name="provider_aws.west"></a> [aws.west](#provider\_aws.west) | 6.56.0 |
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 3.2.1 |
| <a name="provider_null"></a> [null](#provider\_null) | 3.3.0 |

## Modules

No modules.
| Name | Source | Version |
|------|--------|---------|
| <a name="module_istio_ingress"></a> [istio\_ingress](#module\_istio\_ingress) | git@github.e.it.census.gov:terraform-modules/aws-dns//cname | n/a |
| <a name="module_route53_cluster_domain_east"></a> [route53\_cluster\_domain\_east](#module\_route53\_cluster\_domain\_east) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
| <a name="module_route53_cluster_domain_west"></a> [route53\_cluster\_domain\_west](#module\_route53\_cluster\_domain\_west) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
| <a name="module_route53_main_east"></a> [route53\_main\_east](#module\_route53\_main\_east) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
| <a name="module_route53_main_legacy_east"></a> [route53\_main\_legacy\_east](#module\_route53\_main\_legacy\_east) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
| <a name="module_route53_main_legacy_west"></a> [route53\_main\_legacy\_west](#module\_route53\_main\_legacy\_west) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
| <a name="module_route53_main_west"></a> [route53\_main\_west](#module\_route53\_main\_west) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
| <a name="module_tags"></a> [tags](#module\_tags) | git@github.e.it.census.gov:terraform-modules/boc-nts//tags | n/a |

## Resources

| Name | Type |
|------|------|
| [aws_route53_record.entry](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |
| [aws_route53_vpc_association_authorization.central_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource |
| [aws_route53_vpc_association_authorization.central_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource |
| [aws_route53_vpc_association_authorization.legacy_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource |
| [aws_route53_vpc_association_authorization.legacy_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource |
| [aws_route53_zone.cluster_domain](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource |
| [aws_route53_zone_association.central_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource |
| [aws_route53_zone_association.central_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource |
| [aws_route53_zone_association.legacy_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource |
| [aws_route53_zone_association.legacy_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource |
| [aws_route53profiles_resource_association.east_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53profiles_resource_association) | resource |
| [aws_route53profiles_resource_association.west_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53profiles_resource_association) | resource |
| [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_lb.lb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/lb) | data source |
| [aws_route53profiles_profiles.east_vpc_profiles](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53profiles_profiles) | data source |
| [aws_route53profiles_profiles.west_vpc_profiles](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53profiles_profiles) | data source |
| [aws_vpc.dummy_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
| [aws_vpc.eks_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
| [kubernetes_service_v1.istio-ingressgateway](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/service_v1) | data source |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
| <a name="input_delay_route53_association"></a> [delay\_route53\_association](#input\_delay\_route53\_association) | Flag to enable or disable route53 associations. Use if you need to create the same cluter and domain in a new location during migration. | `bool` | `false` | no |
| <a name="input_environment_abbr"></a> [environment\_abbr](#input\_environment\_abbr) | VPC environment purpose (common, shared, dev, stage, ite, prod). From shared VPC defintion. | `string` | `""` | no |
| <a name="input_istio_ingress_lb"></a> [istio\_ingress\_lb](#input\_istio\_ingress\_lb) | The istio ingress load balancer DNS. | `map(string)` | n/a | yes |
| <a name="input_os_username"></a> [os\_username](#input\_os\_username) | OS username from environment variable, ideally as $USER | `string` | `null` | no |
| <a name="input_profile"></a> [profile](#input\_profile) | AWS config profile | `string` | `""` | no |
| <a name="input_region"></a> [region](#input\_region) | AWS config region | `string` | `""` | no |
| <a name="input_region_map"></a> [region\_map](#input\_region\_map) | AWS region map | `map(string)` | <pre>{<br/> "east": "us-gov-east-1",<br/> "west": "us-gov-west-1"<br/>}</pre> | no |
| <a name="input_route53_endpoints"></a> [route53\_endpoints](#input\_route53\_endpoints) | Map of target route53 endpoints (for inbound) central VPCs | `map(map(string))` | <pre>{<br/> "route53_main": {<br/> "account_id": "269244441389",<br/> "alias": "lab-gov-network-nonprod",<br/> "us-gov-east-1": "vpc-070595c5b133243dd",<br/> "us-gov-west-1": "vpc-08b7b4db6a5ddf9c1"<br/> }<br/>}</pre> | no |
| <a name="input_route53_endpoints"></a> [route53\_endpoints](#input\_route53\_endpoints) | Map of target route53 endpoints (for inbound) central VPCs | `map(map(string))` | <pre>{<br/> "route53_main": {<br/> "account_id": "269244441389",<br/> "alias": "lab-gov-network-nonprod",<br/> "us-gov-east-1": "vpc-070595c5b133243dd",<br/> "us-gov-west-1": "vpc-08b7b4db6a5ddf9c1"<br/> },<br/> "route53_main_legacy": {<br/> "account_id": "107742151971",<br/> "alias": "do2-govcloud",<br/> "us-gov-east-1": "vpc-099a991da7c4eb8a5",<br/> "us-gov-west-1": "vpc-77877a12"<br/> }<br/>}</pre> | no |
| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |
| <a name="input_vpc_domain_name"></a> [vpc\_domain\_name](#input\_vpc\_domain\_name) | The DNS domain name of the vpc the cluster is in. | `string` | n/a | yes |
| <a name="input_vpc_name"></a> [vpc\_name](#input\_vpc\_name) | Define the VPC name that will be used by this cluster | `string` | n/a | yes |
Expand Down
32 changes: 26 additions & 6 deletions dns-providers.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,28 +2,48 @@
# Providers for Cross Account DNS Action
#-------------------------------------------------
provider "aws" {
alias = "route53_main"
alias = "route53_self"
profile = var.profile
assume_role {
role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id)
role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, data.aws_caller_identity.current.account_id)
session_name = var.os_username
}
}

#---
# network prod
#---
provider "aws" {
alias = "route53_main_legacy"
alias = "route53_main_east"
profile = var.profile
region = var.region_map["east"]
assume_role {
role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main_legacy"].account_id)
role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id)
session_name = var.os_username
}
}

provider "aws" {
alias = "route53_self"
alias = "route53_main_west"
profile = var.profile
region = var.region_map["west"]
assume_role {
role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, data.aws_caller_identity.current.account_id)
role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id)
session_name = var.os_username
}
}

# other regions
# east
provider "aws" {
alias = "east"
region = var.region_map["east"]
profile = var.profile
}

# west
provider "aws" {
alias = "west"
region = var.region_map["west"]
profile = var.profile
}

0 comments on commit dd63f6b

Please sign in to comment.