From f11f64796d17de3fb0516c138eed1f33376888a8 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Thu, 23 Jul 2026 13:43:35 -0400 Subject: [PATCH] refactor to align with aws-eks and add profiles --- README.md | 43 +++--- dns-providers.tf | 32 ++++- main.tf | 332 +++++++++++++++++++++++++++++------------------ requirements.tf | 6 +- tags.tf | 6 + variables.tf | 18 +++ 6 files changed, 286 insertions(+), 151 deletions(-) create mode 100644 tags.tf diff --git a/README.md b/README.md index 2658e42..bd7ff0e 100644 --- a/README.md +++ b/README.md @@ -21,54 +21,63 @@ Change logs are auto-generated with commitizen. | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.5 | -| [aws](#requirement\_aws) | >= 5.14.0 | +| [aws](#requirement\_aws) | >= 6.0 | +| [kubernetes](#requirement\_kubernetes) | >= 3.0 | | [null](#requirement\_null) | >= 3.2.1 | ## Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | 6.0.0 | -| [aws.route53\_main](#provider\_aws.route53\_main) | 6.0.0 | -| [aws.route53\_main\_legacy](#provider\_aws.route53\_main\_legacy) | 6.0.0 | -| [aws.route53\_self](#provider\_aws.route53\_self) | 6.0.0 | -| [null](#provider\_null) | 3.2.4 | +| [aws](#provider\_aws) | 6.56.0 | +| [aws.east](#provider\_aws.east) | 6.56.0 | +| [aws.west](#provider\_aws.west) | 6.56.0 | +| [kubernetes](#provider\_kubernetes) | 3.2.1 | +| [null](#provider\_null) | 3.3.0 | ## Modules -No modules. +| Name | Source | Version | +|------|--------|---------| +| [istio\_ingress](#module\_istio\_ingress) | git@github.e.it.census.gov:terraform-modules/aws-dns//cname | n/a | +| [route53\_cluster\_domain\_east](#module\_route53\_cluster\_domain\_east) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade | +| [route53\_cluster\_domain\_west](#module\_route53\_cluster\_domain\_west) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade | +| [route53\_main\_east](#module\_route53\_main\_east) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade | +| [route53\_main\_legacy\_east](#module\_route53\_main\_legacy\_east) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade | +| [route53\_main\_legacy\_west](#module\_route53\_main\_legacy\_west) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade | +| [route53\_main\_west](#module\_route53\_main\_west) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade | +| [tags](#module\_tags) | git@github.e.it.census.gov:terraform-modules/boc-nts//tags | n/a | ## Resources | Name | Type | |------|------| -| [aws_route53_record.entry](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource | -| [aws_route53_vpc_association_authorization.central_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource | -| [aws_route53_vpc_association_authorization.central_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource | -| [aws_route53_vpc_association_authorization.legacy_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource | -| [aws_route53_vpc_association_authorization.legacy_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource | | [aws_route53_zone.cluster_domain](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource | -| [aws_route53_zone_association.central_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource | -| [aws_route53_zone_association.central_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource | -| [aws_route53_zone_association.legacy_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource | -| [aws_route53_zone_association.legacy_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource | +| [aws_route53profiles_resource_association.east_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53profiles_resource_association) | resource | +| [aws_route53profiles_resource_association.west_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53profiles_resource_association) | resource | | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_lb.lb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/lb) | data source | +| [aws_route53profiles_profiles.east_vpc_profiles](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53profiles_profiles) | data source | +| [aws_route53profiles_profiles.west_vpc_profiles](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53profiles_profiles) | data source | | [aws_vpc.dummy_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source | | [aws_vpc.eks_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source | +| [kubernetes_service_v1.istio-ingressgateway](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/service_v1) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | +| [delay\_route53\_association](#input\_delay\_route53\_association) | Flag to enable or disable route53 associations. Use if you need to create the same cluter and domain in a new location during migration. | `bool` | `false` | no | +| [environment\_abbr](#input\_environment\_abbr) | VPC environment purpose (common, shared, dev, stage, ite, prod). From shared VPC defintion. | `string` | `""` | no | | [istio\_ingress\_lb](#input\_istio\_ingress\_lb) | The istio ingress load balancer DNS. | `map(string)` | n/a | yes | | [os\_username](#input\_os\_username) | OS username from environment variable, ideally as $USER | `string` | `null` | no | | [profile](#input\_profile) | AWS config profile | `string` | `""` | no | | [region](#input\_region) | AWS config region | `string` | `""` | no | | [region\_map](#input\_region\_map) | AWS region map | `map(string)` | 
{
  "east": "us-gov-east-1",
  "west": "us-gov-west-1"
}
| no | -| [route53\_endpoints](#input\_route53\_endpoints) | Map of target route53 endpoints (for inbound) central VPCs | `map(map(string))` | 
{
  "route53_main": {
    "account_id": "269244441389",
    "alias": "lab-gov-network-nonprod",
    "us-gov-east-1": "vpc-070595c5b133243dd",
    "us-gov-west-1": "vpc-08b7b4db6a5ddf9c1"
  }
}
| no | +| [route53\_endpoints](#input\_route53\_endpoints) | Map of target route53 endpoints (for inbound) central VPCs | `map(map(string))` | 
{
  "route53_main": {
    "account_id": "269244441389",
    "alias": "lab-gov-network-nonprod",
    "us-gov-east-1": "vpc-070595c5b133243dd",
    "us-gov-west-1": "vpc-08b7b4db6a5ddf9c1"
  },
  "route53_main_legacy": {
    "account_id": "107742151971",
    "alias": "do2-govcloud",
    "us-gov-east-1": "vpc-099a991da7c4eb8a5",
    "us-gov-west-1": "vpc-77877a12"
  }
}
| no | | [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no | | [vpc\_domain\_name](#input\_vpc\_domain\_name) | The DNS domain name of the vpc the cluster is in. | `string` | n/a | yes | | [vpc\_name](#input\_vpc\_name) | Define the VPC name that will be used by this cluster | `string` | n/a | yes | diff --git a/dns-providers.tf b/dns-providers.tf index 0039e63..d68b62e 100644 --- a/dns-providers.tf +++ b/dns-providers.tf @@ -2,28 +2,48 @@ # Providers for Cross Account DNS Action #------------------------------------------------- provider "aws" { - alias = "route53_main" + alias = "route53_self" profile = var.profile assume_role { - role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id) + role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, data.aws_caller_identity.current.account_id) session_name = var.os_username } } +#--- +# network prod +#--- provider "aws" { - alias = "route53_main_legacy" + alias = "route53_main_east" profile = var.profile + region = var.region_map["east"] assume_role { - role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main_legacy"].account_id) + role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id) session_name = var.os_username } } provider "aws" { - alias = "route53_self" + alias = "route53_main_west" profile = var.profile + region = var.region_map["west"] assume_role { - role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, data.aws_caller_identity.current.account_id) + role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id) session_name = var.os_username } } + +# other regions +# east +provider "aws" { + alias = "east" + region = var.region_map["east"] + profile = var.profile +} + +# west +provider "aws" { + alias = "west" + region = var.region_map["west"] + profile = var.profile +} diff --git a/main.tf b/main.tf index bc9f3ed..484eb73 100644 --- a/main.tf +++ b/main.tf @@ -2,192 +2,270 @@ # DNS Zone for EKS # Locals #------------------------------------------------- - locals { cluster_domain_description = format("%v EKS Cluster DNS Zone", var.cluster_name) cluster_domain_name = format("%v.%v", var.cluster_name, local.vpc_domain_name) is_shared_vpc = data.aws_vpc.eks_vpc.owner_id != data.aws_caller_identity.current.account_id region = var.region vpc_domain_name = var.vpc_domain_name - vpc_id = local.is_shared_vpc ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id } #------------------------------------------------- # cluster_domain dns zone #------------------------------------------------- - resource "aws_route53_zone" "cluster_domain" { name = local.cluster_domain_name comment = local.cluster_domain_description force_destroy = false vpc { - vpc_id = local.vpc_id + vpc_id = ! (var.environment_abbr == null || var.environment_abbr == "") ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id vpc_region = local.region } lifecycle { ignore_changes = [vpc] precondition { - condition = ! (var.vpc_domain_name == null || var.vpc_domain_name == "") - error_message = "var.vpc_domain_name must be provided." + condition = (var.environment_abbr == null || var.environment_abbr == "") || (! (var.environment_abbr == null || var.environment_abbr == "") && ! (var.vpc_domain_name == null || var.vpc_domain_name == "")) + error_message = "var.vpc_domain_name must be provided when shared VPCs are in use." } } tags = merge( - var.tags, { "Name" = local.cluster_domain_name }, + # local.base_tags, + # local.common_tags, + module.tags.finops_roles["route53"], + module.tags.tags, + # var.application_tags, + var.tags, ) } -# #--- -# # cluster domain associations with eks vpc -# # east region -# #--- -# resource "aws_route53_vpc_association_authorization" "cluster_zone_east" { -# count = local.region != var.region_map["east"] ? 1 : 0 - -# provider = aws.route53_self -# vpc_id = local.vpc_id -# vpc_region = var.region_map["east"] -# zone_id = aws_route53_zone.cluster_domain.zone_id -# } - -# resource "aws_route53_zone_association" "cluster_zone_east" { -# count = local.region != var.region_map["east"] ? 1 : 0 - -# provider = aws.route53_main -# vpc_id = local.vpc_id -# vpc_region = var.region_map["east"] -# zone_id = aws_route53_zone.cluster_domain.zone_id - -# depends_on = [aws_route53_vpc_association_authorization.cluster_zone_east] -# } - -# #------------------------------------------------- -# # cluster PHZ Association west region -# #------------------------------------------------- -# resource "aws_route53_vpc_association_authorization" "cluster_zone_west" { -# count = local.region != var.region_map["west"] ? 1 : 0 - -# provider = aws.route53_self -# vpc_id = local.vpc_id -# vpc_region = var.region_map["west"] -# zone_id = aws_route53_zone.cluster_domain.zone_id -# } - -# resource "aws_route53_zone_association" "cluster_zone_west" { -# count = local.region != var.region_map["west"] ? 1 : 0 -# provider = aws.route53_main -# vpc_id = local.vpc_id -# vpc_region = var.region_map["west"] -# zone_id = aws_route53_zone.cluster_domain.zone_id - -# depends_on = [aws_route53_vpc_association_authorization.cluster_zone_west] -# } - #--- -# cluster domain associations with central networking account -# east region +# need to also associate with network-prod account and this vpc #--- -resource "aws_route53_vpc_association_authorization" "central_zone_east" { - provider = aws.route53_self - vpc_id = var.route53_endpoints.route53_main[var.region_map["east"]] - vpc_region = var.region_map["east"] - zone_id = aws_route53_zone.cluster_domain.zone_id +module "route53_cluster_domain_east" { + count = ! var.delay_route53_association && local.region == "us-gov-east-1" && ! (var.environment_abbr == null || var.environment_abbr == "") ? 1 : 0 + providers = { + aws.self = aws + aws.peer = aws.route53_main_east + } + + source = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone?ref=tf-upgrade" + region = "us-gov-east-1" + vpc_id = data.aws_vpc.eks_vpc.id + zone_ids = [aws_route53_zone.cluster_domain.zone_id] + + tags = merge( + # local.base_tags, + # local.common_tags, + module.tags.finops_roles["route53"], + module.tags.tags, + # var.application_tags, + var.tags, + ) } -resource "aws_route53_zone_association" "central_zone_east" { - provider = aws.route53_main - vpc_id = var.route53_endpoints.route53_main[var.region_map["east"]] - vpc_region = var.region_map["east"] - zone_id = aws_route53_zone.cluster_domain.zone_id +module "route53_cluster_domain_west" { + count = ! var.delay_route53_association && local.region == "us-gov-west-1" && ! (var.environment_abbr == null || var.environment_abbr == "") ? 1 : 0 + providers = { + aws.self = aws + aws.peer = aws.route53_main_west + } + + source = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone?ref=tf-upgrade" + region = "us-gov-west-1" + vpc_id = data.aws_vpc.eks_vpc.id + zone_ids = [aws_route53_zone.cluster_domain.zone_id] - depends_on = [aws_route53_vpc_association_authorization.central_zone_east] + tags = merge( + # local.base_tags, + # local.common_tags, + module.tags.finops_roles["route53"], + module.tags.tags, + # var.application_tags, + var.tags, + ) } -#------------------------------------------------- -# west region -#------------------------------------------------- -resource "aws_route53_vpc_association_authorization" "central_zone_west" { - provider = aws.route53_self - vpc_id = var.route53_endpoints.route53_main[var.region_map["west"]] - vpc_region = var.region_map["west"] - zone_id = aws_route53_zone.cluster_domain.zone_id +#--- +# network prod +#--- +provider "aws" { + alias = "route53_main" + region = var.region_map["east"] + profile = var.profile + assume_role { + role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id) + session_name = var.os_username + } } -resource "aws_route53_zone_association" "central_zone_west" { - provider = aws.route53_main - vpc_id = var.route53_endpoints.route53_main[var.region_map["west"]] - vpc_region = var.region_map["west"] - zone_id = aws_route53_zone.cluster_domain.zone_id +module "route53_main_east" { + count = var.delay_route53_association ? 0 : 1 + providers = { + aws.self = aws + aws.peer = aws.route53_main + } - depends_on = [aws_route53_vpc_association_authorization.central_zone_west] + source = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone?ref=tf-upgrade" + region = "us-gov-east-1" + vpc_id = var.route53_endpoints["route53_main"]["us-gov-east-1"] + zone_ids = [aws_route53_zone.cluster_domain.zone_id] + + tags = merge( + module.tags.finops_roles["route53"], + module.tags.tags, + # var.application_tags, + # local.common_tags, + var.tags, + ) +} + +module "route53_main_west" { + count = var.delay_route53_association ? 0 : 1 + providers = { + aws.self = aws + aws.peer = aws.route53_main + } + + source = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone?ref=tf-upgrade" + region = "us-gov-west-1" + vpc_id = var.route53_endpoints["route53_main"]["us-gov-west-1"] + zone_ids = [aws_route53_zone.cluster_domain.zone_id] + + tags = merge( + module.tags.finops_roles["route53"], + module.tags.tags, + # var.application_tags, + # local.common_tags, + var.tags, + ) } #--- -# cluster domain associations with legacy do2-gov networking -# east region +# do2-gov ("legacy") #--- -resource "aws_route53_vpc_association_authorization" "legacy_zone_east" { - provider = aws.route53_self - vpc_id = var.route53_endpoints.route53_main_legacy[var.region_map["east"]] - vpc_region = var.region_map["east"] - zone_id = aws_route53_zone.cluster_domain.zone_id +provider "aws" { + alias = "route53_main_legacy" + region = var.region_map["east"] + profile = var.profile + assume_role { + role_arn = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main_legacy"].account_id) + session_name = var.os_username + } } -resource "aws_route53_zone_association" "legacy_zone_east" { - provider = aws.route53_main_legacy - vpc_id = var.route53_endpoints.route53_main_legacy[var.region_map["east"]] - vpc_region = var.region_map["east"] - zone_id = aws_route53_zone.cluster_domain.zone_id +module "route53_main_legacy_east" { + count = var.delay_route53_association ? 0 : 1 + providers = { + aws.self = aws + aws.peer = aws.route53_main_legacy + } - depends_on = [aws_route53_vpc_association_authorization.legacy_zone_east] -} + source = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone?ref=tf-upgrade" + region = "us-gov-east-1" + vpc_id = var.route53_endpoints["route53_main_legacy"]["us-gov-east-1"] + zone_ids = [aws_route53_zone.cluster_domain.zone_id] -#------------------------------------------------- -# cluster domain associations with legacy do2-gov networking -# west region -#------------------------------------------------- -resource "aws_route53_vpc_association_authorization" "legacy_zone_west" { - provider = aws.route53_self - vpc_id = var.route53_endpoints.route53_main_legacy[var.region_map["west"]] - vpc_region = var.region_map["west"] - zone_id = aws_route53_zone.cluster_domain.zone_id + tags = merge( + module.tags.finops_roles["route53"], + module.tags.tags, + # var.application_tags, + # local.common_tags, + var.tags, + ) } -resource "aws_route53_zone_association" "legacy_zone_west" { - provider = aws.route53_main_legacy - vpc_id = var.route53_endpoints.route53_main_legacy[var.region_map["west"]] - vpc_region = var.region_map["west"] - zone_id = aws_route53_zone.cluster_domain.zone_id +module "route53_main_legacy_west" { + count = var.delay_route53_association ? 0 : 1 + providers = { + aws.self = aws + aws.peer = aws.route53_main_legacy + } - depends_on = [aws_route53_vpc_association_authorization.legacy_zone_west] + source = "git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone?ref=tf-upgrade" + region = "us-gov-west-1" + vpc_id = var.route53_endpoints["route53_main_legacy"]["us-gov-west-1"] + zone_ids = [aws_route53_zone.cluster_domain.zone_id] + + tags = merge( + module.tags.finops_roles["route53"], + module.tags.tags, + # var.application_tags, + # local.common_tags, + var.tags, + ) } ################################################################### # Cluster DNS CNAME MAPPED TO INGRESS NLB ################################################################### -resource "aws_route53_record" "entry" { - zone_id = aws_route53_zone.cluster_domain.zone_id - name = "*.${local.cluster_domain_name}" - type = "A" +# Equivalent module implementation +data "kubernetes_service_v1" "istio-ingressgateway" { + metadata { + name = "istio-ingressgateway" + namespace = "istio-system" + } +} - alias { - name = var.istio_ingress_lb.dns_name - zone_id = var.istio_ingress_lb.zone_id - # scaling actions will cause dns to drop otherwise - evaluate_target_health = false +locals { + is_gateway_active = data.kubernetes_service_v1.istio-ingressgateway.status != null +} + +data "aws_lb" "lb" { + count = local.is_gateway_active ? 1 : 0 + name = var.istio_ingress_lb +} + +module "istio_ingress" { + depends_on = [aws_route53_zone.cluster_domain] + # tflint-ignore: terraform_module_pinned_source + source = "git@github.e.it.census.gov:terraform-modules/aws-dns//cname" + + name = format("*.%v", aws_route53_zone.cluster_domain.name) + zone_id = aws_route53_zone.cluster_domain.zone_id + values = [data.aws_lb.lb[0].dns_name] + enable_heritage = false +} + + +################################################################# +# dns zone profiles +################################################################# +data "aws_route53profiles_profiles" "east_vpc_profiles" { + provider = aws.east +} +data "aws_route53profiles_profiles" "west_vpc_profiles" { + provider = aws.west +} + +locals { + east_route53_profiles = { for v in data.aws_route53profiles_profiles.east_vpc_profiles.profiles : v.name => v.id } + west_route53_profiles = { for v in data.aws_route53profiles_profiles.west_vpc_profiles.profiles : v.name => v.id } + route53_profile_mapping = { + "shared" = "services" + "ite" = "test" + "qa" = "test" + "uat" = "test" } + route53_profile = lookup(local.route53_profile_mapping, var.environment_abbr, var.environment_abbr) } -# Equivalent module implementation -# module "istio_ingress" { -# source = "git@github.e.it.census.gov:terraform-modules/aws-dns//cname" - -# name = "*.${local.cluster_domain_name}" -# zone = aws_route53_zone.cluster_domain.zone_id -# values = [var.istio_ingress_lb.dns_name] -# enable_heritage = false -# } +resource "aws_route53profiles_resource_association" "east_zone" { + provider = aws.east + region = "us-gov-east-1" + name = format("%v-%v zone %v", local.route53_profile, "vpc", aws_route53_zone.cluster_domain.zone_id) + profile_id = local.east_route53_profiles[local.route53_profile] + resource_arn = aws_route53_zone.cluster_domain.arn +} + +resource "aws_route53profiles_resource_association" "west_zone" { + provider = aws.west + region = "us-gov-west-1" + name = format("%v-%v zone %v", local.route53_profile, "vpc", aws_route53_zone.cluster_domain.zone_id) + profile_id = local.west_route53_profiles[local.route53_profile] + resource_arn = aws_route53_zone.cluster_domain.arn +} diff --git a/requirements.tf b/requirements.tf index 7f4f431..a77c004 100644 --- a/requirements.tf +++ b/requirements.tf @@ -4,7 +4,11 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = ">= 5.14.0" + version = ">= 6.0" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = ">= 3.0" } null = { source = "hashicorp/null" diff --git a/tags.tf b/tags.tf new file mode 100644 index 0000000..7ed73e0 --- /dev/null +++ b/tags.tf @@ -0,0 +1,6 @@ +module "tags" { + # tflint-ignore: terraform_module_pinned_source + source = "git@github.e.it.census.gov:terraform-modules/boc-nts//tags" + filename = format("%v/%v", path.root, "tags.yml") + +} diff --git a/variables.tf b/variables.tf index a536f21..cb3000a 100644 --- a/variables.tf +++ b/variables.tf @@ -74,5 +74,23 @@ variable "route53_endpoints" { "us-gov-east-1" = "vpc-070595c5b133243dd" "us-gov-west-1" = "vpc-08b7b4db6a5ddf9c1" } + route53_main_legacy = { + "account_id" = "107742151971" + "alias" = "do2-govcloud" + "us-gov-east-1" = "vpc-099a991da7c4eb8a5" + "us-gov-west-1" = "vpc-77877a12" + } } } + +variable "delay_route53_association" { + description = "Flag to enable or disable route53 associations. Use if you need to create the same cluter and domain in a new location during migration." + type = bool + default = false +} + +variable "environment_abbr" { + description = "VPC environment purpose (common, shared, dev, stage, ite, prod). From shared VPC defintion." + type = string + default = "" +}