refactor to align with aws-eks and add profiles

.github/workflows/terraform-validate.yaml

@@ -4,7 +4,6 @@ on:
   workflow_dispatch:
 
 jobs:
-
   terraform-validate:
     runs-on: "229685449397"
     permissions:
@@ -16,11 +15,15 @@ jobs:
       - name: Setup Terraform
         uses: CSVD/gh-actions-setup-terraform@v2
         with:
-          terraform_version: '1.10.5'
+          terraform_version: "1.10.5"
 
       - name: Validate Terraform Configuration
         id: validate
         uses: CSVD/terraform-validate@main
+        with:
+          github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }}
+          github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          github_app_id: ${{ vars.GH_APP_ID }}
 
       - name: Check Validation/Test Results
         if: always()

README.md

@@ -21,54 +21,63 @@ Change logs are auto-generated with commitizen.
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.14.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
+| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 3.0 |
 | <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.2.1 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.0.0 |
-| <a name="provider_aws.route53_main"></a> [aws.route53\_main](#provider\_aws.route53\_main) | 6.0.0 |
-| <a name="provider_aws.route53_main_legacy"></a> [aws.route53\_main\_legacy](#provider\_aws.route53\_main\_legacy) | 6.0.0 |
-| <a name="provider_aws.route53_self"></a> [aws.route53\_self](#provider\_aws.route53\_self) | 6.0.0 |
-| <a name="provider_null"></a> [null](#provider\_null) | 3.2.4 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.56.0 |
+| <a name="provider_aws.east"></a> [aws.east](#provider\_aws.east) | 6.56.0 |
+| <a name="provider_aws.west"></a> [aws.west](#provider\_aws.west) | 6.56.0 |
+| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 3.2.1 |
+| <a name="provider_null"></a> [null](#provider\_null) | 3.3.0 |
 
 ## Modules
 
-No modules.
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_istio_ingress"></a> [istio\_ingress](#module\_istio\_ingress) | git@github.e.it.census.gov:terraform-modules/aws-dns//cname | n/a |
+| <a name="module_route53_cluster_domain_east"></a> [route53\_cluster\_domain\_east](#module\_route53\_cluster\_domain\_east) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
+| <a name="module_route53_cluster_domain_west"></a> [route53\_cluster\_domain\_west](#module\_route53\_cluster\_domain\_west) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
+| <a name="module_route53_main_east"></a> [route53\_main\_east](#module\_route53\_main\_east) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
+| <a name="module_route53_main_legacy_east"></a> [route53\_main\_legacy\_east](#module\_route53\_main\_legacy\_east) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
+| <a name="module_route53_main_legacy_west"></a> [route53\_main\_legacy\_west](#module\_route53\_main\_legacy\_west) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
+| <a name="module_route53_main_west"></a> [route53\_main\_west](#module\_route53\_main\_west) | git@github.e.it.census.gov:terraform-modules/aws-vpc-setup.git//route53-zone-association/zone | tf-upgrade |
+| <a name="module_tags"></a> [tags](#module\_tags) | git@github.e.it.census.gov:terraform-modules/boc-nts//tags | n/a |
 
 ## Resources
 
 | Name | Type |
 |------|------|
-| [aws_route53_record.entry](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource |
-| [aws_route53_vpc_association_authorization.central_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource |
-| [aws_route53_vpc_association_authorization.central_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource |
-| [aws_route53_vpc_association_authorization.legacy_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource |
-| [aws_route53_vpc_association_authorization.legacy_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_vpc_association_authorization) | resource |
 | [aws_route53_zone.cluster_domain](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone) | resource |
-| [aws_route53_zone_association.central_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource |
-| [aws_route53_zone_association.central_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource |
-| [aws_route53_zone_association.legacy_zone_east](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource |
-| [aws_route53_zone_association.legacy_zone_west](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_zone_association) | resource |
+| [aws_route53profiles_resource_association.east_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53profiles_resource_association) | resource |
+| [aws_route53profiles_resource_association.west_zone](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53profiles_resource_association) | resource |
 | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
 | [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_lb.lb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/lb) | data source |
+| [aws_route53profiles_profiles.east_vpc_profiles](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53profiles_profiles) | data source |
+| [aws_route53profiles_profiles.west_vpc_profiles](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/route53profiles_profiles) | data source |
 | [aws_vpc.dummy_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
 | [aws_vpc.eks_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
+| [kubernetes_service_v1.istio-ingressgateway](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/service_v1) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
+| <a name="input_delay_route53_association"></a> [delay\_route53\_association](#input\_delay\_route53\_association) | Flag to enable or disable route53 associations.  Use if you need to create the same cluter and domain in a new location during migration. | `bool` | `false` | no |
+| <a name="input_environment_abbr"></a> [environment\_abbr](#input\_environment\_abbr) | VPC environment purpose (common, shared, dev, stage, ite, prod).   From shared VPC defintion. | `string` | `""` | no |
 | <a name="input_istio_ingress_lb"></a> [istio\_ingress\_lb](#input\_istio\_ingress\_lb) | The istio ingress load balancer DNS. | `map(string)` | n/a | yes |
 | <a name="input_os_username"></a> [os\_username](#input\_os\_username) | OS username from environment variable, ideally as $USER | `string` | `null` | no |
 | <a name="input_profile"></a> [profile](#input\_profile) | AWS config profile | `string` | `""` | no |
 | <a name="input_region"></a> [region](#input\_region) | AWS config region | `string` | `""` | no |
 | <a name="input_region_map"></a> [region\_map](#input\_region\_map) | AWS region map | `map(string)` | <pre>{<br/>  "east": "us-gov-east-1",<br/>  "west": "us-gov-west-1"<br/>}</pre> | no |
-| <a name="input_route53_endpoints"></a> [route53\_endpoints](#input\_route53\_endpoints) | Map of target route53 endpoints (for inbound) central VPCs | `map(map(string))` | <pre>{<br/>  "route53_main": {<br/>    "account_id": "269244441389",<br/>    "alias": "lab-gov-network-nonprod",<br/>    "us-gov-east-1": "vpc-070595c5b133243dd",<br/>    "us-gov-west-1": "vpc-08b7b4db6a5ddf9c1"<br/>  }<br/>}</pre> | no |
+| <a name="input_route53_endpoints"></a> [route53\_endpoints](#input\_route53\_endpoints) | Map of target route53 endpoints (for inbound) central VPCs | `map(map(string))` | <pre>{<br/>  "route53_main": {<br/>    "account_id": "269244441389",<br/>    "alias": "lab-gov-network-nonprod",<br/>    "us-gov-east-1": "vpc-070595c5b133243dd",<br/>    "us-gov-west-1": "vpc-08b7b4db6a5ddf9c1"<br/>  },<br/>  "route53_main_legacy": {<br/>    "account_id": "107742151971",<br/>    "alias": "do2-govcloud",<br/>    "us-gov-east-1": "vpc-099a991da7c4eb8a5",<br/>    "us-gov-west-1": "vpc-77877a12"<br/>  }<br/>}</pre> | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |
 | <a name="input_vpc_domain_name"></a> [vpc\_domain\_name](#input\_vpc\_domain\_name) | The DNS domain name of the vpc the cluster is in. | `string` | n/a | yes |
 | <a name="input_vpc_name"></a> [vpc\_name](#input\_vpc\_name) | Define the VPC name that will be used by this cluster | `string` | n/a | yes |

dns-providers.tf

@@ -2,28 +2,48 @@
 # Providers for Cross Account DNS Action
 #-------------------------------------------------
 provider "aws" {
-  alias   = "route53_main"
+  alias   = "route53_self"
   profile = var.profile
   assume_role {
-    role_arn     = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id)
+    role_arn     = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, data.aws_caller_identity.current.account_id)
     session_name = var.os_username
   }
 }
 
+#---
+# network prod
+#---
 provider "aws" {
-  alias   = "route53_main_legacy"
+  alias   = "route53_main_east"
   profile = var.profile
+  region  = var.region_map["east"]
   assume_role {
-    role_arn     = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main_legacy"].account_id)
+    role_arn     = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id)
     session_name = var.os_username
   }
 }
 
 provider "aws" {
-  alias   = "route53_self"
+  alias   = "route53_main_west"
   profile = var.profile
+  region  = var.region_map["west"]
   assume_role {
-    role_arn     = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, data.aws_caller_identity.current.account_id)
+    role_arn     = format("arn:%v:iam::%v:role/r-inf-terraform-route53", data.aws_arn.current.partition, var.route53_endpoints["route53_main"].account_id)
     session_name = var.os_username
   }
 }
+
+# other regions
+# east
+provider "aws" {
+  alias   = "east"
+  region  = var.region_map["east"]
+  profile = var.profile
+}
+
+# west
+provider "aws" {
+  alias   = "west"
+  region  = var.region_map["west"]
+  profile = var.profile
+}