diff --git a/.cz.yaml b/.cz.yaml new file mode 100644 index 0000000..8a11f0c --- /dev/null +++ b/.cz.yaml @@ -0,0 +1,7 @@ +--- +commitizen: + name: cz_gitmoji + tag_format: $version + update_changelog_on_bump: true + version_provider: scm + version_scheme: semver2 diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..867570d --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + - package-ecosystem: "terraform" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "daily" diff --git a/.gitignore b/.gitignore index 7c1cae9..98d790c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ # Local .terraform directories **/.terraform/* +**/.terragrunt-cache/* # terraform lock file. **/.terraform.lock.hcl @@ -35,4 +36,3 @@ override.tf.json # Ignore CLI configuration files .terraformrc terraform.rc - diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 72bd81f..d6091dd 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,22 +1,111 @@ repos: -- repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.83.5 - hooks: -# - id: terraform_validate - - id: terraform_fmt - - id: terraform_docs - args: [ '--args=--config=.terraform-docs.yml', 'table' ] - exclude: common/*.tf - exclude: version.tf - exclude: examples/ - - id: terraform_tflint -# args: [ "--args=--config=__GIT_WORKING_DIR__/.tflint.hcl"] -# exclude: examples/ - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.5.0 + rev: v4.6.0 hooks: + # Git style + - id: check-added-large-files + - id: check-merge-conflict + - id: check-vcs-permalinks + - id: forbid-new-submodules + - id: no-commit-to-branch + - id: check-byte-order-marker + - id: check-case-conflict + - id: check-json + - id: check-merge-conflict - id: check-symlinks - - id: detect-aws-credentials + - id: check-vcs-permalinks + - id: check-toml + - id: check-xml - id: detect-private-key + - id: requirements-txt-fixer + - id: sort-simple-yaml + + # Common errors + - id: end-of-file-fixer - id: trailing-whitespace + args: [--markdown-linebreak-ext=md] + exclude: CHANGELOG.md + - id: check-yaml + - id: check-merge-conflict + - id: check-executables-have-shebangs + + # Cross platform + - id: check-case-conflict + - id: mixed-line-ending + args: [--fix=lf] + + # Security + - id: detect-aws-credentials + args: ['--allow-missing-credentials'] + - id: detect-private-key + +# JSON5 Linter +- repo: https://github.com/pre-commit/mirrors-prettier + rev: v4.0.0-alpha.8 + hooks: + - id: prettier + # https://prettier.io/docs/en/options.html#parser + files: '.json5$' + +# Terraform Hooks +- repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.92.1 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + hooks: + - id: terraform_fmt + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_docs + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_tflint + name: Terraform validate with tflint + description: Validates all Terraform configuration files with TFLint. + require_serial: true + entry: hooks/terraform_tflint.sh + language: script + files: (\.tf|\.tfvars)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terragrunt_fmt + name: Terragrunt fmt + description: Rewrites all Terragrunt configuration files to a canonical format. + entry: hooks/terragrunt_fmt.sh + language: script + files: (\.hcl)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + # Will require dependency mocks + # - id: terragrunt_validate + # name: Terragrunt validate + # description: Validates all Terragrunt configuration files. + # entry: hooks/terragrunt_validate.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_validate_inputs + # name: Terragrunt validate inputs + # description: Validates Terragrunt unused and undefined inputs. + # entry: hooks/terragrunt_validate_inputs.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_providers_lock + # name: Terragrunt providers lock + # description: Updates provider signatures in dependency lock files using terragrunt. + # entry: hooks/terragrunt_providers_lock.sh + # language: script + # files: (terragrunt|\.terraform\.lock)\.hcl$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 +- repo: https://github.com/ljnsn/cz-conventional-gitmoji + rev: v0.3.2 + hooks: + - id: conventional-gitmoji diff --git a/.pre-commit-hooks.yaml b/.pre-commit-hooks.yaml new file mode 100644 index 0000000..266f0c7 --- /dev/null +++ b/.pre-commit-hooks.yaml @@ -0,0 +1,170 @@ +#### THESE ARE NOT ENABLED, THEY ARE FOR REFERENCE +# - id: infracost_breakdown +# name: Infracost breakdown +# description: Check terraform infrastructure cost +# entry: hooks/infracost_breakdown.sh +# language: script +# require_serial: true +# files: \.(tf(vars)?|hcl)$ +# exclude: \.terraform/.*$ + +# - id: terraform_fmt +# name: Terraform fmt +# description: Rewrites all Terraform configuration files to a canonical format. +# entry: hooks/terraform_fmt.sh +# language: script +# files: (\.tf|\.tfvars)$ +# exclude: \.terraform/.*$ + +# - id: terraform_docs +# name: Terraform docs +# description: Inserts input and output documentation into README.md (using terraform-docs). +# require_serial: true +# entry: hooks/terraform_docs.sh +# language: script +# files: (\.tf|\.terraform\.lock\.hcl)$ +# exclude: \.terraform/.*$ + +# - id: terraform_docs_without_aggregate_type_defaults +# name: Terraform docs (without aggregate type defaults) +# description: Inserts input and output documentation into README.md (using terraform-docs). Identical to terraform_docs. +# require_serial: true +# entry: hooks/terraform_docs.sh +# language: script +# files: (\.tf)$ +# exclude: \.terraform/.*$ + +# - id: terraform_docs_replace +# name: Terraform docs (overwrite README.md) +# description: Overwrite content of README.md with terraform-docs. +# require_serial: true +# entry: terraform_docs_replace +# language: python +# files: (\.tf)$ +# exclude: \.terraform/.*$ + +# - id: terraform_validate +# name: Terraform validate +# description: Validates all Terraform configuration files. +# require_serial: true +# entry: hooks/terraform_validate.sh +# language: script +# files: \.(tf(vars)?|terraform\.lock\.hcl)$ +# exclude: \.terraform/.*$ + +# - id: terraform_providers_lock +# name: Lock terraform provider versions +# description: Updates provider signatures in dependency lock files. +# require_serial: true +# entry: hooks/terraform_providers_lock.sh +# language: script +# files: (\.terraform\.lock\.hcl)$ +# exclude: \.terraform/.*$ + +# - id: terraform_tflint +# name: Terraform validate with tflint +# description: Validates all Terraform configuration files with TFLint. +# require_serial: true +# entry: hooks/terraform_tflint.sh +# language: script +# files: (\.tf|\.tfvars)$ +# exclude: \.terraform/.*$ + +# - id: terragrunt_fmt +# name: Terragrunt fmt +# description: Rewrites all Terragrunt configuration files to a canonical format. +# entry: hooks/terragrunt_fmt.sh +# language: script +# files: (\.hcl)$ +# exclude: \.terraform/.*$ + +# - id: terragrunt_validate +# name: Terragrunt validate +# description: Validates all Terragrunt configuration files. +# entry: hooks/terragrunt_validate.sh +# language: script +# files: (\.hcl)$ +# exclude: \.terraform/.*$ + +# - id: terragrunt_validate_inputs +# name: Terragrunt validate inputs +# description: Validates Terragrunt unused and undefined inputs. +# entry: hooks/terragrunt_validate_inputs.sh +# language: script +# files: (\.hcl)$ +# exclude: \.terraform/.*$ + +# - id: terragrunt_providers_lock +# name: Terragrunt providers lock +# description: Updates provider signatures in dependency lock files using terragrunt. +# entry: hooks/terragrunt_providers_lock.sh +# language: script +# files: (terragrunt|\.terraform\.lock)\.hcl$ +# exclude: \.(terraform/.*|terragrunt-cache)$ + +# - id: terraform_tfsec +# name: Terraform validate with tfsec (deprecated, use "terraform_trivy") +# description: Static analysis of Terraform templates to spot potential security issues. +# require_serial: true +# entry: hooks/terraform_tfsec.sh +# files: \.tf(vars)?$ +# language: script + +# - id: terraform_trivy +# name: Terraform validate with trivy +# description: Static analysis of Terraform templates to spot potential security issues. +# require_serial: true +# entry: hooks/terraform_trivy.sh +# files: \.tf(vars)?$ +# language: script + +# - id: checkov +# name: checkov (deprecated, use "terraform_checkov") +# description: Runs checkov on Terraform templates. +# entry: checkov -d . +# language: python +# pass_filenames: false +# always_run: false +# files: \.tf$ +# exclude: \.terraform/.*$ +# require_serial: true + +# - id: terraform_checkov +# name: Checkov +# description: Runs checkov on Terraform templates. +# entry: hooks/terraform_checkov.sh +# language: script +# always_run: false +# files: \.tf$ +# exclude: \.terraform/.*$ +# require_serial: true + +# - id: terraform_wrapper_module_for_each +# name: Terraform wrapper with for_each in module +# description: Generate Terraform wrappers with for_each in module. +# entry: hooks/terraform_wrapper_module_for_each.sh +# language: script +# pass_filenames: false +# always_run: false +# require_serial: true +# files: \.tf$ +# exclude: \.terraform/.*$ + +# - id: terrascan +# name: terrascan +# description: Runs terrascan on Terraform templates. +# language: script +# entry: hooks/terrascan.sh +# files: \.tf$ +# exclude: \.terraform/.*$ +# require_serial: true + +# - id: tfupdate +# name: tfupdate +# description: Runs tfupdate on Terraform templates. +# language: script +# entry: hooks/tfupdate.sh +# args: +# - --args=terraform +# files: \.tf$ +# require_serial: true diff --git a/.terraform-docs.yml b/.terraform-docs.yml index b555908..fabfb8d 100644 --- a/.terraform-docs.yml +++ b/.terraform-docs.yml @@ -1,25 +1,44 @@ formatter: markdown table -content: |- - {{ .Header }} - - {{ .Requirements }} - - {{ .Inputs }} - - {{ .Outputs }} - - {{ .Resources }} - - {{ .Modules }} - - {{ .Footer }} - {{- printf "\n" -}} - +header-from: main.tf +footer-from: "" + +sections: +## hide: [] + show: + - data-sources + - header + - footer + - inputs + - modules + - outputs + - providers + - requirements + - resources output: - file: "README.md" - mode: replace + file: README.md + mode: inject template: |- + {{ .Content }} - + + +output-values: + enabled: false + from: "" + +sort: + enabled: true + by: name + +settings: + anchor: true + color: true + default: true + description: true + escape: true + indent: 2 + required: true + sensitive: true + type: true diff --git a/.tflint.hcl b/.tflint.hcl index e0ab07a..684d807 100644 --- a/.tflint.hcl +++ b/.tflint.hcl @@ -1,9 +1,21 @@ -plugin "terraform" { +config { + module = true + force = false + disabled_by_default = false +} + +rule "aws_instance_invalid_type" { enabled = true - preset = "recommended" } + plugin "aws" { enabled = true - version = "0.27.0" + version = "0.32.0" source = "github.com/terraform-linters/tflint-ruleset-aws" } + +plugin "terraform" { + enabled = true + version = "0.9.0" + source = "github.com/terraform-linters/tflint-ruleset-terraform" +} diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..6891eb4 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,18 @@ +## Unreleased + +### 🎨🏗️ Style & Architecture + +- **repo**: add pre-commit and commitizen repo features + +## 1.0.1 (2023-11-01) + +# CHANGELOG +* 1.0.3 -- 2024-07-30 + - updated image module + - bumped version +* 1.0.2 -- 2024-07-22 + - updated istio chart/app to 1.22.3 + - add force_delete and lifecycle policies to copy_images + - updated version.tf to 1.0.2 + - included module.images in depends on helm charts + - created changelog diff --git a/README.md b/README.md index 9dac2b0..83781a8 100644 --- a/README.md +++ b/README.md @@ -21,26 +21,81 @@ have a istio proxy configured, prevent communication with that pod.) configuration of which identities are allowed to call services, and which services are allowed to interact with other services. -# CHANGELOG -* 1.0.3 -- 2024-07-30 - - updated image module - - bumped version -* 1.0.2 -- 2024-07-22 - - updated istio chart/app to 1.22.3 - - add force_delete and lifecycle policies to copy_images - - updated version.tf to 1.0.2 - - included module.images in depends on helm charts - - created changelog + +A successful Apply will yield: +Apply complete! Resources: 11 added, 0 changed, 0 destroyed. + +Outputs: + +module_name = "tfmod-istio" +module_version = "1.0.3" + +real 1m24.584s +user 0m40.156s +sys 0m5.320s + +A successful Destroy will yield: +Destroy complete! Resources: 11 destroyed. + +real 0m47.952s +user 0m25.809s +sys 0m2.991s + + +# tfmod-istio + +Istio is a service mesh that provides encryption services to network +traffic within the node and externally. + +Generally, for services exposed outside of the EKS cluster, istio +terminates TLS connections at the istio-ingressgateway in the +istio-system namespace. For pod-to-pod communication, istio sidecar +proxies provide encryption for in-cluster communication. Istio is a +highly configurable service mesh and can be configured permissively +(enable encryption where possible, allow non-encrypted communication +if one of the services is not configured with the istio proxy) or +restrictively (enforce all encryption requirements, if a pod does not +have a istio proxy configured, prevent communication with that pod.) + +## Important Topics / Concepts: + +- Gateway/VirtualService/DestinationRule objects allow for services to + be exposed outside of the cluster. +- AuthorizationPolicy/RequestAuthentication objects allow for + configuration of which identities are allowed to call services, and + which services are allowed to interact with other services. ## Requirements | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 0.13 | -| [aws](#requirement\_aws) | >= 5.14.0 | | [helm](#requirement\_helm) | >= 2.11.0 | | [kubernetes](#requirement\_kubernetes) | >= 2.23.0 | -| [null](#requirement\_null) | >= 3.2.1 | + +## Providers + +| Name | Version | +|------|---------| +| [helm](#provider\_helm) | 2.14.0 | +| [kubernetes](#provider\_kubernetes) | 2.31.0 | + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade | + +## Resources + +| Name | Type | +|------|------| +| [helm_release.base](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [helm_release.egress](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [helm_release.ingress](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [helm_release.istiod](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [kubernetes_namespace.ns](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | +| [kubernetes_service.apiserver](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/service) | data source | ## Inputs @@ -50,8 +105,8 @@ have a istio proxy configured, prevent communication with that pod.) | [enable\_egress\_gateway](#input\_enable\_egress\_gateway) | Enable Istio to control outbound traffic from the cluster. | `bool` | `true` | no | | [enable\_telemetry](#input\_enable\_telemetry) | Enable Istio's stracing, monitoring, and logging features. | `string` | `"true"` | no | | [extra\_listener\_ports](#input\_extra\_listener\_ports) | A list of additional ports that the ingress load balancer should listen to, 9094 for kafka as an example. | 
list(object({
    name = string
    port = string
  }))
| `[]` | no | -| [istio\_chart\_version](#input\_istio\_chart\_version) | The version of istio to install into the cluster. | `string` | `"1.18.2"` | no | -| [istio\_version](#input\_istio\_version) | The version of istio to install into the cluster. | `string` | `"1.18.2"` | no | +| [istio\_chart\_version](#input\_istio\_chart\_version) | The version of istio to install into the cluster. | `string` | `"1.22.3"` | no | +| [istio\_version](#input\_istio\_version) | The version of istio to install into the cluster. | `string` | `"1.22.3"` | no | | [namespace](#input\_namespace) | The namespace to install the istio components. Defaults to 'istio-system' | `string` | `"istio-system"` | no | | [profile](#input\_profile) | AWS\_PROFILE to use to apply the terraform script. | `string` | `""` | no | | [region](#input\_region) | The region in which the cluster is running. | `string` | n/a | yes | @@ -63,20 +118,4 @@ have a istio proxy configured, prevent communication with that pod.) |------|-------------| | [module\_name](#output\_module\_name) | The name of this module. | | [module\_version](#output\_module\_version) | The version of this module. | - -## Resources - -| Name | Type | -|------|------| -| [helm_release.base](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [helm_release.egress](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [helm_release.ingress](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [helm_release.istiod](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [kubernetes_namespace.ns](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | -| [kubernetes_service.apiserver](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/service) | data source | - -## Modules - -| Name | Source | Version | -|------|--------|---------| -| [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | 2.0.2 | + diff --git a/examples/simple/providers.tf b/examples/simple/providers.tf index d33658b..fd0156f 100644 --- a/examples/simple/providers.tf +++ b/examples/simple/providers.tf @@ -1,5 +1,19 @@ terraform { required_version = ">= 1.5.0" + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.14.0" + } + helm = { + source = "hashicorp/helm" + version = ">= 2.11.0" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = ">= 2.23.0" + } + } } provider "aws" { @@ -30,4 +44,3 @@ provider "helm" { token = data.aws_eks_cluster_auth.cluster.token } } - diff --git a/examples/simple/simple.auto.tfvars b/examples/simple/simple.auto.tfvars index d6bcabb..84b57d6 100644 --- a/examples/simple/simple.auto.tfvars +++ b/examples/simple/simple.auto.tfvars @@ -1,4 +1,3 @@ region = "us-gov-east-1" profile = "terraform" cluster_name = "platform-test-1" - diff --git a/examples/simple/variables.tf b/examples/simple/variables.tf index d1630e5..2c36665 100644 --- a/examples/simple/variables.tf +++ b/examples/simple/variables.tf @@ -12,4 +12,3 @@ variable "profile" { description = "AWS config profile" type = string } - diff --git a/examples/simple/versions.tf b/examples/simple/versions.tf deleted file mode 120000 index b7707ec..0000000 --- a/examples/simple/versions.tf +++ /dev/null @@ -1 +0,0 @@ -../../versions.tf \ No newline at end of file diff --git a/main.tf b/main.tf index 7ea204d..46df6ca 100644 --- a/main.tf +++ b/main.tf @@ -25,8 +25,8 @@ locals { base_tags = { - "boc:tf_module_name" = local._module_name - "boc:tf_module_version" = local._module_version + "boc:tf_module_name" = local.module_name + "boc:tf_module_version" = local.module_version "Name" = format("%v-istio-ingress", var.cluster_name) "eks-cluster-name" = var.cluster_name } diff --git a/outputs.tf b/outputs.tf index 0349496..b999ac9 100644 --- a/outputs.tf +++ b/outputs.tf @@ -4,10 +4,10 @@ output "module_name" { description = "The name of this module." - value = local._module_name + value = local.module_name } output "module_version" { description = "The version of this module." - value = local._module_version + value = local.module_version } diff --git a/variables.tf b/variables.tf index cbd692a..d980faf 100644 --- a/variables.tf +++ b/variables.tf @@ -9,6 +9,7 @@ variable "cluster_name" { type = string } +# tflint-ignore: terraform_unused_declarations variable "region" { description = "The region in which the cluster is running." type = string diff --git a/version.tf b/version.tf index 888f639..f34b6fb 100644 --- a/version.tf +++ b/version.tf @@ -1,4 +1,4 @@ locals { - _module_name = "tfmod-istio" - _module_version = "1.0.3" + module_name = "tfmod-istio" + module_version = "1.0.3" } diff --git a/versions.tf b/versions.tf index 32e5c6f..5f150af 100644 --- a/versions.tf +++ b/versions.tf @@ -2,10 +2,6 @@ terraform { required_version = ">= 0.13" required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 5.14.0" - } helm = { source = "hashicorp/helm" version = ">= 2.11.0" @@ -14,9 +10,5 @@ terraform { source = "hashicorp/kubernetes" version = ">= 2.23.0" } - null = { - source = "hashicorp/null" - version = ">= 3.2.1" - } } }