Skip to content

Commit

Permalink
add eecr_account_id
Browse files Browse the repository at this point in the history
  • Loading branch information
@morga471
morga471 committed Apr 17, 2025
1 parent 6802bec commit 10f6aeb
Show file tree
Hide file tree
Showing 4 changed files with 70 additions and 85 deletions.
36 changes: 27 additions & 9 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,39 +76,55 @@ Common issues and solutions:

| Name | Version |
|------|---------|
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.17.0 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 5.14 |
| <a name="provider_aws.eecr"></a> [aws.eecr](#provider\_aws.eecr) | ~> 5.14 |
| <a name="provider_helm"></a> [helm](#provider\_helm) | ~> 2.11 |
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | ~> 2.23 |
| <a name="provider_random"></a> [random](#provider\_random) | ~> 3.6 |

## Modules

| Name | Source | Version |
|------|--------|---------|
| <a name="module_images"></a> [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade |
| <a name="module_ingress_resources"></a> [ingress\_resources](#module\_ingress\_resources) | git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git | main |
| <a name="module_ingress_resources"></a> [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | n/a |
| <a name="module_keycloak_db_config"></a> [keycloak\_db\_config](#module\_keycloak\_db\_config) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a |
| <a name="module_post_install"></a> [post\_install](#module\_post\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a |
| <a name="module_pre_install"></a> [pre\_install](#module\_pre\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a |
| <a name="module_service_account"></a> [service\_account](#module\_service\_account) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account | n/a |

## Resources

| Name | Type |
|------|------|
| [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
| [helm_release.keycloak-db](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
| [kubernetes_namespace.keycloak](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
| [random_uuid.user_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource |
| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
| [kubernetes_secret.db-secrets](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret) | data source |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no |
| <a name="input_admin_email"></a> [admin\_email](#input\_admin\_email) | The email address of the admin of the default realm. | `string` | `"luther.coleman.mcginty@census.gov"` | no |
| <a name="input_cluster_domain"></a> [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes |
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
| <a name="input_default_storage_class"></a> [default\_storage\_class](#input\_default\_storage\_class) | The default storage class to use for persistent volumes | `string` | `"gp3-encrypted"` | no |
| <a name="input_keycloak_database"></a> [keycloak\_database](#input\_keycloak\_database) | The name of the database to create in the RDS instance. | `string` | `"keycloak"` | no |
| <a name="input_keycloak_password"></a> [keycloak\_password](#input\_keycloak\_password) | The initial password for the database. | `string` | `"keycloak"` | no |
| <a name="input_keycloak_tag"></a> [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"22.0.1-debian-11-r30"` | no |
| <a name="input_default_realm"></a> [default\_realm](#input\_default\_realm) | The default realm to use to configure the environment. | `string` | `"cluster-user"` | no |
| <a name="input_eecr_account_id"></a> [eecr\_account\_id](#input\_eecr\_account\_id) | enterpirse ecr source aws account number | `string` | `""` | no |
| <a name="input_keycloak_chart_version"></a> [keycloak\_chart\_version](#input\_keycloak\_chart\_version) | The version of the helm chart to install | `string` | `"7.0.1"` | no |
| <a name="input_keycloak_hostname"></a> [keycloak\_hostname](#input\_keycloak\_hostname) | The hostname used to access the keycloak service. | `string` | `"keycloak"` | no |
| <a name="input_keycloak_namespace"></a> [keycloak\_namespace](#input\_keycloak\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no |
| <a name="input_keycloak_tag"></a> [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"26.0.7"` | no |
| <a name="input_keycloak_user"></a> [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no |
| <a name="input_kubectl_image_tag"></a> [kubectl\_image\_tag](#input\_kubectl\_image\_tag) | Version tag for the docker image to use to execute kubectl commands. | `string` | `"1.25.2-debian-11-r3"` | no |
| <a name="input_postgresql_chart_version"></a> [postgresql\_chart\_version](#input\_postgresql\_chart\_version) | The helm chart version of postgresql to use. | `string` | `"16.5.1"` | no |
| <a name="input_postgresql_tag"></a> [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no |
| <a name="input_profile"></a> [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no |
| <a name="input_region"></a> [region](#input\_region) | region name | `string` | `"us-gov-east-1"` | no |
| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"service"` | no |
| <a name="input_telemetry_namespace"></a> [telemetry\_namespace](#input\_telemetry\_namespace) | The namespace used for telemetry. | `string` | `"namespace"` | no |

## Outputs

Expand All @@ -123,4 +139,6 @@ Common issues and solutions:
| <a name="output_namespace"></a> [namespace](#output\_namespace) | The namespace in which keycloak gets installed in. |
| <a name="output_provider_config"></a> [provider\_config](#output\_provider\_config) | Add provider configuration block for easier consumption |
| <a name="output_public_endpoint"></a> [public\_endpoint](#output\_public\_endpoint) | The endpoint at which keycloak can be reached from outside the cluster. |
| <a name="output_user_auth_realm"></a> [user\_auth\_realm](#output\_user\_auth\_realm) | The URL for discovering keycloak services. |
| <a name="output_user_secret"></a> [user\_secret](#output\_user\_secret) | The name of the secret containing the sso user for accessing keycloak. |
<!-- END_TF_DOCS -->
21 changes: 11 additions & 10 deletions copy_images.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,17 +49,18 @@ module "images" {
force_delete = true
lifecycle_policy_keep_count = 5

# source_username = data.aws_ecr_authorization_token.ecr_token.user_name
# source_password = data.aws_ecr_authorization_token.ecr_token.password
source_username = data.aws_ecr_authorization_token.ecr_token.user_name
source_password = data.aws_ecr_authorization_token.ecr_token.password

# destination_username = data.aws_ecr_authorization_token.token.user_name
# destination_password = data.aws_ecr_authorization_token.token.password
destination_username = data.aws_ecr_authorization_token.token.user_name
destination_password = data.aws_ecr_authorization_token.token.password
}

# data "aws_ecr_authorization_token" "ecr_token" {
# registry_id = var.account_id
# }
data "aws_ecr_authorization_token" "ecr_token" {
provider = aws.eecr
registry_id = var.eecr_account_id
}

# data "aws_ecr_authorization_token" "token" {
# registry_id = var.account_id
# }
data "aws_ecr_authorization_token" "token" {
registry_id = var.account_id
}
55 changes: 28 additions & 27 deletions main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,8 @@
resource "random_uuid" "user_secret" {}

locals {
public_hostname = format("%v.%v", var.keycloak_hostname, var.cluster_domain)
public_port_number = "80"
public_url = format("https://%v:%v/", local.public_hostname, local.public_port_number)

internal_port_number = "8080"
admin_internal_port_number = "9000"

user_client_id = "sso.user"
Expand Down Expand Up @@ -71,14 +68,16 @@ resource "kubernetes_namespace" "keycloak" {
}

module "service_account" {
source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//service-account"
# tflint-ignore: terraform_module_pinned_source
source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account"

namespace = kubernetes_namespace.keycloak.metadata[0].name
namespace = kubernetes_namespace.keycloak.metadata[0].name
}

module "pre_install" {
source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job"

# tflint-ignore: terraform_module_pinned_source
source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job"

namespace = kubernetes_namespace.keycloak.metadata[0].name
service_account_name = module.service_account.service_account_name
job_name = "keycloak-config-secret-job"
Expand All @@ -90,20 +89,20 @@ module "pre_install" {
}

resource "helm_release" "keycloak-db" {
chart = "postgresql"
version = var.postgresql_chart_version
name = "keycloak-db"
namespace = kubernetes_namespace.keycloak.metadata[0].name
repository = "oci://registry-1.docker.io/bitnamicharts"
values = [file("${path.module}/keycloak-db-values.yaml")]
wait = true
timeout = 300
chart = "postgresql"
version = var.postgresql_chart_version
name = "keycloak-db"
namespace = kubernetes_namespace.keycloak.metadata[0].name
repository = "oci://registry-1.docker.io/bitnamicharts"
values = [file("${path.module}/keycloak-db-values.yaml")]
wait = true
timeout = 300

depends_on = [
data.kubernetes_secret.db-secrets,
module.images
]

set {
name = "image.registry"
value = module.images.images[local.postgresql_key].dest_registry
Expand All @@ -127,10 +126,11 @@ data "kubernetes_secret" "db-secrets" {
}

module "keycloak_db_config" {
source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job"
# tflint-ignore: terraform_module_pinned_source
source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job"

depends_on = [helm_release.keycloak-db]

depends_on = [ helm_release.keycloak-db ]

namespace = kubernetes_namespace.keycloak.metadata[0].name
service_account_name = module.service_account.service_account_name
job_name = "keycloak-db-config-job"
Expand All @@ -148,8 +148,8 @@ resource "helm_release" "keycloak" {
version = var.keycloak_chart_version
repository = "https://codecentric.github.io/helm-charts"
timeout = 300
depends_on = [ helm_release.keycloak-db ]
depends_on = [helm_release.keycloak-db]

values = [templatefile("${path.module}/keycloak-server-values.yaml", {
hostname = format("https://%v.%v", var.keycloak_hostname, var.cluster_domain)

Expand All @@ -159,7 +159,7 @@ resource "helm_release" "keycloak" {
})]

set {
name = "image.repository"
name = "image.repository"
value = format("%v/%v",
module.images.images[local.keycloak_key].dest_registry,
module.images.images[local.keycloak_key].dest_repository
Expand All @@ -173,9 +173,9 @@ resource "helm_release" "keycloak" {
}

module "ingress_resources" {
# depends_on = [helm_release.keycloak]
depends_on = [helm_release.keycloak]
# tflint-ignore: terraform_module_pinned_source
source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git?ref=main"
source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git"
public_hostname = var.service_name
public_domain = var.cluster_domain
service_name = "keycloak-keycloakx-http"
Expand All @@ -184,8 +184,9 @@ module "ingress_resources" {
}

module "post_install" {
depends_on = [ helm_release.keycloak ]
source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job"
depends_on = [helm_release.keycloak]
# tflint-ignore: terraform_module_pinned_source
source = "git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job"

namespace = kubernetes_namespace.keycloak.metadata[0].name
service_account_name = module.service_account.service_account_name
Expand All @@ -195,4 +196,4 @@ module "post_install" {
init_img = module.images.images[local.kubectl_key].dest_full_path

timeout = "10m"
}
}
43 changes: 4 additions & 39 deletions variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ variable "cluster_name" {
type = string
}

variable "default_storage_class" {
description = "The default storage class to use for persistent volumes"
variable "eecr_account_id" {
description = "enterpirse ecr source aws account number"
type = string
default = "gp3-encrypted"
default = ""
}

variable "keycloak_namespace" {
Expand All @@ -45,24 +45,6 @@ variable "keycloak_user" {
default = "keycloak"
}

variable "namespace" {
description = "The namespace which will be created and into which keycloak will be deployed."
type = string
default = "keycloak"
}

variable "keycloak_postgres_db_hostname" {
description = "The hostname of the postgres database for keycloak to use."
type = string
default = "keycloak-db"
}

variable "keycloak_user" {
description = "The username for the database."
type = string
default = "17.4.0"
}

variable "profile" {
description = "AWS config profile used to upload images into ECR"
type = string
Expand All @@ -75,24 +57,12 @@ variable "keycloak_hostname" {
default = "keycloak"
}

variable "default_storage_class" {
description = "The default storage class to use for persistent volumes"
type = string
default = "us-gov-east-1"
}

variable "service_name" {
description = "The name of the service to be deployed in the EKS cluster."
type = string
default = "service"
}

variable "telemetry_namespace" {
description = "The namespace used for telemetry."
type = string
default = "namespace"
}

variable "postgresql_chart_version" {
description = "The helm chart version of postgresql to use."
type = string
Expand All @@ -107,13 +77,8 @@ variable "postgresql_tag" {

variable "kubectl_image_tag" {
description = "Version tag for the docker image to use to execute kubectl commands."
default = "1.25.2-debian-11-r3"
}

variable "external_database_password" {
description = "The password for the external_database_username user."
type = string
default = "I am a great, thoughtful and extremely well respected password. Vegetable. Phrenologist. Ethiopia."
default = "1.25.2-debian-11-r3"
}

variable "default_realm" {
Expand Down

0 comments on commit 10f6aeb

Please sign in to comment.