From 04f62cb99722ea9268dae169fa1a32460f620789 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 14 Apr 2025 17:49:27 -0400 Subject: [PATCH 1/4] pull from ent-ecr --- README.md | 4 ++++ copy_images.tf | 31 ++++++++++++++++----------- variables.tf | 58 ++++++++++++++++++++++++++++---------------------- 3 files changed, 54 insertions(+), 39 deletions(-) diff --git a/README.md b/README.md index 95208a2..3bd396c 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,7 @@ Common issues and solutions: | Name | Version | |------|---------| +| [aws](#provider\_aws) | 5.88.0 | | [helm](#provider\_helm) | 2.17.0 | ## Modules @@ -85,11 +86,14 @@ Common issues and solutions: | Name | Type | |------|------| | [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | +| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no | | [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | | [default\_storage\_class](#input\_default\_storage\_class) | The default storage class to use for persistent volumes | `string` | `"gp3-encrypted"` | no | diff --git a/copy_images.tf b/copy_images.tf index 9ea2ccd..878b1d7 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -2,7 +2,7 @@ locals { keycloak_name = "bitnami/keycloak" keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) - + ent_ecr_source = format("%v.%v.%v.%v", var.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") image_config = [ { @@ -10,7 +10,7 @@ locals { dest_path = null name = "bitnami/keycloak" source_image = "bitnami/keycloak" - source_registry = "public.ecr.aws" + source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") source_tag = var.keycloak_tag tag = var.keycloak_tag }, @@ -19,19 +19,10 @@ locals { dest_path = null name = "bitnami/postgresql" source_image = "bitnami/postgresql" - source_registry = "public.ecr.aws" + source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") source_tag = var.postgresql_tag tag = var.postgresql_tag }, - # { - # enabled = true - # dest_path = null - # name = "gogatekeeper" - # source_image = "bitnami/keycloak-gatekeeper" - # source_registry = "public.ecr.aws" - # source_tag = var.gogatekeeper_tag - # tag = var.gogatekeeper_tag - # }, ] } @@ -46,5 +37,19 @@ module "images" { enable_lifecycle_policy = true lifecycle_policy_all = true force_delete = true - lifecycle_policy_keep_count = 3 + lifecycle_policy_keep_count = 5 + + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password + + destination_username = data.aws_ecr_authorization_token.token.user_name + destination_password = data.aws_ecr_authorization_token.token.password +} + +data "aws_ecr_authorization_token" "ecr_token" { + registry_id = var.account_id +} + +data "aws_ecr_authorization_token" "token" { + registry_id = var.account_id } diff --git a/variables.tf b/variables.tf index 194fdbc..457f4c2 100644 --- a/variables.tf +++ b/variables.tf @@ -1,29 +1,23 @@ -variable "cluster_name" { - description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)" - type = string -} - -variable "profile" { - description = "AWS config profile used to upload images into ECR" +variable "account_id" { + description = "aws account number" type = string default = "" } -variable "namespace" { - description = "The namespace which will be created and into which keycloak will be deployed." +variable "cluster_domain" { + description = "The domain name used to reference ingresses for the cluster." type = string - default = "keycloak" } -variable "keycloak_tag" { - description = "The image tag associated with the keycloak_chart_version" +variable "cluster_name" { + description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)" type = string - default = "22.0.1-debian-11-r30" } -variable "cluster_domain" { - description = "The domain name used to reference ingresses for the cluster." +variable "default_storage_class" { + description = "The default storage class to use for persistent volumes" type = string + default = "gp3-encrypted" } variable "keycloak_database" { @@ -32,22 +26,40 @@ variable "keycloak_database" { default = "keycloak" } +variable "keycloak_password" { + description = "The initial password for the database." + type = string + default = "keycloak" +} + +variable "keycloak_tag" { + description = "The image tag associated with the keycloak_chart_version" + type = string + default = "22.0.1-debian-11-r30" +} + variable "keycloak_user" { description = "The username for the database." type = string default = "keycloak" } -variable "keycloak_password" { - description = "The initial password for the database." +variable "namespace" { + description = "The namespace which will be created and into which keycloak will be deployed." type = string default = "keycloak" } -variable "default_storage_class" { - description = "The default storage class to use for persistent volumes" +variable "postgresql_tag" { + description = "The tag of the postgresql image to use." type = string - default = "gp3-encrypted" + default = "17.4.0" +} + +variable "profile" { + description = "AWS config profile used to upload images into ECR" + type = string + default = "" } variable "service_name" { @@ -61,9 +73,3 @@ variable "telemetry_namespace" { type = string default = "namespace" } - -variable "postgresql_tag" { - description = "The tag of the postgresql image to use." - type = string - default = "17.4.0" -} From 8ddfbf050d25163aa609934fb491b69fce61900f Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Mon, 14 Apr 2025 21:03:03 -0400 Subject: [PATCH 2/4] add region --- README.md | 1 + variables.tf | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/README.md b/README.md index 3bd396c..c981c86 100644 --- a/README.md +++ b/README.md @@ -104,6 +104,7 @@ Common issues and solutions: | [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | | [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no | | [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | +| [region](#input\_region) | region name | `string` | `"us-gov-east-1"` | no | | [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"service"` | no | | [telemetry\_namespace](#input\_telemetry\_namespace) | The namespace used for telemetry. | `string` | `"namespace"` | no | diff --git a/variables.tf b/variables.tf index 457f4c2..aabae0e 100644 --- a/variables.tf +++ b/variables.tf @@ -62,6 +62,12 @@ variable "profile" { default = "" } +variable "region" { + description = "region name" + type = string + default = "us-gov-east-1" +} + variable "service_name" { description = "The name of the service to be deployed in the EKS cluster." type = string From 125314a9a70e5e5d695cafbc166a1748a6783517 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 15 Apr 2025 14:48:27 -0400 Subject: [PATCH 3/4] revert --- copy_images.tf | 6 +++--- variables.tf | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/copy_images.tf b/copy_images.tf index 878b1d7..3af88f7 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -2,7 +2,7 @@ locals { keycloak_name = "bitnami/keycloak" keycloak_key = format("%v#%v", local.keycloak_name, var.keycloak_tag) postgresql_key = format("%v#%v", "bitnami/postgresql", var.postgresql_tag) - ent_ecr_source = format("%v.%v.%v.%v", var.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") + # ent_ecr_source = format("%v.%v.%v.%v", var.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") image_config = [ { @@ -10,7 +10,7 @@ locals { dest_path = null name = "bitnami/keycloak" source_image = "bitnami/keycloak" - source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") + source_registry = "public.ecr.aws" source_tag = var.keycloak_tag tag = var.keycloak_tag }, @@ -19,7 +19,7 @@ locals { dest_path = null name = "bitnami/postgresql" source_image = "bitnami/postgresql" - source_registry = format("%v/%v", local.ent_ecr_source, "public-ecr") + source_registry = "public.ecr.aws" source_tag = var.postgresql_tag tag = var.postgresql_tag }, diff --git a/variables.tf b/variables.tf index aabae0e..9f73f81 100644 --- a/variables.tf +++ b/variables.tf @@ -62,6 +62,7 @@ variable "profile" { default = "" } +# tflint-ignore: terraform_unused_declarations variable "region" { description = "region name" type = string From c62c0748a12a110f8fe007569a55414106140ed7 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 15 Apr 2025 16:20:48 -0400 Subject: [PATCH 4/4] token expired --- README.md | 3 --- copy_images.tf | 20 ++++++++++---------- variables.tf | 1 + 3 files changed, 11 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index c981c86..f62f6a2 100644 --- a/README.md +++ b/README.md @@ -71,7 +71,6 @@ Common issues and solutions: | Name | Version | |------|---------| -| [aws](#provider\_aws) | 5.88.0 | | [helm](#provider\_helm) | 2.17.0 | ## Modules @@ -86,8 +85,6 @@ Common issues and solutions: | Name | Type | |------|------| | [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | -| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | ## Inputs diff --git a/copy_images.tf b/copy_images.tf index 3af88f7..2fc1b3c 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -39,17 +39,17 @@ module "images" { force_delete = true lifecycle_policy_keep_count = 5 - source_username = data.aws_ecr_authorization_token.ecr_token.user_name - source_password = data.aws_ecr_authorization_token.ecr_token.password + # source_username = data.aws_ecr_authorization_token.ecr_token.user_name + # source_password = data.aws_ecr_authorization_token.ecr_token.password - destination_username = data.aws_ecr_authorization_token.token.user_name - destination_password = data.aws_ecr_authorization_token.token.password + # destination_username = data.aws_ecr_authorization_token.token.user_name + # destination_password = data.aws_ecr_authorization_token.token.password } -data "aws_ecr_authorization_token" "ecr_token" { - registry_id = var.account_id -} +# data "aws_ecr_authorization_token" "ecr_token" { +# registry_id = var.account_id +# } -data "aws_ecr_authorization_token" "token" { - registry_id = var.account_id -} +# data "aws_ecr_authorization_token" "token" { +# registry_id = var.account_id +# } diff --git a/variables.tf b/variables.tf index 9f73f81..fa1f4f4 100644 --- a/variables.tf +++ b/variables.tf @@ -1,3 +1,4 @@ +# tflint-ignore: terraform_unused_declarations variable "account_id" { description = "aws account number" type = string