pull from ent-ecr

SCT-Engineering · Apr 14, 2025 · 68bdf9f · 68bdf9f
1 parent c672da3
commit 68bdf9f
Show file tree

Hide file tree

Showing 4 changed files with 83 additions and 57 deletions.
diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-validate.yaml
@@ -1,42 +1,40 @@
-name: Terraform Validate
+name: Terraform CI/CD
 on:
-  pull_request:
   workflow_dispatch:
-
+  pull_request:
+    types: [closed]
+    branches:
+      - main
 jobs:
-
-  terraform-validate:
-    runs-on: "229685449397"
+  terraform-ci-cd:
+    runs-on: 229685449397
     permissions:
       contents: write
+
     steps:
       - name: Checkout code
         uses: CSVD/gh-actions-checkout@v4
 
-      - name: Setup Terraform
-        uses: CSVD/gh-actions-setup-terraform@v2
+      - name: Setup GITHUB Credentials
+        id: github_credentials
+        uses: CSVD/gh-auth@main
         with:
-          terraform_version: '1.7.3'
-
-      - name: Validate Terraform Configuration
-        id: validate
-        uses: CSVD/terraform-validate@main
+          github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }}
+          github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          github_app_id: ${{ vars.GH_APP_ID }}
 
-      - name: Check Validation/Test Results
-        if: always()
+      - name: Setup GitHub CLI
         run: |
-          # Set default values if outputs are empty
-          IS_VALID="${{ steps.validate.outputs.is_valid }}"
-          TESTS_PASSED="${{ steps.validate.outputs.tests_passed }}"
+          # Force manual authentication since setup-git might not work with GitHub Enterprise
+          echo "${{ steps.github_credentials.outputs.github_token }}" > /tmp/token.txt
+          gh auth login --with-token --hostname "github.e.it.census.gov" < /tmp/token.txt
+          rm /tmp/token.txt
 
-          # If outputs are empty, set them to false
-          [ -z "$IS_VALID" ] && IS_VALID="false"
-          [ -z "$TESTS_PASSED" ] && TESTS_PASSED="false"
+          # Test GitHub CLI auth status
+          gh auth status || echo "GitHub CLI authentication failed"
 
-          if [[ "$IS_VALID" != "true" || "$TESTS_PASSED" != "true" ]]; then
-            echo "Validation or test errors found:"
-            echo "${{ steps.validate.outputs.stderr }}"
-            exit 1
-          else
-            echo "All validations and tests passed successfully!"
-          fi
+      - name: Run Release Action
+        uses: CSVD/releaser@main
+        with:
+          github-token: ${{ steps.github_credentials.outputs.github_token }}
+          working-directory: '.'
diff --git a/README.md b/README.md
@@ -19,6 +19,7 @@ This modules installs the OpenTelemetry Collector operator and two Collectors. O
 
 | Name | Version |
 |------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.93.0 |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 2.17.0 |
 
 ## Modules
@@ -33,11 +34,14 @@ This modules installs the OpenTelemetry Collector operator and two Collectors. O
 |------|------|
 | [helm_release.opentelemetry-operator](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [helm_release.otel-resources](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
+| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
+| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
 | <a name="input_loki_endpoint"></a> [loki\_endpoint](#input\_loki\_endpoint) | The internal endpoint for the loki service | `string` | n/a | yes |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace in which to install open telemetry | `string` | `"telemetry"` | no |

diff --git a/copy_images.tf b/copy_images.tf
@@ -1,7 +1,7 @@
 locals {
-  otel_name    = "opentelemetry-operator"
-  otel_version = "0.110.0"
-  otel_key     = format("%v#%v", local.otel_name, local.otel_version)
+  auto_instrumentation_java_name    = "autoinstrumentation-java"
+  auto_instrumentation_java_version = "2.9.0"
+  auto_instrumentation_java_key     = format("%v#%v", local.auto_instrumentation_java_name, local.auto_instrumentation_java_version)
 
   collector_name    = "opentelemetry-collector-k8s"
   collector_version = "0.111.0-amd64"
@@ -11,21 +11,24 @@ locals {
   collector_contrib_version = "0.113.0-amd64"
   collector_contrib_key     = format("%v#%v", local.collector_contrib_name, local.collector_contrib_version)
 
+  ent_ecr_source = format("%v.%v.%v.%v", var.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images")
+
+  otel_name    = "opentelemetry-operator"
+  otel_version = "0.110.0"
+  otel_key     = format("%v#%v", local.otel_name, local.otel_version)
+
   rbac_proxy_name    = "kube-rbac-proxy"
   rbac_proxy_version = "v0.18.1"
   rbac_proxy_key     = format("%v#%v", local.rbac_proxy_name, local.rbac_proxy_version)
 
-  auto_instrumentation_java_name    = "autoinstrumentation-java"
-  auto_instrumentation_java_version = "2.9.0"
-  auto_instrumentation_java_key     = format("%v#%v", local.auto_instrumentation_java_name, local.auto_instrumentation_java_version)
 
   image_config = [
     {
       enabled         = true
       dest_path       = null
       name            = local.otel_name
       source_image    = "otel/${local.otel_name}"
-      source_registry = "docker.io"
+      source_registry = format("%v/%v", local.ent_ecr_source, "docker")
       source_tag      = local.otel_version
       tag             = local.otel_version
     },
@@ -34,7 +37,7 @@ locals {
       dest_path       = null
       name            = local.collector_name
       source_image    = "otel/${local.collector_name}"
-      source_registry = "docker.io"
+      source_registry = format("%v/%v", local.ent_ecr_source, "docker")
       source_tag      = local.collector_version
       tag             = local.collector_version
     },
@@ -43,7 +46,7 @@ locals {
       dest_path       = null
       name            = local.collector_contrib_name
       source_image    = "otel/${local.collector_contrib_name}"
-      source_registry = "docker.io"
+      source_registry = format("%v/%v", local.ent_ecr_source, "docker")
       source_tag      = local.collector_contrib_version
       tag             = local.collector_contrib_version
     },
@@ -52,7 +55,7 @@ locals {
       dest_path       = null
       name            = local.rbac_proxy_name
       source_image    = "brancz/${local.rbac_proxy_name}"
-      source_registry = "quay.io"
+      source_registry = format("%v/%v", local.ent_ecr_source, "quay")
       source_tag      = local.rbac_proxy_version
       tag             = local.rbac_proxy_version
     },
@@ -61,7 +64,7 @@ locals {
       dest_path       = null
       name            = local.auto_instrumentation_java_name
       source_image    = "open-telemetry/opentelemetry-operator/${local.auto_instrumentation_java_name}"
-      source_registry = "ghcr.io"
+      source_registry = format("%v/%v", local.ent_ecr_source, "ghcr")
       source_tag      = local.auto_instrumentation_java_version
       tag             = local.auto_instrumentation_java_version
     }
@@ -76,7 +79,22 @@ module "images" {
   image_config     = local.image_config
   tags             = {}
 
-  enable_lifecycle_policy = true
-  lifecycle_policy_all    = true
-  force_delete            = true
+  enable_lifecycle_policy     = true
+  lifecycle_policy_all        = true
+  force_delete                = true
+  lifecycle_policy_keep_count = 5
+
+  source_username = data.aws_ecr_authorization_token.ecr_token.user_name
+  source_password = data.aws_ecr_authorization_token.ecr_token.password
+
+  destination_username = data.aws_ecr_authorization_token.token.user_name
+  destination_password = data.aws_ecr_authorization_token.token.password
+}
+
+data "aws_ecr_authorization_token" "ecr_token" {
+  registry_id = var.account_id
+}
+
+data "aws_ecr_authorization_token" "token" {
+  registry_id = var.account_id
 }
diff --git a/variables.tf b/variables.tf
@@ -1,24 +1,23 @@
-variable "cluster_name" {
-  description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)"
+variable "account_id" {
+  description = "aws account number"
   type        = string
+  default     = ""
 }
 
-variable "namespace" {
-  description = "Namespace in which to install open telemetry"
+variable "cluster_name" {
+  description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)"
   type        = string
-  default     = "telemetry"
 }
 
-# tflint-ignore: terraform_unused_declarations
-variable "region" {
-  description = "AWS region"
+variable "loki_endpoint" {
+  description = "The internal endpoint for the loki service"
   type        = string
 }
 
-variable "profile" {
-  description = "AWS config profile"
+variable "namespace" {
+  description = "Namespace in which to install open telemetry"
   type        = string
-  default     = ""
+  default     = "telemetry"
 }
 
 variable "otel_helm_repo" {
@@ -33,13 +32,15 @@ variable "otel_helm_version" {
   default     = "0.71.2"
 }
 
-variable "loki_endpoint" {
-  description = "The internal endpoint for the loki service"
+variable "profile" {
+  description = "AWS config profile"
   type        = string
+  default     = ""
 }
 
-variable "tempo_endpoint" {
-  description = "Internal otlp endpoint of tempo"
+# tflint-ignore: terraform_unused_declarations
+variable "region" {
+  description = "AWS region"
   type        = string
 }
 
@@ -49,3 +50,8 @@ variable "tags" {
   type        = map(string)
   default     = {}
 }
+
+variable "tempo_endpoint" {
+  description = "Internal otlp endpoint of tempo"
+  type        = string
+}