[Major] Code Freeze PR (#2)

* add module release process

* update module source

* update module source

* lint

* pull from ent-ecr

* pull from ent-ecr

* fix source path

* pull across accounts from central ecr

* add eecr_account_id

* fix ent_ecr_source

* dynamic version

* update image sources

* typo

* remove eecr data item as it is in the provider

* update copy images for eecr pulling

* update var and ent_ecr_source

* ensure workflows are current

* ensure workflows are current

* ensure committed

.github/workflows/terraform-release.yaml

@@ -1,25 +1,20 @@
-name: Terraform CI/CD
+name: Terraform Module Release
 on:
   workflow_dispatch:
   pull_request:
     types: [closed]
     branches:
       - main
 jobs:
-  terraform-ci-cd:
-    runs-on: 229685449397
+  terraform-release:
+    runs-on: "229685449397"
     permissions:
       contents: write
 
     steps:
       - name: Checkout code
         uses: CSVD/gh-actions-checkout@v4
 
-      - name: Setup Terraform
-        uses: CSVD/gh-actions-setup-terraform@v3
-        with:
-          terraform_version: "1.9.1"
-
       - name: Setup GITHUB Credentials
         id: github_credentials
         uses: CSVD/gh-auth@main
@@ -28,28 +23,6 @@ jobs:
           github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }}
           github_app_id: ${{ vars.GH_APP_ID }}
 
-
-      - name: Debug Authentication
-        run: |
-          # Print the GitHub server URL
-          echo "GitHub Server URL: ${{ github.server_url }}"
-
-          # Extract the host from the URL
-          HOST="${{ github.server_url }}"
-          HOST="${HOST#*//}"
-          HOST="${HOST%%/*}"
-          echo "GitHub Host: $HOST"
-
-          # Check if token exists
-          if [[ -n "${{ steps.github_credentials.outputs.github_token }}" ]]; then
-            echo "Token generated successfully"
-            # Test the token with a simple GitHub API call (without exposing the token)
-            STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ${{ steps.github_credentials.outputs.github_token }}" "${{ github.server_url }}/api/v3/user")
-            echo "API Test Status Code: $STATUS"
-          else
-            echo "No token was generated!"
-          fi
-
       - name: Setup GitHub CLI
         run: |
           # Force manual authentication since setup-git might not work with GitHub Enterprise
@@ -60,14 +33,8 @@ jobs:
           # Test GitHub CLI auth status
           gh auth status || echo "GitHub CLI authentication failed"
 
-      - name: AWS Auth
-        id: aws_auth
-        uses: CSVD/aws-auth@main
-        with:
-          ecs: true
-
-      - name: Run Terraform Module Release Action
-        uses: CSVD/terraform-module-release@main
+      - name: Run Release Action
+        uses: CSVD/releaser@main
         with:
           github-token: ${{ steps.github_credentials.outputs.github_token }}
           working-directory: '.'

.github/workflows/terraform-validate.yaml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup Terraform
         uses: CSVD/gh-actions-setup-terraform@v2
         with:
-          terraform_version: '1.7.3'
+          terraform_version: '1.10.5'
 
       - name: Validate Terraform Configuration
         id: validate

README.md

@@ -14,12 +14,16 @@ This modules installs the OpenTelemetry Collector operator and two Collectors. O
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.14.0 |
 | <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.11.0 |
+| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.2.1 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.94.1 |
+| <a name="provider_aws.eecr"></a> [aws.eecr](#provider\_aws.eecr) | 5.94.1 |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 2.17.0 |
+| <a name="provider_null"></a> [null](#provider\_null) | 3.2.3 |
 
 ## Modules
 
@@ -33,17 +37,27 @@ This modules installs the OpenTelemetry Collector operator and two Collectors. O
 |------|------|
 | [helm_release.opentelemetry-operator](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [helm_release.otel-resources](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
+| [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
+| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
+| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no |
+| <a name="input_auto_instrumentation_java_version"></a> [auto\_instrumentation\_java\_version](#input\_auto\_instrumentation\_java\_version) | Which version of auto\_instrumentation for java | `string` | `"2.9.0"` | no |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
+| <a name="input_collector_contrib_version"></a> [collector\_contrib\_version](#input\_collector\_contrib\_version) | Which version of collector\_contrib | `string` | `"0.113.0"` | no |
+| <a name="input_collector_version"></a> [collector\_version](#input\_collector\_version) | Which version of collector | `string` | `"0.100.0"` | no |
+| <a name="input_eecr_info"></a> [eecr\_info](#input\_eecr\_info) | Enterprise ECR source information | <pre>object({<br/>    account_id = string<br/>    alias      = string<br/>    profile    = string<br/>    region     = string<br/>  })</pre> | <pre>{<br/>  "account_id": "269222635945",<br/>  "alias": "lab-gov-shared-nonprod",<br/>  "profile": "269222635945-lab-gov-shared-nonprod",<br/>  "region": "us-gov-east-1"<br/>}</pre> | no |
 | <a name="input_loki_endpoint"></a> [loki\_endpoint](#input\_loki\_endpoint) | The internal endpoint for the loki service | `string` | n/a | yes |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace in which to install open telemetry | `string` | `"telemetry"` | no |
 | <a name="input_otel_helm_repo"></a> [otel\_helm\_repo](#input\_otel\_helm\_repo) | Helm repo for official opentelemetry | `string` | `"https://open-telemetry.github.io/opentelemetry-helm-charts"` | no |
 | <a name="input_otel_helm_version"></a> [otel\_helm\_version](#input\_otel\_helm\_version) | Which helm chart version of opentelemetry | `string` | `"0.71.2"` | no |
+| <a name="input_otel_version"></a> [otel\_version](#input\_otel\_version) | Which version of opentelemetry | `string` | `"0.100.0"` | no |
 | <a name="input_profile"></a> [profile](#input\_profile) | AWS config profile | `string` | `""` | no |
+| <a name="input_rbac_proxy_version"></a> [rbac\_proxy\_version](#input\_rbac\_proxy\_version) | Which version of rbac\_proxy | `string` | `"0.100.0"` | no |
 | <a name="input_region"></a> [region](#input\_region) | AWS region | `string` | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |
 | <a name="input_tempo_endpoint"></a> [tempo\_endpoint](#input\_tempo\_endpoint) | Internal otlp endpoint of tempo | `string` | n/a | yes |

copy_images.tf

@@ -1,58 +1,61 @@
 locals {
-  otel_name    = "opentelemetry-operator"
-  otel_version = "0.110.0"
-  otel_key     = format("%v#%v", local.otel_name, local.otel_version)
+  auto_instrumentation_java_name    = "autoinstrumentation-java"
+  auto_instrumentation_java_version = var.auto_instrumentation_java_version
+  auto_instrumentation_java_key     = format("%v#%v", local.auto_instrumentation_java_name, local.auto_instrumentation_java_version)
 
   collector_name    = "opentelemetry-collector-k8s"
-  collector_version = "0.111.0-amd64"
+  collector_version = var.collector_version
   collector_key     = format("%v#%v", local.collector_name, local.collector_version)
 
   collector_contrib_name    = "opentelemetry-collector-contrib"
-  collector_contrib_version = "0.113.0-amd64"
+  collector_contrib_version = var.collector_contrib_version
   collector_contrib_key     = format("%v#%v", local.collector_contrib_name, local.collector_contrib_version)
 
+  ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images")
+
+  otel_name    = "opentelemetry-operator"
+  otel_version = var.otel_version
+  otel_key     = format("%v#%v", local.otel_name, local.otel_version)
+
   rbac_proxy_name    = "kube-rbac-proxy"
-  rbac_proxy_version = "v0.18.1"
+  rbac_proxy_version = var.rbac_proxy_version
   rbac_proxy_key     = format("%v#%v", local.rbac_proxy_name, local.rbac_proxy_version)
 
-  auto_instrumentation_java_name    = "autoinstrumentation-java"
-  auto_instrumentation_java_version = "2.9.0"
-  auto_instrumentation_java_key     = format("%v#%v", local.auto_instrumentation_java_name, local.auto_instrumentation_java_version)
 
   image_config = [
     {
       enabled         = true
       dest_path       = null
       name            = local.otel_name
-      source_image    = "otel/${local.otel_name}"
-      source_registry = "docker.io"
+      source_image    = local.otel_name
+      source_registry = format("%v/%v", local.ent_ecr_source, "docker-io")
       source_tag      = local.otel_version
       tag             = local.otel_version
     },
     {
       enabled         = true
       dest_path       = null
       name            = local.collector_name
-      source_image    = "otel/${local.collector_name}"
-      source_registry = "docker.io"
+      source_image    = local.collector_name
+      source_registry = format("%v/%v", local.ent_ecr_source, "docker-io")
       source_tag      = local.collector_version
       tag             = local.collector_version
     },
     {
       enabled         = true
       dest_path       = null
       name            = local.collector_contrib_name
-      source_image    = "otel/${local.collector_contrib_name}"
-      source_registry = "docker.io"
+      source_image    = local.collector_contrib_name
+      source_registry = format("%v/%v", local.ent_ecr_source, "docker-io")
       source_tag      = local.collector_contrib_version
       tag             = local.collector_contrib_version
     },
     {
       enabled         = true
       dest_path       = null
       name            = local.rbac_proxy_name
-      source_image    = "brancz/${local.rbac_proxy_name}"
-      source_registry = "quay.io"
+      source_image    = "opensource/coreos/${local.rbac_proxy_name}"
+      source_registry = format("%v/%v", local.ent_ecr_source, "ironbank")
       source_tag      = local.rbac_proxy_version
       tag             = local.rbac_proxy_version
     },
@@ -61,7 +64,7 @@ locals {
       dest_path       = null
       name            = local.auto_instrumentation_java_name
       source_image    = "open-telemetry/opentelemetry-operator/${local.auto_instrumentation_java_name}"
-      source_registry = "ghcr.io"
+      source_registry = format("%v/%v", local.ent_ecr_source, "ghcr")
       source_tag      = local.auto_instrumentation_java_version
       tag             = local.auto_instrumentation_java_version
     }
@@ -76,7 +79,29 @@ module "images" {
   image_config     = local.image_config
   tags             = {}
 
-  enable_lifecycle_policy = true
-  lifecycle_policy_all    = true
-  force_delete            = true
+  enable_lifecycle_policy     = true
+  lifecycle_policy_all        = true
+  force_delete                = true
+  lifecycle_policy_keep_count = 5
+
+  source_username = data.aws_ecr_authorization_token.ecr_token.user_name
+  source_password = data.aws_ecr_authorization_token.ecr_token.password
+
+  destination_username = data.aws_ecr_authorization_token.token.user_name
+  destination_password = data.aws_ecr_authorization_token.token.password
+}
+
+data "aws_ecr_authorization_token" "token" {
+  registry_id = var.account_id
+}
+
+data "aws_ecr_authorization_token" "ecr_token" {
+  provider    = aws.eecr
+  registry_id = var.eecr_info.account_id
+}
+
+provider "aws" {
+  alias   = "eecr"
+  profile = var.eecr_info.profile
+  region  = var.eecr_info.region
 }

requirements.tf

@@ -10,5 +10,9 @@ terraform {
       source  = "hashicorp/helm"
       version = ">= 2.11.0"
     }
+    null = {
+      source  = "hashicorp/null"
+      version = ">= 3.2.1"
+    }
   }
 }

variables.tf

@@ -1,24 +1,57 @@
+variable "account_id" {
+  description = "aws account number"
+  type        = string
+  default     = ""
+}
+
+variable "auto_instrumentation_java_version" {
+  description = "Which version of auto_instrumentation for java"
+  type        = string
+  default     = "2.9.0"
+}
+
 variable "cluster_name" {
   description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)"
   type        = string
 }
 
-variable "namespace" {
-  description = "Namespace in which to install open telemetry"
+variable "collector_contrib_version" {
+  description = "Which version of collector_contrib"
   type        = string
-  default     = "telemetry"
+  default     = "0.113.0"
 }
 
-# tflint-ignore: terraform_unused_declarations
-variable "region" {
-  description = "AWS region"
+variable "collector_version" {
+  description = "Which version of collector"
   type        = string
+  default     = "0.100.0"
 }
 
-variable "profile" {
-  description = "AWS config profile"
+variable "eecr_info" {
+  description = "Enterprise ECR source information"
+  type = object({
+    account_id = string
+    alias      = string
+    profile    = string
+    region     = string
+  })
+  default = {
+    account_id = "269222635945"
+    alias      = "lab-gov-shared-nonprod"
+    profile    = "269222635945-lab-gov-shared-nonprod"
+    region     = "us-gov-east-1"
+  }
+}
+
+variable "loki_endpoint" {
+  description = "The internal endpoint for the loki service"
   type        = string
-  default     = ""
+}
+
+variable "namespace" {
+  description = "Namespace in which to install open telemetry"
+  type        = string
+  default     = "telemetry"
 }
 
 variable "otel_helm_repo" {
@@ -33,13 +66,26 @@ variable "otel_helm_version" {
   default     = "0.71.2"
 }
 
-variable "loki_endpoint" {
-  description = "The internal endpoint for the loki service"
+variable "otel_version" {
+  description = "Which version of opentelemetry"
   type        = string
+  default     = "0.100.0"
 }
 
-variable "tempo_endpoint" {
-  description = "Internal otlp endpoint of tempo"
+variable "profile" {
+  description = "AWS config profile"
+  type        = string
+  default     = ""
+}
+
+variable "rbac_proxy_version" {
+  description = "Which version of rbac_proxy"
+  type        = string
+  default     = "0.100.0"
+}
+
+variable "region" {
+  description = "AWS region"
   type        = string
 }
 
@@ -49,3 +95,8 @@ variable "tags" {
   type        = map(string)
   default     = {}
 }
+
+variable "tempo_endpoint" {
+  description = "Internal otlp endpoint of tempo"
+  type        = string
+}

version.tf

@@ -1,4 +1,16 @@
+resource "null_resource" "git_version" {
+  triggers = {
+    # Force this to run on every apply to get the latest tag value
+    always_run = timestamp()
+  }
+
+  provisioner "local-exec" {
+    command    = "git describe --tags --abbrev=0 2>/dev/null || echo 'unknown' > ${path.module}/.git_tag"
+    on_failure = continue
+  }
+}
+
 locals {
   module_name    = "tfmod-open-telemetry"
-  module_version = "0.0.1"
+  module_version = fileexists("${path.module}/.git_tag") ? trimspace(file("${path.module}/.git_tag")) : "latest"
 }