From 380d151491a838fbd682010b0637745c35e29915 Mon Sep 17 00:00:00 2001 From: Matthew Creal Morgan Date: Tue, 22 Apr 2025 09:39:27 -0700 Subject: [PATCH] [Major] Code Freeze PR (#14) * revert replicas change * autoscaling * try tempo-distributed * would require config update * update values * set limits to recommended and requests a bit higher * update s3 naming * update irsa role name * fix dupe data item * fix dupe * fix refs to tempo_s3 * add module release process * update module source * pull from ent-ecr * pull across accounts from central ecr * fix ent_ecr_source * dynamic version * add eecr_account_id * update image source * remove eecr data item as it is in the provider * update copy images for eecr pulling * update var and ent_ecr_source * ensure workflows are current * ensure workflows are current * ensure committed --- .github/workflows/terraform-release.yaml | 43 ++----------- .github/workflows/terraform-validate.yaml | 2 +- README.md | 7 +++ copy_images.tf | 30 +++++++-- variables.tf | 76 +++++++++++++++-------- version.tf | 14 ++++- 6 files changed, 101 insertions(+), 71 deletions(-) diff --git a/.github/workflows/terraform-release.yaml b/.github/workflows/terraform-release.yaml index 90910bc..3f67574 100644 --- a/.github/workflows/terraform-release.yaml +++ b/.github/workflows/terraform-release.yaml @@ -1,4 +1,4 @@ -name: Terraform CI/CD +name: Terraform Module Release on: workflow_dispatch: pull_request: @@ -6,8 +6,8 @@ on: branches: - main jobs: - terraform-ci-cd: - runs-on: 229685449397 + terraform-release: + runs-on: "229685449397" permissions: contents: write @@ -15,11 +15,6 @@ jobs: - name: Checkout code uses: CSVD/gh-actions-checkout@v4 - - name: Setup Terraform - uses: CSVD/gh-actions-setup-terraform@v3 - with: - terraform_version: "1.9.1" - - name: Setup GITHUB Credentials id: github_credentials uses: CSVD/gh-auth@main @@ -28,28 +23,6 @@ jobs: github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }} github_app_id: ${{ vars.GH_APP_ID }} - - - name: Debug Authentication - run: | - # Print the GitHub server URL - echo "GitHub Server URL: ${{ github.server_url }}" - - # Extract the host from the URL - HOST="${{ github.server_url }}" - HOST="${HOST#*//}" - HOST="${HOST%%/*}" - echo "GitHub Host: $HOST" - - # Check if token exists - if [[ -n "${{ steps.github_credentials.outputs.github_token }}" ]]; then - echo "Token generated successfully" - # Test the token with a simple GitHub API call (without exposing the token) - STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ${{ steps.github_credentials.outputs.github_token }}" "${{ github.server_url }}/api/v3/user") - echo "API Test Status Code: $STATUS" - else - echo "No token was generated!" - fi - - name: Setup GitHub CLI run: | # Force manual authentication since setup-git might not work with GitHub Enterprise @@ -60,14 +33,8 @@ jobs: # Test GitHub CLI auth status gh auth status || echo "GitHub CLI authentication failed" - - name: AWS Auth - id: aws_auth - uses: CSVD/aws-auth@main - with: - ecs: true - - - name: Run Terraform Module Release Action - uses: CSVD/terraform-module-release@main + - name: Run Release Action + uses: CSVD/releaser@main with: github-token: ${{ steps.github_credentials.outputs.github_token }} working-directory: '.' diff --git a/.github/workflows/terraform-validate.yaml b/.github/workflows/terraform-validate.yaml index 72829d8..ac349eb 100644 --- a/.github/workflows/terraform-validate.yaml +++ b/.github/workflows/terraform-validate.yaml @@ -16,7 +16,7 @@ jobs: - name: Setup Terraform uses: CSVD/gh-actions-setup-terraform@v2 with: - terraform_version: '1.7.3' + terraform_version: '1.10.5' - name: Validate Terraform Configuration id: validate diff --git a/README.md b/README.md index 824072e..2b75d13 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,9 @@ Developer NOTE: We should automate this configuration. | Name | Version | |------|---------| | [aws](#provider\_aws) | >= 5.14.0 | +| [aws.eecr](#provider\_aws.eecr) | >= 5.14.0 | | [helm](#provider\_helm) | >= 2.11.0 | +| [null](#provider\_null) | >= 3.2.1 | | [terraform](#provider\_terraform) | n/a | ## Modules @@ -47,15 +49,20 @@ Developer NOTE: We should automate this configuration. | Name | Type | |------|------| | [helm_release.tempo](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [terraform_data.bucket_name_validator](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | +| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | +| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [aws_s3_bucket.s3_server_access_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | +| [eecr\_info](#input\_eecr\_info) | Enterprise ECR source information | 
object({
    account_id = string
    alias      = string
    profile    = string
    region     = string
  })
| 
{
  "account_id": "269222635945",
  "alias": "lab-gov-shared-nonprod",
  "profile": "269222635945-lab-gov-shared-nonprod",
  "region": "us-gov-east-1"
}
| no | | [namespace](#input\_namespace) | The namespace into which tempo will be deployed | `string` | `"tempo"` | no | | [oidc\_provider\_arn](#input\_oidc\_provider\_arn) | The ARN in the EKS cluster for the OpenID Connect identity provider. | `string` | n/a | yes | | [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | diff --git a/copy_images.tf b/copy_images.tf index fbb90ef..c764b39 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -1,13 +1,14 @@ locals { - tempo_key = format("%v#%v", "tempo", var.tempo_tag) + ent_ecr_source = format("%v.%v.%v.%v", var.eecr_info.account_id, "dkr.ecr", var.region, "amazonaws.com/ent-images") + tempo_key = format("%v#%v", "tempo", var.tempo_tag) image_config = [ { enabled = true dest_path = null name = "tempo" - source_image = "bitnami/grafana-tempo" - source_registry = "public.ecr.aws" + source_image = "opensource/grafana/tempo" + source_registry = format("%v/%v", local.ent_ecr_source, "ironbank") source_tag = var.tempo_tag tag = var.tempo_tag } @@ -25,5 +26,26 @@ module "images" { enable_lifecycle_policy = true lifecycle_policy_all = true force_delete = true - lifecycle_policy_keep_count = 3 + lifecycle_policy_keep_count = 5 + + source_username = data.aws_ecr_authorization_token.ecr_token.user_name + source_password = data.aws_ecr_authorization_token.ecr_token.password + + destination_username = data.aws_ecr_authorization_token.token.user_name + destination_password = data.aws_ecr_authorization_token.token.password +} + +data "aws_ecr_authorization_token" "token" { + registry_id = var.account_id +} + +data "aws_ecr_authorization_token" "ecr_token" { + provider = aws.eecr + registry_id = var.eecr_info.account_id +} + +provider "aws" { + alias = "eecr" + profile = var.eecr_info.profile + region = var.eecr_info.region } diff --git a/variables.tf b/variables.tf index ce7152f..dc41667 100644 --- a/variables.tf +++ b/variables.tf @@ -1,12 +1,7 @@ -variable "tags" { - description = "Additional tags to add to resources created in AWS (s3 bucket, ...)" - type = map(string) - default = {} -} - -variable "region" { - description = "The region holding these resources (for the s3 bucket.)" +variable "account_id" { + description = "aws account number" type = string + default = "" } variable "cluster_name" { @@ -14,10 +9,20 @@ variable "cluster_name" { type = string } -variable "profile" { - description = "AWS config profile used to upload images into ECR" - type = string - default = "" +variable "eecr_info" { + description = "Enterprise ECR source information" + type = object({ + account_id = string + alias = string + profile = string + region = string + }) + default = { + account_id = "269222635945" + alias = "lab-gov-shared-nonprod" + profile = "269222635945-lab-gov-shared-nonprod" + region = "us-gov-east-1" + } } variable "namespace" { @@ -31,22 +36,22 @@ variable "oidc_provider_arn" { type = string } -variable "rwo_storage_class" { - description = "Specify the storage class for persistent volumes." +variable "profile" { + description = "AWS config profile used to upload images into ECR" type = string - default = "gp3-encrypted" + default = "" } -variable "tempo_chart_version" { - description = "Which version of the grafana/tempo helm chart to use." +variable "prometheus_namespace" { + description = "Namespace where Prometheus is installed." type = string - default = "1.10.3" + default = "prometheus" } -variable "tempo_tag" { - description = "The tag of the tempo image to use." +variable "prometheus_port" { + description = "Port number of Prometheus service, mostly either 80 or 9090" type = string - default = "2.5.0" + default = "80" } # Prometheus data for metrics generator @@ -56,14 +61,31 @@ variable "prometheus_svc" { default = "prometheus-server" } -variable "prometheus_namespace" { - description = "Namespace where Prometheus is installed." +variable "region" { + description = "The region holding these resources (for the s3 bucket.)" type = string - default = "prometheus" } -variable "prometheus_port" { - description = "Port number of Prometheus service, mostly either 80 or 9090" +variable "rwo_storage_class" { + description = "Specify the storage class for persistent volumes." type = string - default = "80" + default = "gp3-encrypted" +} + +variable "tags" { + description = "Additional tags to add to resources created in AWS (s3 bucket, ...)" + type = map(string) + default = {} +} + +variable "tempo_chart_version" { + description = "Which version of the grafana/tempo helm chart to use." + type = string + default = "1.10.3" +} + +variable "tempo_tag" { + description = "The tag of the tempo image to use." + type = string + default = "2.5.0" } diff --git a/version.tf b/version.tf index 7717186..27af354 100644 --- a/version.tf +++ b/version.tf @@ -1,4 +1,16 @@ +resource "null_resource" "git_version" { + triggers = { + # Force this to run on every apply to get the latest tag value + always_run = timestamp() + } + + provisioner "local-exec" { + command = "git describe --tags --abbrev=0 2>/dev/null || echo 'unknown' > ${path.module}/.git_tag" + on_failure = continue + } +} + locals { module_name = "tfmod-tempo" - module_version = "0.1.1" + module_version = fileexists("${path.module}/.git_tag") ? trimspace(file("${path.module}/.git_tag")) : "latest" }