From f29327cf9b2d7be6c2dbd1fe474b56ea31b26394 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 20 Sep 2024 00:25:10 -0400 Subject: [PATCH] moved settings into yaml --- .pre-commit-config.yaml | 99 +++++++++++++++++ main.tf | 228 ++++++++++++++++------------------------ tempo_values.yaml | 73 ++++++++----- 3 files changed, 233 insertions(+), 167 deletions(-) create mode 100644 .pre-commit-config.yaml diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..3d8476f --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,99 @@ +repos: +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.6.0 + hooks: + # Git style + - id: check-added-large-files + - id: check-merge-conflict + - id: check-vcs-permalinks + - id: forbid-new-submodules + - id: no-commit-to-branch + + # Common errors + - id: end-of-file-fixer + - id: trailing-whitespace + args: [--markdown-linebreak-ext=md] + exclude: CHANGELOG.md + - id: check-yaml + - id: check-merge-conflict + - id: check-executables-have-shebangs + + # Cross platform + - id: check-case-conflict + - id: mixed-line-ending + args: [--fix=lf] + + # Security + - id: detect-aws-credentials + args: ['--allow-missing-credentials'] + - id: detect-private-key + +# JSON5 Linter +- repo: https://github.com/pre-commit/mirrors-prettier + rev: v4.0.0-alpha.8 + hooks: + - id: prettier + files: '.json5$' + +# Terraform Hooks +- repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.92.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + hooks: + - id: terraform_fmt + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_docs + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_tflint + name: Terraform validate with tflint + description: Validates all Terraform configuration files with TFLint. + require_serial: true + entry: hooks/terraform_tflint.sh + language: script + files: (\.tf|\.tfvars)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terragrunt_fmt + name: Terragrunt fmt + description: Rewrites all Terragrunt configuration files to a canonical format. + entry: hooks/terragrunt_fmt.sh + language: script + files: (\.hcl)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + ### DISABLED UNTIL MINIFIED TERRAGRUNT.HCL IS CREATED + # - id: terragrunt_validate + # name: Terragrunt validate + # description: Validates all Terragrunt configuration files. + # entry: hooks/terragrunt_validate.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_validate_inputs + # name: Terragrunt validate inputs + # description: Validates Terragrunt unused and undefined inputs. + # entry: hooks/terragrunt_validate_inputs.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_providers_lock + # name: Terragrunt providers lock + # description: Updates provider signatures in dependency lock files using terragrunt. + # entry: hooks/terragrunt_providers_lock.sh + # language: script + # files: (terragrunt|\.terraform\.lock)\.hcl$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + +- repo: https://github.com/ljnsn/cz-conventional-gitmoji + rev: v0.3.2 + hooks: + - id: conventional-gitmoji diff --git a/main.tf b/main.tf index 9415948..1066736 100644 --- a/main.tf +++ b/main.tf @@ -1,138 +1,90 @@ -data "aws_caller_identity" "current" { -} - -locals { - account_id = data.aws_caller_identity.current.account_id - tags = merge({ - "eks-cluster-name" = var.cluster_name - "boc:tf_module_name" = local._module_name - "boc:tf_module_version" = local._module_version - "boc:created_by" = "terraform" - }, var.additional_tags) - - oidc_arn = var.oidc_provider_arn -} - -module "tempo-irsa-role" { - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-custom-iam-role-for-service-account-eks.git/?ref=1.0.0" - - role_name = "${var.cluster_name}-tempo" - attach_s3_bucket_owner_policy = true - attach_encrypted_object_manager_policy = true - - s3_bucket_arns = [ - module.tempo-s3.s3_bucket_arn, - "${module.tempo-s3.s3_bucket_arn}/*", - ] - kms_key_arns = [ - "${module.tempo-s3.kms_key_arn}" - ] - - oidc_providers = { - main = { - provider_arn = local.oidc_arn - namespace_service_accounts = ["${var.namespace}:tempo"] - } - } - tags = local.tags -} - -resource "helm_release" "tempo" { - chart = "tempo" - version = var.tempo_chart_version - name = "tempo" - namespace = var.namespace - create_namespace = true - repository = "https://grafana.github.io/helm-charts" - values = ["${file("${path.module}/tempo_values.yaml")}"] - - - set { - name = "tempo.storage.trace.backend" - value = "s3" - } - set { - name = "tempo.storage.trace.s3.insecure" - value = "false" - } - # Doesn't pass correctly, moved to values.yaml - # set { - # name = "tempo.extraEnv[0].name" - # value = "JAEGER_AGENT_PORT" - # } - # set { - # name = "tempo.extraEnv[0].value" - # value = "9411" - # } - set { - name = "tempo.metricsGenerator.enabled" - value = "true" - } - set { - name = "tempo.reportingEnabled" - value = "false" - } - set { - name = "tempo.serviceAccount.create" - value = "true" - } - set { - name = "tempo.serviceAccount.name" - value = "tempo" - } - - set { - name = "tempo.persistence.enabled" - value = "true" - } - set { - name = "tempo.persistence.accessModes[0]" - value = "ReadWriteOnce" - } - set { - name = "tempo.persistence.size" - value = "10Gi" - } - set { - name = "replicas" - value = "3" - } - set { - name = "tempo.repository" - value = format("%v/%v", - module.images.images[local.tempo_key].dest_registry, - module.images.images[local.tempo_key].dest_repository - ) - } - set { - name = "tempo.tag" - value = var.tempo_tag - } - set { - name = "tempo.storage.trace.s3.bucket" - value = module.tempo-s3.s3_bucket_id - } - set { - name = "tempo.storage.trace.s3.endpoint" - value = "s3.${var.region}.amazonaws.com" - } - set { - name = "tempo.metricsGenerator.remoteWriteUrl" - value = "http://${var.prometheus_svc}.${var.prometheus_namespace}:${var.prometheus_port}/api/v1/write" - } - # Causes an error with the app, moving to values.yaml - # set { - # name = "tempo.receivers.zipkin" - # value = "" - # } - set { - name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn" - value = module.tempo-irsa-role.iam_role_arn - } - set { - name = "persistence.storageClassName" - value = var.rwo_storage_class - } - - timeout = 60 -} \ No newline at end of file +locals { + oidc_arn = var.oidc_provider_arn +} + +################################################################################ +# IRSA Role for Tempo +################################################################################ +module "tempo-irsa-role" { + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-custom-iam-role-for-service-account-eks.git/?ref=1.0.0" + + role_name = "${var.cluster_name}-tempo" + attach_s3_bucket_owner_policy = true + attach_encrypted_object_manager_policy = true + + s3_bucket_arns = [ + module.tempo-s3.s3_bucket_arn, + "${module.tempo-s3.s3_bucket_arn}/*", + ] + kms_key_arns = [ + "${module.tempo-s3.kms_key_arn}" + ] + + oidc_providers = { + main = { + provider_arn = local.oidc_arn + namespace_service_accounts = ["${var.namespace}:tempo"] + } + } + tags = local.tags +} + +################################################################################ +# Helm Chart for Tempo +################################################################################ +resource "helm_release" "tempo" { + chart = "tempo" + version = var.tempo_chart_version + name = "tempo" + namespace = var.namespace + create_namespace = true + repository = "https://grafana.github.io/helm-charts" + values = ["${file("${path.module}/tempo_values.yaml")}"] + + + set { + name = "tempo.storage.trace.backend" + value = "s3" + } + set { + name = "tempo.storage.trace.s3.insecure" + value = "false" + } + set { + name = "replicas" + value = "3" + } + set { + name = "tempo.repository" + value = format("%v/%v", + module.images.images[local.tempo_key].dest_registry, + module.images.images[local.tempo_key].dest_repository + ) + } + set { + name = "tempo.tag" + value = var.tempo_tag + } + set { + name = "tempo.storage.trace.s3.bucket" + value = module.tempo-s3.s3_bucket_id + } + # set { + # name = "tempo.storage.trace.s3.endpoint" + # value = "s3.${var.region}.amazonaws.com" + # } + set { + name = "tempo.metricsGenerator.remoteWriteUrl" + value = "http://${var.prometheus_svc}.${var.prometheus_namespace}:${var.prometheus_port}/api/v1/write" + } + set { + name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn" + value = module.tempo-irsa-role.iam_role_arn + } + set { + name = "persistence.storageClassName" + value = var.rwo_storage_class + } + + timeout = 60 +} diff --git a/tempo_values.yaml b/tempo_values.yaml index c6f525c..f9aaa61 100644 --- a/tempo_values.yaml +++ b/tempo_values.yaml @@ -1,29 +1,44 @@ -tempo: - # storage: - # trace: - # backend: s3 - # s3: - # insecure: false - extraEnv: - - name: JAEGER_AGENT_PORT - value: "9411" - receivers: - zipkin: -# metricsGenerator: -# enabled: true -# reportingEnabled: false - -# serviceAccount: -# create: true -# name: "tempo" - -# persistence: -# enabled: true -# accessModes: -# - ReadWriteOnce -# size: 10Gi - - # set { - # name = "tempo.receivers.zipkin[]" - # value = "" - # } \ No newline at end of file +tempo: + storage: + trace: + backend: s3 + s3: + insecure: false + extraEnv: + - name: JAEGER_AGENT_PORT + value: "9411" + metricsGenerator: + enabled: true + reportingEnabled: false + +serviceAccount: + create: true + name: "tempo" + +persistence: + enabled: true + accessModes: + - ReadWriteOnce + size: 10Gi + +ingester: + autoscaling: + enabled: true +distributor: + autoscaling: + enabled: true +compactor: + autoscaling: + enabled: true +querier: + autoscaling: + enabled: true +gateway: + autoscaling: + enabled: true + +traces: + jaeger: + zipkin: + # -- Enable Tempo to ingest Zipkin traces + enabled: true