diff --git a/.cz.yaml b/.cz.yaml new file mode 100644 index 0000000..b1981ec --- /dev/null +++ b/.cz.yaml @@ -0,0 +1,8 @@ +--- +commitizen: + major_version_zero: true + name: cz_gitmoji + tag_format: $version + update_changelog_on_bump: true + version_provider: scm + version_scheme: semver2 diff --git a/.gitignore b/.gitignore index da5e96c..03d66da 100644 --- a/.gitignore +++ b/.gitignore @@ -1,40 +1,40 @@ -# Local .terraform directories -**/.terraform/* - -# terraform lock file. -**/.terraform.lock.hcl - -# .tfstate files -*.tfstate -*.tfstate.* - -# Crash log files -crash.log -crash.*.log - -# Exclude all .tfvars files, which are likely to contain sensitive data, -# such as password, private keys, and other secrets. These should not be -# part of version control as they are data points which are potentially -# sensitive and subject to change depending on the environment. -*.tfvars -*.tfvars.json - -# Ignore override files as they are usually used to override resources -# locally and so are not checked in -override.tf -override.tf.json -*_override.tf -*_override.tf.json - -# Include override files you do wish to add to version control using negated pattern -# !example_override.tf - -# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan -# example: *tfplan* - -# Ignore CLI configuration files -.terraformrc -terraform.rc - -# It's a module, shouldn't have a providers.tf -provider*.tf +# Local .terraform directories +**/.terraform/* + +# terraform lock file. +**/.terraform.lock.hcl + +# .tfstate files +*.tfstate +*.tfstate.* + +# Crash log files +crash.log +crash.*.log + +# Exclude all .tfvars files, which are likely to contain sensitive data, +# such as password, private keys, and other secrets. These should not be +# part of version control as they are data points which are potentially +# sensitive and subject to change depending on the environment. +*.tfvars +*.tfvars.json + +# Ignore override files as they are usually used to override resources +# locally and so are not checked in +override.tf +override.tf.json +*_override.tf +*_override.tf.json + +# Include override files you do wish to add to version control using negated pattern +# !example_override.tf + +# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan +# example: *tfplan* + +# Ignore CLI configuration files +.terraformrc +terraform.rc + +# It's a module, shouldn't have a providers.tf +provider*.tf diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..59ee012 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,99 @@ +repos: +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.6.0 + hooks: + # Git style + - id: check-added-large-files + - id: check-merge-conflict + - id: check-vcs-permalinks + - id: forbid-new-submodules + - id: no-commit-to-branch + + # Common errors + - id: end-of-file-fixer + - id: trailing-whitespace + args: [--markdown-linebreak-ext=md] + exclude: CHANGELOG.md + - id: check-yaml + - id: check-merge-conflict + - id: check-executables-have-shebangs + + # Cross platform + - id: check-case-conflict + - id: mixed-line-ending + args: [--fix=lf] + + # Security + - id: detect-aws-credentials + args: ['--allow-missing-credentials'] + - id: detect-private-key + +# JSON5 Linter +- repo: https://github.com/pre-commit/mirrors-prettier + rev: v4.0.0-alpha.8 + hooks: + - id: prettier + files: '.json5$' + +# Terraform Hooks +- repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.94.2 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + hooks: + - id: terraform_fmt + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_docs + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_tflint + name: Terraform validate with tflint + description: Validates all Terraform configuration files with TFLint. + require_serial: true + entry: hooks/terraform_tflint.sh + language: script + files: (\.tf|\.tfvars)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terragrunt_fmt + name: Terragrunt fmt + description: Rewrites all Terragrunt configuration files to a canonical format. + entry: hooks/terragrunt_fmt.sh + language: script + files: (\.hcl)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + ### DISABLED UNTIL MINIFIED TERRAGRUNT.HCL IS CREATED + # - id: terragrunt_validate + # name: Terragrunt validate + # description: Validates all Terragrunt configuration files. + # entry: hooks/terragrunt_validate.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_validate_inputs + # name: Terragrunt validate inputs + # description: Validates Terragrunt unused and undefined inputs. + # entry: hooks/terragrunt_validate_inputs.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_providers_lock + # name: Terragrunt providers lock + # description: Updates provider signatures in dependency lock files using terragrunt. + # entry: hooks/terragrunt_providers_lock.sh + # language: script + # files: (terragrunt|\.terraform\.lock)\.hcl$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + +- repo: https://github.com/ljnsn/cz-conventional-gitmoji + rev: v0.3.3 + hooks: + - id: conventional-gitmoji diff --git a/.releaserc.json b/.releaserc.json new file mode 100644 index 0000000..6e39031 --- /dev/null +++ b/.releaserc.json @@ -0,0 +1,36 @@ +{ + "branches": [ + "main", + "master" + ], + "ci": false, + "plugins": [ + "@semantic-release/commit-analyzer", + "@semantic-release/release-notes-generator", + [ + "@semantic-release/github", + { + "successComment": + "This ${issue.pull_request ? 'PR is included' : 'issue has been resolved'} in version ${nextRelease.version} :tada:", + "labels": false, + "releasedLabels": false + } + ], + [ + "@semantic-release/changelog", + { + "changelogFile": "CHANGELOG.md", + "changelogTitle": "# Changelog\n\nAll notable changes to this project will be documented in this file." + } + ], + [ + "@semantic-release/git", + { + "assets": [ + "CHANGELOG.md" + ], + "message": "chore(release): version ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}" + } + ] + ] +} diff --git a/.terraform-docs.yml b/.terraform-docs.yml new file mode 100644 index 0000000..fabfb8d --- /dev/null +++ b/.terraform-docs.yml @@ -0,0 +1,44 @@ +formatter: markdown table + +header-from: main.tf +footer-from: "" + +sections: +## hide: [] + show: + - data-sources + - header + - footer + - inputs + - modules + - outputs + - providers + - requirements + - resources + +output: + file: README.md + mode: inject + template: |- + + {{ .Content }} + + +output-values: + enabled: false + from: "" + +sort: + enabled: true + by: name + +settings: + anchor: true + color: true + default: true + description: true + escape: true + indent: 2 + required: true + sensitive: true + type: true diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..782fcb9 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,11 @@ + + + + +# CHANGELOG +* 0.0.2 -- 2024-07-30 + - updated docs + - updated images module + - NOTE: this is the single binary deploy, there is a disributed version we can use, different helm chart. +* 0.0.1 -- 2024-07-26 + - Code genesis diff --git a/README.md b/README.md index 1b79198..a5f52ed 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Tempo is an open source distributed tracing backend from Grafana. Tempo supports the major standard tracing protocols like Jaeger, Zipkin and OpenTelemetry, allowing flexibility in implementation for development teams. Traces in microservice contexts are a means to track and observe the flow of requests through the various services and components of the distributed system and are a key means to understanding an applications behavior and optimizing performance. Tempo is being adopted as a replacement to Jaeger Tracing because it uses object storage for trace retention that eliminates the costly dependency of running Jaeger's backend (Cassandra or Elasticsearch). Additionally, Tempo is heavily integrated with the other components of our monitoring and operations stack, Grafana, Prometheus and Loki. "Grafana Tempo lets you scale tracing as far as possible with minimal operational cost and less complexity than ever before." - [Grafana Tempo](https://grafana.com/oss/tempo/) -Tempo depends upon Prometheus because we are enabling the [metrics-generator](https://grafana.com/docs/tempo/latest/metrics-generator/) feature that derives RED (Request, Error and Duration) metrics from spans. Capturing these details allow for far more depth in system analysis. See [tfmod-prometheus](https://github.e.it.census.gov/SCT-Engineering/tfmod-prometheus) for ensuring Prometheus is accessible to Tempo. +Tempo depends upon Prometheus because we are enabling the [metrics-generator](https://grafana.com/docs/tempo/latest/metrics-generator/) feature that derives RED (Request, Error and Duration) metrics from spans. Capturing these details allow for far more depth in system analysis. See [tfmod-prometheus](https://github.e.it.census.gov/SCT-Engineering/tfmod-prometheus) for ensuring Prometheus is accessible to Tempo. #### To enable service graph in Grafana: 1. Add tempo as data-source. @@ -14,11 +14,6 @@ Developer NOTE: We should automate this configuration. - Apps within the cluster should push to `http://tempo.$TEMPO_NAMESPACE:9411/api/v2/spans` - Apps outside the cluster should push to tempo external endpoint e.g. `https://tempo.adsd-cumulus-dev.dev.csp1.census.gov/api/v2/spans`. You need to create the external endpoint, ex. `https://tempo.adsd-cumulus-dev.dev.csp1.census.gov`, it will not be created as part of this module. -# CHANGELOG - -* 0.0.1 -- 2024-07-26 - - Code genesis - ## Requirements @@ -35,9 +30,8 @@ Developer NOTE: We should automate this configuration. | Name | Version | |------|---------| -| [aws](#provider\_aws) | >= 5.14.0 | -| [helm](#provider\_helm) | >= 2.11.0 | -| [kubernetes](#provider\_kubernetes) | >= 2.23.0 | +| [aws](#provider\_aws) | 5.68.0 | +| [helm](#provider\_helm) | 2.15.0 | ## Modules @@ -52,31 +46,29 @@ Developer NOTE: We should automate this configuration. | Name | Type | |------|------| | [helm_release.tempo](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [kubernetes_namespace.ns](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | -| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source | -| [aws_eks_cluster_auth.cluster_auth](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source | | [aws_s3_bucket.s3_server_access_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket) | data source | -| [kubernetes_namespace.existing-ns](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/namespace) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [additional\_tags](#input\_additional\_tags) | Additional tags to add to resources created in AWS (s3 bucket, ...) | `map(string)` | `{}` | no | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | -| [create\_namespace](#input\_create\_namespace) | Indicates whether the `namespace` needs to be created ('true') or already exists (not `true`) | `string` | `"true"` | no | | [namespace](#input\_namespace) | The namespace into which tempo will be deployed | `string` | `"tempo"` | no | +| [oidc\_provider\_arn](#input\_oidc\_provider\_arn) | The ARN in the EKS cluster for the OpenID Connect identity provider. | `string` | n/a | yes | | [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | -| [prometheus\_namespace](#input\_prometheus\_namespace) | Namespace where Prometheus is installed. | `string` | `"log-trace-monitor"` | no | +| [prometheus\_namespace](#input\_prometheus\_namespace) | Namespace where Prometheus is installed. | `string` | `"prometheus"` | no | | [prometheus\_port](#input\_prometheus\_port) | Port number of Prometheus service, mostly either 80 or 9090 | `string` | `"80"` | no | | [prometheus\_svc](#input\_prometheus\_svc) | Prometheus service name. | `string` | `"prometheus-server"` | no | | [region](#input\_region) | The region holding these resources (for the s3 bucket.) | `string` | n/a | yes | | [rwo\_storage\_class](#input\_rwo\_storage\_class) | Specify the storage class for persistent volumes. | `string` | `"gp3-encrypted"` | no | -| [tempo\_chart\_version](#input\_tempo\_chart\_version) | Which version of the grafana/tempo helm chart to use. | `string` | `"1.10.1"` | no | +| [tags](#input\_tags) | Additional tags to add to resources created in AWS (s3 bucket, ...) | `map(string)` | `{}` | no | +| [tempo\_chart\_version](#input\_tempo\_chart\_version) | Which version of the grafana/tempo helm chart to use. | `string` | `"1.10.3"` | no | | [tempo\_tag](#input\_tempo\_tag) | The tag of the tempo image to use. | `string` | `"2.5.0"` | no | ## Outputs -No outputs. - \ No newline at end of file +| Name | Description | +|------|-------------| +| [module\_name](#output\_module\_name) | The name of this module. | +| [module\_version](#output\_module\_version) | The version of this module. | + diff --git a/copy_images.tf b/copy_images.tf index ad0a3ea..bb8baca 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -1,28 +1,28 @@ -locals { - tempo_key = format("%v#%v", "tempo", var.tempo_tag) - - image_config = [ - { - enabled = true - dest_path = null - name = "tempo" - source_image = "grafana/tempo" - source_registry = "docker.io" - source_tag = var.tempo_tag - tag = var.tempo_tag - } - ] -} - -module "images" { - source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade" - - profile = var.profile - application_name = var.cluster_name - image_config = local.image_config - tags = {} - - enable_lifecycle_policy = true - lifecycle_policy_all = true - force_delete = true -} \ No newline at end of file +locals { + tempo_key = format("%v#%v", "tempo", var.tempo_tag) + + image_config = [ + { + enabled = true + dest_path = null + name = "tempo" + source_image = "grafana/tempo" + source_registry = "docker.io" + source_tag = var.tempo_tag + tag = var.tempo_tag + } + ] +} + +module "images" { + source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade" + + profile = var.profile + application_name = var.cluster_name + image_config = local.image_config + tags = {} + + enable_lifecycle_policy = true + lifecycle_policy_all = true + force_delete = true +} diff --git a/examples/simple/main.tf b/examples/simple/main.tf index 61c546e..d56d407 100644 --- a/examples/simple/main.tf +++ b/examples/simple/main.tf @@ -1,69 +1,96 @@ -provider "aws" { - profile = local.profile - region = local.region -} - -provider "helm" { - kubernetes { - host = data.aws_eks_cluster.cluster.endpoint - - cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) - token = data.aws_eks_cluster_auth.cluster.token - } -} - -provider "kubernetes" { - host = data.aws_eks_cluster.cluster.endpoint - - cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) - token = data.aws_eks_cluster_auth.cluster.token -} - -data "aws_eks_cluster" "cluster" { - name = local.cluster_name -} - -data "aws_eks_cluster_auth" "cluster" { - name = local.cluster_name -} - -locals { - region = "us-gov-east-1" - cluster_name = "platform-test-1" - profile = "terraform" - namespace = "monitoring" - create_namespace = "true" - prometheus_namespace = "monitoring" - # Default values should match latest and align with broader platform constructs - # tempo_chart_version = "1.10.1" - # tempo_tag = "2.5.0" - # rwo_storage_class = "gp3-encrypted" - # prometheus_svc = "prometheus-server" - # prometheus_port = "80" - - tags = { - project_number = "fs0000000078" - project_name = "csvd_platformbaseline" - project_role = "csvd_platformbaseline_app" - organization = "census:ocio:csvd" - created_by = "luther.coleman.mcginty@census.gov" - created_for = "luther.coleman.mcginty@census.gov" - created_reason = "Testing eks module operation" - Terraform = "true" - Terragrunt = "true" - tag_costallocation = "csvd:infrastructure" - } - -} - -module "tempo" { - source = "../.." - - region = local.region - cluster_name = local.cluster_name - profile = local.profile - namespace = local.namespace - create_namespace = local.create_namespace - prometheus_namespace = local.prometheus_namespace - additional_tags = local.tags -} +terraform { + required_version = ">= 0.13" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.14.0" + } + helm = { + source = "hashicorp/helm" + version = ">= 2.11.0" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = ">= 2.23.0" + } + null = { + source = "hashicorp/null" + version = ">= 3.2.1" + } + template = { + source = "hashicorp/template" + version = ">= 2.2.0" + } + } +} + +provider "aws" { + profile = local.profile + region = local.region +} + +provider "helm" { + kubernetes { + host = data.aws_eks_cluster.cluster.endpoint + + cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) + token = data.aws_eks_cluster_auth.cluster.token + } +} + +provider "kubernetes" { + host = data.aws_eks_cluster.cluster.endpoint + + cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) + token = data.aws_eks_cluster_auth.cluster.token +} + +data "aws_eks_cluster" "cluster" { + name = local.cluster_name +} + +data "aws_eks_cluster_auth" "cluster" { + name = local.cluster_name +} + +locals { + region = "us-gov-east-1" + cluster_name = "platform-test-1" + profile = "terraform" + namespace = "monitoring" + create_namespace = "true" + prometheus_namespace = "monitoring" + # Default values should match latest and align with broader platform constructs + # tempo_chart_version = "1.10.1" + # tempo_tag = "2.5.0" + # rwo_storage_class = "gp3-encrypted" + # prometheus_svc = "prometheus-server" + # prometheus_port = "80" + + tags = { + project_number = "fs0000000078" + project_name = "csvd_platformbaseline" + project_role = "csvd_platformbaseline_app" + organization = "census:ocio:csvd" + created_by = "luther.coleman.mcginty@census.gov" + created_for = "luther.coleman.mcginty@census.gov" + created_reason = "Testing eks module operation" + Terraform = "true" + Terragrunt = "true" + tag_costallocation = "csvd:infrastructure" + } + +} + +module "tempo" { + source = "../.." + + region = local.region + cluster_name = local.cluster_name + profile = local.profile + namespace = local.namespace + create_namespace = local.create_namespace + prometheus_namespace = local.prometheus_namespace + additional_tags = local.tags +} diff --git a/main.tf b/main.tf index 9415948..fa70175 100644 --- a/main.tf +++ b/main.tf @@ -1,138 +1,91 @@ -data "aws_caller_identity" "current" { -} - -locals { - account_id = data.aws_caller_identity.current.account_id - tags = merge({ - "eks-cluster-name" = var.cluster_name - "boc:tf_module_name" = local._module_name - "boc:tf_module_version" = local._module_version - "boc:created_by" = "terraform" - }, var.additional_tags) - - oidc_arn = var.oidc_provider_arn -} - -module "tempo-irsa-role" { - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-custom-iam-role-for-service-account-eks.git/?ref=1.0.0" - - role_name = "${var.cluster_name}-tempo" - attach_s3_bucket_owner_policy = true - attach_encrypted_object_manager_policy = true - - s3_bucket_arns = [ - module.tempo-s3.s3_bucket_arn, - "${module.tempo-s3.s3_bucket_arn}/*", - ] - kms_key_arns = [ - "${module.tempo-s3.kms_key_arn}" - ] - - oidc_providers = { - main = { - provider_arn = local.oidc_arn - namespace_service_accounts = ["${var.namespace}:tempo"] - } - } - tags = local.tags -} - -resource "helm_release" "tempo" { - chart = "tempo" - version = var.tempo_chart_version - name = "tempo" - namespace = var.namespace - create_namespace = true - repository = "https://grafana.github.io/helm-charts" - values = ["${file("${path.module}/tempo_values.yaml")}"] - - - set { - name = "tempo.storage.trace.backend" - value = "s3" - } - set { - name = "tempo.storage.trace.s3.insecure" - value = "false" - } - # Doesn't pass correctly, moved to values.yaml - # set { - # name = "tempo.extraEnv[0].name" - # value = "JAEGER_AGENT_PORT" - # } - # set { - # name = "tempo.extraEnv[0].value" - # value = "9411" - # } - set { - name = "tempo.metricsGenerator.enabled" - value = "true" - } - set { - name = "tempo.reportingEnabled" - value = "false" - } - set { - name = "tempo.serviceAccount.create" - value = "true" - } - set { - name = "tempo.serviceAccount.name" - value = "tempo" - } - - set { - name = "tempo.persistence.enabled" - value = "true" - } - set { - name = "tempo.persistence.accessModes[0]" - value = "ReadWriteOnce" - } - set { - name = "tempo.persistence.size" - value = "10Gi" - } - set { - name = "replicas" - value = "3" - } - set { - name = "tempo.repository" - value = format("%v/%v", - module.images.images[local.tempo_key].dest_registry, - module.images.images[local.tempo_key].dest_repository - ) - } - set { - name = "tempo.tag" - value = var.tempo_tag - } - set { - name = "tempo.storage.trace.s3.bucket" - value = module.tempo-s3.s3_bucket_id - } - set { - name = "tempo.storage.trace.s3.endpoint" - value = "s3.${var.region}.amazonaws.com" - } - set { - name = "tempo.metricsGenerator.remoteWriteUrl" - value = "http://${var.prometheus_svc}.${var.prometheus_namespace}:${var.prometheus_port}/api/v1/write" - } - # Causes an error with the app, moving to values.yaml - # set { - # name = "tempo.receivers.zipkin" - # value = "" - # } - set { - name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn" - value = module.tempo-irsa-role.iam_role_arn - } - set { - name = "persistence.storageClassName" - value = var.rwo_storage_class - } - - timeout = 60 -} \ No newline at end of file +locals { + oidc_arn = var.oidc_provider_arn + tags = var.tags +} + +################################################################################ +# IRSA Role for Tempo +################################################################################ +module "tempo-irsa-role" { + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-custom-iam-role-for-service-account-eks.git/?ref=1.0.0" + + role_name = "${var.cluster_name}-tempo" + attach_s3_bucket_owner_policy = true + attach_encrypted_object_manager_policy = true + + s3_bucket_arns = [ + module.tempo-s3.s3_bucket_arn, + "${module.tempo-s3.s3_bucket_arn}/*", + ] + kms_key_arns = [ + module.tempo-s3.kms_key_arn + ] + + oidc_providers = { + main = { + provider_arn = local.oidc_arn + namespace_service_accounts = ["${var.namespace}:tempo"] + } + } + tags = local.tags +} + +################################################################################ +# Helm Chart for Tempo +################################################################################ +resource "helm_release" "tempo" { + chart = "tempo" + version = var.tempo_chart_version + name = "tempo" + namespace = var.namespace + create_namespace = true + repository = "https://grafana.github.io/helm-charts" + values = [file("${path.module}/tempo_values.yaml")] + + + # set { + # name = "tempo.storage.trace.backend" + # value = "s3" + # } + # set { + # name = "tempo.storage.trace.s3.insecure" + # value = "false" + # } + # set { + # name = "replicas" + # value = "3" + # } + set { + name = "tempo.repository" + value = format("%v/%v", + module.images.images[local.tempo_key].dest_registry, + module.images.images[local.tempo_key].dest_repository + ) + } + set { + name = "tempo.tag" + value = var.tempo_tag + } + set { + name = "tempo.storage.trace.s3.bucket" + value = module.tempo-s3.s3_bucket_id + } + # set { + # name = "tempo.storage.trace.s3.endpoint" + # value = "s3.${var.region}.amazonaws.com" + # } + set { + name = "tempo.metricsGenerator.remoteWriteUrl" + value = "http://${var.prometheus_svc}.${var.prometheus_namespace}:${var.prometheus_port}/api/v1/write" + } + set { + name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn" + value = module.tempo-irsa-role.iam_role_arn + } + set { + name = "persistence.storageClassName" + value = var.rwo_storage_class + } + + timeout = 60 +} diff --git a/outputs.tf b/outputs.tf new file mode 100644 index 0000000..b999ac9 --- /dev/null +++ b/outputs.tf @@ -0,0 +1,13 @@ +################################################################################ +# Module information +################################################################################ + +output "module_name" { + description = "The name of this module." + value = local.module_name +} + +output "module_version" { + description = "The version of this module." + value = local.module_version +} diff --git a/requirements.tf b/requirements.tf index a376988..1b7a5da 100644 --- a/requirements.tf +++ b/requirements.tf @@ -1,26 +1,26 @@ -terraform { - required_version = ">= 0.13" - - required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 5.14.0" - } - helm = { - source = "hashicorp/helm" - version = ">= 2.11.0" - } - kubernetes = { - source = "hashicorp/kubernetes" - version = ">= 2.23.0" - } - null = { - source = "hashicorp/null" - version = ">= 3.2.1" - } - template = { - source = "hashicorp/template" - version = ">= 2.2.0" - } - } -} \ No newline at end of file +terraform { + required_version = ">= 0.13" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.14.0" + } + helm = { + source = "hashicorp/helm" + version = ">= 2.11.0" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = ">= 2.23.0" + } + null = { + source = "hashicorp/null" + version = ">= 3.2.1" + } + template = { + source = "hashicorp/template" + version = ">= 2.2.0" + } + } +} diff --git a/s3.tf b/s3.tf index b64ddc5..498fa70 100644 --- a/s3.tf +++ b/s3.tf @@ -1,14 +1,14 @@ -## create bucket - -data "aws_s3_bucket" "s3_server_access_logs" { - bucket = format("inf-logs-%v-%v", local.account_id, var.region) -} - -module "tempo-s3" { - source = "git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard?ref=tf-upgrade" - - bucket_name = format("%v-tempo", var.cluster_name) - access_log_bucket = data.aws_s3_bucket.s3_server_access_logs.id - - tags = local.tags -} \ No newline at end of file +## create bucket + +data "aws_s3_bucket" "s3_server_access_logs" { + bucket = format("inf-logs-%v-%v", local.account_id, var.region) +} + +module "tempo-s3" { + source = "git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard?ref=tf-upgrade" + + bucket_name = format("%v-tempo", var.cluster_name) + access_log_bucket = data.aws_s3_bucket.s3_server_access_logs.id + + tags = local.tags +} diff --git a/tempo_values.yaml b/tempo_values.yaml index c6f525c..f9aaa61 100644 --- a/tempo_values.yaml +++ b/tempo_values.yaml @@ -1,29 +1,44 @@ -tempo: - # storage: - # trace: - # backend: s3 - # s3: - # insecure: false - extraEnv: - - name: JAEGER_AGENT_PORT - value: "9411" - receivers: - zipkin: -# metricsGenerator: -# enabled: true -# reportingEnabled: false - -# serviceAccount: -# create: true -# name: "tempo" - -# persistence: -# enabled: true -# accessModes: -# - ReadWriteOnce -# size: 10Gi - - # set { - # name = "tempo.receivers.zipkin[]" - # value = "" - # } \ No newline at end of file +tempo: + storage: + trace: + backend: s3 + s3: + insecure: false + extraEnv: + - name: JAEGER_AGENT_PORT + value: "9411" + metricsGenerator: + enabled: true + reportingEnabled: false + +serviceAccount: + create: true + name: "tempo" + +persistence: + enabled: true + accessModes: + - ReadWriteOnce + size: 10Gi + +ingester: + autoscaling: + enabled: true +distributor: + autoscaling: + enabled: true +compactor: + autoscaling: + enabled: true +querier: + autoscaling: + enabled: true +gateway: + autoscaling: + enabled: true + +traces: + jaeger: + zipkin: + # -- Enable Tempo to ingest Zipkin traces + enabled: true diff --git a/variables.tf b/variables.tf index 0f7b0d1..ce7152f 100644 --- a/variables.tf +++ b/variables.tf @@ -1,75 +1,69 @@ -variable "additional_tags" { - description = "Additional tags to add to resources created in AWS (s3 bucket, ...)" - type = map(string) - default = {} -} - -variable "region" { - description = "The region holding these resources (for the s3 bucket.)" - type = string -} - -variable "cluster_name" { - description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)" - type = string -} - -variable "profile" { - description = "AWS config profile used to upload images into ECR" - type = string - default = "" -} - -variable "namespace" { - description = "The namespace into which tempo will be deployed" - type = string - default = "tempo" -} - -variable "create_namespace" { - description = "Indicates whether the `namespace` needs to be created ('true') or already exists (not `true`)" - type = string - default = "true" -} - -variable "rwo_storage_class" { - description = "Specify the storage class for persistent volumes." - type = string - default = "gp3-encrypted" -} - -variable "tempo_chart_version" { - description = "Which version of the grafana/tempo helm chart to use." - type = string - default = "1.10.1" -} - -variable "tempo_tag" { - description = "The tag of the tempo image to use." - type = string - default = "2.5.0" -} - -variable "oidc_provider_arn" { - description = "The ARN in the EKS cluster for the OpenID Connect identity provider." - type = string -} - -# Prometheus data for metrics generator -variable "prometheus_svc" { - description = "Prometheus service name." - type = string - default = "prometheus-server" -} - -variable "prometheus_namespace" { - description = "Namespace where Prometheus is installed." - type = string - default = "log-trace-monitor" -} - -variable "prometheus_port" { - description = "Port number of Prometheus service, mostly either 80 or 9090" - type = string - default = "80" -} \ No newline at end of file +variable "tags" { + description = "Additional tags to add to resources created in AWS (s3 bucket, ...)" + type = map(string) + default = {} +} + +variable "region" { + description = "The region holding these resources (for the s3 bucket.)" + type = string +} + +variable "cluster_name" { + description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)" + type = string +} + +variable "profile" { + description = "AWS config profile used to upload images into ECR" + type = string + default = "" +} + +variable "namespace" { + description = "The namespace into which tempo will be deployed" + type = string + default = "tempo" +} + +variable "oidc_provider_arn" { + description = "The ARN in the EKS cluster for the OpenID Connect identity provider." + type = string +} + +variable "rwo_storage_class" { + description = "Specify the storage class for persistent volumes." + type = string + default = "gp3-encrypted" +} + +variable "tempo_chart_version" { + description = "Which version of the grafana/tempo helm chart to use." + type = string + default = "1.10.3" +} + +variable "tempo_tag" { + description = "The tag of the tempo image to use." + type = string + default = "2.5.0" +} + +# Prometheus data for metrics generator +variable "prometheus_svc" { + description = "Prometheus service name." + type = string + default = "prometheus-server" +} + +variable "prometheus_namespace" { + description = "Namespace where Prometheus is installed." + type = string + default = "prometheus" +} + +variable "prometheus_port" { + description = "Port number of Prometheus service, mostly either 80 or 9090" + type = string + default = "80" +} diff --git a/version.tf b/version.tf index 69fa819..2b79747 100644 --- a/version.tf +++ b/version.tf @@ -1,4 +1,4 @@ -locals { - _module_name = "tfmod-tempo" - _module_version = "0.0.1" -} \ No newline at end of file +locals { + module_name = "tfmod-tempo" + module_version = "0.0.1" +}