From f29327cf9b2d7be6c2dbd1fe474b56ea31b26394 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 20 Sep 2024 00:25:10 -0400 Subject: [PATCH 1/6] moved settings into yaml --- .pre-commit-config.yaml | 99 +++++++++++++++++ main.tf | 228 ++++++++++++++++------------------------ tempo_values.yaml | 73 ++++++++----- 3 files changed, 233 insertions(+), 167 deletions(-) create mode 100644 .pre-commit-config.yaml diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..3d8476f --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,99 @@ +repos: +- repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.6.0 + hooks: + # Git style + - id: check-added-large-files + - id: check-merge-conflict + - id: check-vcs-permalinks + - id: forbid-new-submodules + - id: no-commit-to-branch + + # Common errors + - id: end-of-file-fixer + - id: trailing-whitespace + args: [--markdown-linebreak-ext=md] + exclude: CHANGELOG.md + - id: check-yaml + - id: check-merge-conflict + - id: check-executables-have-shebangs + + # Cross platform + - id: check-case-conflict + - id: mixed-line-ending + args: [--fix=lf] + + # Security + - id: detect-aws-credentials + args: ['--allow-missing-credentials'] + - id: detect-private-key + +# JSON5 Linter +- repo: https://github.com/pre-commit/mirrors-prettier + rev: v4.0.0-alpha.8 + hooks: + - id: prettier + files: '.json5$' + +# Terraform Hooks +- repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.92.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + hooks: + - id: terraform_fmt + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_docs + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terraform_tflint + name: Terraform validate with tflint + description: Validates all Terraform configuration files with TFLint. + require_serial: true + entry: hooks/terraform_tflint.sh + language: script + files: (\.tf|\.tfvars)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + - id: terragrunt_fmt + name: Terragrunt fmt + description: Rewrites all Terragrunt configuration files to a canonical format. + entry: hooks/terragrunt_fmt.sh + language: script + files: (\.hcl)$ + exclude: \.(terraform/.*|terragrunt-cache)$ + args: + - --hook-config=--parallelism-ci-cpu-cores=2 + ### DISABLED UNTIL MINIFIED TERRAGRUNT.HCL IS CREATED + # - id: terragrunt_validate + # name: Terragrunt validate + # description: Validates all Terragrunt configuration files. + # entry: hooks/terragrunt_validate.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_validate_inputs + # name: Terragrunt validate inputs + # description: Validates Terragrunt unused and undefined inputs. + # entry: hooks/terragrunt_validate_inputs.sh + # language: script + # files: (\.hcl)$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + # - id: terragrunt_providers_lock + # name: Terragrunt providers lock + # description: Updates provider signatures in dependency lock files using terragrunt. + # entry: hooks/terragrunt_providers_lock.sh + # language: script + # files: (terragrunt|\.terraform\.lock)\.hcl$ + # exclude: \.(terraform/.*|terragrunt-cache)$ + # args: + # - --hook-config=--parallelism-ci-cpu-cores=2 + +- repo: https://github.com/ljnsn/cz-conventional-gitmoji + rev: v0.3.2 + hooks: + - id: conventional-gitmoji diff --git a/main.tf b/main.tf index 9415948..1066736 100644 --- a/main.tf +++ b/main.tf @@ -1,138 +1,90 @@ -data "aws_caller_identity" "current" { -} - -locals { - account_id = data.aws_caller_identity.current.account_id - tags = merge({ - "eks-cluster-name" = var.cluster_name - "boc:tf_module_name" = local._module_name - "boc:tf_module_version" = local._module_version - "boc:created_by" = "terraform" - }, var.additional_tags) - - oidc_arn = var.oidc_provider_arn -} - -module "tempo-irsa-role" { - source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-custom-iam-role-for-service-account-eks.git/?ref=1.0.0" - - role_name = "${var.cluster_name}-tempo" - attach_s3_bucket_owner_policy = true - attach_encrypted_object_manager_policy = true - - s3_bucket_arns = [ - module.tempo-s3.s3_bucket_arn, - "${module.tempo-s3.s3_bucket_arn}/*", - ] - kms_key_arns = [ - "${module.tempo-s3.kms_key_arn}" - ] - - oidc_providers = { - main = { - provider_arn = local.oidc_arn - namespace_service_accounts = ["${var.namespace}:tempo"] - } - } - tags = local.tags -} - -resource "helm_release" "tempo" { - chart = "tempo" - version = var.tempo_chart_version - name = "tempo" - namespace = var.namespace - create_namespace = true - repository = "https://grafana.github.io/helm-charts" - values = ["${file("${path.module}/tempo_values.yaml")}"] - - - set { - name = "tempo.storage.trace.backend" - value = "s3" - } - set { - name = "tempo.storage.trace.s3.insecure" - value = "false" - } - # Doesn't pass correctly, moved to values.yaml - # set { - # name = "tempo.extraEnv[0].name" - # value = "JAEGER_AGENT_PORT" - # } - # set { - # name = "tempo.extraEnv[0].value" - # value = "9411" - # } - set { - name = "tempo.metricsGenerator.enabled" - value = "true" - } - set { - name = "tempo.reportingEnabled" - value = "false" - } - set { - name = "tempo.serviceAccount.create" - value = "true" - } - set { - name = "tempo.serviceAccount.name" - value = "tempo" - } - - set { - name = "tempo.persistence.enabled" - value = "true" - } - set { - name = "tempo.persistence.accessModes[0]" - value = "ReadWriteOnce" - } - set { - name = "tempo.persistence.size" - value = "10Gi" - } - set { - name = "replicas" - value = "3" - } - set { - name = "tempo.repository" - value = format("%v/%v", - module.images.images[local.tempo_key].dest_registry, - module.images.images[local.tempo_key].dest_repository - ) - } - set { - name = "tempo.tag" - value = var.tempo_tag - } - set { - name = "tempo.storage.trace.s3.bucket" - value = module.tempo-s3.s3_bucket_id - } - set { - name = "tempo.storage.trace.s3.endpoint" - value = "s3.${var.region}.amazonaws.com" - } - set { - name = "tempo.metricsGenerator.remoteWriteUrl" - value = "http://${var.prometheus_svc}.${var.prometheus_namespace}:${var.prometheus_port}/api/v1/write" - } - # Causes an error with the app, moving to values.yaml - # set { - # name = "tempo.receivers.zipkin" - # value = "" - # } - set { - name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn" - value = module.tempo-irsa-role.iam_role_arn - } - set { - name = "persistence.storageClassName" - value = var.rwo_storage_class - } - - timeout = 60 -} \ No newline at end of file +locals { + oidc_arn = var.oidc_provider_arn +} + +################################################################################ +# IRSA Role for Tempo +################################################################################ +module "tempo-irsa-role" { + source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-custom-iam-role-for-service-account-eks.git/?ref=1.0.0" + + role_name = "${var.cluster_name}-tempo" + attach_s3_bucket_owner_policy = true + attach_encrypted_object_manager_policy = true + + s3_bucket_arns = [ + module.tempo-s3.s3_bucket_arn, + "${module.tempo-s3.s3_bucket_arn}/*", + ] + kms_key_arns = [ + "${module.tempo-s3.kms_key_arn}" + ] + + oidc_providers = { + main = { + provider_arn = local.oidc_arn + namespace_service_accounts = ["${var.namespace}:tempo"] + } + } + tags = local.tags +} + +################################################################################ +# Helm Chart for Tempo +################################################################################ +resource "helm_release" "tempo" { + chart = "tempo" + version = var.tempo_chart_version + name = "tempo" + namespace = var.namespace + create_namespace = true + repository = "https://grafana.github.io/helm-charts" + values = ["${file("${path.module}/tempo_values.yaml")}"] + + + set { + name = "tempo.storage.trace.backend" + value = "s3" + } + set { + name = "tempo.storage.trace.s3.insecure" + value = "false" + } + set { + name = "replicas" + value = "3" + } + set { + name = "tempo.repository" + value = format("%v/%v", + module.images.images[local.tempo_key].dest_registry, + module.images.images[local.tempo_key].dest_repository + ) + } + set { + name = "tempo.tag" + value = var.tempo_tag + } + set { + name = "tempo.storage.trace.s3.bucket" + value = module.tempo-s3.s3_bucket_id + } + # set { + # name = "tempo.storage.trace.s3.endpoint" + # value = "s3.${var.region}.amazonaws.com" + # } + set { + name = "tempo.metricsGenerator.remoteWriteUrl" + value = "http://${var.prometheus_svc}.${var.prometheus_namespace}:${var.prometheus_port}/api/v1/write" + } + set { + name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn" + value = module.tempo-irsa-role.iam_role_arn + } + set { + name = "persistence.storageClassName" + value = var.rwo_storage_class + } + + timeout = 60 +} diff --git a/tempo_values.yaml b/tempo_values.yaml index c6f525c..f9aaa61 100644 --- a/tempo_values.yaml +++ b/tempo_values.yaml @@ -1,29 +1,44 @@ -tempo: - # storage: - # trace: - # backend: s3 - # s3: - # insecure: false - extraEnv: - - name: JAEGER_AGENT_PORT - value: "9411" - receivers: - zipkin: -# metricsGenerator: -# enabled: true -# reportingEnabled: false - -# serviceAccount: -# create: true -# name: "tempo" - -# persistence: -# enabled: true -# accessModes: -# - ReadWriteOnce -# size: 10Gi - - # set { - # name = "tempo.receivers.zipkin[]" - # value = "" - # } \ No newline at end of file +tempo: + storage: + trace: + backend: s3 + s3: + insecure: false + extraEnv: + - name: JAEGER_AGENT_PORT + value: "9411" + metricsGenerator: + enabled: true + reportingEnabled: false + +serviceAccount: + create: true + name: "tempo" + +persistence: + enabled: true + accessModes: + - ReadWriteOnce + size: 10Gi + +ingester: + autoscaling: + enabled: true +distributor: + autoscaling: + enabled: true +compactor: + autoscaling: + enabled: true +querier: + autoscaling: + enabled: true +gateway: + autoscaling: + enabled: true + +traces: + jaeger: + zipkin: + # -- Enable Tempo to ingest Zipkin traces + enabled: true From 1ff3e8e62b326335423f716ce8051eb1a6a70203 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 26 Jul 2024 21:20:46 -0400 Subject: [PATCH 2/6] add _module_providers --- version.tf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/version.tf b/version.tf index 69fa819..ce92014 100644 --- a/version.tf +++ b/version.tf @@ -1,4 +1,5 @@ locals { _module_name = "tfmod-tempo" _module_version = "0.0.1" -} \ No newline at end of file + _module_providers = ["helm", "kubernetes"] +} From d2c5c9e512cc9b8094d140b47a1882b371e607b1 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 30 Jul 2024 20:56:11 -0400 Subject: [PATCH 3/6] updates --- README.md | 15 +++++++++------ outputs.tf | 13 +++++++++++++ version.tf | 1 - 3 files changed, 22 insertions(+), 7 deletions(-) create mode 100644 outputs.tf diff --git a/README.md b/README.md index 1b79198..7b10c78 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,10 @@ Developer NOTE: We should automate this configuration. - Apps outside the cluster should push to tempo external endpoint e.g. `https://tempo.adsd-cumulus-dev.dev.csp1.census.gov/api/v2/spans`. You need to create the external endpoint, ex. `https://tempo.adsd-cumulus-dev.dev.csp1.census.gov`, it will not be created as part of this module. # CHANGELOG - +* 0.0.2 -- 2024-07-30 + - updated docs + - updated images module + - * 0.0.1 -- 2024-07-26 - Code genesis @@ -37,7 +40,6 @@ Developer NOTE: We should automate this configuration. |------|---------| | [aws](#provider\_aws) | >= 5.14.0 | | [helm](#provider\_helm) | >= 2.11.0 | -| [kubernetes](#provider\_kubernetes) | >= 2.23.0 | ## Modules @@ -52,12 +54,10 @@ Developer NOTE: We should automate this configuration. | Name | Type | |------|------| | [helm_release.tempo](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [kubernetes_namespace.ns](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source | | [aws_eks_cluster_auth.cluster_auth](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source | | [aws_s3_bucket.s3_server_access_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket) | data source | -| [kubernetes_namespace.existing-ns](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/namespace) | data source | ## Inputs @@ -78,5 +78,8 @@ Developer NOTE: We should automate this configuration. ## Outputs -No outputs. - \ No newline at end of file +| Name | Description | +|------|-------------| +| [module\_name](#output\_module\_name) | The name of this module. | +| [module\_version](#output\_module\_version) | The version of this module. | + diff --git a/outputs.tf b/outputs.tf new file mode 100644 index 0000000..0349496 --- /dev/null +++ b/outputs.tf @@ -0,0 +1,13 @@ +################################################################################ +# Module information +################################################################################ + +output "module_name" { + description = "The name of this module." + value = local._module_name +} + +output "module_version" { + description = "The version of this module." + value = local._module_version +} diff --git a/version.tf b/version.tf index ce92014..de67d08 100644 --- a/version.tf +++ b/version.tf @@ -1,5 +1,4 @@ locals { _module_name = "tfmod-tempo" _module_version = "0.0.1" - _module_providers = ["helm", "kubernetes"] } From 3eb179b3e8e64abca4de9424cfb628dec82136f8 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Tue, 30 Jul 2024 22:44:31 -0400 Subject: [PATCH 4/6] update notes --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 7b10c78..e77bf47 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,7 @@ Developer NOTE: We should automate this configuration. * 0.0.2 -- 2024-07-30 - updated docs - updated images module - - + - NOTE: this is the single binary deploy, there is a disributed version we can use, different helm chart. * 0.0.1 -- 2024-07-26 - Code genesis From a05a4a4620a30e28c2995d739ddc51c053f2e431 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Fri, 20 Sep 2024 00:43:13 -0400 Subject: [PATCH 5/6] moved settings into yaml --- .cz.yaml | 8 ++ .gitignore | 80 +++++++++---------- .pre-commit-config.yaml | 4 +- .releaserc.json | 36 +++++++++ .terraform-docs.yml | 44 +++++++++++ CHANGELOG.md | 11 +++ README.md | 25 ++---- copy_images.tf | 56 +++++++------- examples/simple/main.tf | 165 +++++++++++++++++++++++----------------- main.tf | 29 +++---- requirements.tf | 52 ++++++------- s3.tf | 28 +++---- variables.tf | 144 +++++++++++++++++------------------ version.tf | 8 +- 14 files changed, 400 insertions(+), 290 deletions(-) create mode 100644 .cz.yaml create mode 100644 .releaserc.json create mode 100644 .terraform-docs.yml create mode 100644 CHANGELOG.md diff --git a/.cz.yaml b/.cz.yaml new file mode 100644 index 0000000..b1981ec --- /dev/null +++ b/.cz.yaml @@ -0,0 +1,8 @@ +--- +commitizen: + major_version_zero: true + name: cz_gitmoji + tag_format: $version + update_changelog_on_bump: true + version_provider: scm + version_scheme: semver2 diff --git a/.gitignore b/.gitignore index da5e96c..03d66da 100644 --- a/.gitignore +++ b/.gitignore @@ -1,40 +1,40 @@ -# Local .terraform directories -**/.terraform/* - -# terraform lock file. -**/.terraform.lock.hcl - -# .tfstate files -*.tfstate -*.tfstate.* - -# Crash log files -crash.log -crash.*.log - -# Exclude all .tfvars files, which are likely to contain sensitive data, -# such as password, private keys, and other secrets. These should not be -# part of version control as they are data points which are potentially -# sensitive and subject to change depending on the environment. -*.tfvars -*.tfvars.json - -# Ignore override files as they are usually used to override resources -# locally and so are not checked in -override.tf -override.tf.json -*_override.tf -*_override.tf.json - -# Include override files you do wish to add to version control using negated pattern -# !example_override.tf - -# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan -# example: *tfplan* - -# Ignore CLI configuration files -.terraformrc -terraform.rc - -# It's a module, shouldn't have a providers.tf -provider*.tf +# Local .terraform directories +**/.terraform/* + +# terraform lock file. +**/.terraform.lock.hcl + +# .tfstate files +*.tfstate +*.tfstate.* + +# Crash log files +crash.log +crash.*.log + +# Exclude all .tfvars files, which are likely to contain sensitive data, +# such as password, private keys, and other secrets. These should not be +# part of version control as they are data points which are potentially +# sensitive and subject to change depending on the environment. +*.tfvars +*.tfvars.json + +# Ignore override files as they are usually used to override resources +# locally and so are not checked in +override.tf +override.tf.json +*_override.tf +*_override.tf.json + +# Include override files you do wish to add to version control using negated pattern +# !example_override.tf + +# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan +# example: *tfplan* + +# Ignore CLI configuration files +.terraformrc +terraform.rc + +# It's a module, shouldn't have a providers.tf +provider*.tf diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 3d8476f..59ee012 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -37,7 +37,7 @@ repos: # Terraform Hooks - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.92.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + rev: v1.94.2 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases hooks: - id: terraform_fmt args: @@ -94,6 +94,6 @@ repos: # - --hook-config=--parallelism-ci-cpu-cores=2 - repo: https://github.com/ljnsn/cz-conventional-gitmoji - rev: v0.3.2 + rev: v0.3.3 hooks: - id: conventional-gitmoji diff --git a/.releaserc.json b/.releaserc.json new file mode 100644 index 0000000..6e39031 --- /dev/null +++ b/.releaserc.json @@ -0,0 +1,36 @@ +{ + "branches": [ + "main", + "master" + ], + "ci": false, + "plugins": [ + "@semantic-release/commit-analyzer", + "@semantic-release/release-notes-generator", + [ + "@semantic-release/github", + { + "successComment": + "This ${issue.pull_request ? 'PR is included' : 'issue has been resolved'} in version ${nextRelease.version} :tada:", + "labels": false, + "releasedLabels": false + } + ], + [ + "@semantic-release/changelog", + { + "changelogFile": "CHANGELOG.md", + "changelogTitle": "# Changelog\n\nAll notable changes to this project will be documented in this file." + } + ], + [ + "@semantic-release/git", + { + "assets": [ + "CHANGELOG.md" + ], + "message": "chore(release): version ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}" + } + ] + ] +} diff --git a/.terraform-docs.yml b/.terraform-docs.yml new file mode 100644 index 0000000..fabfb8d --- /dev/null +++ b/.terraform-docs.yml @@ -0,0 +1,44 @@ +formatter: markdown table + +header-from: main.tf +footer-from: "" + +sections: +## hide: [] + show: + - data-sources + - header + - footer + - inputs + - modules + - outputs + - providers + - requirements + - resources + +output: + file: README.md + mode: inject + template: |- + + {{ .Content }} + + +output-values: + enabled: false + from: "" + +sort: + enabled: true + by: name + +settings: + anchor: true + color: true + default: true + description: true + escape: true + indent: 2 + required: true + sensitive: true + type: true diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..782fcb9 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,11 @@ + + + + +# CHANGELOG +* 0.0.2 -- 2024-07-30 + - updated docs + - updated images module + - NOTE: this is the single binary deploy, there is a disributed version we can use, different helm chart. +* 0.0.1 -- 2024-07-26 + - Code genesis diff --git a/README.md b/README.md index e77bf47..a5f52ed 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Tempo is an open source distributed tracing backend from Grafana. Tempo supports the major standard tracing protocols like Jaeger, Zipkin and OpenTelemetry, allowing flexibility in implementation for development teams. Traces in microservice contexts are a means to track and observe the flow of requests through the various services and components of the distributed system and are a key means to understanding an applications behavior and optimizing performance. Tempo is being adopted as a replacement to Jaeger Tracing because it uses object storage for trace retention that eliminates the costly dependency of running Jaeger's backend (Cassandra or Elasticsearch). Additionally, Tempo is heavily integrated with the other components of our monitoring and operations stack, Grafana, Prometheus and Loki. "Grafana Tempo lets you scale tracing as far as possible with minimal operational cost and less complexity than ever before." - [Grafana Tempo](https://grafana.com/oss/tempo/) -Tempo depends upon Prometheus because we are enabling the [metrics-generator](https://grafana.com/docs/tempo/latest/metrics-generator/) feature that derives RED (Request, Error and Duration) metrics from spans. Capturing these details allow for far more depth in system analysis. See [tfmod-prometheus](https://github.e.it.census.gov/SCT-Engineering/tfmod-prometheus) for ensuring Prometheus is accessible to Tempo. +Tempo depends upon Prometheus because we are enabling the [metrics-generator](https://grafana.com/docs/tempo/latest/metrics-generator/) feature that derives RED (Request, Error and Duration) metrics from spans. Capturing these details allow for far more depth in system analysis. See [tfmod-prometheus](https://github.e.it.census.gov/SCT-Engineering/tfmod-prometheus) for ensuring Prometheus is accessible to Tempo. #### To enable service graph in Grafana: 1. Add tempo as data-source. @@ -14,14 +14,6 @@ Developer NOTE: We should automate this configuration. - Apps within the cluster should push to `http://tempo.$TEMPO_NAMESPACE:9411/api/v2/spans` - Apps outside the cluster should push to tempo external endpoint e.g. `https://tempo.adsd-cumulus-dev.dev.csp1.census.gov/api/v2/spans`. You need to create the external endpoint, ex. `https://tempo.adsd-cumulus-dev.dev.csp1.census.gov`, it will not be created as part of this module. -# CHANGELOG -* 0.0.2 -- 2024-07-30 - - updated docs - - updated images module - - NOTE: this is the single binary deploy, there is a disributed version we can use, different helm chart. -* 0.0.1 -- 2024-07-26 - - Code genesis - ## Requirements @@ -38,8 +30,8 @@ Developer NOTE: We should automate this configuration. | Name | Version | |------|---------| -| [aws](#provider\_aws) | >= 5.14.0 | -| [helm](#provider\_helm) | >= 2.11.0 | +| [aws](#provider\_aws) | 5.68.0 | +| [helm](#provider\_helm) | 2.15.0 | ## Modules @@ -54,26 +46,23 @@ Developer NOTE: We should automate this configuration. | Name | Type | |------|------| | [helm_release.tempo](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source | -| [aws_eks_cluster_auth.cluster_auth](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source | | [aws_s3_bucket.s3_server_access_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| [additional\_tags](#input\_additional\_tags) | Additional tags to add to resources created in AWS (s3 bucket, ...) | `map(string)` | `{}` | no | | [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes | -| [create\_namespace](#input\_create\_namespace) | Indicates whether the `namespace` needs to be created ('true') or already exists (not `true`) | `string` | `"true"` | no | | [namespace](#input\_namespace) | The namespace into which tempo will be deployed | `string` | `"tempo"` | no | +| [oidc\_provider\_arn](#input\_oidc\_provider\_arn) | The ARN in the EKS cluster for the OpenID Connect identity provider. | `string` | n/a | yes | | [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no | -| [prometheus\_namespace](#input\_prometheus\_namespace) | Namespace where Prometheus is installed. | `string` | `"log-trace-monitor"` | no | +| [prometheus\_namespace](#input\_prometheus\_namespace) | Namespace where Prometheus is installed. | `string` | `"prometheus"` | no | | [prometheus\_port](#input\_prometheus\_port) | Port number of Prometheus service, mostly either 80 or 9090 | `string` | `"80"` | no | | [prometheus\_svc](#input\_prometheus\_svc) | Prometheus service name. | `string` | `"prometheus-server"` | no | | [region](#input\_region) | The region holding these resources (for the s3 bucket.) | `string` | n/a | yes | | [rwo\_storage\_class](#input\_rwo\_storage\_class) | Specify the storage class for persistent volumes. | `string` | `"gp3-encrypted"` | no | -| [tempo\_chart\_version](#input\_tempo\_chart\_version) | Which version of the grafana/tempo helm chart to use. | `string` | `"1.10.1"` | no | +| [tags](#input\_tags) | Additional tags to add to resources created in AWS (s3 bucket, ...) | `map(string)` | `{}` | no | +| [tempo\_chart\_version](#input\_tempo\_chart\_version) | Which version of the grafana/tempo helm chart to use. | `string` | `"1.10.3"` | no | | [tempo\_tag](#input\_tempo\_tag) | The tag of the tempo image to use. | `string` | `"2.5.0"` | no | ## Outputs diff --git a/copy_images.tf b/copy_images.tf index ad0a3ea..bb8baca 100644 --- a/copy_images.tf +++ b/copy_images.tf @@ -1,28 +1,28 @@ -locals { - tempo_key = format("%v#%v", "tempo", var.tempo_tag) - - image_config = [ - { - enabled = true - dest_path = null - name = "tempo" - source_image = "grafana/tempo" - source_registry = "docker.io" - source_tag = var.tempo_tag - tag = var.tempo_tag - } - ] -} - -module "images" { - source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade" - - profile = var.profile - application_name = var.cluster_name - image_config = local.image_config - tags = {} - - enable_lifecycle_policy = true - lifecycle_policy_all = true - force_delete = true -} \ No newline at end of file +locals { + tempo_key = format("%v#%v", "tempo", var.tempo_tag) + + image_config = [ + { + enabled = true + dest_path = null + name = "tempo" + source_image = "grafana/tempo" + source_registry = "docker.io" + source_tag = var.tempo_tag + tag = var.tempo_tag + } + ] +} + +module "images" { + source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade" + + profile = var.profile + application_name = var.cluster_name + image_config = local.image_config + tags = {} + + enable_lifecycle_policy = true + lifecycle_policy_all = true + force_delete = true +} diff --git a/examples/simple/main.tf b/examples/simple/main.tf index 61c546e..d56d407 100644 --- a/examples/simple/main.tf +++ b/examples/simple/main.tf @@ -1,69 +1,96 @@ -provider "aws" { - profile = local.profile - region = local.region -} - -provider "helm" { - kubernetes { - host = data.aws_eks_cluster.cluster.endpoint - - cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) - token = data.aws_eks_cluster_auth.cluster.token - } -} - -provider "kubernetes" { - host = data.aws_eks_cluster.cluster.endpoint - - cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) - token = data.aws_eks_cluster_auth.cluster.token -} - -data "aws_eks_cluster" "cluster" { - name = local.cluster_name -} - -data "aws_eks_cluster_auth" "cluster" { - name = local.cluster_name -} - -locals { - region = "us-gov-east-1" - cluster_name = "platform-test-1" - profile = "terraform" - namespace = "monitoring" - create_namespace = "true" - prometheus_namespace = "monitoring" - # Default values should match latest and align with broader platform constructs - # tempo_chart_version = "1.10.1" - # tempo_tag = "2.5.0" - # rwo_storage_class = "gp3-encrypted" - # prometheus_svc = "prometheus-server" - # prometheus_port = "80" - - tags = { - project_number = "fs0000000078" - project_name = "csvd_platformbaseline" - project_role = "csvd_platformbaseline_app" - organization = "census:ocio:csvd" - created_by = "luther.coleman.mcginty@census.gov" - created_for = "luther.coleman.mcginty@census.gov" - created_reason = "Testing eks module operation" - Terraform = "true" - Terragrunt = "true" - tag_costallocation = "csvd:infrastructure" - } - -} - -module "tempo" { - source = "../.." - - region = local.region - cluster_name = local.cluster_name - profile = local.profile - namespace = local.namespace - create_namespace = local.create_namespace - prometheus_namespace = local.prometheus_namespace - additional_tags = local.tags -} +terraform { + required_version = ">= 0.13" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.14.0" + } + helm = { + source = "hashicorp/helm" + version = ">= 2.11.0" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = ">= 2.23.0" + } + null = { + source = "hashicorp/null" + version = ">= 3.2.1" + } + template = { + source = "hashicorp/template" + version = ">= 2.2.0" + } + } +} + +provider "aws" { + profile = local.profile + region = local.region +} + +provider "helm" { + kubernetes { + host = data.aws_eks_cluster.cluster.endpoint + + cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) + token = data.aws_eks_cluster_auth.cluster.token + } +} + +provider "kubernetes" { + host = data.aws_eks_cluster.cluster.endpoint + + cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) + token = data.aws_eks_cluster_auth.cluster.token +} + +data "aws_eks_cluster" "cluster" { + name = local.cluster_name +} + +data "aws_eks_cluster_auth" "cluster" { + name = local.cluster_name +} + +locals { + region = "us-gov-east-1" + cluster_name = "platform-test-1" + profile = "terraform" + namespace = "monitoring" + create_namespace = "true" + prometheus_namespace = "monitoring" + # Default values should match latest and align with broader platform constructs + # tempo_chart_version = "1.10.1" + # tempo_tag = "2.5.0" + # rwo_storage_class = "gp3-encrypted" + # prometheus_svc = "prometheus-server" + # prometheus_port = "80" + + tags = { + project_number = "fs0000000078" + project_name = "csvd_platformbaseline" + project_role = "csvd_platformbaseline_app" + organization = "census:ocio:csvd" + created_by = "luther.coleman.mcginty@census.gov" + created_for = "luther.coleman.mcginty@census.gov" + created_reason = "Testing eks module operation" + Terraform = "true" + Terragrunt = "true" + tag_costallocation = "csvd:infrastructure" + } + +} + +module "tempo" { + source = "../.." + + region = local.region + cluster_name = local.cluster_name + profile = local.profile + namespace = local.namespace + create_namespace = local.create_namespace + prometheus_namespace = local.prometheus_namespace + additional_tags = local.tags +} diff --git a/main.tf b/main.tf index 1066736..fa70175 100644 --- a/main.tf +++ b/main.tf @@ -1,5 +1,6 @@ locals { oidc_arn = var.oidc_provider_arn + tags = var.tags } ################################################################################ @@ -17,7 +18,7 @@ module "tempo-irsa-role" { "${module.tempo-s3.s3_bucket_arn}/*", ] kms_key_arns = [ - "${module.tempo-s3.kms_key_arn}" + module.tempo-s3.kms_key_arn ] oidc_providers = { @@ -39,21 +40,21 @@ resource "helm_release" "tempo" { namespace = var.namespace create_namespace = true repository = "https://grafana.github.io/helm-charts" - values = ["${file("${path.module}/tempo_values.yaml")}"] + values = [file("${path.module}/tempo_values.yaml")] - set { - name = "tempo.storage.trace.backend" - value = "s3" - } - set { - name = "tempo.storage.trace.s3.insecure" - value = "false" - } - set { - name = "replicas" - value = "3" - } + # set { + # name = "tempo.storage.trace.backend" + # value = "s3" + # } + # set { + # name = "tempo.storage.trace.s3.insecure" + # value = "false" + # } + # set { + # name = "replicas" + # value = "3" + # } set { name = "tempo.repository" value = format("%v/%v", diff --git a/requirements.tf b/requirements.tf index a376988..1b7a5da 100644 --- a/requirements.tf +++ b/requirements.tf @@ -1,26 +1,26 @@ -terraform { - required_version = ">= 0.13" - - required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 5.14.0" - } - helm = { - source = "hashicorp/helm" - version = ">= 2.11.0" - } - kubernetes = { - source = "hashicorp/kubernetes" - version = ">= 2.23.0" - } - null = { - source = "hashicorp/null" - version = ">= 3.2.1" - } - template = { - source = "hashicorp/template" - version = ">= 2.2.0" - } - } -} \ No newline at end of file +terraform { + required_version = ">= 0.13" + + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.14.0" + } + helm = { + source = "hashicorp/helm" + version = ">= 2.11.0" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = ">= 2.23.0" + } + null = { + source = "hashicorp/null" + version = ">= 3.2.1" + } + template = { + source = "hashicorp/template" + version = ">= 2.2.0" + } + } +} diff --git a/s3.tf b/s3.tf index b64ddc5..498fa70 100644 --- a/s3.tf +++ b/s3.tf @@ -1,14 +1,14 @@ -## create bucket - -data "aws_s3_bucket" "s3_server_access_logs" { - bucket = format("inf-logs-%v-%v", local.account_id, var.region) -} - -module "tempo-s3" { - source = "git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard?ref=tf-upgrade" - - bucket_name = format("%v-tempo", var.cluster_name) - access_log_bucket = data.aws_s3_bucket.s3_server_access_logs.id - - tags = local.tags -} \ No newline at end of file +## create bucket + +data "aws_s3_bucket" "s3_server_access_logs" { + bucket = format("inf-logs-%v-%v", local.account_id, var.region) +} + +module "tempo-s3" { + source = "git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard?ref=tf-upgrade" + + bucket_name = format("%v-tempo", var.cluster_name) + access_log_bucket = data.aws_s3_bucket.s3_server_access_logs.id + + tags = local.tags +} diff --git a/variables.tf b/variables.tf index 0f7b0d1..ce7152f 100644 --- a/variables.tf +++ b/variables.tf @@ -1,75 +1,69 @@ -variable "additional_tags" { - description = "Additional tags to add to resources created in AWS (s3 bucket, ...)" - type = map(string) - default = {} -} - -variable "region" { - description = "The region holding these resources (for the s3 bucket.)" - type = string -} - -variable "cluster_name" { - description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)" - type = string -} - -variable "profile" { - description = "AWS config profile used to upload images into ECR" - type = string - default = "" -} - -variable "namespace" { - description = "The namespace into which tempo will be deployed" - type = string - default = "tempo" -} - -variable "create_namespace" { - description = "Indicates whether the `namespace` needs to be created ('true') or already exists (not `true`)" - type = string - default = "true" -} - -variable "rwo_storage_class" { - description = "Specify the storage class for persistent volumes." - type = string - default = "gp3-encrypted" -} - -variable "tempo_chart_version" { - description = "Which version of the grafana/tempo helm chart to use." - type = string - default = "1.10.1" -} - -variable "tempo_tag" { - description = "The tag of the tempo image to use." - type = string - default = "2.5.0" -} - -variable "oidc_provider_arn" { - description = "The ARN in the EKS cluster for the OpenID Connect identity provider." - type = string -} - -# Prometheus data for metrics generator -variable "prometheus_svc" { - description = "Prometheus service name." - type = string - default = "prometheus-server" -} - -variable "prometheus_namespace" { - description = "Namespace where Prometheus is installed." - type = string - default = "log-trace-monitor" -} - -variable "prometheus_port" { - description = "Port number of Prometheus service, mostly either 80 or 9090" - type = string - default = "80" -} \ No newline at end of file +variable "tags" { + description = "Additional tags to add to resources created in AWS (s3 bucket, ...)" + type = map(string) + default = {} +} + +variable "region" { + description = "The region holding these resources (for the s3 bucket.)" + type = string +} + +variable "cluster_name" { + description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)" + type = string +} + +variable "profile" { + description = "AWS config profile used to upload images into ECR" + type = string + default = "" +} + +variable "namespace" { + description = "The namespace into which tempo will be deployed" + type = string + default = "tempo" +} + +variable "oidc_provider_arn" { + description = "The ARN in the EKS cluster for the OpenID Connect identity provider." + type = string +} + +variable "rwo_storage_class" { + description = "Specify the storage class for persistent volumes." + type = string + default = "gp3-encrypted" +} + +variable "tempo_chart_version" { + description = "Which version of the grafana/tempo helm chart to use." + type = string + default = "1.10.3" +} + +variable "tempo_tag" { + description = "The tag of the tempo image to use." + type = string + default = "2.5.0" +} + +# Prometheus data for metrics generator +variable "prometheus_svc" { + description = "Prometheus service name." + type = string + default = "prometheus-server" +} + +variable "prometheus_namespace" { + description = "Namespace where Prometheus is installed." + type = string + default = "prometheus" +} + +variable "prometheus_port" { + description = "Port number of Prometheus service, mostly either 80 or 9090" + type = string + default = "80" +} diff --git a/version.tf b/version.tf index de67d08..9ae6ee9 100644 --- a/version.tf +++ b/version.tf @@ -1,4 +1,4 @@ -locals { - _module_name = "tfmod-tempo" - _module_version = "0.0.1" -} +locals { + _module_name = "tfmod-tempo" + _module_version = "0.0.1" +} From eea2fe60ebd27f27334ac1b28211e794ddfec212 Mon Sep 17 00:00:00 2001 From: "Matthew C. Morgan" Date: Thu, 19 Sep 2024 21:08:07 -0400 Subject: [PATCH 6/6] wip --- outputs.tf | 4 ++-- version.tf | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/outputs.tf b/outputs.tf index 0349496..b999ac9 100644 --- a/outputs.tf +++ b/outputs.tf @@ -4,10 +4,10 @@ output "module_name" { description = "The name of this module." - value = local._module_name + value = local.module_name } output "module_version" { description = "The version of this module." - value = local._module_version + value = local.module_version } diff --git a/version.tf b/version.tf index 9ae6ee9..2b79747 100644 --- a/version.tf +++ b/version.tf @@ -1,4 +1,4 @@ locals { - _module_name = "tfmod-tempo" - _module_version = "0.0.1" + module_name = "tfmod-tempo" + module_version = "0.0.1" }