Skip to content

Commit a64d3be

Browse files
josmojosmo
committed
refactor: initial move from foundation to terraform only repo
0 parents  commit a64d3be

17 files changed

+743
-0
lines changed

‎.github/workflows/pr-title.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: lint-pr-title
2+
3+
on:
4+
pull_request:
5+
types: [opened, edited, reopened, synchronize]
6+
7+
jobs:
8+
pr-lint:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: morrisoncole/[email protected]
12+
with:
13+
# Note: if you have branch protection rules enabled, the `GITHUB_TOKEN` permissions
14+
# won't cover dismissing reviews. Your options are to pass in a custom token
15+
# (perhaps by creating some sort of 'service' user and creating a personal access
16+
# token with the correct permissions) or to turn off `on-failed-regex-request-changes`
17+
# and use action failure to prevent merges instead (with
18+
# `on-failed-regex-fail-action: true`). See:
19+
# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
20+
# https://docs.github.com/en/rest/pulls/reviews#dismiss-a-review-for-a-pull-request
21+
repo-token: "${{ secrets.GITHUB_TOKEN }}"
22+
title-regex: '^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test){1}(\([\w\-\.]+\))?(!)?: ([\w ])+([\s\S]*)'
23+
on-failed-regex-fail-action: true
24+
on-failed-regex-create-review: false
25+
on-failed-regex-request-changes: false

‎.github/workflows/pre-commit.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: pre-commit
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
7+
branches:
8+
- main
9+
jobs:
10+
pre-commit:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
- name: install pre-commit
15+
run: pip install pre-commit
16+
17+
- name: Terraform
18+
uses: hashicorp/setup-terraform@v3
19+
with:
20+
terraform_version: "1.5.7"
21+
22+
- name: install hcledit
23+
run: |
24+
curl -sSLo ./hcledit.tar.gz https://github.com/minamijoyo/hcledit/releases/download/v0.2.10/hcledit_0.2.10_linux_amd64.tar.gz
25+
tar -xzf hcledit.tar.gz
26+
chmod +x hcledit
27+
mv hcledit /usr/local/bin/hcledit
28+
29+
- name: install tf-lint
30+
run: curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash
31+
32+
- name: install tf-docs
33+
run: |
34+
curl -sSLo ./terraform-docs.tar.gz https://terraform-docs.io/dl/v0.17.0/terraform-docs-v0.17.0-linux-amd64.tar.gz
35+
tar -xzf terraform-docs.tar.gz
36+
chmod +x terraform-docs
37+
mv terraform-docs /usr/local/bin/terraform-docs
38+
39+
- name: pre-commit
40+
run: pre-commit run --all-files --show-diff-on-failure

‎.github/workflows/releases.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: release-notes
2+
3+
on:
4+
push:
5+
tags:
6+
- v[0-9]+.[0-9]+.[0-9]+
7+
jobs:
8+
deploy:
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- name: Checkout Code
13+
uses: actions/checkout@v4
14+
15+
- name: Update CHANGELOG
16+
id: changelog
17+
uses: requarks/changelog-action@v1
18+
with:
19+
token: ${{ github.token }}
20+
tag: ${{ github.ref_name }}
21+
22+
- name: Create Release
23+
uses: ncipollo/[email protected]
24+
with:
25+
allowUpdates: true
26+
draft: false
27+
makeLatest: true
28+
name: ${{ github.ref_name }}
29+
body: ${{ steps.changelog.outputs.changes }}
30+
token: ${{ github.token }}

‎.gitignore

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
crash.*.log
11+
12+
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
13+
# password, private keys, and other secrets. These should not be part of version
14+
# control as they are data points which are potentially sensitive and subject
15+
# to change depending on the environment.
16+
*.tfvars
17+
*.tfvars.json
18+
19+
# Ignore override files as they are usually used to override resources locally and so
20+
# are not checked in
21+
override.tf
22+
override.tf.json
23+
*_override.tf
24+
*_override.tf.json
25+
26+
# Include override files you do wish to add to version control using negated pattern
27+
# !example_override.tf
28+
29+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
30+
# example: *tfplan*
31+
32+
# Ignore CLI configuration files
33+
.terraformrc
34+
terraform.rc
35+
36+
.idea/*
37+
38+
# Devenv
39+
.devenv*
40+
devenv.local.nix
41+
.direnv

‎.pre-commit-config.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v5.0.0
4+
hooks:
5+
- id: check-merge-conflict
6+
- id: end-of-file-fixer
7+
- id: trailing-whitespace
8+
- id: forbid-submodules
9+
- repo: https://github.com/adrienverge/yamllint
10+
rev: v1.35.1
11+
hooks:
12+
- id: yamllint
13+
args: [--strict, -c=.yamllint]
14+
- repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
15+
rev: v9.18.0
16+
hooks:
17+
- id: commitlint
18+
stages: [commit-msg]
19+
additional_dependencies: ['@commitlint/config-conventional']
20+
- repo: https://github.com/antonbabenko/pre-commit-terraform
21+
rev: v1.96.1
22+
hooks:
23+
- id: terraform_wrapper_module_for_each
24+
- id: terraform_tflint
25+
args:
26+
- '--args=--only=terraform_deprecated_interpolation'
27+
- '--args=--only=terraform_deprecated_index'
28+
- '--args=--only=terraform_unused_declarations'
29+
- '--args=--only=terraform_comment_syntax'
30+
- '--args=--only=terraform_documented_outputs'
31+
- '--args=--only=terraform_documented_variables'
32+
- '--args=--only=terraform_typed_variables'
33+
- '--args=--only=terraform_module_pinned_source'
34+
- '--args=--only=terraform_naming_convention'
35+
- '--args=--only=terraform_required_version'
36+
- '--args=--only=terraform_required_providers'
37+
- '--args=--only=terraform_standard_module_structure'
38+
- '--args=--only=terraform_workspace_remote'

‎.tflint.hcl

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
plugin "aws" {
2+
enabled = true
3+
version = "0.36.0"
4+
source = "github.com/terraform-linters/tflint-ruleset-aws"
5+
}

‎.yamllint

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
extends: relaxed
2+
3+
rules:
4+
line-length: disable
5+
commas: disable
6+
indentation:
7+
spaces: 2
8+
indent-sequences: whatever
9+
10+
ignore: |
11+
*.terraform/
12+
gitops/base-install/cert-manager/create-issuer/templates/create-issuer.yaml

‎README.md

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
## Requirements
3+
4+
| Name | Version |
5+
|------|---------|
6+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
7+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.45.0 |
8+
9+
## Providers
10+
11+
| Name | Version |
12+
|------|---------|
13+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.45.0 |
14+
15+
## Modules
16+
17+
| Name | Source | Version |
18+
|------|--------|---------|
19+
| <a name="module_cert_manager_irsa_role"></a> [cert\_manager\_irsa\_role](#module\_cert\_manager\_irsa\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | 5.51.0 |
20+
| <a name="module_ebs_csi_driver_irsa_role"></a> [ebs\_csi\_driver\_irsa\_role](#module\_ebs\_csi\_driver\_irsa\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | 5.51.0 |
21+
| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | 20.31.6 |
22+
| <a name="module_external_dns_irsa_role"></a> [external\_dns\_irsa\_role](#module\_external\_dns\_irsa\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | 5.51.0 |
23+
| <a name="module_karpenter"></a> [karpenter](#module\_karpenter) | terraform-aws-modules/eks/aws//modules/karpenter | 20.31.6 |
24+
| <a name="module_load_balancer_controller_irsa_role"></a> [load\_balancer\_controller\_irsa\_role](#module\_load\_balancer\_controller\_irsa\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | 5.51.0 |
25+
| <a name="module_s3_csi"></a> [s3\_csi](#module\_s3\_csi) | terraform-aws-modules/s3-bucket/aws | 4.3.0 |
26+
| <a name="module_s3_driver_irsa_role"></a> [s3\_driver\_irsa\_role](#module\_s3\_driver\_irsa\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | 5.51.0 |
27+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.17.0 |
28+
29+
## Resources
30+
31+
| Name | Type |
32+
|------|------|
33+
| [aws_vpc_endpoint.eks_vpc_endpoints](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource |
34+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
35+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
36+
37+
## Inputs
38+
39+
| Name | Description | Type | Default | Required |
40+
|------|-------------|------|---------|:--------:|
41+
| <a name="input_extra_access_entries"></a> [extra\_access\_entries](#input\_extra\_access\_entries) | EKS access entries needed by IAM roles interacting with this cluster | <pre>list(object({<br/> principal_arn = string<br/> kubernetes_groups = optional(list(string))<br/> policy_arn = string<br/> access_scope_type = string<br/> access_scope_namespaces = optional(list(string))<br/> }))</pre> | `[]` | no |
42+
| <a name="input_initial_instance_types"></a> [initial\_instance\_types](#input\_initial\_instance\_types) | instance types of the initial managed node group | `list(string)` | n/a | yes |
43+
| <a name="input_initial_node_desired_size"></a> [initial\_node\_desired\_size](#input\_initial\_node\_desired\_size) | desired size of the initial managed node group | `number` | `3` | no |
44+
| <a name="input_initial_node_labels"></a> [initial\_node\_labels](#input\_initial\_node\_labels) | labels for the initial managed node group | `map(string)` | <pre>{<br/> "kube-ovn/role": "master"<br/>}</pre> | no |
45+
| <a name="input_initial_node_max_size"></a> [initial\_node\_max\_size](#input\_initial\_node\_max\_size) | max size of the initial managed node group | `number` | `6` | no |
46+
| <a name="input_initial_node_min_size"></a> [initial\_node\_min\_size](#input\_initial\_node\_min\_size) | minimum size of the initial managed node group | `number` | `2` | no |
47+
| <a name="input_initial_node_taints"></a> [initial\_node\_taints](#input\_initial\_node\_taints) | taints for the initial managed node group | `list(object({ key = string, value = string, effect = string }))` | <pre>[<br/> {<br/> "effect": "NO_SCHEDULE",<br/> "key": "CriticalAddonsOnly",<br/> "value": "true"<br/> },<br/> {<br/> "effect": "NO_SCHEDULE",<br/> "key": "nidhogg.uswitch.com/kube-system.kube-multus-ds",<br/> "value": "true"<br/> }<br/>]</pre> | no |
48+
| <a name="input_s3_csi_driver_bucket_arns"></a> [s3\_csi\_driver\_bucket\_arns](#input\_s3\_csi\_driver\_bucket\_arns) | existing buckets the s3 CSI driver should have access to | `list(string)` | `[]` | no |
49+
| <a name="input_s3_csi_driver_create_bucket"></a> [s3\_csi\_driver\_create\_bucket](#input\_s3\_csi\_driver\_create\_bucket) | create a new bucket for use with the s3 CSI driver | `bool` | `true` | no |
50+
| <a name="input_stack_admin_arns"></a> [stack\_admin\_arns](#input\_stack\_admin\_arns) | arn to the roles for the cluster admins role | `list(string)` | `[]` | no |
51+
| <a name="input_stack_ci_admin_arn"></a> [stack\_ci\_admin\_arn](#input\_stack\_ci\_admin\_arn) | arn to the ci role | `string` | n/a | yes |
52+
| <a name="input_stack_ci_ro_arn"></a> [stack\_ci\_ro\_arn](#input\_stack\_ci\_ro\_arn) | arn to the ci role for planning on PRs | `string` | n/a | yes |
53+
| <a name="input_stack_create"></a> [stack\_create](#input\_stack\_create) | should resources be created | `bool` | `true` | no |
54+
| <a name="input_stack_name"></a> [stack\_name](#input\_stack\_name) | Name of the stack | `string` | `"foundation-stack"` | no |
55+
| <a name="input_stack_ro_arns"></a> [stack\_ro\_arns](#input\_stack\_ro\_arns) | arn to the roles for the cluster read only role | `list(string)` | `[]` | no |
56+
| <a name="input_stack_tags"></a> [stack\_tags](#input\_stack\_tags) | tags to be added to the stack, should at least have Owner and Environment | `map(any)` | <pre>{<br/> "Environment": "prod",<br/> "Owner": "pelotech"<br/>}</pre> | no |
57+
| <a name="input_stack_vpc_block"></a> [stack\_vpc\_block](#input\_stack\_vpc\_block) | Variables for defining the vpc for the stack | <pre>object({<br/> cidr = string<br/> azs = list(string)<br/> private_subnets = list(string)<br/> public_subnets = list(string)<br/> database_subnets = list(string)<br/> })</pre> | <pre>{<br/> "azs": [<br/> "us-west-2a",<br/> "us-west-2b",<br/> "us-west-2c"<br/> ],<br/> "cidr": "172.16.0.0/16",<br/> "database_subnets": [<br/> "172.16.200.0/24",<br/> "172.16.201.0/24",<br/> "172.16.202.0/24"<br/> ],<br/> "private_subnets": [<br/> "172.16.0.0/24",<br/> "172.16.1.0/24",<br/> "172.16.2.0/24"<br/> ],<br/> "public_subnets": [<br/> "172.16.100.0/24",<br/> "172.16.101.0/24",<br/> "172.16.102.0/24"<br/> ]<br/>}</pre> | no |
58+
| <a name="input_vpc_endpoints"></a> [vpc\_endpoints](#input\_vpc\_endpoints) | vpc endpoints within the cluster vpc network | `list(string)` | `[]` | no |
59+
60+
## Outputs
61+
62+
No outputs.
63+
<!-- END_TF_DOCS -->

‎catalog-info.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: backstage.io/v1alpha1
2+
kind: Component
3+
metadata:
4+
name: terraform-foundation-aws-stack
5+
description: Terraform modules to bootstrap k8s cluster in aws
6+
tags:
7+
- terraform
8+
- k8s
9+
annotations:
10+
github.com/project-slug: pelotech/terraform-foundation-aws-stack
11+
backstage.io/techdocs-ref: dir:.
12+
spec:
13+
type: infrastructure
14+
lifecycle: production
15+
owner: group:pelotech/leads

‎commitlint.config.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
module.exports = {extends: ['@commitlint/config-conventional']};

0 commit comments

Comments
 (0)