temp tf

terraform/modules/cloudflare-cluster-dns/main.tf

@@ -0,0 +1,66 @@
+# Primary cluster hostname
+resource "cloudflare_record" "cluster" {
+  zone_id = var.cloudflare-zone-id
+  name    = var.record-name
+  value   = var.ingress-endpoint
+  type    = "A"
+  proxied = true
+}
+
+# PRD & STG records for direct FQDN usage
+# Long term, these will also be CNAME'd to 
+# - prd == roleypoly.com
+# - stg == beta.roleypoly.com
+resource "cloudflare_record" "prd" {
+  zone_id = var.cloudflare-zone-id
+  name    = "prd.${var.record-name}"
+  value   = cloudflare_record.cluster.hostname
+  type    = "CNAME"
+  proxied = true
+}
+
+resource "cloudflare_record" "stg" {
+  zone_id = var.cloudflare-zone-id
+  name    = "stg.${var.record-name}"
+  value   = cloudflare_record.cluster.hostname
+  type    = "CNAME"
+  proxied = true
+}
+
+# Origin CA Cert
+resource "tls_private_key" "origin-ca-key" {
+  algorithm = "ECDSA"
+}
+
+resource "tls_cert_request" "origin-ca-csr" {
+  key_algorithm   = tls_private_key.origin-ca-key.algorithm
+  private_key_pem = tls_private_key.origin-ca-key.private_key_pem
+
+  subject {
+    common_name  = "roleypoly.com"
+    organization = "Roleypoly"
+  }
+}
+
+resource "cloudflare_origin_ca_certificate" "origin-ca-cert" {
+  csr = tls_cert_request.origin-ca-csr.cert_request_pem
+  hostnames = [
+    cloudflare_record.cluster.hostname,
+    cloudflare_record.prd.hostname,
+    cloudflare_record.stg.hostname
+  ]
+  request_type       = "origin-ecc"
+  requested_validity = 1095 # 3 years
+}
+
+resource "kubernetes_secret" "cloudflare-origin" {
+  type = "kubernetes.io/tls"
+  metadata {
+    name      = "cloudflare-origin"
+    namespace = "default"
+  }
+  data = {
+    "tls.crt" = base64encode(cloudflare_origin_ca_certificate.origin-ca-cert.certificate),
+    "tls.key" = base64encode(tls_private_key.origin-ca-key.private_key_pem)
+  }
+}

terraform/modules/cloudflare-cluster-dns/variables.tf

@@ -0,0 +1,19 @@
+variable "ingress-name" {
+  type = string
+}
+
+variable "ingress-namespace" {
+  type = string
+}
+
+variable "ingress-endpoint" {
+  type = string
+}
+
+variable "cloudflare-zone-id" {
+  type = string
+}
+
+variable "record-name" {
+  type = string
+}

terraform/modules/cloudflare-cluster-dns/version.tf

@@ -0,0 +1,4 @@
+terraform {
+  required_version = ">=0.12"
+}
+

terraform/modules/cluster-environment/main.tf

@@ -0,0 +1,56 @@
+locals {
+  ns = "${var.app_name}-${var.environment_tag}"
+  labels = {
+    "app.kubernetes.io/name"    = var.app_name
+    "app.kubernetes.io/part-of" = var.app_name
+    "roleypoly/environment"     = var.environment_tag
+  }
+}
+
+resource "kubernetes_namespace" "ns" {
+  metadata {
+    name   = local.ns
+    labels = local.labels
+  }
+}
+
+resource "kubernetes_service_account" "sa" {
+  metadata {
+    name      = "${local.ns}-sa-tf"
+    namespace = local.ns
+    labels    = local.labels
+  }
+}
+
+resource "kubernetes_secret" "sa-key" {
+  metadata {
+    name      = "${local.ns}-sa-tf-key"
+    namespace = local.ns
+    labels    = local.labels
+    annotations = {
+      "kubernetes.io/service-account.name" = kubernetes_service_account.sa.metadata.0.name
+    }
+  }
+
+  type = "kubernetes.io/service-account-token"
+}
+
+resource "kubernetes_role_binding" "sa-admin-rb" {
+  metadata {
+    name      = "${local.ns}-sa-admin-binding"
+    namespace = local.ns
+    labels    = local.labels
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    name      = kubernetes_service_account.sa.metadata.0.name
+    namespace = local.ns
+  }
+
+  role_ref {
+    kind      = "ClusterRole"
+    name      = "admin"
+    api_group = "rbac.authorization.k8s.io"
+  }
+}

terraform/modules/cluster-environment/output.tf

@@ -0,0 +1,7 @@
+output "service_account_token" {
+  value = lookup(kubernetes_secret.sa-key, "data.token", "")
+}
+
+output "namespace" {
+  value = local.ns
+}

terraform/modules/cluster-environment/variables.tf

@@ -0,0 +1,9 @@
+variable "environment_tag" {
+  type    = string
+  default = "main"
+}
+
+variable "app_name" {
+  type = string
+}
+

terraform/modules/nginx-ingress-controller/main.tf

@@ -0,0 +1,331 @@
+locals {
+  ns = kubernetes_namespace.ns.metadata.0.name
+  labels = {
+    "app.kubernetes.io/name"    = "ingress-nginx"
+    "app.kubernetes.io/part-of" = "ingress-nginx"
+  }
+}
+
+resource "kubernetes_namespace" "ns" {
+  metadata {
+    name   = "ingress-nginx"
+    labels = local.labels
+  }
+}
+
+resource "kubernetes_config_map" "cm-nginx" {
+  metadata {
+    name      = "nginx-configuration"
+    namespace = local.ns
+    labels    = local.labels
+  }
+}
+
+resource "kubernetes_config_map" "cm-tcp" {
+  metadata {
+    name      = "tcp-services"
+    namespace = local.ns
+    labels    = local.labels
+  }
+}
+
+resource "kubernetes_config_map" "cm-udp" {
+  metadata {
+    name      = "udp-services"
+    namespace = local.ns
+    labels    = local.labels
+  }
+}
+
+resource "kubernetes_service_account" "sa" {
+  metadata {
+    name      = "nginx-ingress-serviceaccount"
+    namespace = local.ns
+    labels    = local.labels
+  }
+}
+
+resource "kubernetes_cluster_role" "cr" {
+  metadata {
+    name   = "nginx-ingress-clusterrole"
+    labels = local.labels
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["configmaps", "endpoints", "nodes", "pods", "secrets"]
+    verbs      = ["list", "watch"]
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["nodes"]
+    verbs      = ["get"]
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["services"]
+    verbs      = ["get", "list", "watch"]
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["events"]
+    verbs      = ["create", "patch"]
+  }
+  rule {
+    api_groups = ["extensions", "networking.k8s.io"]
+    resources  = ["ingresses"]
+    verbs      = ["get", "list", "watch"]
+  }
+  rule {
+    api_groups = ["extensions", "networking.k8s.io"]
+    resources  = ["ingresses/status"]
+    verbs      = ["update"]
+  }
+}
+
+resource "kubernetes_role" "role" {
+  metadata {
+    name      = "nginx-ingress-role"
+    namespace = local.ns
+    labels    = local.labels
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["configmaps", "pods", "secrets", "namespaces"]
+    verbs      = ["get"]
+  }
+
+  rule {
+    api_groups     = [""]
+    resources      = ["configmaps"]
+    resource_names = ["ingress-controller-leader-nginx"]
+    verbs          = ["get", "update"]
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["configmaps"]
+    verbs      = ["create"]
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["endpoints"]
+    verbs      = ["get"]
+  }
+}
+
+resource "kubernetes_role_binding" "rb" {
+  metadata {
+    name      = "nginx-ingress-role-nisa-binding"
+    namespace = local.ns
+    labels    = local.labels
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = kubernetes_role.role.metadata.0.name
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    name      = kubernetes_service_account.sa.metadata.0.name
+    namespace = local.ns
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "crb" {
+  metadata {
+    name   = "nginx-ingress-clusterrole-nisa-binding"
+    labels = local.labels
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = kubernetes_cluster_role.cr.metadata.0.name
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    name      = kubernetes_service_account.sa.metadata.0.name
+    namespace = local.ns
+  }
+}
+
+resource "kubernetes_deployment" "deployment" {
+  metadata {
+    name      = "nginx-ingress-controller"
+    namespace = local.ns
+    labels    = local.labels
+  }
+
+  spec {
+    replicas = 3
+
+    selector {
+      match_labels = local.labels
+    }
+
+    template {
+      metadata {
+        labels = local.labels
+        annotations = {
+          "prometheus.io/port"   = "10254"
+          "prometheus.io/scrape" = "true"
+        }
+      }
+
+      spec {
+        automount_service_account_token  = true
+        termination_grace_period_seconds = 300
+        service_account_name             = kubernetes_service_account.sa.metadata.0.name
+        node_selector = {
+          "kubernetes.io/os" = "linux"
+          node_type          = "static"
+        }
+
+        container {
+          name  = "nginx-ingress-controller"
+          image = "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:${var.nginx-ingress-version}"
+          args = [
+            "/nginx-ingress-controller",
+            "--configmap=${local.ns}/${kubernetes_config_map.cm-nginx.metadata.0.name}",
+            "--tcp-services-configmap=${local.ns}/${kubernetes_config_map.cm-tcp.metadata.0.name}",
+            "--udp-services-configmap=${local.ns}/${kubernetes_config_map.cm-udp.metadata.0.name}",
+            "--publish-service=${local.ns}/ingress-nginx",
+            "--annotations-prefix=nginx.ingress.kubernetes.io",
+          ]
+          security_context {
+            allow_privilege_escalation = true
+            capabilities {
+              drop = ["ALL"]
+              add  = ["NET_BIND_SERVICE"]
+            }
+            run_as_user = 101
+          }
+
+          env {
+            name = "POD_NAME"
+            value_from {
+              field_ref {
+                field_path = "metadata.name"
+              }
+            }
+          }
+
+          env {
+            name = "POD_NAMESPACE"
+            value_from {
+              field_ref {
+                field_path = "metadata.namespace"
+              }
+            }
+          }
+
+          port {
+            name           = "http"
+            container_port = 80
+            protocol       = "TCP"
+          }
+
+          port {
+            name           = "https"
+            container_port = 443
+            protocol       = "TCP"
+          }
+
+          liveness_probe {
+            http_get {
+              path   = "/healthz"
+              port   = 10254
+              scheme = "HTTP"
+            }
+            failure_threshold     = 3
+            initial_delay_seconds = 10
+            period_seconds        = 10
+            success_threshold     = 1
+            timeout_seconds       = 10
+          }
+
+          readiness_probe {
+            http_get {
+              path   = "/healthz"
+              port   = 10254
+              scheme = "HTTP"
+            }
+            failure_threshold     = 3
+            initial_delay_seconds = 10
+            period_seconds        = 10
+            success_threshold     = 1
+            timeout_seconds       = 10
+          }
+
+          lifecycle {
+            pre_stop {
+              exec {
+                command = ["/wait-shutdown"]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_limit_range" "lr" {
+  metadata {
+    name      = "ingress-nginx"
+    namespace = local.ns
+    labels    = local.labels
+  }
+
+  spec {
+    limit {
+      min = {
+        memory = "90Mi"
+        cpu    = "100m"
+      }
+
+      type = "Container"
+    }
+  }
+}
+
+# Specific service related to Google Cloud
+resource "kubernetes_service" "svc" {
+  metadata {
+    name      = "ingress-nginx"
+    namespace = local.ns
+    labels    = local.labels
+  }
+
+  spec {
+    external_traffic_policy = "Local"
+    type                    = "LoadBalancer"
+    selector                = local.labels
+
+    port {
+      name        = "http"
+      port        = 80
+      protocol    = "TCP"
+      target_port = "http"
+    }
+
+    port {
+      name        = "https"
+      port        = 443
+      protocol    = "TCP"
+      target_port = "https"
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [
+      // We add no annotations, but DO adds some.
+      metadata[0].annotations,
+    ]
+  }
+}

terraform/modules/nginx-ingress-controller/outputs.tf

@@ -0,0 +1,11 @@
+output "service-name" {
+  value = kubernetes_service.svc.metadata.0.name
+}
+
+output "service-namespace" {
+  value = kubernetes_service.svc.metadata.0.namespace
+}
+
+output "service-endpoint" {
+  value = kubernetes_service.svc.load_balancer_ingress.0.ip
+}

terraform/modules/nginx-ingress-controller/variables.tf

@@ -0,0 +1,4 @@
+variable "nginx-ingress-version" {
+  type    = string
+  default = "0.30.0"
+}

terraform/modules/nginx-ingress-controller/version.tf

@@ -0,0 +1,3 @@
+terraform {
+    required_version = ">=0.12"
+}

terraform/modules/tfc-workspace/main.tf

@@ -0,0 +1,57 @@
+locals {
+  dependentModulesPathed = formatlist("terraform/modules/%s", var.dependent_modules)
+  variableDescription    = "Terraform-owned variable"
+}
+
+resource "tfe_workspace" "ws" {
+  name              = var.workspace-name
+  organization      = var.tfc_org
+  auto_apply        = var.auto_apply
+  trigger_prefixes  = concat([var.directory], local.dependentModulesPathed)
+  working_directory = var.directory
+
+  vcs_repo {
+    identifier     = var.repo
+    branch         = var.branch
+    oauth_token_id = var.tfc_oauth_token_id
+  }
+}
+
+resource "tfe_notification_configuration" "webhook" {
+  name             = "${var.workspace-name}-webhook"
+  enabled          = true
+  destination_type = "slack"
+  triggers         = ["run:created", "run:planning", "run:needs_attention", "run:applying", "run:completed", "run:errored"]
+  url              = var.tfc_webhook_url
+  workspace_id     = tfe_workspace.ws.id
+}
+
+resource "tfe_variable" "vars" {
+  for_each = var.vars
+
+  key          = each.key
+  value        = each.value
+  category     = "terraform"
+  workspace_id = tfe_workspace.ws.id
+  sensitive    = false
+}
+
+resource "tfe_variable" "sensitive" {
+  for_each = var.secret-vars
+
+  key          = each.key
+  value        = each.value
+  category     = "terraform"
+  workspace_id = tfe_workspace.ws.id
+  sensitive    = true
+}
+
+resource "tfe_variable" "env" {
+  for_each = var.env-vars
+
+  key          = each.key
+  value        = each.value
+  category     = "env"
+  workspace_id = tfe_workspace.ws.id
+  sensitive    = true
+}

terraform/modules/tfc-workspace/outputs.tf

@@ -0,0 +1,3 @@
+output "workspace" {
+  value = tfe_workspace.ws[*]
+}

terraform/modules/tfc-workspace/variables.tf

@@ -0,0 +1,54 @@
+variable "workspace-name" {
+  type = string
+}
+
+variable "secret-vars" {
+  type    = map(string)
+  default = {}
+}
+
+variable "vars" {
+  type    = map(string)
+  default = {}
+}
+
+variable "env-vars" {
+  type    = map(string)
+  default = {}
+}
+
+variable "repo" {
+  type = string
+}
+
+variable "directory" {
+  type    = string
+  default = "/"
+}
+
+variable "branch" {
+  type    = string
+  default = "master"
+}
+
+variable "auto_apply" {
+  type    = bool
+  default = false
+}
+
+variable "dependent_modules" {
+  type    = list(string)
+  default = []
+}
+
+variable "tfc_oauth_token_id" {
+  type = string
+}
+
+variable "tfc_org" {
+  type = string
+}
+
+variable "tfc_webhook_url" {
+  type = string
+}

terraform/modules/tfc-workspace/version.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_version = ">=0.12.6"
+}
+
+provider "tfe" {
+  version = ">=0.15.0"
+}