working gcp setup

.gitignore

@@ -32,3 +32,5 @@ override.tf.json
 # Ignore CLI configuration files
 .terraformrc
 terraform.rc
+
+helm-values

charts/runtime/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: runtime
 description: Sets up the basic dependencies needed to get a network stack running
 type: application
-version: 0.1.2
-appVersion: "1.16.0"
+version: 0.1.3
+appVersion: "0.1.0"
 dependencies:
 - name: external-dns
   version: 6.14.5

charts/runtime/charts/plural-certmanager-webhook/templates/deployment.yaml

@@ -7,6 +7,8 @@ metadata:
     chart: {{ include "plural-webhook.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   replicas: {{ .Values.replicaCount }}
   selector:

charts/runtime/charts/plural-certmanager-webhook/templates/pki.yaml

@@ -11,6 +11,8 @@ metadata:
     chart: {{ include "plural-webhook.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   selfSigned: {}
 
@@ -27,6 +29,8 @@ metadata:
     chart: {{ include "plural-webhook.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   secretName: {{ include "plural-webhook.rootCACertificate" . }}
   duration: 43800h # 5y
@@ -48,6 +52,8 @@ metadata:
     chart: {{ include "plural-webhook.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   ca:
     secretName: {{ include "plural-webhook.rootCACertificate" . }}
@@ -65,6 +71,8 @@ metadata:
     chart: {{ include "plural-webhook.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   secretName: {{ include "plural-webhook.servingCertificate" . }}
   duration: 8760h # 1y

charts/runtime/templates/helmrepositories.yaml

@@ -2,6 +2,8 @@ apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
   name: bitnami
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   interval: 5m0s
   type: oci
@@ -11,6 +13,8 @@ apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
   name: flagger
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   interval: 5m0s
   url: https://flagger.app
@@ -19,6 +23,8 @@ apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
   name: console
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   interval: 5m0s
   url: https://pluralsh.github.io/console
@@ -27,6 +33,8 @@ apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
   name: bootstrap
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   interval: 5m0s
   url: https://pluralsh.github.io/bootstrap

charts/runtime/templates/issuer.yaml

@@ -2,13 +2,35 @@ apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
   name: letsencrypt-staging
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   selfSigned: {}
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+spec:
+  acme:
+    email: {{ .Values.ownerEmail }}
+    server: {{ .Values.letsencryptServer }}
+    privateKeySecretRef:
+      name: letsencryt-prod-key
+    solvers:
+    - http01:
+        ingress:
+          ingressClassName: nginx
+{{ if and .Values.acmeEAB.kid .Values.dnsSolver }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
 metadata:
   name: plural
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
 spec:
   acme:
     # You must replace this email address with your own.
@@ -30,4 +52,5 @@ spec:
     # Add a single challenge solver, dns01, configured using the appropriate cloud dns setup
     solvers:
     - dns01:
-      {{ .Values.dnsSolver | toYaml | nindent 8 }}
+      {{ .Values.dnsSolver | toYaml | nindent 8 }}
+{{ end }}

charts/runtime/values.yaml

@@ -21,6 +21,7 @@ external-dns:
 
 ownerEmail: [email protected]
 acmeServer: https://acme.zerossl.com/v2/DV90
+letsencryptServer: https://acme-v02.api.letsencrypt.org/directory
 
 dnsSolver:
   webhook:
@@ -116,7 +117,7 @@ ingress-nginx:
           prometheus.io/path: "/metrics"
           prometheus.io/scheme: http
       serviceMonitor:
-        enabled: true
+        enabled: false
       prometheusRule:
         enabled: false
 
@@ -188,7 +189,7 @@ ingress-nginx-private:
           prometheus.io/path: "/metrics"
           prometheus.io/scheme: http
       serviceMonitor:
-        enabled: true
+        enabled: false
       prometheusRule:
         enabled: false
 

providers/aws.tf

@@ -1,6 +1,12 @@
 terraform {
   required_version = ">= 1.0"
 
+  backend "s3" {
+    bucket = "{{ .Bucket }}"
+    key = "{{ .Cluster }}/terraform.tfstate"
+    region = "{{ .Region }}"
+  }
+
   required_providers {
     aws = {
       source  = "hashicorp/aws"
@@ -22,5 +28,5 @@ terraform {
 }
 
 provider "aws" {
-  region = "us-east-2"
-}
+  region = "{{ .Region }}"
+}

providers/azure.tf

@@ -1,5 +1,13 @@
 terraform {
   required_version = ">=1.3"
+
+  backend "azurerm" {
+    storage_account_name = "{{ .Context.StorageAccount }}"
+    resource_group_name = "{{ .Project }}"
+    container_name = "{{ .Bucket }}"
+    key = "{{ .Cluster }}/terraform.tfstate"
+  }
+
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
@@ -9,6 +17,10 @@ terraform {
       source  = "anschoewe/curl"
       version = "1.0.2"
     }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = ">= 2.10"
+    }
     random = {
       source  = "hashicorp/random"
       version = "3.3.2"

providers/gcp.tf

@@ -1,10 +1,16 @@
 terraform {
+  backend "gcs" {
+    bucket = "{{ .Bucket }}"
+    prefix = "{{ .Cluster }}/bootstrap"
+  }
+
   required_providers {
     google = {
       source = "hashicorp/google"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"
+      version = ">= 2.10"
     }
     random = {
       source  = "hashicorp/random"

clouds/aws/eks.tf → terraform/clouds/aws/eks.tf

@@ -3,7 +3,7 @@ module "eks" {
   version = "~> 19.0"
 
   cluster_name    = var.cluster_name
-  cluster_version = var.cluster_version
+  cluster_version = var.kubernetes_version
 
   cluster_endpoint_public_access  = var.public
 

terraform/clouds/aws/locals.tf

@@ -0,0 +1,3 @@
+locals {
+  db_url = format("postgresql://console:%s@%s:5432/console", random_password.password.result, module.db.db_instance_address)
+}

clouds/aws/outputs.tf → terraform/clouds/aws/outputs.tf

@@ -12,6 +12,6 @@ output "db" {
 }
 
 output "db_url" {
-    value = format("postgresql://console:%s@%s:5432/console", random_password.password.result, module.db.db_instance_address)
+    value = local.db_url
     sensitive = true
 }

clouds/aws/postgres.tf → terraform/clouds/aws/postgres.tf

@@ -48,7 +48,7 @@ module "db" {
   ]
 
   # Database Deletion Protection
-  deletion_protection = true
+  deletion_protection = var.deletion_protection
 }
 
 module "security_group" {

clouds/aws/addons.tf → terraform/clouds/aws/runtime.tf

@@ -34,4 +34,15 @@ module "eks_blueprints_addons" {
   enable_aws_load_balancer_controller    = true
   enable_cluster_proportional_autoscaler = true
   enable_metrics_server                  = true
+}
+
+resource "helm_release" "runtime" {
+  name       = "runtime"
+  namespace  = "plural-runtime"
+  chart      = "../../../charts/runtime"
+  create_namespace = true
+  timeout    = 300
+  values     = [
+    file(var.runtime_values_file)
+  ]
 }

clouds/aws/variables.tf → terraform/clouds/aws/variables.tf

@@ -3,7 +3,7 @@ variable "cluster_name" {
     default = "plural"
 }
 
-variable "cluster_version" {
+variable "kubernetes_version" {
     type = string
     default = "1.27"
 }
@@ -36,4 +36,14 @@ variable "public_subnets" {
 variable "install_runtime" {
   type = bool
   default = true
+}
+
+variable "deletion_protection" {
+  type = bool
+  default = true
+}
+
+variable "runtime_values_file" {
+  type = string
+  default = "../../helm-values/runtime.yaml"
 }

clouds/azure/aks.tf → terraform/clouds/azure/aks.tf

@@ -2,7 +2,7 @@ module "aks" {
   source = "Azure/aks/azurerm"
   version = "7.5.0"
 
-  kubernetes_version  = "1.27.3"
+  kubernetes_version  = var.kubernetes_version
   cluster_name        = var.cluster_name
   resource_group_name = local.resource_group.name
   os_disk_size_gb     = 60

terraform/clouds/azure/kubernetes.tf

@@ -0,0 +1,6 @@
+provider "kubernetes" {
+  host                   = module.aks.cluster_fqdn
+  cluster_ca_certificate = base64decode(module.aks.cluster_ca_certificate)
+  client_certificate     = base64decode(module.aks.client_certificate)
+  client_key             = base64decode(module.aks.client_key)
+}

clouds/azure/locals.tf → terraform/clouds/azure/locals.tf

@@ -4,4 +4,5 @@ locals {
     name     = var.create_resource_group ? azurerm_resource_group.main[0].name : var.resource_group_name
     location = var.location
   }
+  db_url = format("postgresql://console:%s@%s:5432/console", random_password.password.result, module.postgresql.server_fqdn)
 }