Install Apache Druid in shared responsibility model with Data Platform

_sub/compute/k8s-fluxcd/main.tf

@@ -35,6 +35,7 @@ resource "flux_bootstrap_git" "this" {
 # --------------------------------------------------
 
 resource "github_repository_file" "flux_monitoring_config_path" {
+ count = var.enable_monitoring ? 1 : 0
  repository = var.repository_name
  branch = data.github_branch.flux_branch.branch
  file = "${local.cluster_target_path}/${local.app_install_name}.yaml"
@@ -69,4 +70,4 @@ resource "github_repository_file" "custom_folder" {
  file = "platform-apps/${var.cluster_name}/custom/README.md"
  content = local.custom_folder_readme
  overwrite_on_create = var.overwrite_on_create
-}
+}

_sub/compute/k8s-fluxcd/vars.tf

@@ -62,3 +62,9 @@ variable "token" {
 variable "cluster_ca_certificate" {
  type = string
 }
+
+variable "enable_monitoring" {
+ type = bool
+ default = false
+ description = "Enable monitoring for Flux"
+}

_sub/compute/k8s-shared-manifests/main.tf

@@ -0,0 +1,29 @@
+# --------------------------------------------------
+# Flux CD in a shared responsibility model with
+# other platform teams
+# --------------------------------------------------
+
+data "github_repository" "main" {
+ full_name = "${var.repo_owner}/${var.repo_name}"
+}
+
+locals {
+ default_repo_branch = data.github_repository.main.default_branch
+ repo_branch = length(var.repo_branch) > 0 ? var.repo_branch : local.default_repo_branch
+ cluster_repo_path = "clusters/${var.cluster_name}"
+}
+
+resource "github_repository_file" "shared_manifests" {
+ repository = var.repo_name
+ branch = local.repo_branch
+ file = "${local.cluster_repo_path}/shared-manifests.yaml"
+ content = templatefile("${path.module}/values/shared-manifests.yaml", {
+ shared_manifests_repo_url = var.shared_manifests_repo_url
+ shared_manifests_repo_branch = var.shared_manifests_repo_branch
+ overlay_folder = var.overlay_folder
+ account_id = var.account_id
+ role_name = var.role_name
+ prune = var.prune
+ })
+ overwrite_on_create = var.overwrite_on_create
+}

_sub/compute/k8s-shared-manifests/values/shared-manifests.yaml

@@ -0,0 +1,73 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: ssm-secrets
+ namespace: flux-system
+ annotations:
+ eks.amazonaws.com/role-arn: arn:aws:iam::${account_id}:role/${role_name}
+ eks.amazonaws.com/sts-regional-endpoints: "true"
+---
+apiVersion: external-secrets.io/v1beta1
+kind: SecretStore
+metadata:
+ name: shared-manifests-git
+ namespace: flux-system
+spec:
+ provider:
+ aws:
+ service: ParameterStore
+ region: eu-west-1
+ auth:
+ jwt:
+ serviceAccountRef:
+ name: ssm-secrets
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+ name: shared-manifests-git
+ namespace: flux-system
+spec:
+ refreshInterval: 1m
+ secretStoreRef:
+ kind: SecretStore
+ name: shared-manifests-git
+ target:
+ name: shared-manifests-git
+ creationPolicy: Owner
+ data:
+ - secretKey: username
+ remoteRef:
+ key: /github/shared-manifests/owner
+ - secretKey: password
+ remoteRef:
+ key: /github/shared-manifests/token
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+ name: shared-manifests-git
+ namespace: flux-system
+spec:
+ interval: 1m0s
+ secretRef:
+ name: shared-manifests-git
+ ref:
+ branch: ${shared_manifests_repo_branch}
+ url: ${shared_manifests_repo_url}
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+ name: shared-manifests
+ namespace: flux-system
+spec:
+ interval: 1m0s
+ dependsOn:
+ - name: flux-system
+ sourceRef:
+ kind: GitRepository
+ name: shared-manifests-git
+ path: ./infrastructure/${overlay_folder}
+ prune: ${prune}

_sub/compute/k8s-shared-manifests/vars.tf

@@ -0,0 +1,56 @@
+variable "cluster_name" {
+ type = string
+}
+
+variable "overlay_folder" {
+ type = string
+}
+
+variable "repo_owner" {
+ type = string
+ description = "Name of the repo owner (previously: organization)"
+ sensitive = true
+}
+
+variable "repo_name" {
+ type = string
+ description = "Name of the Github repo to store the manifests in"
+}
+
+variable "repo_branch" {
+ type = string
+ description = "Override the default branch of the repo (optional)"
+ default = "main"
+}
+
+variable "overwrite_on_create" {
+ type = bool
+ default = true
+ description = "Enable overwriting existing files"
+}
+
+variable "shared_manifests_repo_url" {
+ type = string
+ default = ""
+ description = "The https url for your GitOps manifests"
+}
+
+variable "shared_manifests_repo_branch" {
+ type = string
+ default = "main"
+ description = "The default branch for your GitOps manifests"
+}
+
+variable "prune" {
+ type = bool
+ default = true
+ description = "Enable Garbage collection"
+}
+
+variable "account_id" {
+ type = string
+}
+
+variable "role_name" {
+ type = string
+}

_sub/compute/k8s-shared-manifests/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+ required_version = ">= 1.3.0, < 1.6.0"
+
+ required_providers {
+ github = {
+ source = "integrations/github"
+ version = "~> 6.3.0"
+ }
+ }
+}

_sub/compute/k8s-shared-manifests/versions.tofu

@@ -0,0 +1,10 @@
+terraform {
+ required_version = ">= 1.8.0"
+
+ required_providers {
+ github = {
+ source = "integrations/github"
+ version = "~> 6.3.0"
+ }
+ }
+}

compute/k8s-services/dependencies.tf

@@ -260,7 +260,8 @@ locals {
 # --------------------------------------------------
 
 locals {
- fluxcd_apps_repo_url = "${var.fluxcd_apps_git_provider_url}${var.fluxcd_apps_repo_owner}/${var.fluxcd_apps_repo_name}"
+ fluxcd_apps_repo_url = "${var.fluxcd_apps_git_provider_url}${var.fluxcd_apps_repo_owner}/${var.fluxcd_apps_repo_name}"
+ shared_manifests_repo_url = "${var.fluxcd_apps_git_provider_url}${var.shared_manifests_repo_owner}/${var.shared_manifests_repo_name}"
 }
 
 # --------------------------------------------------

compute/k8s-services/main.tf

@@ -458,6 +458,7 @@ module "platform_fluxcd" {
  endpoint = data.aws_eks_cluster.eks.endpoint
  token = data.aws_eks_cluster_auth.eks.token
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.eks.certificate_authority[0].data)
+ enable_monitoring = var.monitoring_kube_prometheus_stack_deploy || var.grafana_deploy ? true : false
 
  providers = {
  github = github.fluxcd
@@ -995,3 +996,51 @@ module "github_arc_runners" {
 
  depends_on = [module.platform_fluxcd, module.github_arc_ss_controller]
 }
+
+# --------------------------------------------------
+# Flux CD in a shared responsibility model with
+# other platform teams
+# --------------------------------------------------
+
+module "shared_manifests_git_owner" {
+ source = "../../_sub/security/ssm-parameter-store"
+ count = var.shared_manifests_deploy ? 1 : 0
+ key_name = "/github/shared-manifests/owner"
+ key_description = "Git owner for the shared Flux manifests"
+ key_value = var.fluxcd_bootstrap_repo_owner
+ tag_createdby = var.ssm_param_createdby != null ? var.ssm_param_createdby : "k8s-services"
+}
+
+module "shared_manifests_git_token" {
+ source = "../../_sub/security/ssm-parameter-store"
+ count = var.shared_manifests_deploy ? 1 : 0
+ key_name = "/github/shared-manifests/token"
+ key_description = "Git owner's token for the shared Flux manifests"
+ key_value = var.fluxcd_bootstrap_repo_owner_token
+ tag_createdby = var.ssm_param_createdby != null ? var.ssm_param_createdby : "k8s-services"
+}
+
+module "shared_manifests" {
+ source = "../../_sub/compute/k8s-shared-manifests"
+ count = var.shared_manifests_deploy ? 1 : 0
+ cluster_name = var.eks_cluster_name
+ overlay_folder = var.shared_manifests_overlay_folder
+ repo_owner = var.fluxcd_bootstrap_repo_owner
+ repo_name = var.fluxcd_bootstrap_repo_name
+ repo_branch = var.fluxcd_bootstrap_repo_branch
+ overwrite_on_create = var.fluxcd_bootstrap_overwrite_on_create
+ shared_manifests_repo_url = local.shared_manifests_repo_url
+ shared_manifests_repo_branch = var.shared_manifests_repo_branch
+ account_id = var.aws_workload_account_id
+ role_name = var.external_secrets_ssm_iam_role_name
+
+ providers = {
+ github = github.fluxcd
+ }
+
+ depends_on = [
+ module.shared_manifests_git_owner,
+ module.shared_manifests_git_token,
+ module.external_secrets_ssm
+ ]
+}

compute/k8s-services/vars.tf

@@ -468,7 +468,6 @@ variable "fluxcd_bootstrap_overwrite_on_create" {
  description = "Enable overwriting existing files"
 }
 
-
 # --------------------------------------------------
 # GitOps apps used by Flux CD
 # --------------------------------------------------
@@ -1613,3 +1612,48 @@ variable "github_arc_runners_memory_limit" {
  description = "Memory request for the runner pods"
  default = "8Gi"
 }
+
+# --------------------------------------------------
+# Optional
+# --------------------------------------------------
+
+variable "ssm_param_createdby" {
+ type = string
+ description = "The value that will be used for the createdBy key when tagging any SSM parameters"
+ default = null
+}
+
+# --------------------------------------------------
+# Flux CD in a shared responsibility model with
+# other platform teams
+# --------------------------------------------------
+
+variable "shared_manifests_repo_name" {
+ type = string
+ default = ""
+ description = "The repo name for your GitOps manifests"
+}
+
+variable "shared_manifests_repo_branch" {
+ type = string
+ default = "main"
+ description = "The default branch for your GitOps manifests"
+}
+
+variable "shared_manifests_repo_owner" {
+ type = string
+ default = "main"
+ description = "The repo owner for your GitOps manifests"
+}
+
+variable "shared_manifests_deploy" {
+ type = bool
+ description = "Deploy Flux manifests from a shared responsibily repo"
+ default = false
+}
+
+variable "shared_manifests_overlay_folder" {
+ type = string
+ description = "Which overlay folder to deploy"
+ default = "production"
+}

test/integration/eu-west-1/k8s-qa/services/terragrunt.hcl

@@ -291,8 +291,20 @@ inputs = {
  # --------------------------------------------------
  # Github ARC SS Controller
  # --------------------------------------------------
- 
+
  github_arc_ss_controller_deploy = true
  github_arc_ss_controller_helm_chart_version = "0.9.3"
 
+ # --------------------------------------------------
+ # Flux CD in a shared responsibility model with
+ # other platform teams
+ # --------------------------------------------------
+
+ shared_manifests_repo_name = "shared-manifests"
+ shared_manifests_repo_branch = "main"
+ shared_manifests_repo_owner = "dfds"
+
+ shared_manifests_deploy = true
+ shared_manifests_overlay_folder = "qa"
+
 }