Skip to content

Commit 98e775c

Browse files
matejhasulmatejhasul
authored
refactor(addon): switch to universal addon (#29)
* refactor: switch to universal addon This is first part - replace content by universal addon * feat(modules): remove modules dir All modules are loaded from universal-addon * feat(addons): remove oidc * fixup! feat(addons): remove oidc * feat(main): initial setup of main * fix(setup): remove renovate config * fixup! fix(setup): remove renovate config * feat(ci): install kubectl * feat(iam): add default irsa policy * fix(doc): fix docs after fucked-up rebase * fix(ci): remove renovate config * fix(main): change addon name * feat(iam): load default policy with datasource instead of file * feat(iam): make aws partition configurable * fix(iam): rename default_policy to iam * feat(pod identity): plumb pod identity * fix(pod identity): change default value for service_account_namespace * feat(pod identity): use similiar variables as in addon-irsa * feat(pod identity): finally make all the conditions work * refactor(pod identity): make resources names consistent * doc(examples): fix examples And add example how to use pod identity instead of irsa * fix(addon-irsa): fix processing of irsa_additional_policies Same as in lablabs/terraform-aws-eks-universal-addon#38 * refactor(pod-identity): rename pod_identity.tf to pod-identity.tf * refactor(pod-identity): prefix local vars in pod-identity.tf * fix(pod-identity): remove try for service_account_name * refactor(pod-identity): remove redundant () for pod_identity_policy_enabled condition * fix(pod-identity): use try() to set pod_identy_policy to empty string when null * fix(iam): add local var for irsa_policy_enabled * fix(main): do not explicitely set helm_chart_name Correct value is taken from local.addon.name * fix(main): use try() to set empty string to irsa_policy if null * fix(main): use irsa_policy_enabled from locals * feat(irsa): add migrations for irsa * feat(addon): add migration resources * feat(examples): Make examples work Upgrade modules and make sure that at least helm examples are working * feat(pod-identity): use pod identity from irsa module * fix(pod identity): fix conditions * fixup! fix(pod identity): fix conditions * fix(pod identity): set pod_identity_policy_enabled to true by default. It will do no harm and keep the default in sync with irsa_policy_enabled. * feat(addon): add moved blocks to ease migration * refactor(irsa): make tflint happy * fix(iam): fix condition for irsa policy * fix(migrations): use old name for irsa-related resources Resources are just moved to correct destination (into irsa module). It is responsibility of irsa module itself to rename the resources. * fix(migrations): removed indexes from moved blocks Not necessary at all * fix(variables): update variables from latest universal-addon * fix(universal-addon): use univeral addon from specific commit * fix(migrations): add moved blocks for all installation methods * fix(ci): use github workflows from universal addon * fix(ci): remove renovate from gh workflow * fix(variables): add clusterName to values Also add validation * fix(main): update null handling for *_policy * fix(doc): add link to lb-controller repo * fix(docs): add repo link to main.tf * fix(docs): remove empty line * fix(examples): remove extra line
1 parent 40a0fee commit 98e775c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+1812
-1220
lines changed

‎.github/workflows/pre-commit.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: pre-commit
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
branches:
7+
- main
8+
- master
9+
10+
permissions:
11+
contents: read
12+
13+
concurrency:
14+
group: pre-commit-${{ github.ref }}
15+
cancel-in-progress: false
16+
17+
env:
18+
# renovate: datasource=github-releases depName=asdf-vm/asdf
19+
ASDF_VERSION: 31e8c93004abd76253d186b8896785895069749b # v0.15.0 # pragma: allowlist secret
20+
21+
jobs:
22+
pre-commit:
23+
runs-on: ubuntu-24.04
24+
steps:
25+
- name: Checkout
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
with:
28+
persist-credentials: false
29+
30+
- name: Setup ASDF
31+
uses: asdf-vm/actions/setup@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2
32+
33+
- name: Cache ASDF
34+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
35+
id: asdf-cache
36+
with:
37+
# https://github.com/asdf-vm/asdf/blob/master/.gitignore
38+
path: |
39+
~/.asdf/installs
40+
~/.asdf/plugins
41+
~/.asdf/shims
42+
key: ${{ runner.os }}-asdf-${{ hashFiles('.tool-versions') }}
43+
restore-keys: ${{ runner.os }}-asdf-
44+
45+
- name: Install ASDF
46+
uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2
47+
if: ${{ steps.asdf-cache.outputs.cache-hit != 'true' }}
48+
with:
49+
asdf_branch: ${{ env.ASDF_VERSION }}
50+
51+
- name: Reshim installed ASDF tools
52+
shell: bash
53+
run: asdf reshim
54+
55+
- name: Cache pip
56+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
57+
with:
58+
path: ~/.cache/pip/
59+
key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt', '.pre-commit-config.yaml') }}
60+
restore-keys: |
61+
${{ runner.os }}-pip-
62+
63+
- name: Install pip dependencies
64+
run: pip install -r requirements.txt
65+
66+
- name: Run pre-commit
67+
run: pre-commit run --show-diff-on-failure --color=always --all-files
68+
env:
69+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # required for zizmor

‎.github/workflows/pre-commit.yml‎

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎.github/workflows/release-drafter.yml‎ renamed to ‎.github/workflows/release-drafter.yaml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,4 @@
1-
name: Release Drafter
2-
3-
permissions:
4-
contents: write
5-
pull-requests: read
1+
name: Release drafter
62

73
on:
84
push:
@@ -11,13 +7,21 @@ on:
117
- master
128

139
pull_request:
14-
types: [opened, reopened, synchronize, labeled]
10+
types:
11+
- opened
12+
- reopened
13+
- synchronize
14+
- labeled
15+
16+
permissions:
17+
contents: write
18+
pull-requests: read
1519

1620
jobs:
17-
update_release_draft:
18-
runs-on: ubuntu-22.04
21+
release-drafter:
22+
runs-on: ubuntu-24.04
1923
steps:
20-
- uses: release-drafter/release-drafter@v5
24+
- uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
2125
with:
2226
config-name: RELEASE_DRAFTER.yml
2327
env:

‎.github/workflows/template-sync.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: Template sync
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: '0 0 * * *' # every day at midnight
7+
8+
permissions: {}
9+
10+
concurrency:
11+
group: pre-commit
12+
cancel-in-progress: false
13+
14+
env:
15+
# renovate: datasource=github-releases depName=asdf-vm/asdf
16+
ASDF_VERSION: 31e8c93004abd76253d186b8896785895069749b # v0.15.0 # pragma: allowlist secret
17+
18+
jobs:
19+
universal-addon:
20+
if: github.repository != 'lablabs/terraform-aws-eks-universal-addon'
21+
runs-on: ubuntu-24.04
22+
steps:
23+
- name: Generate GitHub App token
24+
id: template-sync-app-token
25+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
26+
with:
27+
app-id: ${{ secrets.LARA_TEMPLATE_SYNC_APP_ID }}
28+
private-key: ${{ secrets.LARA_TEMPLATE_SYNC_APP_PRIVATE_KEY }}
29+
repositories: ${{ github.event.repository.name }}
30+
owner: ${{ github.repository_owner }}
31+
32+
- name: Checkout
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
34+
with:
35+
token: ${{ steps.template-sync-app-token.outputs.token }} # needed for private repositories
36+
persist-credentials: false
37+
38+
- name: Sync universal-addon template
39+
uses: AndreasAugustin/actions-template-sync@bcb94410a4f1dffdfe5eaabc8234c3b8e76ebc5b # v2.5.1
40+
with:
41+
source_gh_token: ${{ steps.template-sync-app-token.outputs.token }}
42+
source_repo_path: lablabs/terraform-aws-eks-universal-addon
43+
upstream_branch: main
44+
45+
target_gh_token: ${{ steps.template-sync-app-token.outputs.token }}
46+
47+
git_remote_pull_params: --allow-unrelated-histories --squash --strategy=recursive --no-tags -X theirs
48+
49+
pr_labels: kind/sync
50+
pr_branch_name_prefix: "feat/universal-addon-sync"
51+
pr_title: "feat(sync): sync universal-addon changes"
52+
pr_commit_msg: "feat(sync): sync universal-addon changes"
53+
54+
is_pr_cleanup: true
55+
56+
- name: Setup ASDF
57+
uses: asdf-vm/actions/setup@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2
58+
59+
- name: Cache ASDF
60+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
61+
id: asdf-cache
62+
with:
63+
# https://github.com/asdf-vm/asdf/blob/master/.gitignore
64+
path: |
65+
~/.asdf/installs
66+
~/.asdf/plugins
67+
~/.asdf/shims
68+
key: ${{ runner.os }}-asdf-${{ hashFiles('.tool-versions') }}
69+
restore-keys: ${{ runner.os }}-asdf-
70+
71+
- name: Install ASDF
72+
uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2
73+
if: ${{ steps.asdf-cache.outputs.cache-hit != 'true' }}
74+
with:
75+
asdf_branch: ${{ env.ASDF_VERSION }}
76+
77+
- name: Reshim installed ASDF tools
78+
shell: bash
79+
run: asdf reshim
80+
81+
- name: Cache pip
82+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
83+
with:
84+
path: ~/.cache/pip/
85+
key: ${{ runner.os }}-pip-${{ hashFiles('.pre-commit-config.yaml') }}
86+
restore-keys: |
87+
${{ runner.os }}-pip-
88+
89+
- name: Update README.md
90+
run: pre-commit run --show-diff-on-failure --color=always terraform_docs --all-files || true
91+
92+
- name: Commit and push README.md
93+
uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
94+
with:
95+
add: README.md
96+
message: "docs: update README.md"

‎.github/workflows/validate.yaml‎

Lines changed: 27 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -11,42 +11,45 @@ on:
1111
- master
1212

1313
jobs:
14-
versionExtract:
14+
extract-version:
1515
name: Extract min/max Terraform versions
16-
runs-on: ubuntu-22.04
16+
runs-on: ubuntu-24.04
1717

1818
steps:
1919
- name: Checkout
20-
uses: actions/checkout@v3
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
with:
22+
persist-credentials: false
2123

2224
- name: Extract Terraform min/max versions
23-
id: minMax
24-
uses: clowdhaus/terraform-min-max@main
25+
id: terraform-min-max
26+
uses: clowdhaus/terraform-min-max@f489335873df04c3ce04b5e73f385a726d910039 # v1.3.2
2527
with:
2628
directory: .
2729
outputs:
28-
minVersion: ${{ steps.minMax.outputs.minVersion }}
29-
maxVersion: ${{ steps.minMax.outputs.maxVersion }}
30+
minVersion: ${{ steps.terraform-min-max.outputs.minVersion }}
31+
maxVersion: ${{ steps.terraform-min-max.outputs.maxVersion }}
3032

3133
terraform-validate:
32-
runs-on: ubuntu-22.04
33-
needs: versionExtract
34+
runs-on: ubuntu-24.04
35+
needs: extract-version
3436
strategy:
3537
matrix:
3638
tf_ver:
37-
- ${{ needs.versionExtract.outputs.minVersion }}
38-
- ${{ needs.versionExtract.outputs.maxVersion }}
39-
39+
- ${{ needs.extract-version.outputs.minVersion }}
40+
- ${{ needs.extract-version.outputs.maxVersion }}
4041
steps:
41-
- uses: actions/checkout@v3
42-
- uses: hashicorp/setup-terraform@v2
43-
with:
44-
terraform_version: ${{ matrix.tf_ver }}
45-
46-
- name: Terraform Init
47-
id: init
48-
run: terraform init
49-
50-
- name: Terraform Validate
51-
id: validate
52-
run: terraform validate
42+
- name: Checkout
43+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
44+
with:
45+
persist-credentials: false
46+
47+
- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
48+
with:
49+
terraform_version: ${{ matrix.tf_ver }}
50+
51+
- name: Terraform Init
52+
run: terraform init
53+
54+
- name: Terraform Validate
55+
run: terraform validate

‎.gitignore‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,3 @@ override.tf.json
3232
# Ignore CLI configuration files
3333
.terraformrc
3434
terraform.rc
35-
36-
.terraform.lock.hcl

‎.pre-commit-config.yaml‎

Lines changed: 33 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,49 @@
11
repos:
22
- repo: https://github.com/pre-commit/pre-commit-hooks
3-
rev: v4.4.0
3+
rev: v5.0.0
44
hooks:
55
- id: trailing-whitespace
6+
args: ["--markdown-linebreak-ext=md"]
67
- id: check-merge-conflict
78
- id: detect-aws-credentials
8-
args: ['--allow-missing-credentials']
9+
args: ["--allow-missing-credentials"]
910
- id: detect-private-key
1011
- id: end-of-file-fixer
1112

1213
- repo: https://github.com/antonbabenko/pre-commit-terraform
13-
rev: v1.83.1
14+
rev: v1.96.3
1415
hooks:
15-
- id: terraform_fmt
16-
- id: terraform_tflint
17-
args:
18-
- --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
19-
- id: terraform_validate
20-
- id: terraform_checkov
21-
args:
22-
- '--args=--skip-check CKV_TF_1' #CKV_TF_1: "Ensure Terraform module sources use a commit hash"
23-
- id: terraform_docs
24-
args:
25-
- '--args=--config=.terraform-docs.yml'
16+
- id: terraform_validate
17+
- id: terraform_fmt
18+
- id: terraform_providers_lock
19+
args:
20+
- --hook-config=--mode=only-check-is-current-lockfile-cross-platform
21+
- --args=-platform=darwin_amd64
22+
- --args=-platform=darwin_arm64
23+
- --args=-platform=linux_amd64
24+
- id: terraform_tflint
25+
args:
26+
- --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
27+
- id: terraform_checkov
28+
args:
29+
- "--args=--quiet --skip-check CKV_TF_1" #CKV_TF_1: "Ensure Terraform module sources use a commit hash"
30+
- id: terraform_docs
31+
args:
32+
- "--args=--config=.terraform-docs.yml"
2633

2734
- repo: https://github.com/Yelp/detect-secrets
28-
rev: v1.4.0
35+
rev: v1.5.0
2936
hooks:
3037
- id: detect-secrets
31-
args: ['--baseline', '.secrets.baseline']
38+
args: ["--baseline", ".secrets.baseline"]
3239
exclude: terraform.tfstate
40+
41+
- repo: local
42+
hooks:
43+
- id: sync-variables
44+
name: Sync module variables
45+
entry: ./scripts/sync-variables.py
46+
language: system
47+
types: [python]
48+
always_run: true
49+
pass_filenames: false

0 commit comments

Comments
 (0)