diff --git a/modules/azure/aks-global/README.md b/modules/azure/aks-global/README.md
index 6e6d5ec86..709c3167b 100644
--- a/modules/azure/aks-global/README.md
+++ b/modules/azure/aks-global/README.md
@@ -34,7 +34,7 @@ This module is used to create resources that are used by AKS clusters.
| group\_name\_separator | Separator for group names | `string` | `"-"` | no |
| location\_short | The Azure region short name. | `string` | n/a | yes |
| name | The name to use for the deploy | `string` | n/a | yes |
-| namespaces | The namespaces that should be created in Kubernetes. | list(
object({
name = string
delegate_resource_group = bool
flux = object({
enabled = bool
repo = string
})
})
)
| n/a | yes |
+| namespaces | The namespaces that should be created in Kubernetes. | list(
object({
name = string
delegate_resource_group = bool
})
)
| n/a | yes |
| public\_ip\_prefix\_configuration | Configuration for public ip prefix | object({
count = number
prefix_length = number
}) | {
"count": 2,
"prefix_length": 30
} | no |
| service\_principal\_name\_prefix | Prefix for service principals | `string` | `"sp"` | no |
| subscription\_name | The commonName for the subscription | `string` | n/a | yes |
diff --git a/modules/azure/aks-global/variables.tf b/modules/azure/aks-global/variables.tf
index 4fd7fa1ea..543458200 100644
--- a/modules/azure/aks-global/variables.tf
+++ b/modules/azure/aks-global/variables.tf
@@ -29,10 +29,6 @@ variable "namespaces" {
object({
name = string
delegate_resource_group = bool
- flux = object({
- enabled = bool
- repo = string
- })
})
)
}
@@ -87,4 +83,4 @@ variable "aks_group_name_prefix" {
description = "Prefix for AKS Azure AD groups"
type = string
default = "aks"
-}
\ No newline at end of file
+}
diff --git a/modules/kubernetes/aks-core/README.md b/modules/kubernetes/aks-core/README.md
index 86ebcf3a7..130b26491 100644
--- a/modules/kubernetes/aks-core/README.md
+++ b/modules/kubernetes/aks-core/README.md
@@ -31,13 +31,15 @@ This module is used to create AKS clusters.
| environment | The environment name to use for the deploy | `string` | n/a | yes |
| external\_dns\_config | External DNS configuration | object({
client_id = string
resource_id = string
}) | n/a | yes |
| external\_dns\_enabled | Should External DNS be enabled | `bool` | `true` | no |
+| fluxcd\_v1\_config | Configuration for fluxcd-v1 | object({
azure_devops = object({
pat = string
org = string
proj = string
})
}) | n/a | yes |
+| fluxcd\_v1\_enabled | Should fluxcd-v1 be enabled | `bool` | `false` | no |
| fluxcd\_v2\_config | Configuration for fluxcd-v2 | object({
type = string
github = object({
owner = string
})
azure_devops = object({
pat = string
org = string
proj = string
})
}) | n/a | yes |
| fluxcd\_v2\_enabled | Should fluxcd-v2 be enabled | `bool` | `true` | no |
| ingress\_nginx\_enabled | Should Ingress NGINX be enabled | `bool` | `true` | no |
| kubernetes\_network\_policy\_default\_deny | If network policies should by default deny cross namespace traffic | `bool` | `false` | no |
| location\_short | The Azure region short name. | `string` | n/a | yes |
| name | The commonName to use for the deploy | `string` | n/a | yes |
-| namespaces | The namespaces that should be created in Kubernetes. | list(
object({
name = string
delegate_resource_group = bool
labels = map(string)
flux = object({
enabled = bool
repo = string
})
})
)
| n/a | yes |
+| namespaces | The namespaces that should be created in Kubernetes. | list(
object({
name = string
labels = map(string)
flux = object({
enabled = bool
github = object({
repo = string
})
azure_devops = object({
org = string
proj = string
repo = string
})
})
})
)
| n/a | yes |
| opa\_gatekeeper\_enabled | Should OPA Gatekeeper be enabled | `bool` | `true` | no |
| velero\_config | Velero configuration | object({
azure_storage_account_name = string
azure_storage_account_container = string
identity = object({
client_id = string
resource_id = string
})
}) | n/a | yes |
| velero\_enabled | Should Velero be enabled | `bool` | `false` | no |
diff --git a/modules/kubernetes/aks-core/modules.tf b/modules/kubernetes/aks-core/modules.tf
index 6de9bf7e8..e7092f5c4 100644
--- a/modules/kubernetes/aks-core/modules.tf
+++ b/modules/kubernetes/aks-core/modules.tf
@@ -29,6 +29,26 @@ module "opa_gatekeeper" {
]
}
+# FluxCD v1
+module "fluxcd_v1_azure_devops" {
+ depends_on = [kubernetes_namespace.group]
+ for_each = {
+ for s in ["fluxcd-v1"] :
+ s => s
+ if var.fluxcd_v1_enabled
+ }
+
+ source = "../../kubernetes/fluxcd-v1"
+
+ azure_devops_pat = var.fluxcd_v1_config.azure_devops.pat
+ azure_devops_org = var.fluxcd_v1_config.azure_devops.org
+ environment = var.environment
+ namespaces = [for ns in var.namespaces : {
+ name = ns.name
+ flux = ns.flux
+ }]
+}
+
# FluxCD v2
module "fluxcd_v2_azure_devops" {
depends_on = [kubernetes_namespace.group]
diff --git a/modules/kubernetes/aks-core/variables.tf b/modules/kubernetes/aks-core/variables.tf
index 04ade6df0..6006d1da6 100644
--- a/modules/kubernetes/aks-core/variables.tf
+++ b/modules/kubernetes/aks-core/variables.tf
@@ -37,12 +37,18 @@ variable "namespaces" {
description = "The namespaces that should be created in Kubernetes."
type = list(
object({
- name = string
- delegate_resource_group = bool
- labels = map(string)
+ name = string
+ labels = map(string)
flux = object({
enabled = bool
- repo = string
+ github = object({
+ repo = string
+ })
+ azure_devops = object({
+ org = string
+ proj = string
+ repo = string
+ })
})
})
)
@@ -54,6 +60,23 @@ variable "kubernetes_network_policy_default_deny" {
default = false
}
+variable "fluxcd_v1_enabled" {
+ description = "Should fluxcd-v1 be enabled"
+ type = bool
+ default = false
+}
+
+variable "fluxcd_v1_config" {
+ description = "Configuration for fluxcd-v1"
+ type = object({
+ azure_devops = object({
+ pat = string
+ org = string
+ proj = string
+ })
+ })
+}
+
variable "fluxcd_v2_enabled" {
description = "Should fluxcd-v2 be enabled"
type = bool
diff --git a/modules/kubernetes/azdo-proxy/README.md b/modules/kubernetes/azdo-proxy/README.md
deleted file mode 100644
index e8722b909..000000000
--- a/modules/kubernetes/azdo-proxy/README.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Azure DevOps Proxy (azdo-proxy)
-
-This module is used to add [`azdo-proxy`](https://github.com/XenitAB/azdo-proxy) to Kubernetes clusters.
-
-## Details
-
-Azure DevOps Proxy is used to grant convert a single Azure DevOps PAT (Personal Access Token) to a unique local secret in the cluster.
-
-This unique secret can only be used to communicate with a single repository in Azure DevOps, compared to the PAT which may have access to the whole organization.
-
-## Requirements
-
-| Name | Version |
-|------|---------|
-| terraform | 0.13.5 |
-| azurerm | 2.35.0 |
-| helm | 1.3.2 |
-| kubernetes | 1.13.3 |
-| random | 3.0.0 |
-
-## Providers
-
-| Name | Version |
-|------|---------|
-| azurerm | 2.35.0 |
-| helm | 1.3.2 |
-| kubernetes | 1.13.3 |
-| random | 3.0.0 |
-
-## Inputs
-
-| Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
-| azdo\_proxy\_config\_secret\_name | The name of the secret storing the azdo-proxy configuration | `string` | `"azdo-proxy-config"` | no |
-| azdo\_proxy\_helm\_chart\_name | The helm chart name for azdo-proxy | `string` | `"azdo-proxy"` | no |
-| azdo\_proxy\_helm\_chart\_version | The helm chart version for azdo-proxy | `string` | `"v0.3.0"` | no |
-| azdo\_proxy\_helm\_repository | The helm repository for azdo-proxy | `string` | `"https://xenitab.github.io/azdo-proxy/"` | no |
-| azdo\_proxy\_namespace | The namespace to be used by Azure DevOps Proxy | `string` | `"azdo-proxy"` | no |
-| azure\_devops\_domain | The domain of Azure DevOps | `string` | `"dev.azure.com"` | no |
-| azure\_devops\_organization | Azure Devops organization used to configure azdo-proxy | `string` | n/a | yes |
-| azure\_devops\_pat | Azure DevOps PAT (Personal Access Token) | `string` | `""` | no |
-| azure\_devops\_pat\_keyvault | Object to read Azure DevOps PAT (Personal Access Token) from Azure KeyVault | object({
read_azure_devops_pat_from_azure_keyvault = bool
azure_keyvault_id = string
key = string
}) | n/a | yes |
-| namespaces | The namespaces that should be created in Kubernetes. | list(
object({
name = string
flux = object({
enabled = bool
azdo_org = string
azdo_project = string
azdo_repo = string
})
})
)
| n/a | yes |
-
-## Outputs
-
-| Name | Description |
-|------|-------------|
-| azdo\_proxy\_local\_passwords | The local passwords for Azure DevOps Proxy |
-
diff --git a/modules/kubernetes/azdo-proxy/main.tf b/modules/kubernetes/azdo-proxy/main.tf
deleted file mode 100644
index 73552d264..000000000
--- a/modules/kubernetes/azdo-proxy/main.tf
+++ /dev/null
@@ -1,106 +0,0 @@
-/**
- * # Azure DevOps Proxy (azdo-proxy)
- *
- * This module is used to add [`azdo-proxy`](https://github.com/XenitAB/azdo-proxy) to Kubernetes clusters.
- *
- * ## Details
- *
- * Azure DevOps Proxy is used to grant convert a single Azure DevOps PAT (Personal Access Token) to a unique local secret in the cluster.
- *
- * This unique secret can only be used to communicate with a single repository in Azure DevOps, compared to the PAT which may have access to the whole organization.
- */
-
-terraform {
- required_version = "0.13.5"
-
- required_providers {
- azurerm = {
- version = "2.35.0"
- source = "hashicorp/azurerm"
- }
- random = {
- source = "hashicorp/random"
- version = "3.0.0"
- }
- kubernetes = {
- source = "hashicorp/kubernetes"
- version = "1.13.3"
- }
- helm = {
- source = "hashicorp/helm"
- version = "1.3.2"
- }
- }
-}
-
-data "azurerm_key_vault_secret" "azdo_proxy_pat" {
- for_each = {
- for azure_devops_pat_keyvault in [var.azure_devops_pat_keyvault] :
- "azdo-proxy-pat" => azure_devops_pat_keyvault
- if var.azure_devops_pat_keyvault.read_azure_devops_pat_from_azure_keyvault == true
- }
- name = each.value.key
- key_vault_id = each.value.azure_keyvault_id
-}
-
-resource "random_password" "azdo_proxy" {
- for_each = {
- for ns in var.namespaces :
- ns.name => ns
- }
-
- length = 48
- special = false
-
- keepers = {
- namespace = each.key
- }
-}
-
-locals {
- azdo_proxy_json = {
- domain = var.azure_devops_domain
- pat = var.azure_devops_pat_keyvault.read_azure_devops_pat_from_azure_keyvault ? data.azurerm_key_vault_secret.azdo_proxy_pat["azdo-proxy-pat"].value : var.azure_devops_pat
- organization = var.azure_devops_organization
- repositories = [
- for ns in var.namespaces : {
- project = ns.flux.azdo_project
- name = ns.flux.azdo_repo
- token = random_password.azdo_proxy[ns.name].result
- }
- ]
- }
-}
-
-resource "kubernetes_namespace" "azdo_proxy" {
- metadata {
- labels = {
- name = var.azdo_proxy_namespace
- }
- name = var.azdo_proxy_namespace
- }
-}
-
-resource "kubernetes_secret" "azdo_proxy" {
- metadata {
- name = var.azdo_proxy_config_secret_name
- namespace = kubernetes_namespace.azdo_proxy.metadata[0].name
- }
-
- data = {
- "config.json" = jsonencode(local.azdo_proxy_json)
- }
-}
-
-resource "helm_release" "azdo_proxy" {
- repository = var.azdo_proxy_helm_repository
- chart = var.azdo_proxy_helm_chart_name
- version = var.azdo_proxy_helm_chart_version
- name = kubernetes_namespace.azdo_proxy.metadata[0].name
- namespace = kubernetes_namespace.azdo_proxy.metadata[0].name
-
- set {
- name = "configSecretName"
- value = kubernetes_secret.azdo_proxy.metadata[0].name
- }
-}
diff --git a/modules/kubernetes/azdo-proxy/outputs.tf b/modules/kubernetes/azdo-proxy/outputs.tf
deleted file mode 100644
index 0544982df..000000000
--- a/modules/kubernetes/azdo-proxy/outputs.tf
+++ /dev/null
@@ -1,6 +0,0 @@
-# Azure DevOps local passwords
-output "azdo_proxy_local_passwords" {
- description = "The local passwords for Azure DevOps Proxy"
- value = { for k, v in random_password.azdo_proxy : k => v.result }
- sensitive = true
-}
diff --git a/modules/kubernetes/azdo-proxy/variables.tf b/modules/kubernetes/azdo-proxy/variables.tf
deleted file mode 100644
index 8291cb615..000000000
--- a/modules/kubernetes/azdo-proxy/variables.tf
+++ /dev/null
@@ -1,80 +0,0 @@
-# Object to enable or disable reading Azure DevOps PAT from Azure KeyVault
-variable "azure_devops_pat_keyvault" {
- description = "Object to read Azure DevOps PAT (Personal Access Token) from Azure KeyVault"
- type = object({
- read_azure_devops_pat_from_azure_keyvault = bool
- azure_keyvault_id = string
- key = string
- })
-}
-
-# If var.azure_devops_pat_keyvault.read_azure_devops_pat_from_azure_keyvault == false, use var.azure_devops_pat instead
-variable "azure_devops_pat" {
- description = "Azure DevOps PAT (Personal Access Token)"
- type = string
- default = ""
-}
-
-# Azure DevOps Configuration
-variable "azure_devops_domain" {
- description = "The domain of Azure DevOps"
- type = string
- default = "dev.azure.com"
-}
-
-# Azure DevOps Proxy Namespace
-variable "azdo_proxy_namespace" {
- description = "The namespace to be used by Azure DevOps Proxy"
- type = string
- default = "azdo-proxy"
-}
-
-# Azure DevOps Proxy Configuration Secret name
-variable "azdo_proxy_config_secret_name" {
- description = "The name of the secret storing the azdo-proxy configuration"
- type = string
- default = "azdo-proxy-config" #tfsec:ignore:GEN001
-}
-
-# Azure DevOps Proxy Helm Repositroy
-variable "azdo_proxy_helm_repository" {
- description = "The helm repository for azdo-proxy"
- type = string
- default = "https://xenitab.github.io/azdo-proxy/"
-}
-
-# Azure DevOps Proxy Helm Chart name
-variable "azdo_proxy_helm_chart_name" {
- description = "The helm chart name for azdo-proxy"
- type = string
- default = "azdo-proxy"
-}
-
-# Azure DevOps Proxy Helm Chart version
-variable "azdo_proxy_helm_chart_version" {
- description = "The helm chart version for azdo-proxy"
- type = string
- default = "v0.3.0"
-}
-
-# Azure DevOps Organization to use
-variable "azure_devops_organization" {
- description = "Azure Devops organization used to configure azdo-proxy"
- type = string
-}
-
-# Namespace configuration
-variable "namespaces" {
- description = "The namespaces that should be created in Kubernetes."
- type = list(
- object({
- name = string
- flux = object({
- enabled = bool
- azdo_org = string
- azdo_project = string
- azdo_repo = string
- })
- })
- )
-}
diff --git a/modules/kubernetes/fluxcd-v1/README.md b/modules/kubernetes/fluxcd-v1/README.md
index 98239cdab..f1104f0fc 100644
--- a/modules/kubernetes/fluxcd-v1/README.md
+++ b/modules/kubernetes/fluxcd-v1/README.md
@@ -16,21 +16,26 @@ Will be deprecated as soon as Flux v2 module is finished and tested.
|------|---------|
| terraform | 0.13.5 |
| helm | 1.3.2 |
+| kubernetes | 1.13.3 |
+| random | 3.0.0 |
## Providers
| Name | Version |
|------|---------|
| helm | 1.3.2 |
+| kubernetes | 1.13.3 |
+| random | 3.0.0 |
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
-| azdo\_proxy\_enabled | Should azdo-proxy integration be enabled | `bool` | `true` | no |
-| azdo\_proxy\_local\_passwords | The passwords (per namespace) to communicate with Azure DevOps Proxy | `map(string)` | `{}` | no |
-| fluxcd\_v1\_git\_path | The git path for fluxcd-v1 | `string` | `""` | no |
-| namespaces | The namespaces that should be created in Kubernetes. | list(
object({
name = string
flux = object({
enabled = bool
azdo_org = string
azdo_project = string
azdo_repo = string
})
})
)
| n/a | yes |
+| azure\_devops\_domain | Domain for azure devops | `string` | `"dev.azure.com"` | no |
+| azure\_devops\_org | Azure DevOps organization for bootstrap repository | `string` | n/a | yes |
+| azure\_devops\_pat | PAT to authenticate with Azure DevOps | `string` | n/a | yes |
+| environment | Environment name of the cluster | `string` | n/a | yes |
+| namespaces | The namespaces to configure flux with | list(
object({
name = string
flux = object({
enabled = bool
azure_devops = object({
org = string
proj = string
repo = string
})
})
})
)
| n/a | yes |
## Outputs
diff --git a/modules/kubernetes/fluxcd-v1/main.tf b/modules/kubernetes/fluxcd-v1/main.tf
index a441915c0..7ba77381a 100644
--- a/modules/kubernetes/fluxcd-v1/main.tf
+++ b/modules/kubernetes/fluxcd-v1/main.tf
@@ -16,6 +16,14 @@ terraform {
required_version = "0.13.5"
required_providers {
+ random = {
+ source = "hashicorp/random"
+ version = "3.0.0"
+ }
+ kubernetes = {
+ source = "hashicorp/kubernetes"
+ version = "1.13.3"
+ }
helm = {
source = "hashicorp/helm"
version = "1.3.2"
@@ -23,36 +31,109 @@ terraform {
}
}
+resource "random_password" "azdo_proxy" {
+ for_each = {
+ for ns in var.namespaces :
+ ns.name => ns
+ }
+
+ length = 48
+ special = false
+
+ keepers = {
+ namespace = each.key
+ }
+}
+
locals {
- helm_release_name = "fluxcd-v1"
+ azdo_proxy_json = {
+ domain = var.azure_devops_domain
+ pat = var.azure_devops_pat
+ organization = var.azure_devops_org
+ repositories = [
+ for ns in var.namespaces : {
+ project = ns.flux.azure_devops.proj
+ name = ns.flux.azure_devops.repo
+ token = random_password.azdo_proxy[ns.name].result
+ }
+ ]
+ }
+}
+
+resource "kubernetes_namespace" "azdo_proxy" {
+ metadata {
+ labels = {
+ name = "azdo-proxy"
+ }
+ name = "azdo-proxy"
+ }
+}
+
+resource "kubernetes_secret" "azdo_proxy" {
+ metadata {
+ name = "azdo-proxy-config"
+ namespace = kubernetes_namespace.azdo_proxy.metadata[0].name
+ }
+
+ data = {
+ "config.json" = jsonencode(local.azdo_proxy_json)
+ }
}
-resource "helm_release" "fluxcd_v1" {
+resource "helm_release" "azdo_proxy" {
+ repository = "https://xenitab.github.io/azdo-proxy/"
+ chart = "azdo-proxy"
+ version = "v0.3.0"
+ name = kubernetes_namespace.azdo_proxy.metadata[0].name
+ namespace = kubernetes_namespace.azdo_proxy.metadata[0].name
+
+ set {
+ name = "configSecretName"
+ value = kubernetes_secret.azdo_proxy.metadata[0].name
+ }
+}
+
+resource "helm_release" "fluxcd" {
for_each = {
for ns in var.namespaces :
ns.name => ns
if ns.flux.enabled
}
- name = local.helm_release_name
+ name = "fluxcd"
chart = "${path.module}/charts/flux"
namespace = each.key
- values = [templatefile("${path.module}/templates/values.yaml.tpl", { namespace = each.key, git_url = "https://dev.azure.com/${each.value.flux.azdo_org}/${each.value.flux.azdo_project}/_git/${each.value.flux.azdo_repo}", fluxcd_v1_git_path = var.fluxcd_v1_git_path })]
+ values = [templatefile("${path.module}/templates/fluxcd-values.yaml.tpl", { namespace = each.key, git_url = "https://dev.azure.com/${each.value.flux.azure_devops.org}/${each.value.flux.azure_devops.proj}/_git/${each.value.flux.azure_devops.repo}", environment = var.environment })]
+
+ set_sensitive {
+ name = "git.config.data"
+ value = < ns
+ }
+ repository = "https://charts.fluxcd.io"
+ chart = "helm-operator"
+ version = "1.2.0"
+ name = "helm-operator"
+ namespace = each.key
- dynamic "set_sensitive" {
- for_each = {
- for s in ["azdo-proxy"] :
- s => s
- if var.azdo_proxy_enabled == true
- }
- content {
- name = "git.config.data"
- value = <object({
client_id = string
secret = string
}) | n/a | yes |
-| namespaces | The namespaces that should be created in Kubernetes. | list(
object({
name = string
flux = object({
enabled = bool
azdo_org = string
azdo_project = string
azdo_repo = string
})
})
)
| n/a | yes |
-
-## Outputs
-
-No output.
-
diff --git a/modules/kubernetes/helm-operator/main.tf b/modules/kubernetes/helm-operator/main.tf
deleted file mode 100644
index df9d5ce0d..000000000
--- a/modules/kubernetes/helm-operator/main.tf
+++ /dev/null
@@ -1,64 +0,0 @@
-/**
- * # Helm Operator (helm-operator)
- *
- * This module is used to add [`helm-operator`](https://github.com/fluxcd/helm-operator) to Kubernetes clusters.
- *
- * ## Details
- *
- * This module will create a helm-operator instance in each namespace, and not used for fleet-wide configuration.
- *
- * Will be deprecated as soon as Flux v2 module is finished and tested.
- */
-
-terraform {
- required_version = "0.13.5"
-
- required_providers {
- helm = {
- source = "hashicorp/helm"
- version = "1.3.2"
- }
- }
-}
-
-locals {
- helm_repository = "https://charts.fluxcd.io"
- helm_chart_name = "helm-operator"
- helm_chart_release_name = "helm-operator"
- helm_chart_version = "1.2.0"
-}
-
-resource "helm_release" "helm_operator" {
- for_each = {
- for ns in var.namespaces :
- ns.name => ns
- }
-
- repository = local.helm_repository
- chart = local.helm_chart_name
- version = local.helm_chart_version
- name = local.helm_chart_release_name
- namespace = each.key
-
- values = [templatefile("${path.module}/templates/values.yaml.tpl", { namespace = each.key, acr_name = var.acr_name, helm_operator_credentials = var.helm_operator_credentials, azdo_proxy_enabled = var.azdo_proxy_enabled, azdo_proxy_local_passwords = var.azdo_proxy_local_passwords })]
-
- set {
- name = "configureRepositories.repositories[0].password"
- value = var.helm_operator_credentials.secret
- }
-
- dynamic "set_sensitive" {
- for_each = {
- for s in ["azdo-proxy"] :
- s => s
- if var.azdo_proxy_enabled == true
- }
- content {
- name = "git.config.data"
- value = <