diff --git a/CHANGELOG.md b/CHANGELOG.md index 88e0f24ca..34ca44327 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,8 +9,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ### Added - [#934](https://github.com/XenitAB/terraform-modules/pull/934) Add certificate permissions for resource group AAD group. - - [#906](https://github.com/XenitAB/terraform-modules/pull/906) Add support for kubernetes 1.25 in Azure. +- [#936](https://github.com/XenitAB/terraform-modules/pull/936) Add Spegel to AKS and EKS. ### Changed diff --git a/modules/kubernetes/README.md b/modules/kubernetes/README.md index 422a896b5..734096539 100644 --- a/modules/kubernetes/README.md +++ b/modules/kubernetes/README.md @@ -34,6 +34,7 @@ This directory contains all the Kubernetes Terraform modules. - [`control-plane-logs`](control-plane-logs/README.md) - [`helm-crd`](helm-crd/README.md) - [`helm-crd-oci`](helm-crd-oci/README.md) +- [`spegel`](spegel/README.md) ## Style Guide diff --git a/modules/kubernetes/aks-core/README.md b/modules/kubernetes/aks-core/README.md index b359c897c..0dbacc0bb 100644 --- a/modules/kubernetes/aks-core/README.md +++ b/modules/kubernetes/aks-core/README.md @@ -58,6 +58,7 @@ This module is used to create AKS clusters. | [prometheus\_crd](#module\_prometheus\_crd) | ../../kubernetes/helm-crd | n/a | | [promtail](#module\_promtail) | ../../kubernetes/promtail | n/a | | [reloader](#module\_reloader) | ../../kubernetes/reloader | n/a | +| [spegel](#module\_spegel) | ../../kubernetes/spegel | n/a | | [trivy](#module\_trivy) | ../../kubernetes/trivy | n/a | | [trivy\_crd](#module\_trivy\_crd) | ../../kubernetes/helm-crd | n/a | | [velero](#module\_velero) | ../../kubernetes/velero | n/a | @@ -151,6 +152,7 @@ This module is used to create AKS clusters. | [promtail\_config](#input\_promtail\_config) | Configuration for promtail | 
object({
    azure_key_vault_name = string
    identity = object({
      client_id   = string
      resource_id = string
      tenant_id   = string
    })
    loki_address        = string
    excluded_namespaces = list(string)
  })
| 
{
  "azure_key_vault_name": "",
  "excluded_namespaces": [],
  "identity": {
    "client_id": "",
    "resource_id": "",
    "tenant_id": ""
  },
  "loki_address": ""
}
| no | | [promtail\_enabled](#input\_promtail\_enabled) | Should promtail be enabled | `bool` | `false` | no | | [reloader\_enabled](#input\_reloader\_enabled) | Should Reloader be enabled | `bool` | `true` | no | +| [spegel\_enabled](#input\_spegel\_enabled) | Should Spegel be enabled | `bool` | `true` | no | | [subscription\_name](#input\_subscription\_name) | The commonName for the subscription | `string` | n/a | yes | | [trivy\_config](#input\_trivy\_config) | Configuration for trivy | 
object({
    client_id   = string
    resource_id = string
  })
| n/a | yes | | [trivy\_enabled](#input\_trivy\_enabled) | Should trivy be enabled | `bool` | `true` | no | diff --git a/modules/kubernetes/aks-core/modules.tf b/modules/kubernetes/aks-core/modules.tf index 5e374db2d..d06dffa6e 100644 --- a/modules/kubernetes/aks-core/modules.tf +++ b/modules/kubernetes/aks-core/modules.tf @@ -21,6 +21,7 @@ locals { "grafana-agent", "promtail", "prometheus", + "spegel", ] } @@ -650,3 +651,15 @@ module "node_ttl" { status_config_map_namespace = "kube-system" } + +module "spegel" { + depends_on = [module.opa_gatekeeper] + + for_each = { + for s in ["spegel"] : + s => s + if var.spegel_enabled + } + + source = "../../kubernetes/spegel" +} diff --git a/modules/kubernetes/aks-core/variables.tf b/modules/kubernetes/aks-core/variables.tf index 442975046..3fc9863ba 100644 --- a/modules/kubernetes/aks-core/variables.tf +++ b/modules/kubernetes/aks-core/variables.tf @@ -506,6 +506,11 @@ variable "node_ttl_enabled" { default = true } +variable "spegel_enabled" { + description = "Should Spegel be enabled" + type = bool + default = true +} variable "control_plane_logs_enabled" { description = "Should Control plan be enabled" diff --git a/modules/kubernetes/eks-core/README.md b/modules/kubernetes/eks-core/README.md index 966a9b3ce..fe23fcc80 100644 --- a/modules/kubernetes/eks-core/README.md +++ b/modules/kubernetes/eks-core/README.md @@ -51,6 +51,7 @@ This module is used to configure EKS clusters. | [prometheus\_crd](#module\_prometheus\_crd) | ../../kubernetes/helm-crd | n/a | | [promtail](#module\_promtail) | ../../kubernetes/promtail | n/a | | [reloader](#module\_reloader) | ../../kubernetes/reloader | n/a | +| [spegel](#module\_spegel) | ../../kubernetes/spegel | n/a | | [trivy](#module\_trivy) | ../../kubernetes/trivy | n/a | | [trivy\_crd](#module\_trivy\_crd) | ../../kubernetes/helm-crd | n/a | | [velero](#module\_velero) | ../../kubernetes/velero | n/a | @@ -131,6 +132,7 @@ This module is used to configure EKS clusters. | [promtail\_config](#input\_promtail\_config) | Configuration for promtail | 
object({
    role_arn            = string
    loki_address        = string
    excluded_namespaces = list(string)
  })
| 
{
  "excluded_namespaces": [],
  "loki_address": "",
  "role_arn": ""
}
| no | | [promtail\_enabled](#input\_promtail\_enabled) | Should promtail be enabled | `bool` | `false` | no | | [reloader\_enabled](#input\_reloader\_enabled) | Should Reloader be enabled | `bool` | `true` | no | +| [spegel\_enabled](#input\_spegel\_enabled) | Should Spegel be enabled | `bool` | `true` | no | | [subscription\_name](#input\_subscription\_name) | The commonName for the subscription | `string` | n/a | yes | | [trivy\_config](#input\_trivy\_config) | Configuration for trivy-operator & trivy | 
object({
    trivy_operator_role_arn = string
    trivy_role_arn          = string
  })
| n/a | yes | | [trivy\_enabled](#input\_trivy\_enabled) | Should trivy be enabled | `bool` | `false` | no | diff --git a/modules/kubernetes/eks-core/modules.tf b/modules/kubernetes/eks-core/modules.tf index 9df4be002..019f2b432 100644 --- a/modules/kubernetes/eks-core/modules.tf +++ b/modules/kubernetes/eks-core/modules.tf @@ -13,7 +13,8 @@ locals { "prometheus", "reloader", "velero", - "promtail" + "promtail", + "spegel" ] dns_zone = { for dns in data.aws_route53_zone.this : @@ -525,3 +526,15 @@ module "node_ttl" { status_config_map_namespace = "cluster-autoscaler" } + +module "spegel" { + depends_on = [module.opa_gatekeeper] + + for_each = { + for s in ["spegel"] : + s => s + if var.spegel_enabled + } + + source = "../../kubernetes/spegel" +} diff --git a/modules/kubernetes/eks-core/variables.tf b/modules/kubernetes/eks-core/variables.tf index 68ace7730..ff1e3087a 100644 --- a/modules/kubernetes/eks-core/variables.tf +++ b/modules/kubernetes/eks-core/variables.tf @@ -397,3 +397,9 @@ variable "node_ttl_enabled" { type = bool default = true } + +variable "spegel_enabled" { + description = "Should Spegel be enabled" + type = bool + default = true +} diff --git a/modules/kubernetes/spegel/README.md b/modules/kubernetes/spegel/README.md new file mode 100644 index 000000000..30901fcce --- /dev/null +++ b/modules/kubernetes/spegel/README.md @@ -0,0 +1,37 @@ +# Spegel + +This module is used to add [spegel](https://github.com/XenitAB/spegel) to Kubernetes clusters. + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.3.0 | +| [helm](#requirement\_helm) | 2.6.0 | +| [kubernetes](#requirement\_kubernetes) | 2.13.1 | + +## Providers + +| Name | Version | +|------|---------| +| [helm](#provider\_helm) | 2.6.0 | +| [kubernetes](#provider\_kubernetes) | 2.13.1 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [helm_release.this](https://registry.terraform.io/providers/hashicorp/helm/2.6.0/docs/resources/release) | resource | +| [kubernetes_namespace.this](https://registry.terraform.io/providers/hashicorp/kubernetes/2.13.1/docs/resources/namespace) | resource | + +## Inputs + +No inputs. + +## Outputs + +No outputs. diff --git a/modules/kubernetes/spegel/main.tf b/modules/kubernetes/spegel/main.tf new file mode 100644 index 000000000..e1142d4f5 --- /dev/null +++ b/modules/kubernetes/spegel/main.tf @@ -0,0 +1,38 @@ +/** + * # Spegel + * + * This module is used to add [spegel](https://github.com/XenitAB/spegel) to Kubernetes clusters. + */ + +terraform { + required_version = ">= 1.3.0" + + required_providers { + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.13.1" + } + helm = { + source = "hashicorp/helm" + version = "2.6.0" + } + } +} + +resource "kubernetes_namespace" "this" { + metadata { + name = "sepgel" + labels = { + name = "spegel" + "xkf.xenit.io/kind" = "platform" + } + } +} + +resource "helm_release" "this" { + chart = "oci://ghcr.io/xenitab/helm-charts/spegel" + name = "spegel" + namespace = kubernetes_namespace.this.metadata[0].name + version = "v0.0.3" + max_history = 3 +} diff --git a/modules/kubernetes/spegel/outputs.tf b/modules/kubernetes/spegel/outputs.tf new file mode 100644 index 000000000..e69de29bb diff --git a/modules/kubernetes/spegel/variables.tf b/modules/kubernetes/spegel/variables.tf new file mode 100644 index 000000000..8b1378917 --- /dev/null +++ b/modules/kubernetes/spegel/variables.tf @@ -0,0 +1 @@ + diff --git a/validation/kubernetes/spegel/main.tf b/validation/kubernetes/spegel/main.tf new file mode 100644 index 000000000..9b62bdb92 --- /dev/null +++ b/validation/kubernetes/spegel/main.tf @@ -0,0 +1,9 @@ +terraform {} + +provider "kubernetes" {} + +provider "helm" {} + +module "spegel" { + source = "../../../modules/kubernetes/spegel" +}