Merge remote-tracking branch 'origin/main' into config_worker_memory

Author: jochenehret

.tool-versions

@@ -1,12 +1,12 @@
-concourse 7.11.2
+concourse 7.12.0
 gcloud 469.0.0
 helm 3.14.3
 kapp 0.60.0
 kubectl 1.29.3
 python 3.12.2
-terraform 1.7.5
+terraform 1.10.3
 terraform-lsp 0.0.12
-terragrunt 0.55.19
+terragrunt 0.70.4
 vendir 0.40.0
 yq 4.43.1
 ytt 0.44.1

docs/concourse/README.md

@@ -94,6 +94,8 @@ The following command needs to be run from within your root directory (containin
 
 *NOTE: `terragrunt run-all` commands **do not** show changes before applying*
 
+*NOTE: If you need to update the providers, run `terragrunt run-all init -upgrade`
+
 ```sh
 terragrunt run-all apply
 ```

docs/concourse/concourse_minor_version_upgrade.md

@@ -2,32 +2,35 @@
 
 Following is a tested upgrade path for a minor version upgrade of Concourse (partially manual).
 
-The process assumes the usage of terragrunt Concourse stack.
+The process assumes the usage of the Terragrunt Concourse stack.
 
 Please note the process should be also useful for upgrading major versions.
 
-## Roll-in procedure
+## Roll-in Procedure
 
 1. Connect to your GCP account
    ```
    gcloud auth login && gcloud auth application-default login
+   gcloud set project <your project name>
    ```
+
 2. `cd` to a folder with concourse folder with `config.yaml` file
 
 3. Confirm there are no pending changes for the Concourse stack
-    ```
-    terragrunt run-all plan --terragrunt-source-update
-    ```
+   ```
+   terragrunt run-all plan --terragrunt-source-update
+   ```
+
 4. Switch to `renovate's` pull request having bumped Concourse helm chart version
    ```
    git pull
    git checkout renovate/concourse-17.x
    ```
 
 5. Create on-demand SQL instance backup
-    ```
-    ../terragrunt/scripts/concourse/create-sql-backup.sh
-    ```
+   ```
+   ../terragrunt/scripts/concourse/create-sql-backup.sh
+   ```
 
 6. Apply roll-out for new Concourse version
    ```
@@ -36,11 +39,12 @@ Please note the process should be also useful for upgrading major versions.
 
 At this point depending on your use case:
 
-1. Update `fly` to new minor version ie. change the version in `.tool-versions`` and run `asdf install`
+1. Update `fly` to new minor version i.e. change the version in `.tool-versions` and run `asdf install`
 
 2. Login to the new Concourse
    ```
    fly login -t <target name>
+   ```
 
 3. For `wg-ci-test` cluster: execute end-to-end test
    ```
@@ -49,7 +53,7 @@ At this point depending on your use case:
    cd ..
    ```
 
-## Roll-back procedure
+## Roll-back Procedure
 
 To guarantee SQL databases consistency delete Concourse deployment and restore SQL instance
 
@@ -61,7 +65,7 @@ To guarantee SQL databases consistency delete Concourse deployment and restore S
 
 2. Restore on-demand SQL instance backup - use Web UI or gcloud command
 
-3. Run concourse stack deployment
+3. Run Concourse stack deployment
    ```
    terragrunt run-all plan
    terragrunt run-all apply

terraform-modules/actions_runner_controller/infra/providers.tf

@@ -7,7 +7,7 @@ terraform {
       source = "hashicorp/kubernetes"
     }
     kubectl = {
-      source = "gavinbunney/kubectl"
+      source = "registry.terraform.io/gavinbunney/kubectl"
     }
     github = {
       source = "integrations/github"

terraform-modules/actions_runner_controller/team/providers.tf

@@ -7,7 +7,7 @@ terraform {
       source = "hashicorp/kubernetes"
     }
     kubectl = {
-      source = "gavinbunney/kubectl"
+      source = "registry.terraform.io/gavinbunney/kubectl"
     }
     github = {
       source  = "integrations/github"

terraform-modules/concourse/app/files/config/concourse/pod_disruption_budget.yml

@@ -0,0 +1,11 @@
+#@ load("@ytt:data", "data")
+#@ load("@ytt:library", "library")
+#@ load("@ytt:overlay", "overlay")
+#@ load("@ytt:template", "template")
+
+#! workaround for buggy GKE version check:
+#! https://github.com/concourse/concourse-chart/blob/c92075294c39a20fd48e0c5cc4533a2a59adfc70/templates/worker-policy.yaml#L2
+
+#@overlay/match by=overlay.subset({"kind": "PodDisruptionBudget"})
+---
+apiVersion: policy/v1

terraform-modules/concourse/app/providers.tf

@@ -4,7 +4,7 @@ terraform {
       source = "hashicorp/google"
     }
     carvel = {
-      source = "vmware-tanzu/carvel"
+      source = "registry.terraform.io/vmware-tanzu/carvel"
     }
   }
 }

terraform-modules/concourse/automatic_certificate_regeneration/cron_job.tf

@@ -16,7 +16,7 @@ resource "kubernetes_cron_job_v1" "automatic_certificate_regeneration" {
             restart_policy = "OnFailure"
             container {
               name              = "cert-regen"
-              image             = "yatzek/credhub-cli:2.9.0"
+              image             = "cloudfoundry/cf-deployment-concourse-tasks:v19.0.0"
               image_pull_policy = "IfNotPresent"
               command           = ["bash", "-c", "IFS=',' read -r -a CERTIFICATES <<< \"$CERTS_TO_RENEW\"; for cert in \"$${CERTIFICATES[@]}\"; do credhub regenerate -n \"$cert\"; done"]
               env {

terraform-modules/concourse/backend/providers.tf

@@ -4,10 +4,10 @@ terraform {
       source = "hashicorp/google"
     }
     carvel = {
-      source = "vmware-tanzu/carvel"
+      source = "registry.terraform.io/vmware-tanzu/carvel"
     }
     kubectl = {
-      source = "gavinbunney/kubectl"
+      source = "registry.terraform.io/gavinbunney/kubectl"
     }
   }
 }

terraform-modules/concourse/e2e_test/credhub_test_secret_k8s.tf

@@ -40,7 +40,7 @@ resource "kubernetes_job" "credhub_cli" {
       spec {
         restart_policy = "Never"
         container {
-          image = "yatzek/credhub-cli:2.9.0"
+          image = "cloudfoundry/cf-deployment-concourse-tasks:v19.0.0"
           name  = "credhub-cli"
 
           command = [