Skip to content

Commit 1e87355

Browse files
goruhagoruha
committed
Initial commit
1 parent 78d6bbe commit 1e87355

16 files changed

+883
-58
lines changed

‎.github/settings.yml‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,7 @@
11
# Upstream changes from _extends are only recognized when modifications are made to this file in the default branch.
22
_extends: .github
33
repository:
4-
name: template
5-
description: Template for Terraform Components
4+
name: aws-argocd-github-repo
5+
description: This component is responsible for creating and managing an ArgoCD desired state repository
66
homepage: https://cloudposse.com/accelerate
77
topics: terraform, terraform-component
8-
9-
10-
11-

‎CHANGELOG.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
## Components PR [#851](https://github.com/cloudposse/terraform-aws-components/pull/851)
2+
3+
This is a bug fix and feature enhancement update. There are few actions necessary to upgrade.
4+
5+
## Upgrade actions
6+
7+
1. Enable `github_default_notifications_enabled` (set `true`)
8+
9+
```yaml
10+
components:
11+
terraform:
12+
argocd-repo-defaults:
13+
metadata:
14+
type: abstract
15+
vars:
16+
enabled: true
17+
github_default_notifications_enabled: true
18+
```
19+
20+
2. Apply changes with Atmos
21+
22+
## Features
23+
24+
- Support predefined GitHub commit status notifications for CD sync mode:
25+
- `on-deploy-started`
26+
- `app-repo-github-commit-status`
27+
- `argocd-repo-github-commit-status`
28+
- `on-deploy-succeded`
29+
- `app-repo-github-commit-status`
30+
- `argocd-repo-github-commit-status`
31+
- `on-deploy-failed`
32+
- `app-repo-github-commit-status`
33+
- `argocd-repo-github-commit-status`
34+
35+
### Bug Fixes
36+
37+
- Remove legacy unnecessary helm values used in old ArgoCD versions (ex. `workflow auth` configs) and dropped
38+
notifications services

‎README.yaml‎

Lines changed: 197 additions & 48 deletions
Large diffs are not rendered by default.

‎src/applicationset.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
locals {
2+
github_default_notifications_enabled = local.enabled && var.github_default_notifications_enabled
3+
github_notifications = local.github_default_notifications_enabled ? var.github_notifications : []
4+
}
5+
6+
resource "github_repository_file" "application_set" {
7+
for_each = local.environments
8+
9+
repository = local.github_repository.name
10+
branch = local.github_repository.default_branch
11+
file = "${each.value.tenant != null ? format("%s/", each.value.tenant) : ""}${each.value.environment}-${each.value.stage}${length(each.value.attributes) > 0 ? format("-%s", join("-", each.value.attributes)) : ""}/${local.manifest_kubernetes_namespace}/applicationset.yaml"
12+
content = templatefile("${path.module}/templates/applicationset.yaml.tpl", {
13+
environment = each.key
14+
auto-sync = each.value.auto-sync
15+
ignore-differences = each.value.ignore-differences
16+
name = module.this.namespace
17+
namespace = local.manifest_kubernetes_namespace
18+
ssh_url = local.github_repository.ssh_clone_url
19+
notifications = local.github_notifications
20+
slack_notifications_channel = var.slack_notifications_channel
21+
})
22+
commit_message = "Initialize environment: `${each.key}`."
23+
commit_author = var.github_user
24+
commit_email = var.github_user_email
25+
overwrite_on_create = true
26+
}

‎src/git-files.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
resource "github_repository_file" "gitignore" {
2+
count = local.enabled ? 1 : 0
3+
4+
repository = local.github_repository.name
5+
branch = local.github_repository.default_branch
6+
file = ".gitignore"
7+
content = templatefile("${path.module}/templates/.gitignore.tpl", {
8+
entries = var.gitignore_entries
9+
})
10+
commit_message = "Create .gitignore file."
11+
commit_author = var.github_user
12+
commit_email = var.github_user_email
13+
overwrite_on_create = true
14+
}
15+
16+
resource "github_repository_file" "readme" {
17+
count = local.enabled ? 1 : 0
18+
19+
repository = local.github_repository.name
20+
branch = local.github_repository.default_branch
21+
file = "README.md"
22+
content = templatefile("${path.module}/templates/README.md.tpl", {
23+
repository_name = local.github_repository.name
24+
repository_description = local.github_repository.description
25+
github_organization = var.github_organization
26+
})
27+
commit_message = "Create README.md file."
28+
commit_author = var.github_user
29+
commit_email = var.github_user_email
30+
overwrite_on_create = true
31+
}
32+
33+
resource "github_repository_file" "codeowners_file" {
34+
count = local.enabled ? 1 : 0
35+
36+
repository = local.github_repository.name
37+
branch = local.github_repository.default_branch
38+
file = ".github/CODEOWNERS"
39+
content = templatefile("${path.module}/templates/CODEOWNERS.tpl", {
40+
codeowners = var.github_codeowner_teams
41+
})
42+
commit_message = "Create CODEOWNERS file."
43+
commit_author = var.github_user
44+
commit_email = var.github_user_email
45+
overwrite_on_create = true
46+
}
47+
48+
resource "github_repository_file" "pull_request_template" {
49+
count = local.enabled ? 1 : 0
50+
51+
repository = local.github_repository.name
52+
branch = local.github_repository.default_branch
53+
file = ".github/PULL_REQUEST_TEMPLATE.md"
54+
content = file("${path.module}/templates/PULL_REQUEST_TEMPLATE.md")
55+
commit_message = "Create PULL_REQUEST_TEMPLATE.md file."
56+
commit_author = var.github_user
57+
commit_email = var.github_user_email
58+
overwrite_on_create = true
59+
}

‎src/main.tf‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,133 @@
11
locals {
22
enabled = module.this.enabled
3+
4+
environments = local.enabled ? {
5+
for env in var.environments :
6+
(format(
7+
"${env.tenant != null ? "%[1]s/" : ""}%[2]s-%[3]s${length(env.attributes) > 0 ? "-%[4]s" : "%[4]s"}",
8+
env.tenant,
9+
env.environment,
10+
env.stage,
11+
join("-", env.attributes)
12+
)) => env
13+
} : {}
14+
15+
manifest_kubernetes_namespace = var.manifest_kubernetes_namespace
16+
17+
team_slugs = toset(compact([
18+
for permission in var.permissions : lookup(permission, "team_slug", null)
19+
]))
20+
21+
team_ids = [
22+
for team in data.github_team.default : team.id
23+
]
24+
25+
team_permissions = {
26+
for index, id in local.team_ids : (var.permissions[index].team_slug) => {
27+
id = id
28+
permission = var.permissions[index].permission
29+
}
30+
}
31+
32+
empty_repo = {
33+
name = ""
34+
default_branch = ""
35+
}
36+
37+
github_repository = try((var.create_repo ? github_repository.default : data.github_repository.default)[0], local.empty_repo)
38+
}
39+
40+
data "github_repository" "default" {
41+
count = local.enabled && !var.create_repo ? 1 : 0
42+
name = var.name
43+
}
44+
45+
resource "github_repository" "default" {
46+
count = local.enabled && var.create_repo ? 1 : 0
47+
48+
name = module.this.name
49+
description = var.description
50+
auto_init = true # will create a 'main' branch
51+
52+
visibility = "private"
53+
vulnerability_alerts = var.vulnerability_alerts_enabled
54+
55+
web_commit_signoff_required = var.web_commit_signoff_required
56+
}
57+
58+
resource "github_branch_default" "default" {
59+
count = local.enabled ? 1 : 0
60+
61+
repository = local.github_repository.name
62+
branch = local.github_repository.default_branch
363
}
464

65+
data "github_user" "automation_user" {
66+
count = local.enabled ? 1 : 0
567

68+
username = var.github_user
69+
}
70+
71+
resource "github_branch_protection" "default" {
72+
# This resource enforces PRs needing to be opened in order for changes to be made, except for automated commits to
73+
# the main branch. Those commits made by the automation user, which is an admin.
74+
count = local.enabled ? 1 : 0
75+
76+
repository_id = local.github_repository.name
77+
78+
pattern = join("", github_branch_default.default[*].branch)
79+
enforce_admins = false # needs to be false in order to allow automation user to push
80+
allows_deletions = true
81+
82+
dynamic "required_pull_request_reviews" {
83+
for_each = var.required_pull_request_reviews ? [0] : []
84+
content {
85+
dismiss_stale_reviews = true
86+
restrict_dismissals = true
87+
require_code_owner_reviews = true
88+
}
89+
}
690

91+
restrict_pushes {
92+
blocks_creations = var.restrict_pushes_blocks_creations
93+
push_allowances = var.push_restrictions_enabled ? [
94+
join("", data.github_user.automation_user[*].node_id),
95+
] : []
96+
}
797

98+
lifecycle {
99+
ignore_changes = [
100+
restrict_pushes[0].push_allowances
101+
]
102+
}
103+
}
104+
105+
data "github_team" "default" {
106+
for_each = local.team_slugs
107+
108+
slug = each.value
109+
}
8110

111+
resource "github_team_repository" "default" {
112+
for_each = local.team_permissions
113+
114+
repository = local.github_repository.name
115+
team_id = each.value.id
116+
permission = each.value.permission
117+
}
118+
119+
resource "tls_private_key" "default" {
120+
for_each = local.environments
121+
122+
algorithm = "RSA"
123+
rsa_bits = "2048"
124+
}
125+
126+
resource "github_repository_deploy_key" "default" {
127+
for_each = local.environments
128+
129+
title = "Deploy key for ArgoCD environment: ${each.key} (${local.github_repository.default_branch} branch)"
130+
repository = local.github_repository.name
131+
key = tls_private_key.default[each.key].public_key_openssh
132+
read_only = true
133+
}

‎src/outputs.tf‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,39 @@
1-
output "mock" {
2-
description = "Mock output example for the Cloud Posse Terraform component template"
3-
value = local.enabled ? "hello ${basename(abspath(path.module))}" : ""
1+
output "deploy_keys_ssm_paths" {
2+
description = "SSM Parameter Store paths for the repository's deploy keys"
3+
value = module.store_write.names
4+
}
5+
6+
output "deploy_keys_ssm_path_format" {
7+
description = "SSM Parameter Store path format for the repository's deploy keys"
8+
value = local.enabled ? var.ssm_github_deploy_key_format : null
9+
}
10+
11+
output "repository" {
12+
description = "Repository name"
13+
value = local.enabled && var.create_repo ? module.this.name : var.name
14+
}
15+
16+
output "repository_description" {
17+
description = "Repository description"
18+
value = local.github_repository.description
19+
}
20+
21+
output "repository_default_branch" {
22+
description = "Repository default branch"
23+
value = local.github_repository.default_branch
24+
}
25+
26+
output "repository_url" {
27+
description = "Repository URL"
28+
value = local.github_repository.html_url
29+
}
30+
31+
output "repository_git_clone_url" {
32+
description = "Repository git clone URL"
33+
value = local.github_repository.git_clone_url
34+
}
35+
36+
output "repository_ssh_clone_url" {
37+
description = "Repository SSH clone URL"
38+
value = local.github_repository.ssh_clone_url
439
}

‎src/provider-github.tf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
locals {
2+
github_token = local.enabled ? coalesce(var.github_token_override, data.aws_ssm_parameter.github_api_key[0].value) : ""
3+
}
4+
5+
data "aws_ssm_parameter" "github_api_key" {
6+
count = local.enabled ? 1 : 0
7+
name = var.ssm_github_api_key
8+
with_decryption = true
9+
}
10+
11+
module "store_write" {
12+
source = "cloudposse/ssm-parameter-store/aws"
13+
version = "0.11.0"
14+
15+
parameter_write = [for k, v in local.environments :
16+
{
17+
name = format(var.ssm_github_deploy_key_format, k)
18+
value = tls_private_key.default[k].private_key_pem
19+
type = "SecureString"
20+
overwrite = true
21+
description = github_repository_deploy_key.default[k].title
22+
}
23+
]
24+
25+
context = module.this.context
26+
}
27+
28+
provider "github" {
29+
base_url = var.github_base_url
30+
owner = var.github_organization
31+
token = local.github_token
32+
}

‎src/providers.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
provider "aws" {
2+
region = var.region
3+
4+
# Profile is deprecated in favor of terraform_role_arn. When profiles are not in use, terraform_profile_name is null.
5+
profile = module.iam_roles.terraform_profile_name
6+
7+
dynamic "assume_role" {
8+
# module.iam_roles.terraform_role_arn may be null, in which case do not assume a role.
9+
for_each = compact([module.iam_roles.terraform_role_arn])
10+
content {
11+
role_arn = module.iam_roles.terraform_role_arn
12+
}
13+
}
14+
}
15+
16+
module "iam_roles" {
17+
source = "../account-map/modules/iam-roles"
18+
context = module.this.context
19+
}

‎src/templates/.gitignore.tpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# This file has been programmatically generated and committed by the argocd-repo Terraform component in the infrastructure
2+
# monorepo. It can be updated to contain further entries by adjusting var.gitignore_entries in the aforementioned component.
3+
4+
%{ for entry in entries ~}
5+
${entry}
6+
%{ endfor ~}

0 commit comments

Comments
 (0)