Skip to content

Commit 238f0bc

Browse files
Prajyot-ParabPrajyot-Parab
committed
Terraform for k8s-power-conformance job on ibmcloud
Signed-off-by: Prajyot-Parab <[email protected]>
1 parent 245816b commit 238f0bc

File tree

28 files changed

+1076
-0
lines changed

28 files changed

+1076
-0
lines changed

‎infra/ibmcloud/terraform/k8s-power-conformance/README.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# _TF: IBM K8s Power Conformance_
2+
These define Terraform resources for setting up infrastructure for the Kubernetes on Power conformance job.
3+
4+
---
5+
## Initial Setup
6+
7+
### Supporting infrastructure
8+
9+
#### Deploy k8s-infra-setup resources
10+
11+
- this covers things like Resource Group, Power Virtual Server Workspace, Virtual Private Cloud, IBM Cloud Secret Manager Secrets, Transit Gateway, etc.
12+
- Once the deployment successfully completes, the `service_instance_id` and `secrets_manager_id` will be generated and should be used in the subsequent steps.
13+
14+
---
15+
#### Deploy k8s-power-conformance resources
16+
17+
**1. Navigate to the correct directory**
18+
<br> You need to be in the `k8s-power-conformance` directory to run the automation.
19+
20+
**2. Check the `versions.tf` file**
21+
<br> Set `secret_key` and `access_key` in `versions.tf` to configure the remote S3 backend (IBM Cloud COS).
22+
23+
**3. Initialize Terraform**
24+
<br> Execute the following command to initialize Terraform in your project directory. This command will download the necessary provider plugins and prepare the working environment.
25+
```
26+
terraform init -reconfigure
27+
```
28+
29+
**4. Check the `variables.tf` file**
30+
<br> Open the `variables.tf` file to review all the available variables. This file lists all customizable inputs for your Terraform configuration.
31+
32+
`ibmcloud_api_key`, `service_instance_id`, `secrets_manager_id` are the only required variables that you must set in order to proceed. You can set this key either by adding it to your `var.tfvars` file or by exporting it as an environment variable.
33+
34+
**Option 1:** Set in `var.tfvars` file
35+
Create `var.tfvars` file and set the following variables in `var.tfvars` file:
36+
```
37+
ibmcloud_api_key = "<YOUR_API_KEY>"
38+
service_instance_id = "<POWERVS_SERVICE_INSTANCE_ID>"
39+
secrets_manager_id = "<SECRETS_MANAGER_ID>"
40+
```
41+
42+
**Option 2:** Export as an environment variable
43+
Alternatively, you can export above as an environment variable before running Terraform:
44+
```
45+
export TF_VAR_ibmcloud_api_key="<YOUR_API_KEY>"
46+
export TF_VAR_service_instance_id="<POWERVS_SERVICE_INSTANCE_ID>"
47+
export TF_VAR_secrets_manager_id="<SECRETS_MANAGER_ID>"
48+
```
49+
50+
**5. Run Terraform Apply**
51+
<br> After setting the necessary variables (particularly the API_KEY), execute the following command to apply the Terraform configuration and provision the infrastructure:
52+
```
53+
terraform apply -var-file var.tfvars
54+
```
55+
Terraform will display a plan of the actions it will take, and you'll be prompted to confirm the execution. Type `yes` to proceed.
56+
57+
**6. Get Output Information**
58+
<br> Once the infrastructure has been provisioned, use the terraform output command to list details about the provisioned resources.
59+
```
60+
terraform output
61+
```

‎infra/ibmcloud/terraform/k8s-power-conformance/main.tf

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
module "resource_group" {
18+
source = "./modules/resource_group"
19+
}
20+
21+
module "iam_custom_role" {
22+
source = "./modules/iam/custom_role"
23+
}
24+
25+
module "service_ids" {
26+
depends_on = [module.iam_custom_role]
27+
source = "./modules/iam/service_ids"
28+
project_resource_group_id = module.resource_group.k8s_project_rg_id
29+
}
30+
31+
module "iam_access_groups" {
32+
depends_on = [module.iam_custom_role]
33+
source = "./modules/iam/access_groups"
34+
resource_group_id = module.resource_group.k8s_rg_id
35+
project_resource_group_id = module.resource_group.k8s_project_rg_id
36+
}
37+
38+
module "secrets_manager" {
39+
source = "./modules/secrets_manager"
40+
secrets_manager_id = var.secrets_manager_id
41+
pvs_access_group_id = module.iam_access_groups.pvs_access_group_id
42+
janitor_access_group_id = module.iam_access_groups.janitor_access_group_id
43+
secret_rotator_access_group_id = module.iam_access_groups.secret_rotator_access_group_id
44+
apikey = module.service_ids.sm_read_apikey
45+
}

‎infra/ibmcloud/terraform/k8s-power-conformance/modules/iam/access_groups/access_groups.tf

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
resource "ibm_iam_access_group" "pvs" {
18+
name = "powervs-access"
19+
description = "Access group with the necessary permissions for Prow job on the PowerVS service."
20+
}
21+
22+
resource "ibm_iam_access_group_policy" "pvs" {
23+
access_group_id = ibm_iam_access_group.pvs.id
24+
roles = ["PVSRole"]
25+
26+
resources {
27+
service = "power-iaas"
28+
resource_group_id = var.resource_group_id
29+
}
30+
}
31+
32+
resource "ibm_iam_access_group" "janitor" {
33+
name = "janitor-access"
34+
description = "Access group with the necessary permissions for the Boskos Janitor."
35+
}
36+
37+
resource "ibm_iam_access_group_policy" "janitor_pvs" {
38+
access_group_id = ibm_iam_access_group.janitor.id
39+
roles = ["JanitorPVSRole"]
40+
41+
resources {
42+
service = "power-iaas"
43+
resource_group_id = var.resource_group_id
44+
}
45+
}
46+
47+
resource "ibm_iam_access_group" "secret_rotator" {
48+
name = "secret-rotator"
49+
description = "Access group with the necessary permissions for secret-manager(rotator)."
50+
}
51+
52+
resource "ibm_iam_access_group_policy" "secret_rotator" {
53+
access_group_id = ibm_iam_access_group.secret_rotator.id
54+
roles = ["SecretRotator"]
55+
56+
resources {
57+
service = "secrets-manager"
58+
resource_group_id = var.project_resource_group_id
59+
}
60+
}

‎infra/ibmcloud/terraform/k8s-power-conformance/modules/iam/access_groups/outputs.tf

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
output "pvs_access_group_id" {
18+
value = ibm_iam_access_group.pvs.id
19+
}
20+
21+
output "janitor_access_group_id" {
22+
value = ibm_iam_access_group.janitor.id
23+
}
24+
25+
output "secret_rotator_access_group_id" {
26+
value = ibm_iam_access_group.secret_rotator.id
27+
}

‎infra/ibmcloud/terraform/k8s-power-conformance/modules/iam/access_groups/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
variable "resource_group_id" {}
18+
variable "project_resource_group_id" {}

‎infra/ibmcloud/terraform/k8s-power-conformance/modules/iam/access_groups/versions.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_providers {
19+
ibm = {
20+
source = "IBM-Cloud/ibm"
21+
}
22+
}
23+
}

‎infra/ibmcloud/terraform/k8s-power-conformance/modules/iam/custom_role/iam_custom_role.tf

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
resource "ibm_iam_custom_role" "pvs" {
18+
name = "PVSRole"
19+
display_name = "PVSRole"
20+
service = "power-iaas.workspace"
21+
actions = [
22+
"power-iaas.network.create",
23+
"power-iaas.network.delete",
24+
"power-iaas.pvm-instance.create",
25+
"power-iaas.pvm-instance.delete",
26+
"power-iaas.cloud-instance-image.list",
27+
"power-iaas.cloud-instance-image.read",
28+
"power-iaas.cloud-instance.read",
29+
]
30+
}
31+
32+
resource "ibm_iam_custom_role" "sm" {
33+
name = "SMRead"
34+
display_name = "SMRead"
35+
service = "secrets-manager"
36+
actions = [
37+
"secrets-manager.secrets.list",
38+
"secrets-manager.secret.read",
39+
]
40+
}
41+
42+
resource "ibm_iam_custom_role" "janitor_pvs" {
43+
name = "JanitorPVSRole"
44+
display_name = "JanitorPVSRole"
45+
service = "power-iaas.workspace"
46+
actions = [
47+
"power-iaas.dashboard.view",
48+
"power-iaas.cloud-instance.modify",
49+
"power-iaas.cloud-instance.read",
50+
"resource-controller.instance.retrieve",
51+
"resource-controller.group.retrieve",
52+
]
53+
}
54+
55+
resource "ibm_iam_custom_role" "secret_rotator" {
56+
name = "SecretRotator"
57+
display_name = "SecretRotator"
58+
service = "secrets-manager"
59+
actions = [
60+
"secrets-manager.secret-version.read",
61+
"secrets-manager.secret-version.create",
62+
"secrets-manager.secret.read",
63+
"secrets-manager.secret.rotate",
64+
]
65+
}

‎infra/ibmcloud/terraform/k8s-power-conformance/modules/iam/custom_role/versions.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_providers {
19+
ibm = {
20+
source = "IBM-Cloud/ibm"
21+
}
22+
}
23+
}

‎infra/ibmcloud/terraform/k8s-power-conformance/modules/iam/service_ids/outputs.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
output "sm_read_apikey" {
18+
value = ibm_iam_service_api_key.service_id_apikey.apikey
19+
sensitive = true
20+
}

0 commit comments

Comments
 (0)