Skip to content

Commit 3c304ed

Browse files
mglotovmglotov
authored
refactor: change code structure; update code conventions (#290)
1 parent 57308b2 commit 3c304ed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+365
-412
lines changed

‎.github/CONTRIBUTING.md‎

Lines changed: 33 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ Please note we have a code of conduct, please follow it in all your interactions
2222
- [Resource names](#resource-names)
2323
- [Variable names](#variable-names)
2424
- [Output names](#output-names)
25+
- [Resources order in .tf files](#resources-order-in-tf-files)
2526
- [Names of terraform files, directories, and modules](#names-of-terraform-files-directories-and-modules)
2627
- [General configuration files](#general-configuration-files)
2728
- [Specific configuration files](#specific-configuration-files)
@@ -292,13 +293,21 @@ resource "aws_route_table_association" "intra" {
292293
- If the return value is a list, it must have a plural name
293294
- Use description for outputs
294295

296+
#### Resources order in .tf files
297+
298+
Resources in `.tf` files should be described in the following order:
299+
1. locals
300+
2. data
301+
3. modules
302+
4. resources
303+
295304
### Names of terraform files, directories, and modules
296305

297306
#### General configuration files
298307

299308
Each terraform module and configuration contains a set of general files ending in `.tf`:
300309

301-
- `main.tf` - contains terraform settings if it is the top layer; or the main working code if it is a module
310+
- `main.tf` - contains terraform settings and resources that can't be somehow grouped if it is the top layer; or the main working code if it is a module
302311
- `variables.tf` - module input values
303312
- `outputs.tf` - module output values
304313

@@ -308,27 +317,27 @@ Besides these, there may be:
308317
- `providers.tf` - contains settings from terraform providers, e.g. `aws`, `kubernetes`, etc
309318
- `iam.tf` - IAM configurations of policies, roles, etc
310319

311-
This is not a full list; each configuration, module, or layer may need additional files and manifests. The objective is to name them as succinctly and closer in meaning to the content as possible. Do not use prefixes.
320+
This is not a full list; each configuration, module, or layer may need additional files and manifests. The objective is to name them as succinctly and closer in meaning to the content as possible. Do not use prefixes (for files inside modules).
312321

313322
> Terraform itself doesn't care how many files you create. It collects all layer and module manifests into one object, builds dependencies, and executes.
314323
315324
#### Specific configuration files
316325

317-
These configuration files and manifests include the following: `data "template_file"` or `templatefile ()` template resources, a logical resource group placed in a separate `.tf` file, one or more deployments to k8s using `resource "helm_release"`, module initialization, aws resources that do not require a separate module, etc.
326+
These configuration files and manifests include a logical resource group placed in a separate `.tf` file.
318327

319328
> It should be noted that since some kind of a logical group of resources is being, why not move it all into a separate module. But it turned out that it is easier to manage helm releases, templates for them, and additional resources in separate `.tf` files at the root of a layer. And for many such configurations, when moving to modules, the amount of code can double + what we move to modules is usually what we are going to reuse.
320329
321-
Each specific `.tf` file must begin with a prefix indicating the service or provider to which the main resource or group being created belongs, e.g. `aws`. Optionally, the type of service is indicated next, e.g. `iam`. Next comes the name of the main service or resource or resource group declared inside, and after that, an explanatory suffix can optionally be added if there are several such files. All the parts of the name are separated by hyphens`
330+
Each specific `.tf` file must begin with a prefix indicating the service or provider to which the main resource or group being created belongs, e.g. `aws`. Next comes the name of the main service or resource or resource group declared inside, and after that, an explanatory suffix can optionally be added if there are several such files. All the parts of the name are separated by hyphens`
322331

323-
So the formula looks like this: `provider|servicename`-[`optional resource/service type`]-`main resourcename|group-name`-[`optional suffix`].tf
332+
So the formula looks like this: `provider|servicename`-`main resourcename|group-name`-[`optional suffix`].tf
324333

325334
Examples:
326335

327-
- `aws-vpc.tf` - terraform manifest describing the creation of a single vpc
336+
- `aws-vpc.tf` - terraform manifest describing the creation of a group resources for vpc (vpc + vpc endpoints)
328337
- `aws-vpc-stage.tf` - terraform manifest describing the creation of one of several vpc, for staging
329-
- `eks-namespaces.tf` - group of namespaces created in the EKS cluster
330338
- `eks-external-dns.tf` - contains the description of external-dns service deployment to the EKS cluster
331-
- `aws-ec2-pritunl.tf` - contains the initialization of the module that creates an EC2 instance in AWS with pritunl configured
339+
340+
If a resource isn't related to any others (for example: `resource "aws_iam_account_password_policy" "default"`), it can be stored in the `main.tf` file.
332341

333342
#### Modules
334343

@@ -338,24 +347,24 @@ Examples:
338347

339348
- `eks-rbac-ci` - module for creating rbac for CI inside the EKS cluster
340349
- `aws-iam-autoscaler` - module for creating IAM policies for autoscaler
341-
- `aws-ec2-pritunl` - module for creating pritunl ec2 instance
350+
- `aws-pritunl` - module for creating pritunl ec2 instance
342351

343352
### Project structure
344353
---
345354

346-
| FILE / DIRECTORY| DESCRIPTION |
347-
| --------------- |:-------------:|
348-
| docker/ | custom dockerfiles for examples |
349-
| examples/ | example k8s deployments |
350-
| helm-charts/ | directory contains custom helm charts |
351-
| helm-charts/certificate | helm chart which creates ssl certificate for nginx ingress |
355+
| FILE / DIRECTORY | DESCRIPTION |
356+
| -------------------------- | :-------------------------------------------------------------: |
357+
| docker/ | custom dockerfiles for examples |
358+
| examples/ | example k8s deployments |
359+
| helm-charts/ | directory contains custom helm charts |
360+
| helm-charts/certificate | helm chart which creates ssl certificate for nginx ingress |
352361
| helm-charts/cluster-issuer | helm chart which creates cluster-issuer using cert manager cdrs |
353-
| helm-charts/elk | umbrella chart to deploy elk stack |
354-
| helm-charts/teamcity | helm chart which deploys teamcity agent and/or server |
355-
|terraform/| directory contains terraform configuration files |
356-
|terraform/layer1-aws| directory contains aws resources |
357-
|terraform/layer2-k8s| directory contains resources deployed to k8s-EKS |
358-
|terraform/modules| directory contains terraform modules |
359-
|.editorconfig| |
360-
|.gitlab-ci.yml||
361-
|.pre-commit-config.yaml||
362+
| helm-charts/elk | umbrella chart to deploy elk stack |
363+
| helm-charts/teamcity | helm chart which deploys teamcity agent and/or server |
364+
| terraform/ | directory contains terraform configuration files |
365+
| terraform/layer1-aws | directory contains aws resources |
366+
| terraform/layer2-k8s | directory contains resources deployed to k8s-EKS |
367+
| terraform/modules | directory contains terraform modules |
368+
| .editorconfig | |
369+
| .gitlab-ci.yml | |
370+
| .pre-commit-config.yaml | |

‎.github/workflows/terraform-ci.yml‎

Lines changed: 53 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: 'Terraform-ci'
1+
name: "Terraform-ci"
22

33
on: [push, pull_request]
44

@@ -9,118 +9,87 @@ defaults:
99
jobs:
1010
# Terraform validate configuration
1111
terraform-validate:
12-
name: 'Terraform-validate'
12+
name: "Terraform-validate"
1313
runs-on: ubuntu-latest
1414
container:
1515
image: maddevsio/terraform-utils:latest
1616
env:
1717
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
1818
steps:
19-
- name: Checkout
20-
uses: actions/checkout@v2
21-
- name: Terraform Init l1
22-
working-directory: ./terraform/layer1-aws
23-
run: terraform init -backend=false
24-
- name: Terraform Init l2
25-
working-directory: ./terraform/layer2-k8s
26-
run: terraform init -backend=false
27-
- name: Terraform Validate l1
28-
working-directory: ./terraform/layer1-aws
29-
run: terraform validate -no-color .
30-
- name: Terraform Validate l2
31-
working-directory: ./terraform/layer2-k8s
32-
run: terraform validate -no-color .
33-
- name: Upload files for l1
34-
uses: actions/upload-artifact@v2
35-
with:
36-
name: l1
37-
path: ./terraform/layer1-aws/.terraform
38-
retention-days: 1
39-
- name: Upload files for l2
40-
uses: actions/upload-artifact@v2
41-
with:
42-
name: l2
43-
path: ./terraform/layer2-k8s/.terraform
44-
retention-days: 1
19+
- name: Checkout
20+
uses: actions/checkout@v2
21+
- name: Terraform Init l1
22+
working-directory: ./terraform/layer1-aws
23+
run: terraform init -backend=false
24+
- name: Terraform Init l2
25+
working-directory: ./terraform/layer2-k8s
26+
run: terraform init -backend=false
27+
- name: Terraform Validate l1
28+
working-directory: ./terraform/layer1-aws
29+
run: terraform validate -no-color .
30+
- name: Terraform Validate l2
31+
working-directory: ./terraform/layer2-k8s
32+
run: terraform validate -no-color .
33+
- name: Upload files for l1
34+
uses: actions/upload-artifact@v2
35+
with:
36+
name: l1
37+
path: ./terraform/layer1-aws/.terraform
38+
retention-days: 1
4539

4640
# Checks that all Terraform configuration files format
4741
terraform-format:
48-
name: 'Terraform-format'
42+
name: "Terraform-format"
4943
runs-on: ubuntu-latest
5044
container:
5145
image: maddevsio/terraform-utils:latest
5246
env:
5347
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
5448
steps:
55-
- name: Checkout
56-
uses: actions/checkout@v2
57-
- name: Terraform Format
58-
run: terraform fmt -recursive -write=false -check .
59-
working-directory: ./terraform
49+
- name: Checkout
50+
uses: actions/checkout@v2
51+
- name: Terraform Format
52+
run: terraform fmt -recursive -write=false -check .
53+
working-directory: ./terraform
6054

6155
# Checks that all Terraform configuration files tflint
6256
terraform-tflint:
63-
name: 'Terraform-tflint'
57+
name: "Terraform-tflint"
6458
runs-on: ubuntu-latest
6559
container:
6660
image: maddevsio/terraform-utils:latest
6761
env:
6862
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
6963
steps:
70-
- name: Checkout
71-
uses: actions/checkout@v2
72-
- name: Terraform tflint l1
73-
working-directory: ./terraform/layer1-aws
74-
run: tflint --no-color
75-
- name: Terraform tflint l2
76-
working-directory: ./terraform/layer2-k8s
77-
run: tflint --no-color
64+
- name: Checkout
65+
uses: actions/checkout@v2
66+
- name: Terraform tflint l1
67+
working-directory: ./terraform/layer1-aws
68+
run: tflint --no-color
69+
- name: Terraform tflint l2
70+
working-directory: ./terraform/layer2-k8s
71+
run: tflint --no-color
7872

7973
terraform-tfsec-l1:
80-
name: 'Terraform-tfsec-l1'
74+
name: "Terraform-tfsec-l1"
8175
needs: terraform-validate
8276
runs-on: ubuntu-latest
8377
container:
8478
image: tfsec/tfsec
8579
options: --user root
8680
steps:
87-
- name: Checkout
88-
uses: actions/checkout@v2
89-
- name: Download init for l1
90-
uses: actions/download-artifact@v2
91-
with:
92-
name: l1
93-
path: ./terraform/layer1-aws/.terraform
94-
- name: tfsec l1
95-
working-directory: ./terraform
96-
run: tfsec layer1-aws
97-
- uses: geekyeggo/delete-artifact@v1
98-
with:
99-
name: l1
100-
failOnError: false
101-
if: ${{ always() }}
102-
103-
terraform-tfsec-l2:
104-
name: 'Terraform-tfsec-l2'
105-
needs: terraform-validate
106-
runs-on: ubuntu-latest
107-
container:
108-
image: tfsec/tfsec
109-
options: --user root
110-
steps:
111-
- name: Checkout
112-
uses: actions/checkout@v2
113-
- name: Download init for l2
114-
uses: actions/download-artifact@v2
115-
with:
116-
name: l2
117-
path: ./terraform/layer2-k8s/.terraform
118-
- name: Terraform tfsec l2
119-
working-directory: ./terraform
120-
run: tfsec layer2-k8s
121-
- uses: geekyeggo/delete-artifact@v1
122-
with:
123-
name: l2
124-
failOnError: false
125-
if: ${{ always() }}
126-
81+
- name: Checkout
82+
uses: actions/checkout@v2
83+
- name: Download init for l1
84+
uses: actions/download-artifact@v2
85+
with:
86+
name: l1
87+
path: ./terraform/layer1-aws/.terraform
88+
- name: tfsec l1
89+
working-directory: ./terraform
90+
run: tfsec layer1-aws
91+
- uses: geekyeggo/delete-artifact@v1
92+
with:
93+
name: l1
94+
failOnError: false
95+
if: ${{ always() }}

‎terraform/layer1-aws/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
| <a name="module_acm"></a> [acm](#module\_acm) | terraform-aws-modules/acm/aws | 3.3.0 |
2323
| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | 18.9.0 |
2424
| <a name="module_eventbridge"></a> [eventbridge](#module\_eventbridge) | terraform-aws-modules/eventbridge/aws | 1.14.0 |
25-
| <a name="module_pritunl"></a> [pritunl](#module\_pritunl) | ../modules/aws-ec2-pritunl | n/a |
25+
| <a name="module_pritunl"></a> [pritunl](#module\_pritunl) | ../modules/aws-pritunl | n/a |
2626
| <a name="module_r53_zone"></a> [r53\_zone](#module\_r53\_zone) | terraform-aws-modules/route53/aws//modules/zones | 2.5.0 |
2727
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 3.12.0 |
2828
| <a name="module_vpc_cni_irsa"></a> [vpc\_cni\_irsa](#module\_vpc\_cni\_irsa) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | 4.14.0 |
@@ -33,7 +33,7 @@
3333
| Name | Type |
3434
|------|------|
3535
| [aws_cloudtrail.main](https://registry.terraform.io/providers/aws/4.10.0/docs/resources/cloudtrail) | resource |
36-
| [aws_ebs_encryption_by_default.this](https://registry.terraform.io/providers/aws/4.10.0/docs/resources/ebs_encryption_by_default) | resource |
36+
| [aws_ebs_encryption_by_default.default](https://registry.terraform.io/providers/aws/4.10.0/docs/resources/ebs_encryption_by_default) | resource |
3737
| [aws_iam_account_password_policy.default](https://registry.terraform.io/providers/aws/4.10.0/docs/resources/iam_account_password_policy) | resource |
3838
| [aws_kms_key.eks](https://registry.terraform.io/providers/aws/4.10.0/docs/resources/kms_key) | resource |
3939
| [aws_s3_bucket.cloudtrail](https://registry.terraform.io/providers/aws/4.10.0/docs/resources/s3_bucket) | resource |
@@ -60,7 +60,7 @@
6060
|------|-------------|------|---------|:--------:|
6161
| <a name="input_allowed_account_ids"></a> [allowed\_account\_ids](#input\_allowed\_account\_ids) | List of allowed AWS account IDs | `list` | `[]` | no |
6262
| <a name="input_allowed_ips"></a> [allowed\_ips](#input\_allowed\_ips) | IP addresses allowed to connect to private resources | `list(any)` | `[]` | no |
63-
| <a name="input_aws_account_password_policy"></a> [aws\_account\_password\_policy](#input\_aws\_account\_password\_policy) | n/a | `any` | <pre>{<br> "allow_users_to_change_password": true,<br> "create": true,<br> "hard_expiry": true,<br> "max_password_age": "90",<br> "minimum_password_length": "14",<br> "password_reuse_prevention": "10",<br> "require_lowercase_characters": true,<br> "require_numbers": true,<br> "require_symbols": true,<br> "require_uppercase_characters": true<br>}</pre> | no |
63+
| <a name="input_aws_account_password_policy"></a> [aws\_account\_password\_policy](#input\_aws\_account\_password\_policy) | n/a | `any` | <pre>{<br> "allow_users_to_change_password": true,<br> "create": true,<br> "hard_expiry": false,<br> "max_password_age": "90",<br> "minimum_password_length": "14",<br> "password_reuse_prevention": "10",<br> "require_lowercase_characters": true,<br> "require_numbers": true,<br> "require_symbols": true,<br> "require_uppercase_characters": true<br>}</pre> | no |
6464
| <a name="input_aws_cis_benchmark_alerts"></a> [aws\_cis\_benchmark\_alerts](#input\_aws\_cis\_benchmark\_alerts) | AWS CIS Benchmark alerts configuration | `any` | <pre>{<br> "email": "[email protected]",<br> "enabled": "false",<br> "rules": {<br> "aws_config_changes_enabled": true,<br> "cloudtrail_configuration_changes_enabled": true,<br> "console_login_failed_enabled": true,<br> "consolelogin_without_mfa_enabled": true,<br> "iam_policy_changes_enabled": true,<br> "kms_cmk_delete_or_disable_enabled": true,<br> "nacl_changes_enabled": true,<br> "network_gateway_changes_enabled": true,<br> "organization_changes_enabled": true,<br> "parameter_store_actions_enabled": true,<br> "route_table_changes_enabled": true,<br> "s3_bucket_policy_changes_enabled": true,<br> "secrets_manager_actions_enabled": true,<br> "security_group_changes_enabled": true,<br> "unauthorized_api_calls_enabled": true,<br> "usage_of_root_account_enabled": true,<br> "vpc_changes_enabled": true<br> }<br>}</pre> | no |
6565
| <a name="input_az_count"></a> [az\_count](#input\_az\_count) | Count of avaiablity zones, min 2 | `number` | `3` | no |
6666
| <a name="input_cidr"></a> [cidr](#input\_cidr) | Default CIDR block for VPC | `string` | `"10.0.0.0/16"` | no |

‎terraform/layer1-aws/aws-acm.tf‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
data "aws_acm_certificate" "main" {
2+
count = var.create_acm_certificate ? 0 : 1
3+
4+
domain = var.domain_name
5+
statuses = [
6+
"ISSUED",
7+
"PENDING_VALIDATION"]
8+
most_recent = true
9+
}
10+
111
module "acm" {
212
source = "terraform-aws-modules/acm/aws"
313
version = "3.3.0"
@@ -11,13 +21,3 @@ module "acm" {
1121

1222
tags = local.tags
1323
}
14-
15-
data "aws_acm_certificate" "main" {
16-
count = var.create_acm_certificate ? 0 : 1
17-
18-
domain = var.domain_name
19-
statuses = [
20-
"ISSUED",
21-
"PENDING_VALIDATION"]
22-
most_recent = true
23-
}

0 commit comments

Comments
 (0)