Skip to content

Commit 88b6b2c

Browse files
tjholmjyecusch
andauthored
fix: Terraform provider updates (#710)
* update cdktf modules interface to support extension. * make policy helpers public * access roles for SSM index param * redeploy images without tag updates Co-authored-by: Jye Cusch <jye.cusch@nitric.io>
1 parent fe39988 commit 88b6b2c

File tree

7 files changed

+82
-61
lines changed

7 files changed

+82
-61
lines changed

cloud/aws/deploytf/.nitric/modules/api/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ resource "aws_apigatewayv2_api" "api_gateway" {
22
name = var.name
33
protocol_type = "HTTP"
44
body = var.spec
5+
fail_on_warnings = true
56
tags = {
67
"x-nitric-${var.stack_id}-name" = var.name,
78
"x-nitric-${var.stack_id}-type" = "api",

cloud/aws/deploytf/.nitric/modules/service/main.tf

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,13 @@ resource "aws_ecr_repository" "repo" {
1515
data "aws_ecr_authorization_token" "ecr_auth" {
1616
}
1717

18+
data "docker_image" "latest" {
19+
name = var.image
20+
}
21+
1822
# Tag the provided docker image with the ECR repository url
1923
resource "docker_tag" "tag" {
20-
source_image = var.image
24+
source_image = data.docker_image.latest.repo_digest
2125
target_image = aws_ecr_repository.repo.repository_url
2226
}
2327

@@ -79,7 +83,7 @@ resource "aws_iam_role_policy_attachment" "basic-execution" {
7983

8084
# Attach vpc access execution role if subnets are provided
8185
resource "aws_iam_role_policy_attachment" "vpc-access" {
82-
count = length(var.subnet_ids) > 0 ? 1 : 0
86+
count = length(var.subnet_ids) > 0 ? 1 : 0
8387
role = aws_iam_role.role.name
8488
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
8589
}
@@ -90,8 +94,8 @@ resource "aws_lambda_function" "function" {
9094
role = aws_iam_role.role.arn
9195
image_uri = "${aws_ecr_repository.repo.repository_url}@${docker_registry_image.push.sha256_digest}"
9296
package_type = "Image"
93-
timeout = var.timeout
94-
memory_size = var.memory
97+
timeout = var.timeout
98+
memory_size = var.memory
9599
ephemeral_storage {
96100
size = var.ephemeral_storage
97101
}

cloud/aws/deploytf/deploy.go

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ package deploytf
1616

1717
import (
1818
"embed"
19-
"io/fs"
2019

2120
"github.com/aws/jsii-runtime-go"
2221
ecrauth "github.com/cdktf/cdktf-provider-aws-go/aws/v19/dataawsecrauthorizationtoken"
@@ -91,8 +90,13 @@ func (a *NitricAwsTerraformProvider) Init(attributes map[string]interface{}) err
9190
//go:embed .nitric/modules/**/*
9291
var modules embed.FS
9392

94-
func (a *NitricAwsTerraformProvider) CdkTfModules() (string, fs.FS, error) {
95-
return ".nitric/modules", modules, nil
93+
func (a *NitricAwsTerraformProvider) CdkTfModules() ([]provider.ModuleDirectory, error) {
94+
return []provider.ModuleDirectory{
95+
{
96+
ParentDir: ".nitric/modules",
97+
Modules: modules,
98+
},
99+
}, nil
96100
}
97101

98102
func (a *NitricAwsTerraformProvider) RequiredProviders() map[string]interface{} {
@@ -142,7 +146,13 @@ func (a *NitricAwsTerraformProvider) Pre(stack cdktf.TerraformStack, resources [
142146
}
143147

144148
func (a *NitricAwsTerraformProvider) Post(stack cdktf.TerraformStack) error {
145-
return a.resourcesStore(stack)
149+
// Give all the Services access to the resource index
150+
accessRoleNames := []string{}
151+
for _, service := range a.Services {
152+
accessRoleNames = append(accessRoleNames, *service.RoleNameOutput())
153+
}
154+
155+
return a.ResourcesStore(stack, accessRoleNames)
146156
}
147157

148158
// // Post - Called after all resources have been created, before the Pulumi Context is concluded

cloud/aws/deploytf/policy.go

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,7 @@ import (
2525
"github.com/samber/lo"
2626
)
2727

28-
// func md5Hash(b []byte) string {
29-
// hasher := md5.New() //#nosec G401 -- md5 used only to produce a unique ID from non-sensistive information (policy IDs)
30-
// hasher.Write(b)
31-
32-
// return hex.EncodeToString(hasher.Sum(nil))
33-
// }
34-
35-
var awsActionsMap map[resourcespb.Action][]string = map[resourcespb.Action][]string{
28+
var AwsActionsMap map[resourcespb.Action][]string = map[resourcespb.Action][]string{
3629
resourcespb.Action_BucketFileList: {
3730
"s3:ListBucket",
3831
},
@@ -87,20 +80,20 @@ var awsActionsMap map[resourcespb.Action][]string = map[resourcespb.Action][]str
8780
},
8881
}
8982

90-
func actionsToAwsActions(actions []resourcespb.Action) []string {
83+
func ActionsToAwsActions(actions []resourcespb.Action) []string {
9184
awsActions := make([]string, 0)
9285

9386
for _, a := range actions {
94-
awsActions = append(awsActions, awsActionsMap[a]...)
87+
awsActions = append(awsActions, AwsActionsMap[a]...)
9588
}
9689

9790
awsActions = lo.Uniq(awsActions)
9891

9992
return awsActions
10093
}
10194

102-
// // discover the arn of a deployed resource
103-
func (a *NitricAwsTerraformProvider) arnForResource(resource *deploymentspb.Resource) ([]*string, error) {
95+
// discover the arn of a deployed resource
96+
func (a *NitricAwsTerraformProvider) ArnForResource(resource *deploymentspb.Resource) ([]*string, error) {
10497
switch resource.Id.Type {
10598
case resourcespb.ResourceType_Bucket:
10699
if b, ok := a.Buckets[resource.Id.Name]; ok {
@@ -149,13 +142,13 @@ func (a *NitricAwsTerraformProvider) roleForPrincipal(resource *deploymentspb.Re
149142

150143
func (a *NitricAwsTerraformProvider) Policy(stack cdktf.TerraformStack, name string, config *deploymentspb.Policy) error {
151144
// Get Actions
152-
actions := actionsToAwsActions(config.Actions)
145+
actions := ActionsToAwsActions(config.Actions)
153146

154147
// Get Targets
155148
targetArns := make([]*string, 0, len(config.Resources))
156149

157150
for _, res := range config.Resources {
158-
if arn, err := a.arnForResource(res); err == nil {
151+
if arn, err := a.ArnForResource(res); err == nil {
159152
targetArns = append(targetArns, arn...)
160153
} else {
161154
return fmt.Errorf("failed to create policy, unable to determine resource ARN: %w", err)

cloud/aws/deploytf/resources.go

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ import (
2424
"github.com/nitrictech/nitric/cloud/aws/deploytf/generated/parameter"
2525
)
2626

27-
func (a *NitricAwsTerraformProvider) resourcesStore(stack cdktf.TerraformStack) error {
27+
func (a *NitricAwsTerraformProvider) ResourcesStore(stack cdktf.TerraformStack, accessRoleNames []string) error {
2828
index := common.NewResourceIndex()
2929

3030
for name, bucket := range a.Buckets {
@@ -76,12 +76,6 @@ func (a *NitricAwsTerraformProvider) resourcesStore(stack cdktf.TerraformStack)
7676
return fmt.Errorf("failed to marshal resource index: %w", err)
7777
}
7878

79-
// Give all the Services access to the resource index
80-
accessRoleNames := []string{}
81-
for _, service := range a.Services {
82-
accessRoleNames = append(accessRoleNames, *service.RoleNameOutput())
83-
}
84-
8579
parameter.NewParameter(stack, jsii.String("nitric_resources"), &parameter.ParameterConfig{
8680
ParameterName: jsii.Sprintf("/nitric/%s/resource-index", *a.Stack.StackIdOutput()),
8781
ParameterValue: jsii.String(string(indexJson)),

cloud/common/deploy/provider/terraform.go

Lines changed: 44 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ import (
2121
"io/fs"
2222
"net"
2323
"os"
24-
"path/filepath"
2524

2625
goruntime "runtime"
2726

@@ -36,14 +35,20 @@ import (
3635
"google.golang.org/grpc/status"
3736
)
3837

38+
type ModuleDirectory struct {
39+
ParentDir string
40+
Modules fs.FS
41+
}
42+
3943
type NitricTerraformProvider interface {
4044
// Init - Initialize the provider with the given attributes, prior to any resource creation or Pulumi Context creation
4145
Init(attributes map[string]interface{}) error
4246
// Pre - Called prior to any resource creation, after the Pulumi Context has been established
4347
Pre(stack cdktf.TerraformStack, resources []*deploymentspb.Resource) error
4448

4549
// CdkTfModules - Return the relative parent directory (root golang packed) and embedded modules directory
46-
CdkTfModules() (string, fs.FS, error)
50+
// CdkTfModules() (string, fs.FS, error)
51+
CdkTfModules() ([]ModuleDirectory, error)
4752

4853
// RequiredProviders - Return a list of required providers for this provider
4954
RequiredProviders() map[string]interface{}
@@ -127,53 +132,63 @@ func createTerraformStackForNitricProvider(req *deploymentspb.DeploymentUpReques
127132

128133
fullStackName := fmt.Sprintf("%s-%s", projectName, stackName)
129134

130-
parentDir, modules, err := nitricProvider.CdkTfModules()
135+
modules, err := nitricProvider.CdkTfModules()
131136
if err != nil {
132137
return err
133138
}
134139

135-
// modules dir
136-
modulesDir := filepath.Join(parentDir)
137-
138-
err = os.MkdirAll(modulesDir, 0o750)
139-
if err != nil {
140-
return err
141-
}
142-
// cleanup the modules when we're done
143-
// NOTE: Its importent to ensure that the modules are written to a temporary directory like .nitric
144-
defer os.RemoveAll(modulesDir)
145-
146-
err = fs.WalkDir(modules, ".", func(path string, d fs.DirEntry, err error) error {
140+
fses := []fs.FS{}
141+
relativeModules := []string{}
142+
for _, module := range modules {
143+
relativeModules = append(relativeModules, module.ParentDir)
144+
err = os.MkdirAll(module.ParentDir, 0o750)
147145
if err != nil {
148146
return err
149147
}
150148

151-
if !d.IsDir() {
152-
data, err := modules.Open(path)
149+
defer os.RemoveAll(module.ParentDir)
150+
fses = append(fses, module.Modules)
151+
}
152+
153+
// modules dir
154+
155+
// cleanup the modules when we're done
156+
// NOTE: Its important to ensure that the modules are written to a temporary directory like .nitric
157+
158+
for _, fsx := range fses {
159+
err = fs.WalkDir(fsx, ".", func(path string, d fs.DirEntry, err error) error {
153160
if err != nil {
154161
return err
155162
}
156-
defer data.Close()
157163

158-
//#nosec G304 -- path unpacking known modules embedded fs
159-
out, err := os.Create(path)
160-
if err != nil {
164+
if !d.IsDir() {
165+
data, err := fsx.Open(path)
166+
if err != nil {
167+
return err
168+
}
169+
defer data.Close()
170+
171+
//#nosec G304 -- path unpacking known modules embedded fs
172+
out, err := os.Create(path)
173+
if err != nil {
174+
return err
175+
}
176+
defer out.Close()
177+
178+
fmt.Println("Writing module to", path)
179+
_, err = io.Copy(out, data)
161180
return err
162181
}
163-
defer out.Close()
164182

165-
_, err = io.Copy(out, data)
183+
return os.MkdirAll(path, 0o750)
184+
})
185+
if err != nil {
166186
return err
167187
}
168-
169-
return os.MkdirAll(path, 0o750)
170-
})
171-
if err != nil {
172-
return err
173188
}
174189

175190
appCtx := map[string]interface{}{
176-
"cdktfRelativeModules": []string{filepath.Join(modulesDir)},
191+
"cdktfRelativeModules": relativeModules,
177192
// Ensure static output
178193
"cdktfStaticModuleAssetHash": "nitric_modules",
179194
}

cloud/gcp/deploytf/deploy.go

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ package deploytf
1616

1717
import (
1818
"embed"
19-
"io/fs"
2019

2120
"github.com/aws/jsii-runtime-go"
2221
dockerprovider "github.com/cdktf/cdktf-provider-docker-go/docker/v11/provider"
@@ -99,8 +98,13 @@ func (a *NitricGcpTerraformProvider) RequiredProviders() map[string]interface{}
9998
}
10099
}
101100

102-
func (a *NitricGcpTerraformProvider) CdkTfModules() (string, fs.FS, error) {
103-
return ".nitric/modules", modules, nil
101+
func (a *NitricGcpTerraformProvider) CdkTfModules() ([]provider.ModuleDirectory, error) {
102+
return []provider.ModuleDirectory{
103+
{
104+
ParentDir: ".nitric/modules",
105+
Modules: modules,
106+
},
107+
}, nil
104108
}
105109

106110
func (a *NitricGcpTerraformProvider) prepareGcpProviders(stack cdktf.TerraformStack) {

0 commit comments

Comments
 (0)