Skip to content

Commit 430a91d

Browse files
diegoitaliaitdiegoitaliait
committed
creazione modulo argocd
1 parent 7ecbb51 commit 430a91d

File tree

4 files changed

+305
-94
lines changed

4 files changed

+305
-94
lines changed

‎src/aks-platform/10_argocd.tf‎

Lines changed: 27 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -17,28 +17,28 @@ data "azurerm_key_vault_secret" "argocd_entra_app_client_id" {
1717
}
1818

1919
#
20-
# Setup ArgoCD
20+
# Setup ArgoCD (module)
2121
#
22-
resource "helm_release" "argocd" {
23-
name = "argo"
24-
chart = "https://github.com/argoproj/argo-helm/releases/download/argo-cd-${var.argocd_helm_release_version}/argo-cd-${var.argocd_helm_release_version}.tgz"
25-
namespace = kubernetes_namespace.namespace_argocd.metadata[0].name
26-
wait = true
27-
28-
values = [
29-
templatefile("${path.module}/argocd/argocd_helm_setup_values.yaml", {
30-
ARGOCD_APPLICATION_NAMESPACES = var.argocd_application_namespaces
31-
TENANT_ID = data.azurerm_subscription.current.tenant_id
32-
APP_CLIENT_ID = data.azurerm_key_vault_secret.argocd_entra_app_client_id.value
33-
ENTRA_ADMIN_GROUP_OBJECT_IDS = []
34-
ENTRA_DEVELOPER_GROUP_OBJECT_IDS = []
35-
ENTRA_READER_GROUP_OBJECT_IDS = []
36-
ENTRA_GUEST_GROUP_OBJECT_IDS = []
37-
ARGOCD_INTERNAL_URL = local.argocd_internal_url
38-
ARGOCD_INGRESS_TLS_SECRET_NAME = replace(local.argocd_internal_url, ".", "-", )
39-
FORCE_REINSTALL = var.argocd_force_reinstall_version
40-
})
41-
]
22+
module "argocd" {
23+
source = "./modules/argocd"
24+
25+
namespace = kubernetes_namespace.namespace_argocd.metadata[0].name
26+
argocd_helm_release_version = var.argocd_helm_release_version
27+
argocd_application_namespaces = var.argocd_application_namespaces
28+
argocd_force_reinstall_version = var.argocd_force_reinstall_version
29+
tenant_id = data.azurerm_subscription.current.tenant_id
30+
app_client_id = data.azurerm_key_vault_secret.argocd_entra_app_client_id.value
31+
argocd_internal_url = local.argocd_internal_url
32+
kv_core_id = data.azurerm_key_vault.kv_core_ita.id
33+
aks_name = module.aks.name
34+
aks_resource_group_name = azurerm_resource_group.rg_aks.name
35+
workload_identity_resource_group_name = azurerm_resource_group.rg_aks.name
36+
location = var.location
37+
internal_dns_zone_name = data.azurerm_private_dns_zone.internal.name
38+
internal_dns_zone_resource_group_name = local.internal_dns_zone_resource_group_name
39+
ingress_load_balancer_ip = var.ingress_load_balancer_ip
40+
ingress_hostname_prefix = local.ingress_hostname_prefix
41+
admin_password = data.azurerm_key_vault_secret.argocd_admin_password.value
4242

4343
depends_on = [
4444
module.aks,
@@ -53,73 +53,12 @@ data "azurerm_key_vault_secret" "argocd_admin_password" {
5353
name = "argocd-admin-password"
5454
}
5555

56-
resource "null_resource" "argocd_change_admin_password" {
57-
58-
triggers = {
59-
argocd_password = data.azurerm_key_vault_secret.argocd_admin_password.value
60-
force_reinstall = var.argocd_force_reinstall_version
61-
}
62-
63-
provisioner "local-exec" {
64-
command = "kubectl -n argocd patch secret argocd-secret -p '{\"stringData\": {\"admin.password\": \"${bcrypt(data.azurerm_key_vault_secret.argocd_admin_password.value)}\", \"admin.passwordMtime\": \"'$(date +%FT%T%Z)'\"}}'"
65-
}
66-
67-
depends_on = [
68-
data.azurerm_key_vault_secret.argocd_admin_password,
69-
helm_release.argocd
70-
]
71-
}
72-
73-
resource "null_resource" "restart_argocd_server" {
74-
triggers = {
75-
force_reinstall = var.argocd_force_reinstall_version
76-
helm_version = helm_release.argocd.version
77-
helm_values = helm_release.argocd.values[0]
78-
}
79-
80-
provisioner "local-exec" {
81-
command = "kubectl -n argocd rollout restart deployment/argo-argocd-server"
82-
}
83-
84-
depends_on = [
85-
helm_release.argocd,
86-
null_resource.argocd_change_admin_password
87-
]
88-
}
89-
90-
resource "azurerm_key_vault_secret" "argocd_admin_username" {
91-
key_vault_id = data.azurerm_key_vault.kv_core_ita.id
92-
name = "argocd-admin-username"
93-
value = "admin"
94-
}
56+
# moved to module
9557

9658
#
9759
# tools
9860
#
99-
module "argocd_workload_identity_init" {
100-
source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_workload_identity_init?ref=v8.77.0"
101-
102-
workload_identity_name_prefix = "argocd"
103-
workload_identity_resource_group_name = azurerm_resource_group.rg_aks.name
104-
workload_identity_location = var.location
105-
}
106-
107-
module "argocd_workload_identity_configuration" {
108-
source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_workload_identity_configuration?ref=v8.77.0"
109-
110-
workload_identity_name_prefix = "argocd"
111-
workload_identity_resource_group_name = azurerm_resource_group.rg_aks.name
112-
aks_name = module.aks.name
113-
aks_resource_group_name = azurerm_resource_group.rg_aks.name
114-
namespace = kubernetes_namespace.namespace_argocd.metadata[0].name
115-
116-
key_vault_id = data.azurerm_key_vault.kv_core_ita.id
117-
key_vault_certificate_permissions = ["Get"]
118-
key_vault_key_permissions = ["Get"]
119-
key_vault_secret_permissions = ["Get"]
120-
121-
depends_on = [module.argocd_workload_identity_init]
122-
}
61+
# moved to module
12362

12463
module "cert_mounter_argocd_internal" {
12564
source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//cert_mounter?ref=v8.77.0"
@@ -129,11 +68,11 @@ module "cert_mounter_argocd_internal" {
12968
tenant_id = data.azurerm_subscription.current.tenant_id
13069

13170
workload_identity_enabled = true
132-
workload_identity_service_account_name = module.argocd_workload_identity_configuration.workload_identity_service_account_name
133-
workload_identity_client_id = module.argocd_workload_identity_configuration.workload_identity_client_id
71+
workload_identity_service_account_name = module.argocd.workload_identity_service_account_name
72+
workload_identity_client_id = module.argocd.workload_identity_client_id
13473

13574
depends_on = [
136-
module.argocd_workload_identity_configuration
75+
module.argocd
13776
]
13877
}
13978

@@ -153,10 +92,4 @@ resource "helm_release" "reloader_argocd" {
15392
#
15493
# 🌐 Network
15594
#
156-
resource "azurerm_private_dns_a_record" "argocd_ingress" {
157-
name = local.ingress_hostname_prefix
158-
zone_name = data.azurerm_private_dns_zone.internal.name
159-
resource_group_name = local.internal_dns_zone_resource_group_name
160-
ttl = 3600
161-
records = [var.ingress_load_balancer_ip]
162-
}
95+
# moved to module

‎src/aks-platform/modules/argocd/main.tf‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
locals {
2+
tls_secret_name = coalesce(var.ingress_tls_secret_name, replace(var.argocd_internal_url, ".", "-"))
3+
}
4+
5+
resource "helm_release" "argocd" {
6+
count = var.enable_helm_release ? 1 : 0
7+
name = "argo"
8+
chart = "https://github.com/argoproj/argo-helm/releases/download/argo-cd-${var.argocd_helm_release_version}/argo-cd-${var.argocd_helm_release_version}.tgz"
9+
namespace = var.namespace
10+
wait = true
11+
12+
values = [
13+
templatefile("${path.root}/src/aks-platform/argocd/argocd_helm_setup_values.yaml", {
14+
ARGOCD_APPLICATION_NAMESPACES = var.argocd_application_namespaces
15+
TENANT_ID = var.tenant_id
16+
APP_CLIENT_ID = var.app_client_id
17+
ENTRA_ADMIN_GROUP_OBJECT_IDS = var.entra_admin_group_object_ids
18+
ENTRA_DEVELOPER_GROUP_OBJECT_IDS = var.entra_developer_group_object_ids
19+
ENTRA_READER_GROUP_OBJECT_IDS = var.entra_reader_group_object_ids
20+
ENTRA_GUEST_GROUP_OBJECT_IDS = var.entra_guest_group_object_ids
21+
ARGOCD_INTERNAL_URL = var.argocd_internal_url
22+
ARGOCD_INGRESS_TLS_SECRET_NAME = local.tls_secret_name
23+
FORCE_REINSTALL = var.argocd_force_reinstall_version
24+
})
25+
]
26+
}
27+
28+
resource "azurerm_key_vault_secret" "argocd_admin_username" {
29+
count = var.enable_store_admin_username ? 1 : 0
30+
key_vault_id = var.kv_core_id
31+
name = "argocd-admin-username"
32+
value = "admin"
33+
}
34+
35+
resource "null_resource" "argocd_change_admin_password" {
36+
count = var.enable_change_admin_password ? 1 : 0
37+
38+
triggers = {
39+
argocd_password = var.admin_password
40+
force_reinstall = var.argocd_force_reinstall_version
41+
}
42+
43+
provisioner "local-exec" {
44+
command = "kubectl -n ${var.namespace} patch secret argocd-secret -p '{\"stringData\": {\"admin.password\": \"${bcrypt(var.admin_password)}\", \"admin.passwordMtime\": \"'$(date +%FT%T%Z)'\"}}'"
45+
}
46+
47+
depends_on = [
48+
# Ensure helm release is applied before patching the secret when enabled
49+
helm_release.argocd,
50+
]
51+
}
52+
53+
resource "null_resource" "restart_argocd_server" {
54+
count = var.enable_restart_argocd_server ? 1 : 0
55+
56+
triggers = {
57+
force_reinstall = var.argocd_force_reinstall_version
58+
helm_version = try(helm_release.argocd[0].version, "")
59+
helm_values = try(helm_release.argocd[0].values[0], "")
60+
}
61+
62+
provisioner "local-exec" {
63+
command = "kubectl -n ${var.namespace} rollout restart deployment/argo-argocd-server"
64+
}
65+
66+
depends_on = [
67+
helm_release.argocd,
68+
null_resource.argocd_change_admin_password,
69+
]
70+
}
71+
72+
module "argocd_workload_identity_init" {
73+
count = var.enable_workload_identity_init ? 1 : 0
74+
source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_workload_identity_init?ref=v8.77.0"
75+
76+
workload_identity_name_prefix = "argocd"
77+
workload_identity_resource_group_name = var.workload_identity_resource_group_name
78+
workload_identity_location = var.location
79+
}
80+
81+
module "argocd_workload_identity_configuration" {
82+
count = var.enable_workload_identity_configuration ? 1 : 0
83+
source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_workload_identity_configuration?ref=v8.77.0"
84+
85+
workload_identity_name_prefix = "argocd"
86+
workload_identity_resource_group_name = var.workload_identity_resource_group_name
87+
aks_name = var.aks_name
88+
aks_resource_group_name = var.aks_resource_group_name
89+
namespace = var.namespace
90+
91+
key_vault_id = var.kv_core_id
92+
key_vault_certificate_permissions = ["Get"]
93+
key_vault_key_permissions = ["Get"]
94+
key_vault_secret_permissions = ["Get"]
95+
96+
depends_on = [module.argocd_workload_identity_init]
97+
}
98+
99+
resource "azurerm_private_dns_a_record" "argocd_ingress" {
100+
count = var.enable_private_dns_a_record ? 1 : 0
101+
name = var.ingress_hostname_prefix
102+
zone_name = var.internal_dns_zone_name
103+
resource_group_name = var.internal_dns_zone_resource_group_name
104+
ttl = 3600
105+
records = [var.ingress_load_balancer_ip]
106+
}
107+

‎src/aks-platform/modules/argocd/outputs.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
output "workload_identity_service_account_name" {
2+
description = "Service Account name created by workload identity configuration"
3+
value = try(module.argocd_workload_identity_configuration[0].workload_identity_service_account_name, null)
4+
}
5+
6+
output "workload_identity_client_id" {
7+
description = "Client ID created by workload identity configuration"
8+
value = try(module.argocd_workload_identity_configuration[0].workload_identity_client_id, null)
9+
}
10+

0 commit comments

Comments
 (0)