|
| 1 | +######################################################################################################################## |
| 2 | +# Resource group |
| 3 | +######################################################################################################################## |
| 4 | + |
| 5 | +module "resource_group" { |
| 6 | + source = "terraform-ibm-modules/resource-group/ibm" |
| 7 | + version = "1.4.0" |
| 8 | + existing_resource_group_name = var.existing_resource_group_name |
| 9 | +} |
| 10 | + |
| 11 | +######################################################################################################################## |
| 12 | +# Add-ons |
| 13 | +######################################################################################################################## |
| 14 | + |
| 15 | +module "monolith_add_ons" { |
| 16 | + source = "../../modules/monolith" |
| 17 | + prefix = var.prefix |
| 18 | + region = var.region |
| 19 | + resource_group_id = module.resource_group.resource_group_id |
| 20 | + kms_encryption_enabled_cluster = var.kms_encryption_enabled_cluster |
| 21 | + existing_kms_instance_crn = var.existing_kms_instance_crn |
| 22 | + existing_cluster_kms_key_crn = var.existing_cluster_kms_key_crn |
| 23 | + kms_endpoint_type = var.kms_endpoint_type |
| 24 | + key_protect_allowed_network = var.key_protect_allowed_network |
| 25 | + kms_encryption_enabled_boot_volume = var.kms_encryption_enabled_boot_volume |
| 26 | + existing_boot_volume_kms_key_crn = var.existing_boot_volume_kms_key_crn |
| 27 | + kms_plan = var.kms_plan |
| 28 | + existing_secrets_manager_crn = var.existing_secrets_manager_crn |
| 29 | + secrets_manager_service_plan = var.secrets_manager_service_plan |
| 30 | + secrets_manager_endpoint_type = var.secrets_manager_endpoint_type |
| 31 | + secrets_manager_allowed_network = var.secrets_manager_allowed_network |
| 32 | + existing_event_notifications_instance_crn = var.existing_event_notifications_instance_crn |
| 33 | + existing_cos_instance_crn = var.existing_cos_instance_crn |
| 34 | + cos_instance_plan = var.cos_instance_plan |
| 35 | + existing_cloud_monitoring_crn = var.existing_cloud_monitoring_crn |
| 36 | + cloud_monitoring_plan = var.cloud_monitoring_plan |
| 37 | + existing_cloud_logs_crn = var.existing_cloud_logs_crn |
| 38 | + scc_workload_protection_service_plan = var.scc_workload_protection_service_plan |
| 39 | + enable_vpc_flow_logs = var.enable_vpc_flow_logs |
| 40 | +} |
| 41 | + |
| 42 | +######################################################################################################################## |
| 43 | +# OCP VPC cluster |
| 44 | +######################################################################################################################## |
| 45 | + |
| 46 | +locals { |
| 47 | + vpc_subnets = { |
| 48 | + # The default behavior is to deploy the worker pool across all subnets within the VPC. |
| 49 | + "default" = [ |
| 50 | + for subnet in module.monolith_add_ons.subnet_zone_list : |
| 51 | + { |
| 52 | + id = subnet.id |
| 53 | + zone = subnet.zone |
| 54 | + cidr_block = subnet.cidr |
| 55 | + } |
| 56 | + ] |
| 57 | + } |
| 58 | + |
| 59 | + worker_pools = concat([ |
| 60 | + { |
| 61 | + subnet_prefix = "default" |
| 62 | + pool_name = "default" |
| 63 | + machine_type = var.default_worker_pool_machine_type |
| 64 | + workers_per_zone = var.default_worker_pool_workers_per_zone |
| 65 | + resource_group_id = module.resource_group.resource_group_id |
| 66 | + operating_system = var.default_worker_pool_operating_system |
| 67 | + labels = var.default_worker_pool_labels |
| 68 | + minSize = var.default_pool_minimum_number_of_nodes |
| 69 | + maxSize = var.default_pool_maximum_number_of_nodes |
| 70 | + enableAutoscaling = var.enable_autoscaling_for_default_pool |
| 71 | + boot_volume_encryption_kms_config = { |
| 72 | + crk = module.monolith_add_ons.boot_volume_kms_key_id |
| 73 | + kms_instance_id = module.monolith_add_ons.boot_volume_existing_kms_guid |
| 74 | + kms_account_id = module.monolith_add_ons.boot_volume_kms_account_id |
| 75 | + } |
| 76 | + additional_security_group_ids = var.additional_security_group_ids |
| 77 | + } |
| 78 | + ], [for pool in var.additional_worker_pools : merge(pool, { resource_group_id = module.resource_group.resource_group_id |
| 79 | + boot_volume_encryption_kms_config = { |
| 80 | + crk = module.monolith_add_ons.boot_volume_kms_key_id |
| 81 | + kms_instance_id = module.monolith_add_ons.boot_volume_existing_kms_guid |
| 82 | + kms_account_id = module.monolith_add_ons.boot_volume_kms_account_id |
| 83 | + } }) if length(pool.vpc_subnets) > 0], |
| 84 | + [for pool in var.additional_worker_pools : { |
| 85 | + pool_name = pool.pool_name |
| 86 | + machine_type = pool.machine_type |
| 87 | + workers_per_zone = pool.workers_per_zone |
| 88 | + resource_group_id = module.resource_group.resource_group_id |
| 89 | + operating_system = pool.operating_system |
| 90 | + labels = pool.labels |
| 91 | + minSize = pool.minSize |
| 92 | + secondary_storage = pool.secondary_storage |
| 93 | + maxSize = pool.maxSize |
| 94 | + enableAutoscaling = pool.enableAutoscaling |
| 95 | + boot_volume_encryption_kms_config = { |
| 96 | + crk = module.monolith_add_ons.boot_volume_kms_key_id |
| 97 | + kms_instance_id = module.monolith_add_ons.boot_volume_existing_kms_guid |
| 98 | + kms_account_id = module.monolith_add_ons.boot_volume_kms_account_id |
| 99 | + } |
| 100 | + additional_security_group_ids = pool.additional_security_group_ids |
| 101 | + subnet_prefix = "default" |
| 102 | + } if length(pool.vpc_subnets) == 0]) |
| 103 | + |
| 104 | + # Managing the ODF version accordingly, as it changes with each OCP version. |
| 105 | + addons = lookup(var.addons, "openshift-data-foundation", null) != null ? lookup(var.addons["openshift-data-foundation"], "version", null) == null ? { for key, value in var.addons : |
| 106 | + key => value != null ? { |
| 107 | + version = lookup(value, "version", null) == null && key == "openshift-data-foundation" ? "${var.openshift_version}.0" : lookup(value, "version", null) |
| 108 | + parameters_json = lookup(value, "parameters_json", null) |
| 109 | + } : null } : var.addons : var.addons |
| 110 | +} |
| 111 | + |
| 112 | +module "ocp_base" { |
| 113 | + depends_on = [module.monolith_add_ons] |
| 114 | + source = "../.." |
| 115 | + resource_group_id = module.resource_group.resource_group_id |
| 116 | + region = var.region |
| 117 | + tags = var.cluster_resource_tags |
| 118 | + cluster_name = "${var.prefix}-${var.cluster_name}" |
| 119 | + force_delete_storage = true |
| 120 | + use_existing_cos = true |
| 121 | + existing_cos_id = module.monolith_add_ons.cos_instance_id |
| 122 | + vpc_id = module.monolith_add_ons.vpc_id |
| 123 | + vpc_subnets = local.vpc_subnets |
| 124 | + ocp_version = var.openshift_version |
| 125 | + worker_pools = local.worker_pools |
| 126 | + access_tags = var.access_tags |
| 127 | + ocp_entitlement = var.ocp_entitlement |
| 128 | + additional_lb_security_group_ids = var.additional_lb_security_group_ids |
| 129 | + additional_vpe_security_group_ids = var.additional_vpe_security_group_ids |
| 130 | + addons = local.addons |
| 131 | + allow_default_worker_pool_replacement = var.allow_default_worker_pool_replacement |
| 132 | + attach_ibm_managed_security_group = var.attach_ibm_managed_security_group |
| 133 | + cluster_config_endpoint_type = var.cluster_config_endpoint_type |
| 134 | + cbr_rules = var.ocp_cbr_rules |
| 135 | + cluster_ready_when = var.cluster_ready_when |
| 136 | + custom_security_group_ids = var.custom_security_group_ids |
| 137 | + disable_outbound_traffic_protection = var.allow_outbound_traffic |
| 138 | + disable_public_endpoint = !var.allow_public_access_to_cluster_management |
| 139 | + enable_ocp_console = var.enable_ocp_console |
| 140 | + ignore_worker_pool_size_changes = var.ignore_worker_pool_size_changes |
| 141 | + kms_config = module.monolith_add_ons.kms_config |
| 142 | + manage_all_addons = var.manage_all_addons |
| 143 | + number_of_lbs = var.number_of_lbs |
| 144 | + pod_subnet_cidr = var.pod_subnet_cidr |
| 145 | + service_subnet_cidr = var.service_subnet_cidr |
| 146 | + verify_worker_network_readiness = var.verify_worker_network_readiness |
| 147 | + worker_pools_taints = var.worker_pools_taints |
| 148 | + enable_secrets_manager_integration = var.enable_secrets_manager_integration |
| 149 | + existing_secrets_manager_instance_crn = module.monolith_add_ons.secrets_manager_crn |
| 150 | + secrets_manager_secret_group_id = var.secrets_manager_secret_group_id != null ? var.secrets_manager_secret_group_id : (var.enable_secrets_manager_integration ? module.secret_group[0].secret_group_id : null) |
| 151 | + skip_ocp_secrets_manager_iam_auth_policy = var.skip_ocp_secrets_manager_iam_auth_policy |
| 152 | +} |
| 153 | + |
| 154 | +resource "terraform_data" "delete_secrets" { |
| 155 | + depends_on = [module.monolith_add_ons] |
| 156 | + count = var.enable_secrets_manager_integration && var.secrets_manager_secret_group_id == null ? 1 : 0 |
| 157 | + input = { |
| 158 | + secret_id = module.secret_group[0].secret_group_id |
| 159 | + provider_visibility = var.provider_visibility |
| 160 | + secrets_manager_instance_id = module.monolith_add_ons.secrets_manager_guid |
| 161 | + secrets_manager_region = module.monolith_add_ons.secrets_manager_region |
| 162 | + secrets_manager_endpoint = var.secrets_manager_endpoint_type |
| 163 | + } |
| 164 | + # api key in triggers_replace to avoid it to be printed out in clear text in terraform_data output |
| 165 | + triggers_replace = { |
| 166 | + api_key = var.ibmcloud_api_key |
| 167 | + } |
| 168 | + provisioner "local-exec" { |
| 169 | + when = destroy |
| 170 | + command = "${path.module}/../../solutions/fully-configurable/scripts/delete_secrets.sh ${self.input.secret_id} ${self.input.provider_visibility} ${self.input.secrets_manager_instance_id} ${self.input.secrets_manager_region} ${self.input.secrets_manager_endpoint}" |
| 171 | + interpreter = ["/bin/bash", "-c"] |
| 172 | + |
| 173 | + environment = { |
| 174 | + API_KEY = self.triggers_replace.api_key |
| 175 | + } |
| 176 | + } |
| 177 | +} |
| 178 | + |
| 179 | +module "secret_group" { |
| 180 | + count = var.enable_secrets_manager_integration && var.secrets_manager_secret_group_id == null ? 1 : 0 |
| 181 | + source = "terraform-ibm-modules/secrets-manager-secret-group/ibm" |
| 182 | + version = "1.3.15" |
| 183 | + region = module.monolith_add_ons.secrets_manager_region |
| 184 | + secrets_manager_guid = module.monolith_add_ons.secrets_manager_guid |
| 185 | + secret_group_name = module.ocp_base.cluster_id |
| 186 | + secret_group_description = "Secret group for storing ingress certificates for cluster ${var.cluster_name} with id: ${module.ocp_base.cluster_id}" |
| 187 | + endpoint_type = var.secrets_manager_endpoint_type |
| 188 | +} |
| 189 | + |
| 190 | +data "ibm_container_cluster_config" "cluster_config" { |
| 191 | + count = var.enable_kube_audit ? 1 : 0 |
| 192 | + cluster_name_id = module.ocp_base.cluster_id |
| 193 | + config_dir = "${path.module}/../../kubeconfig" |
| 194 | + admin = true |
| 195 | + resource_group_id = module.ocp_base.resource_group_id |
| 196 | + endpoint_type = var.cluster_config_endpoint_type != "default" ? var.cluster_config_endpoint_type : null |
| 197 | +} |
| 198 | + |
| 199 | +module "kube_audit" { |
| 200 | + count = var.enable_kube_audit ? 1 : 0 |
| 201 | + ibmcloud_api_key = var.ibmcloud_api_key |
| 202 | + source = "../../modules/kube-audit" |
| 203 | + cluster_id = module.ocp_base.cluster_id |
| 204 | + cluster_resource_group_id = module.ocp_base.resource_group_id |
| 205 | + region = module.ocp_base.region |
| 206 | + use_private_endpoint = var.use_private_endpoint |
| 207 | + cluster_config_endpoint_type = var.cluster_config_endpoint_type |
| 208 | + audit_log_policy = var.audit_log_policy |
| 209 | + audit_namespace = var.audit_namespace |
| 210 | + audit_deployment_name = var.audit_deployment_name |
| 211 | + audit_webhook_listener_image = var.audit_webhook_listener_image |
| 212 | + audit_webhook_listener_image_tag_digest = var.audit_webhook_listener_image_tag_digest |
| 213 | +} |
0 commit comments