Skip to content

Commit 5cca92d

Browse files
Aashiq-JAashiq-J
committed
revert kube-audit changes
1 parent c04417a commit 5cca92d

File tree

7 files changed

+37
-5
lines changed

7 files changed

+37
-5
lines changed

‎examples/advanced/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,7 @@ module "kube_audit" {
219219
cluster_resource_group_id = module.resource_group.resource_group_id
220220
audit_log_policy = "WriteRequestBodies"
221221
region = var.region
222+
ibmcloud_api_key = var.ibmcloud_api_key
222223
}
223224

224225

‎modules/kube-audit/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ No modules.
9090
| <a name="input_cluster_config_endpoint_type"></a> [cluster\_config\_endpoint\_type](#input\_cluster\_config\_endpoint\_type) | Specify which type of endpoint to use for for cluster config access: 'default', 'private', 'vpe', 'link'. 'default' value will use the default endpoint of the cluster. | `string` | `"default"` | no |
9191
| <a name="input_cluster_id"></a> [cluster\_id](#input\_cluster\_id) | The ID of the cluster to deploy the log collection service in. | `string` | n/a | yes |
9292
| <a name="input_cluster_resource_group_id"></a> [cluster\_resource\_group\_id](#input\_cluster\_resource\_group\_id) | The resource group ID of the cluster. | `string` | n/a | yes |
93+
| <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The IBM Cloud api key to generate an IAM token. | `string` | n/a | yes |
9394
| <a name="input_install_required_binaries"></a> [install\_required\_binaries](#input\_install\_required\_binaries) | When set to true, a script will run to check if `kubectl` and `jq` exist on the runtime and if not attempt to download them from the public internet and install them to /tmp. Set to false to skip running this script. | `bool` | `true` | no |
9495
| <a name="input_region"></a> [region](#input\_region) | The IBM Cloud region where the cluster is provisioned. | `string` | n/a | yes |
9596
| <a name="input_use_private_endpoint"></a> [use\_private\_endpoint](#input\_use\_private\_endpoint) | Set this to true to force all api calls to use the IBM Cloud private endpoints. | `bool` | `false` | no |

‎modules/kube-audit/main.tf‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,20 +110,25 @@ locals {
110110
audit_server = "https://127.0.0.1:2040/api/v1/namespaces/${var.audit_namespace}/services/${var.audit_deployment_name}-service/proxy/post"
111111
}
112112

113+
# see [issue](https://github.com/IBM-Cloud/terraform-provider-ibm/issues/6107)
114+
# data "ibm_iam_auth_token" "webhook_api_key_tokendata" {
115+
# depends_on = [data.ibm_container_cluster_config.cluster_config]
116+
# }
117+
113118
data "ibm_iam_auth_token" "webhook_api_key_tokendata" {
114119
depends_on = [time_sleep.wait_for_kube_audit]
115120
}
116121

117122
resource "null_resource" "set_audit_webhook" {
118-
depends_on = [null_resource.install_required_binaries]
123+
depends_on = [null_resource.install_required_binaries, time_sleep.wait_for_kube_audit]
119124
triggers = {
120125
audit_log_policy = var.audit_log_policy
121126
}
122127
provisioner "local-exec" {
123128
command = "${path.module}/scripts/set_webhook.sh ${var.region} ${var.use_private_endpoint} ${var.cluster_config_endpoint_type} ${var.cluster_id} ${var.cluster_resource_group_id} ${var.audit_log_policy != "default" ? "verbose" : "default"} ${local.binaries_path}"
124129
interpreter = ["/bin/bash", "-c"]
125130
environment = {
126-
IAM_TOKEN = sensitive(data.ibm_iam_auth_token.webhook_api_key_tokendata.iam_access_token)
131+
IAM_API_KEY = var.ibmcloud_api_key
127132
AUDIT_SERVER = local.audit_server
128133
CLIENT_CERT = data.ibm_container_cluster_config.cluster_config.admin_certificate
129134
CLIENT_KEY = data.ibm_container_cluster_config.cluster_config.admin_key

‎modules/kube-audit/scripts/set_webhook.sh‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@
22

33
set -euo pipefail
44

5-
# Adding sleep for the token to be ready
6-
sleep 10
7-
85
REGION="$1"
96
PRIVATE_ENV="$2"
107
CLUSTER_ENDPOINT="$3"
@@ -16,13 +13,33 @@ POLICY="$6"
1613
export PATH=$PATH:${7:-"/tmp"}
1714

1815
get_cloud_endpoint() {
16+
iam_cloud_endpoint="${IBMCLOUD_IAM_API_ENDPOINT:-"iam.cloud.ibm.com"}"
17+
IBMCLOUD_IAM_API_ENDPOINT=${iam_cloud_endpoint#https://}
1918
cs_api_endpoint="${IBMCLOUD_CS_API_ENDPOINT:-"containers.cloud.ibm.com"}"
2019
cs_api_endpoint=${cs_api_endpoint#https://}
2120
IBMCLOUD_CS_API_ENDPOINT=${cs_api_endpoint%/global}
2221
}
2322

2423
get_cloud_endpoint
2524

25+
# This is a workaround function added to retrieve a new token, this can be removed once this issue(https://github.com/IBM-Cloud/terraform-provider-ibm/issues/6107) is fixed.
26+
fetch_token() {
27+
if [ "$IBMCLOUD_IAM_API_ENDPOINT" = "iam.cloud.ibm.com" ]; then
28+
if [ "$PRIVATE_ENV" = true ]; then
29+
IAM_URL="https://private.$IBMCLOUD_IAM_API_ENDPOINT/identity/token"
30+
else
31+
IAM_URL="https://$IBMCLOUD_IAM_API_ENDPOINT/identity/token"
32+
fi
33+
else
34+
IAM_URL="https://$IBMCLOUD_IAM_API_ENDPOINT/identity/token"
35+
fi
36+
37+
token=$(curl -s -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=$IAM_API_KEY" -X POST "$IAM_URL") #pragma: allowlist secret
38+
IAM_TOKEN=$(echo "$token" | jq -r .access_token)
39+
}
40+
41+
fetch_token
42+
2643
# This is a workaround function added to retrieve the CA cert, this can be removed once this issue(https://github.com/IBM-Cloud/terraform-provider-ibm/issues/6068) is fixed.
2744
get_ca_cert() {
2845
if [ "$IBMCLOUD_CS_API_ENDPOINT" = "containers.cloud.ibm.com" ]; then

‎modules/kube-audit/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22
# Cluster variables
33
##############################################################################
44

5+
variable "ibmcloud_api_key" {
6+
type = string
7+
description = "The IBM Cloud api key to generate an IAM token."
8+
sensitive = true
9+
}
10+
511
variable "cluster_id" {
612
type = string
713
description = "The ID of the cluster to deploy the log collection service in."

‎solutions/fully-configurable/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -298,6 +298,7 @@ data "ibm_container_cluster_config" "cluster_config" {
298298

299299
module "kube_audit" {
300300
count = var.enable_kube_audit ? 1 : 0
301+
ibmcloud_api_key = var.ibmcloud_api_key
301302
source = "../../modules/kube-audit"
302303
cluster_id = module.ocp_base.cluster_id
303304
cluster_resource_group_id = module.ocp_base.resource_group_id

‎tests/pr_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ func setupQuickstartOptions(t *testing.T, prefix string) *testschematic.TestSche
102102
"*.tf",
103103
quickStartTerraformDir + "/*.tf", "scripts/*.sh", "kubeconfig/README.md",
104104
"modules/worker-pool/*.tf",
105+
"modules/kube-audit/scripts/*.sh",
105106
},
106107
TemplateFolder: quickStartTerraformDir,
107108
Tags: []string{"test-schematic"},

0 commit comments

Comments
 (0)