From 2710d62bc391f4c77aafc64ef3d1a53db7bb9de2 Mon Sep 17 00:00:00 2001 From: Anders Qvist Date: Mon, 18 Dec 2023 14:41:01 +0100 Subject: [PATCH 1/2] Currently configured customers. --- terraform/main.tf | 5 +++++ terraform/prod.tfvars | 15 +++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 terraform/prod.tfvars diff --git a/terraform/main.tf b/terraform/main.tf index adb75f9..c25b7cc 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -18,6 +18,11 @@ locals { resource "azurerm_resource_group" "this" { name = "rg-${local.eln}" location = var.location + lifecycle { + ignore_changes = [ + tags, + ] + } } resource "azurerm_log_analytics_workspace" "this" { diff --git a/terraform/prod.tfvars b/terraform/prod.tfvars new file mode 100644 index 0000000..0d96695 --- /dev/null +++ b/terraform/prod.tfvars @@ -0,0 +1,15 @@ +location = "westeurope" +location_short = "we" +environment = "prod" +name = "acrproxy" +unique_suffix = "4017" +allowed_tenant_ids = [ + "f919e23e-f8b7-46ff-b0c7-6512ee530391", # Simon G personal + "0a3a19f8-5fe4-4fb1-aabc-2bf971085ba2", # Anders Q personal + "61628e86-8793-4457-8ca6-05c4c3961965", # 092 + "a1b44af3-4c00-4531-ae80-f3f67fba126f", # 027 + "aa0a2535-79bc-4ce8-b41d-4ba38d687e29", # Josefin B personal + "8876461b-3d64-48b4-88a8-e7d81cbc3d1d", # 070 + "a97f5891-d113-4d40-a492-9999be8edec6", # 063 +] +acr_proxy_version = "v0.0.4" \ No newline at end of file From 851e6f80498cc1ce9c119ec156378fbcf68b19f9 Mon Sep 17 00:00:00 2001 From: Anders Qvist Date: Mon, 18 Dec 2023 15:48:34 +0100 Subject: [PATCH 2/2] Proper sharing of Terraform state. --- terraform/Makefile | 120 ++++++++++++++++++++ terraform/{ => unbox}/.terraform.lock.hcl | 26 ++--- terraform/{ => unbox}/main.tf | 0 terraform/{ => unbox}/outputs.tf | 0 terraform/{ => unbox}/variables.tf | 0 terraform/{ => unbox/variables}/prod.tfvars | 3 +- 6 files changed, 135 insertions(+), 14 deletions(-) create mode 100644 terraform/Makefile rename terraform/{ => unbox}/.terraform.lock.hcl (59%) rename terraform/{ => unbox}/main.tf (100%) rename terraform/{ => unbox}/outputs.tf (100%) rename terraform/{ => unbox}/variables.tf (100%) rename terraform/{ => unbox/variables}/prod.tfvars (85%) diff --git a/terraform/Makefile b/terraform/Makefile new file mode 100644 index 0000000..3579451 --- /dev/null +++ b/terraform/Makefile @@ -0,0 +1,120 @@ +.ONESHELL: +SHELL:=/bin/bash + +ifndef ENV +$(error Need to set ENV) +endif +DIR=unbox +DEPLOYMENT_TF_VARS = $(DIR)/variables/$(ENV).tfvars + +UNIQUE_SUFFIX := $(shell grep -i -w unique_suffix $(DEPLOYMENT_TF_VARS) | awk -F'=' '{print $$2}' | tr -d '"' | tr -d '[:blank:]') +ifndef UNIQUE_SUFFIX +$(error Need to set unique_suffix terraform variable inside of $(DIR)/variables/$(ENV).tfvars) +endif + +COMMON_NAME := $(shell grep -i -w name $(DEPLOYMENT_TF_VARS) | awk -F'=' '{print $$2}' | tr -d '"' | tr -d '[:blank:]') +ifndef COMMON_NAME +$(error Need to set common_name terraform variable inside of $(DIR)/variables/$(ENV).tfvars) +endif + +CURRENT_SUBSCRIPTION_ID := $(shell az account show --query id --output tsv) +REQUIRED_SUBSCRIPTION_ID := $(shell grep -i -w subscription_id $(DEPLOYMENT_TF_VARS) | awk -F'=' '{print $$2}' | tr -d '"' | tr -d '[:blank:]') +ifndef REQUIRED_SUBSCRIPTION_ID +$(error Need to set subscription_id terraform variable inside of $(DIR)/variables/$(ENV).tfvars) +endif +ifneq ($(CURRENT_SUBSCRIPTION_ID),$(REQUIRED_SUBSCRIPTION_ID)) +$(error Need to set Azure CLI to use the subscription id $(REQUIRED_SUBSCRIPTION_ID) defined by $(DIR)/variables/$(ENV).tfvars. The current is: $(CURRENT_SUBSCRIPTION_ID)) +endif + +SUFFIX="tfstate$(UNIQUE_SUFFIX)" +IMAGE="ghcr.io/xenitab/github-actions/tools:2023.12.1" + +# User mapping compat when using podman as alias for docker (with Debian update-alternatives or Red Hat alternatives) +export PODMAN_USERNS=keep-id + +OPA_BLAST_RADIUS := $(if $(OPA_BLAST_RADIUS),$(OPA_BLAST_RADIUS),50) +RG_LOCATION_SHORT:=we +RG_LOCATION_LONG:=swedencentral +AZURE_CONFIG_DIR := $(if $(AZURE_CONFIG_DIR),$(AZURE_CONFIG_DIR),"$${HOME}/.azure") +TTY_OPTIONS=$(shell [ -t 0 ] && echo '-it') +TEMP_ENV_FILE:=$(shell mktemp) +TEMP_SHELL_RC_FILE:=$(shell mktemp) + +AZURE_DIR_MOUNT:=-v $(AZURE_CONFIG_DIR):/work/.azure +DOCKER_ENTRYPOINT:=/opt/terraform.sh +DOCKER_OPTS:=--user $(shell id -u) $(TTY_OPTIONS) --rm --env-file $(TEMP_ENV_FILE) +DOCKER_MOUNTS:=-v "$${PWD}/$(DIR)":"/tmp/$(DIR)" -v "$${PWD}/global.tfvars":"/tmp/global.tfvars" +DOCKER_RUN:=docker run $(DOCKER_OPTS) --entrypoint $(DOCKER_ENTRYPOINT) $(AZURE_DIR_MOUNT) $(DOCKER_MOUNTS) $(IMAGE) +DOCKER_SHELL:=docker run $(DOCKER_OPTS) --entrypoint /bin/bash $(AZURE_DIR_MOUNT) $(DOCKER_MOUNTS) -v "$(TEMP_SHELL_RC_FILE)":"/work/.bashrc" $(IMAGE) +CLEANUP_COMMAND:=$(MAKE) --no-print-directory teardown TEMP_ENV_FILE=$(TEMP_ENV_FILE) TEMP_SHELL_RC_FILE=$(TEMP_SHELL_RC_FILE) + +.PHONY: setup +.SILENT: setup +setup: + set -e + + mkdir -p $(AZURE_CONFIG_DIR) + export AZURE_CONFIG_DIR="$(AZURE_CONFIG_DIR)" + + echo BACKEND_KEY=$(DIR)$(ENV).terraform.tfstate >> $(TEMP_ENV_FILE) + echo BACKEND_RG=rg-$(ENV)-$(RG_LOCATION_SHORT)-$(COMMON_NAME) >> $(TEMP_ENV_FILE) + echo BACKEND_KV=kv-$(ENV)-$(RG_LOCATION_SHORT)-$(COMMON_NAME)-$(UNIQUE_SUFFIX) >> $(TEMP_ENV_FILE) + echo BACKEND_KV_KEY=sops >> $(TEMP_ENV_FILE) + echo BACKEND_NAME=tf$(ENV)$(RG_LOCATION_SHORT)$(COMMON_NAME)$(UNIQUE_SUFFIX) >> $(TEMP_ENV_FILE) + echo CONTAINER_NAME=tfstate-$(DIR) >> $(TEMP_ENV_FILE) + echo AZURE_RESOURCE_LOCKS=false >> $(TEMP_ENV_FILE) + + if [ -n "$${servicePrincipalId}" ]; then + echo ARM_CLIENT_ID=$${servicePrincipalId} >> $(TEMP_ENV_FILE) + echo ARM_CLIENT_SECRET=$${servicePrincipalKey} >> $(TEMP_ENV_FILE) + echo ARM_TENANT_ID=$${tenantId} >> $(TEMP_ENV_FILE) + fi + + echo ARM_SUBSCRIPTION_ID=$$(az account show -o tsv --query 'id') >> $(TEMP_ENV_FILE) + + echo RG_LOCATION_SHORT=$(RG_LOCATION_SHORT) >> $(TEMP_ENV_FILE) + echo RG_LOCATION_LONG=$(RG_LOCATION_LONG) >> $(TEMP_ENV_FILE) + +.PHONY: teardown +.SILENT: teardown +teardown: + -rm -f $(TEMP_ENV_FILE) + +.PHONY: prepare +prepare: setup + trap '$(CLEANUP_COMMAND)' EXIT + $(DOCKER_RUN) prepare $(DIR) $(ENV) $(SUFFIX) + +.PHONY: plan +plan: setup + trap '$(CLEANUP_COMMAND)' EXIT + $(DOCKER_RUN) plan $(DIR) $(ENV) $(SUFFIX) $(OPA_BLAST_RADIUS) + +.PHONY: apply +apply: setup + trap '$(CLEANUP_COMMAND)' EXIT + $(DOCKER_RUN) apply $(DIR) $(ENV) $(SUFFIX) + +.PHONY: destroy +destroy: setup + trap '$(CLEANUP_COMMAND)' EXIT + $(DOCKER_RUN) destroy $(DIR) $(ENV) $(SUFFIX) + +.PHONY: state-remove +state-remove: setup + trap '$(CLEANUP_COMMAND)' EXIT + $(DOCKER_RUN) state-remove $(DIR) $(ENV) $(SUFFIX) + +.PHONY: validate +validate: setup + trap '$(CLEANUP_COMMAND)' EXIT + $(DOCKER_RUN) validate $(DIR) $(ENV) $(SUFFIX) + +.PHONY: shell +shell: setup + trap '$(CLEANUP_COMMAND)' EXIT + cat << EOF > $(TEMP_SHELL_RC_FILE) + cd /tmp/$(DIR) + /opt/terraform.sh init $(DIR) $(ENV) $(SUFFIX) + EOF + $(DOCKER_SHELL) diff --git a/terraform/.terraform.lock.hcl b/terraform/unbox/.terraform.lock.hcl similarity index 59% rename from terraform/.terraform.lock.hcl rename to terraform/unbox/.terraform.lock.hcl index f8ea7a9..d478b62 100644 --- a/terraform/.terraform.lock.hcl +++ b/terraform/unbox/.terraform.lock.hcl @@ -22,20 +22,20 @@ provider "registry.terraform.io/hashicorp/azurerm" { } provider "registry.terraform.io/hashicorp/random" { - version = "3.5.1" + version = "3.6.0" hashes = [ - "h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=", - "zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64", - "zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d", - "zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831", - "zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3", - "zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f", + "h1:R5Ucn26riKIEijcsiOMBR3uOAjuOMfI1x7XvH4P6B1w=", + "zh:03360ed3ecd31e8c5dac9c95fe0858be50f3e9a0d0c654b5e504109c2159287d", + "zh:1c67ac51254ba2a2bb53a25e8ae7e4d076103483f55f39b426ec55e47d1fe211", + "zh:24a17bba7f6d679538ff51b3a2f378cedadede97af8a1db7dad4fd8d6d50f829", + "zh:30ffb297ffd1633175d6545d37c2217e2cef9545a6e03946e514c59c0859b77d", + "zh:454ce4b3dbc73e6775f2f6605d45cee6e16c3872a2e66a2c97993d6e5cbd7055", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b", - "zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2", - "zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865", - "zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03", - "zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602", - "zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014", + "zh:91df0a9fab329aff2ff4cf26797592eb7a3a90b4a0c04d64ce186654e0cc6e17", + "zh:aa57384b85622a9f7bfb5d4512ca88e61f22a9cea9f30febaa4c98c68ff0dc21", + "zh:c4a3e329ba786ffb6f2b694e1fd41d413a7010f3a53c20b432325a94fa71e839", + "zh:e2699bc9116447f96c53d55f2a00570f982e6f9935038c3810603572693712d0", + "zh:e747c0fd5d7684e5bfad8aa0ca441903f15ae7a98a737ff6aca24ba223207e2c", + "zh:f1ca75f417ce490368f047b63ec09fd003711ae48487fba90b4aba2ccf71920e", ] } diff --git a/terraform/main.tf b/terraform/unbox/main.tf similarity index 100% rename from terraform/main.tf rename to terraform/unbox/main.tf diff --git a/terraform/outputs.tf b/terraform/unbox/outputs.tf similarity index 100% rename from terraform/outputs.tf rename to terraform/unbox/outputs.tf diff --git a/terraform/variables.tf b/terraform/unbox/variables.tf similarity index 100% rename from terraform/variables.tf rename to terraform/unbox/variables.tf diff --git a/terraform/prod.tfvars b/terraform/unbox/variables/prod.tfvars similarity index 85% rename from terraform/prod.tfvars rename to terraform/unbox/variables/prod.tfvars index 0d96695..1c6c879 100644 --- a/terraform/prod.tfvars +++ b/terraform/unbox/variables/prod.tfvars @@ -12,4 +12,5 @@ allowed_tenant_ids = [ "8876461b-3d64-48b4-88a8-e7d81cbc3d1d", # 070 "a97f5891-d113-4d40-a492-9999be8edec6", # 063 ] -acr_proxy_version = "v0.0.4" \ No newline at end of file +acr_proxy_version = "v0.0.4" +subscription_id = "fa3d92ff-c90c-4898-bec5-27f51d500e16" \ No newline at end of file