diff --git a/README.md b/README.md index 59fc9a5..5413cc0 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # necronizer's cloud modules -OpenTofu Modules that can be used to deploy a functioning self hosted cloud solution perfect for side projects. For a guide on how to use these modules, please navigate to the [example](./example) directory. +OpenTofu Modules that can be used to deploy a functioning self hosted cloud solution perfect for side projects. For a guide on how to use these modules, please navigate to the [infrastructure](./infrastructure) directory. # Requirements and Dependencies @@ -15,7 +15,7 @@ The following is required to start using this repository: The following modules have been implemented and their usage instructions written in README: 1. [Helm](modules/helm) 2. [Cluster Issuer for internal certificates](modules/cluster-issuer) -3. [\[DEPRECATED\] MinIO Storage](modules/minio) +3. [Observability](modules/observability) 4. [Garage Storage](modules/garage) 5. [Cloudnative PG PostgreSQL Database](modules/cnpg) 6. [FerretDB (MongoDB) Database](modules/ferretdb) diff --git a/modules/cnpg/README.md b/modules/cnpg/README.md index a71796d..da5c2d9 100644 --- a/modules/cnpg/README.md +++ b/modules/cnpg/README.md @@ -6,6 +6,7 @@ Required Modules to deploy Cloudnative PG PostgreSQL Database: 1. [Helm](../helm) 2. [Cluster Issuer](../cluster-issuer) 3. [Garage](../garage) +4. [Observability](../observability) ## Providers diff --git a/modules/ferretdb/README.md b/modules/ferretdb/README.md index 5d78f2c..79e77c8 100644 --- a/modules/ferretdb/README.md +++ b/modules/ferretdb/README.md @@ -6,6 +6,7 @@ Required Modules to deploy FerretDB Database: 1. [Helm](../helm) 2. [Cluster Issuer](../cluster-issuer) 3. [Garage](../garage) +4. [Observability](../observability) ## Providers diff --git a/modules/garage/README.md b/modules/garage/README.md index 9dc5e8a..7445f40 100644 --- a/modules/garage/README.md +++ b/modules/garage/README.md @@ -4,6 +4,7 @@ OpenTofu Module to deploy [Garage](https://garagehq.deuxfleurs.fr/) Object Stora Required Modules to deploy Garage Object Storage: 1. [Cluster Issuer](../cluster-issuer) +2. [Observability](../observability) ## Providers @@ -74,6 +75,7 @@ Required Modules to deploy Garage Object Storage: | [kubernetes\_api\_port](#input\_kubernetes\_api\_port) | Port for the Kubernetes API | `number` | n/a | yes | | [kubernetes\_api\_protocol](#input\_kubernetes\_api\_protocol) | Protocol for the Kubernetes API | `string` | n/a | yes | | [namespace](#input\_namespace) | Namespace to be used for deploying Garage Storage Solution | `string` | `"garage"` | no | +| [observability\_namespace](#input\_observability\_namespace) | Namespace where all components for observability are deployed | `string` | n/a | yes | | [organization\_name](#input\_organization\_name) | Organization name for deploying Garage Storage Solution | `string` | `"cloud"` | no | | [proxy\_image](#input\_proxy\_image) | Docker image to be used for deployment of Garage NGINX Proxy for TLS | `string` | `"nginx"` | no | | [proxy\_repository](#input\_proxy\_repository) | Repository to be used for deployment of Garage NGINX Proxy for TLS | `string` | `"docker.io/library"` | no | diff --git a/modules/keycloak/README.md b/modules/keycloak/README.md index 48c744c..c9c8d07 100644 --- a/modules/keycloak/README.md +++ b/modules/keycloak/README.md @@ -6,6 +6,7 @@ OpenTofu Module to deploy [Keycloak](https://www.keycloak.org/) Identity Managem Required Modules to deploy Keycloak Identity Management: 1. [Cluster Issuer](../cluster-issuer) 2. [Cloudnative PG](../cnpg) +3. [Observability](../observability) ## Providers @@ -65,6 +66,7 @@ Required Modules to deploy Keycloak Identity Management: | [keycloak\_environment\_variables](#input\_keycloak\_environment\_variables) | Environment variables for Keycloak Configuration | `list` | 
[
  {
    "name": "KC_HTTP_PORT",
    "value": "8080"
  },
  {
    "name": "KC_HTTPS_PORT",
    "value": "8443"
  },
  {
    "name": "KC_HTTPS_CERTIFICATE_FILE",
    "value": "/mnt/certs/tls/tls.crt"
  },
  {
    "name": "KC_HTTPS_CERTIFICATE_KEY_FILE",
    "value": "/mnt/certs/tls/tls.key"
  },
  {
    "name": "KC_DB_URL",
    "value": "jdbc:postgresql://postgresql-cluster-rw.postgres.svc/keycloak?ssl=true&sslmode=verify-full&sslrootcert=/mnt/certs/database/certificate-authority/ca.crt&sslcert=/mnt/certs/database/certificate/tls.crt&sslkey=/mnt/certs/database/certificate/key.der"
  },
  {
    "name": "KC_DB_POOL_INITIAL_SIZE",
    "value": "1"
  },
  {
    "name": "KC_DB_POOL_MIN_SIZE",
    "value": "1"
  },
  {
    "name": "KC_DB_POOL_MAX_SIZE",
    "value": "3"
  },
  {
    "name": "KC_HEALTH_ENABLED",
    "value": "true"
  },
  {
    "name": "KC_CACHE",
    "value": "ispn"
  },
  {
    "name": "KC_CACHE_STACK",
    "value": "jdbc-ping"
  },
  {
    "name": "KC_PROXY",
    "value": "passthrough"
  },
  {
    "name": "KC_TRUSTSTORE_PATHS",
    "value": "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
  }
]
| no | | [keycloak\_ports](#input\_keycloak\_ports) | Keycloak Ports Configuration | `list` | 
[
  {
    "containerPort": "8443",
    "name": "https",
    "protocol": "TCP"
  },
  {
    "containerPort": "8080",
    "name": "http",
    "protocol": "TCP"
  },
  {
    "containerPort": "9000",
    "name": "management",
    "protocol": "TCP"
  },
  {
    "containerPort": "7800",
    "name": "discovery",
    "protocol": "TCP"
  }
]
| no | | [namespace](#input\_namespace) | Namespace to be used for deploying Keycloak Identity Platform solution | `string` | `"keycloak"` | no | +| [observability\_namespace](#input\_observability\_namespace) | Namespace where all components for observability are deployed | `string` | n/a | yes | | [organization\_name](#input\_organization\_name) | Organization name for deploying Keycloak Identity Platform solution | `string` | `"cloud"` | no | | [postgres\_namespace](#input\_postgres\_namespace) | Namespace for the PostgreSQL Deployment for database connections | `string` | n/a | yes | | [realm\_settings](#input\_realm\_settings) | Realm Settings for pre-installing a realm with Keycloak | 
object({
    display_name               = string
    application_name           = string
    base_url                   = string
    valid_login_redirect_path  = string
    valid_logout_redirect_path = string
    smtp_host                  = string
    smtp_port                  = number
    smtp_mail                  = string
    smtp_username              = string
    smtp_password              = string
  })
| n/a | yes | diff --git a/modules/minio/README.md b/modules/minio/README.md deleted file mode 100644 index c9faf36..0000000 --- a/modules/minio/README.md +++ /dev/null @@ -1,85 +0,0 @@ - -## [DEPRECATED] necronizer's cloud minio module - -OpenTofu Module to deploy [MinIO](https://min.io/) Object Storage on the Kubernetes Cluster - -Required Modules to deploy MinIO Object Storage: -1. [Helm](../helm) -2. [Cluster Issuer](../cluster-issuer) - -## Providers - -| Name | Version | -|------|---------| -| [kubernetes](#provider\_kubernetes) | 2.36.0 | -| [null](#provider\_null) | 3.2.3 | -| [random](#provider\_random) | 3.7.1 | - -## Resources - -| Name | Type | -|------|------| -| [kubernetes_ingress_v1.api_ingress](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/ingress_v1) | resource | -| [kubernetes_ingress_v1.ingress](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/ingress_v1) | resource | -| [kubernetes_manifest.api_ingress_certificate](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_manifest.certificate_authority](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_manifest.ingress_certificate](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_manifest.internal_certificate](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_manifest.issuer](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_manifest.minio_tenant](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_manifest.operator_certificate_authority](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_manifest.operator_internal_certificate](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_manifest.operator_issuer](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_manifest.public_issuer](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [kubernetes_namespace.namespace](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | -| [kubernetes_secret.cloudflare_token](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource | -| [kubernetes_secret.postgres_user_configuration](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource | -| [kubernetes_secret.storage_configuration](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource | -| [kubernetes_secret.tenant_certificate](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource | -| [kubernetes_secret.user_configuration](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource | -| [null_resource.restart_deployment](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | -| [random_password.postgres_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | -| [random_password.root_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | -| [random_password.user_passwords](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [acme\_server](#input\_acme\_server) | URL for the ACME Server to be used, defaults to production URL for LetsEncrypt | `string` | `"https://acme-v02.api.letsencrypt.org/directory"` | no | -| [admin\_user](#input\_admin\_user) | Name of the admin user for accessing MinIO Tenant | `string` | `"minio.admin"` | no | -| [api\_ingress\_certificate\_name](#input\_api\_ingress\_certificate\_name) | Name of the Ingress Certificate to be associated with MinIO API Storage Solution | `string` | `"minio-api-ingress-certificate"` | no | -| [app\_name](#input\_app\_name) | App name for deploying MinIO Storage Solution | `string` | `"minio"` | no | -| [buckets](#input\_buckets) | List of buckets for which MinIO Tenant needs to be deployed with | `list(string)` | `[]` | no | -| [certificate\_authority\_name](#input\_certificate\_authority\_name) | Name of the Certificate Authority to be associated with MinIO Storage Solution | `string` | `"minio-certificate-authority"` | no | -| [cloudflare\_email](#input\_cloudflare\_email) | Email for generating Ingress Certificates to be associated with MinIO Storage Solution | `string` | n/a | yes | -| [cloudflare\_issuer\_name](#input\_cloudflare\_issuer\_name) | Name of the Cloudflare Issuer to be associated with MinIO Storage Solution | `string` | `"minio-cloudflare-issuer"` | no | -| [cloudflare\_token](#input\_cloudflare\_token) | Token for generating Ingress Certificates to be associated with MinIO Storage Solution | `string` | n/a | yes | -| [cluster\_issuer\_name](#input\_cluster\_issuer\_name) | Name for the Cluster Issuer to be used to generate internal self signed certificates | `string` | n/a | yes | -| [country\_name](#input\_country\_name) | Country name for deploying MinIO Storage Solution | `string` | `"India"` | no | -| [database\_replication\_namespaces](#input\_database\_replication\_namespaces) | Namespaces to which Certificate Authority can be replicated to | `string` | `"postgres"` | no | -| [domain](#input\_domain) | Domain for which Ingress Certificate is to be generated for | `string` | n/a | yes | -| [host\_name](#input\_host\_name) | Host name for which Ingress Certificate is to be generated for | `string` | `"storage"` | no | -| [ingress\_certificate\_name](#input\_ingress\_certificate\_name) | Name of the Ingress Certificate to be associated with MinIO Storage Solution | `string` | `"minio-ingress-certificate"` | no | -| [internal\_certificate\_name](#input\_internal\_certificate\_name) | Name of the Internal Certificate to be associated with MinIO Storage Solution | `string` | `"minio-internal-certificate"` | no | -| [issuer\_name](#input\_issuer\_name) | Name of the Issuer to be associated with MinIO Storage Solution | `string` | `"minio-certificate-issuer"` | no | -| [namespace](#input\_namespace) | Namespace to be used for deploying MinIO Storage Solution | `string` | `"minio"` | no | -| [operator\_certificate\_authority\_name](#input\_operator\_certificate\_authority\_name) | Name of the Certificate Authority to be associated with MinIO Operator | `string` | `"operator-ca-tls"` | no | -| [operator\_internal\_certificate\_name](#input\_operator\_internal\_certificate\_name) | Name of the Internal Certificate to be associated with MinIO Operator | `string` | `"sts-certmanager-cert"` | no | -| [operator\_issuer\_name](#input\_operator\_issuer\_name) | Name of the Issuer to be associated with MinIO Operator | `string` | `"operator-ca-issuer"` | no | -| [operator\_namespace](#input\_operator\_namespace) | Namespace where the MinIO Operator is deployed in | `string` | n/a | yes | -| [operator\_tenant\_certificate\_name](#input\_operator\_tenant\_certificate\_name) | Name of the Certificate of the Tenant to be used by the MinIO Operator | `string` | `"operator-ca-tls-tenant"` | no | -| [organization\_name](#input\_organization\_name) | Organization name for deploying MinIO Storage Solution | `string` | `"cloud"` | no | -| [postgresql\_backup\_bucket](#input\_postgresql\_backup\_bucket) | Bucket to be used for storing PostgreSQL PITR Backups | `string` | `"postgres"` | no | -| [storage\_configuration\_name](#input\_storage\_configuration\_name) | Name of the secret for storing MinIO Storage Configuration | `string` | `"storage-configuration"` | no | -| [users](#input\_users) | List of users for which MinIO Tenant needs to be deployed with | `list(string)` | `[]` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [certificate-authority-name](#output\_certificate-authority-name) | Certificate Authority Name for the MinIO Tenant | -| [namespace](#output\_namespace) | Namespace where MinIO is deployed | -| [postgres-backup-bucket](#output\_postgres-backup-bucket) | Bucket to be used for storing PostgreSQL PITR Backups | -| [postgres-user-minio-configuration](#output\_postgres-user-minio-configuration) | PostgreSQL Configuration for storing PITR backups | - diff --git a/modules/minio/certificates.tf b/modules/minio/certificates.tf deleted file mode 100644 index 7dc75bc..0000000 --- a/modules/minio/certificates.tf +++ /dev/null @@ -1,316 +0,0 @@ -// Certificate Authority to be used with MinIO Tenant Cluster -resource "kubernetes_manifest" "certificate_authority" { - manifest = { - "apiVersion" = "cert-manager.io/v1" - "kind" = "Certificate" - "metadata" = { - "name" = var.certificate_authority_name - "namespace" = kubernetes_namespace.namespace.metadata[0].name - "labels" = { - "app" = var.app_name - "component" = "certificate-authority" - } - } - "spec" = { - "isCA" = true - "subject" = { - "organizations" = [var.organization_name] - "countries" = [var.country_name] - "organizationalUnits" = [var.app_name] - } - "commonName" = var.certificate_authority_name - "secretName" = var.certificate_authority_name - "secretTemplate" = { - "annotations" = { - "reflector.v1.k8s.emberstack.com/reflection-allowed" = "true" - "reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces" = var.database_replication_namespaces - } - } - "duration" = "70128h" - "privateKey" = { - "algorithm" = "ECDSA" - "size" = 256 - } - "issuerRef" = { - "name" = "${var.cluster_issuer_name}" - "kind" = "ClusterIssuer" - "group" = "cert-manager.io" - } - } - } - - wait { - condition { - type = "Ready" - status = "True" - } - } - - timeouts { - create = "5m" - update = "5m" - delete = "5m" - } -} - -// Issuer for the MinIO Tenant Cluster -resource "kubernetes_manifest" "issuer" { - manifest = { - "apiVersion" = "cert-manager.io/v1" - "kind" = "Issuer" - "metadata" = { - "name" = var.issuer_name - "namespace" = kubernetes_namespace.namespace.metadata[0].name - "labels" = { - "app" = var.app_name - "component" = "issuer" - } - } - "spec" = { - "ca" = { - "secretName" = kubernetes_manifest.certificate_authority.manifest.spec.secretName - } - } - } - - wait { - condition { - type = "Ready" - status = "True" - } - } - - timeouts { - create = "5m" - update = "5m" - delete = "5m" - } -} - -// Internal Certificate for MinIO Tenant Cluster -resource "kubernetes_manifest" "internal_certificate" { - manifest = { - "apiVersion" = "cert-manager.io/v1" - "kind" = "Certificate" - "metadata" = { - "name" = var.internal_certificate_name - "namespace" = kubernetes_namespace.namespace.metadata[0].name - "labels" = { - "app" = var.app_name - "component" = "internal-certificate" - } - } - "spec" = { - "dnsNames" = [ - "minio.minio", - "minio.minio.svc", - "minio.minio.svc.cluster.local", - "*.minio.minio.svc.cluster.local", - "*.minio-hl.minio.svc.cluster.local", - "minio-hl.minio.svc.cluster.local", - "*.minio.minio.minio.svc.cluster.local", - ] - "subject" = { - "organizations" = [var.organization_name] - "countries" = [var.country_name] - "organizationalUnits" = [var.app_name] - } - "commonName" = var.internal_certificate_name - "secretName" = var.internal_certificate_name - "secretTemplate" = { - "annotations" = { - "reflector.v1.k8s.emberstack.com/reflection-allowed" = "true" - "reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces" = var.operator_namespace - } - } - "issuerRef" = { - "name" = kubernetes_manifest.issuer.manifest.metadata.name - } - } - } - - wait { - condition { - type = "Ready" - status = "True" - } - } - timeouts { - create = "5m" - update = "5m" - delete = "5m" - } -} - -// Kubernetes Secret for Cloudflare Tokens -resource "kubernetes_secret" "cloudflare_token" { - metadata { - name = "cloudflare-token" - namespace = kubernetes_namespace.namespace.metadata[0].name - labels = { - "app" = var.app_name - "component" = "secret" - } - } - - data = { - cloudflare-token = var.cloudflare_token - } - - type = "Opaque" -} - -// Cloudflare Issuer for MinIO Ingress Service -resource "kubernetes_manifest" "public_issuer" { - manifest = { - "apiVersion" = "cert-manager.io/v1" - "kind" = "Issuer" - "metadata" = { - "name" = var.cloudflare_issuer_name - "namespace" = kubernetes_namespace.namespace.metadata[0].name - "labels" = { - "app" = var.app_name - "component" = "cloudflare-issuer" - } - } - "spec" = { - "acme" = { - "email" = var.cloudflare_email - "server" = var.acme_server - "privateKeySecretRef" = { - "name" = var.cloudflare_issuer_name - } - "solvers" = [ - { - "dns01" = { - "cloudflare" = { - "email" = var.cloudflare_email - "apiTokenSecretRef" = { - "name" = "cloudflare-token" - "key" = "cloudflare-token" - } - } - } - } - ] - } - } - } - - depends_on = [kubernetes_secret.cloudflare_token] - - wait { - condition { - type = "Ready" - status = "True" - } - } - - timeouts { - create = "5m" - update = "5m" - delete = "5m" - } -} - -// Certificate to be used for MinIO Ingress -resource "kubernetes_manifest" "ingress_certificate" { - - manifest = { - "apiVersion" = "cert-manager.io/v1" - "kind" = "Certificate" - "metadata" = { - "name" = var.ingress_certificate_name - "namespace" = kubernetes_namespace.namespace.metadata[0].name - "labels" = { - "app" = var.app_name - "component" = "ingress-certificate" - } - } - "spec" = { - "duration" = "2160h" - "renewBefore" = "360h" - "subject" = { - "organizations" = [var.organization_name] - "countries" = [var.country_name] - "organizationalUnits" = [var.app_name] - } - "privateKey" = { - "algorithm" = "RSA" - "encoding" = "PKCS1" - "size" = "2048" - } - "dnsNames" = ["${var.host_name}.${var.domain}"] - "secretName" = var.ingress_certificate_name - "issuerRef" = { - "name" = kubernetes_manifest.public_issuer.manifest.metadata.name - "kind" = "Issuer" - "group" = "cert-manager.io" - } - } - } - - wait { - condition { - type = "Ready" - status = "True" - } - } - - timeouts { - create = "5m" - update = "5m" - delete = "5m" - } -} - -# Certificate to be used for MinIO API Ingress -resource "kubernetes_manifest" "api_ingress_certificate" { - - manifest = { - "apiVersion" = "cert-manager.io/v1" - "kind" = "Certificate" - "metadata" = { - "name" = var.api_ingress_certificate_name - "namespace" = kubernetes_namespace.namespace.metadata[0].name - "labels" = { - "app" = var.app_name - "component" = "ingress-certificate" - } - } - "spec" = { - "duration" = "2160h" - "renewBefore" = "360h" - "subject" = { - "organizations" = [var.organization_name] - "countries" = [var.country_name] - "organizationalUnits" = [var.app_name] - } - "privateKey" = { - "algorithm" = "RSA" - "encoding" = "PKCS1" - "size" = "2048" - } - "dnsNames" = ["api.${var.host_name}.${var.domain}"] - "secretName" = var.api_ingress_certificate_name - "issuerRef" = { - "name" = kubernetes_manifest.public_issuer.manifest.metadata.name - "kind" = "Issuer" - "group" = "cert-manager.io" - } - } - } - - wait { - condition { - type = "Ready" - status = "True" - } - } - - timeouts { - create = "5m" - update = "5m" - delete = "5m" - } -} diff --git a/modules/minio/ingress.tf b/modules/minio/ingress.tf deleted file mode 100644 index c945ac9..0000000 --- a/modules/minio/ingress.tf +++ /dev/null @@ -1,89 +0,0 @@ -resource "kubernetes_ingress_v1" "ingress" { - metadata { - name = "ingress" - namespace = kubernetes_namespace.namespace.metadata[0].name - labels = { - app = var.app_name - component = "ingress" - } - annotations = { - "nginx.ingress.kubernetes.io/proxy-ssl-verify" : "on" - "nginx.ingress.kubernetes.io/proxy-ssl-secret" : "${kubernetes_namespace.namespace.metadata[0].name}/${kubernetes_manifest.internal_certificate.manifest.spec.secretName}" - "nginx.ingress.kubernetes.io/proxy-ssl-name" : "minio.minio.svc.cluster.local" - "nginx.ingress.kubernetes.io/backend-protocol" : "HTTPS" - "nginx.ingress.kubernetes.io/rewrite-target" : "/" - "nginx.ingress.kubernetes.io/proxy-body-size" : 0 - } - } - - spec { - ingress_class_name = "nginx" - tls { - hosts = ["${var.host_name}.${var.domain}"] - secret_name = kubernetes_manifest.ingress_certificate.manifest.spec.secretName - } - rule { - host = "${var.host_name}.${var.domain}" - http { - path { - path = "/" - backend { - service { - name = "minio-console" - port { - number = 9443 - } - } - } - } - } - } - } - - depends_on = [kubernetes_manifest.minio_tenant] -} - -resource "kubernetes_ingress_v1" "api_ingress" { - metadata { - name = "api-ingress" - namespace = kubernetes_namespace.namespace.metadata[0].name - labels = { - app = var.app_name - component = "ingress" - } - annotations = { - "nginx.ingress.kubernetes.io/proxy-ssl-verify" : "on" - "nginx.ingress.kubernetes.io/proxy-ssl-secret" : "${kubernetes_namespace.namespace.metadata[0].name}/${kubernetes_manifest.internal_certificate.manifest.spec.secretName}" - "nginx.ingress.kubernetes.io/proxy-ssl-name" : "minio.minio.svc.cluster.local" - "nginx.ingress.kubernetes.io/backend-protocol" : "HTTPS" - "nginx.ingress.kubernetes.io/rewrite-target" : "/" - "nginx.ingress.kubernetes.io/proxy-body-size" : 0 - } - } - - spec { - ingress_class_name = "nginx" - tls { - hosts = ["api.${var.host_name}.${var.domain}"] - secret_name = kubernetes_manifest.api_ingress_certificate.manifest.spec.secretName - } - rule { - host = "api.${var.host_name}.${var.domain}" - http { - path { - path = "/" - backend { - service { - name = "minio-hl" - port { - number = 9000 - } - } - } - } - } - } - } - - depends_on = [kubernetes_manifest.minio_tenant] -} diff --git a/modules/minio/namespace.tf b/modules/minio/namespace.tf deleted file mode 100644 index 491575d..0000000 --- a/modules/minio/namespace.tf +++ /dev/null @@ -1,9 +0,0 @@ -resource "kubernetes_namespace" "namespace" { - metadata { - name = var.namespace - labels = { - "app" = var.app_name - "component" = "namespace" - } - } -} diff --git a/modules/minio/operator.tf b/modules/minio/operator.tf deleted file mode 100644 index cbae1ee..0000000 --- a/modules/minio/operator.tf +++ /dev/null @@ -1,152 +0,0 @@ -// Certificate Authority to be used with MinIO Operator -resource "kubernetes_manifest" "operator_certificate_authority" { - manifest = { - - "apiVersion" = "cert-manager.io/v1" - "kind" = "Certificate" - "metadata" = { - "name" = var.operator_certificate_authority_name - "namespace" = var.operator_namespace - - "labels" = { - "app" = "minio-operator" - "component" = "ca" - } - } - "spec" = { - "isCA" = true - - "subject" = { - "organizations" = [var.organization_name] - "countries" = [var.country_name] - "organizationalUnits" = ["MinIO Operator"] - } - "commonName" = var.operator_certificate_authority_name - "secretName" = var.operator_certificate_authority_name - "duration" = "70128h" - - "privateKey" = { - "algorithm" = "ECDSA" - "size" = 256 - } - "issuerRef" = { - "name" = "${var.cluster_issuer_name}" - "kind" = "ClusterIssuer" - "group" = "cert-manager.io" - } - } - } - - wait { - condition { - type = "Ready" - status = "True" - } - } -} - -// Issuer for the MinIO Operator Namespace -resource "kubernetes_manifest" "operator_issuer" { - manifest = { - "apiVersion" = "cert-manager.io/v1" - "kind" = "Issuer" - - "metadata" = { - "name" = var.operator_issuer_name - "namespace" = var.operator_namespace - "labels" = { - "app" = "minio-operator" - "component" = "issuer" - } - } - "spec" = { - "ca" = { - "secretName" = kubernetes_manifest.operator_certificate_authority.manifest.spec.secretName - } - } - } - - wait { - condition { - type = "Ready" - status = "True" - } - } -} - -// Certificate for MinIO STS -resource "kubernetes_manifest" "operator_internal_certificate" { - manifest = { - "apiVersion" = "cert-manager.io/v1" - "kind" = "Certificate" - "metadata" = { - "name" = var.operator_internal_certificate_name - "namespace" = var.operator_namespace - "labels" = { - "app" = "minio-operator" - "component" = "certificate" - } - } - "spec" = { - "subject" = { - "organizations" = [var.organization_name] - "countries" = [var.country_name] - "organizationalUnits" = ["MinIO Operator"] - } - "commonName" = "sts" - "dnsNames" = [ - "sts", - "sts.minio-operator.svc", - "sts.minio-operator.svc.cluster.local" - ] - "secretName" = var.operator_internal_certificate_name - "issuerRef" = { - "name" = kubernetes_manifest.operator_issuer.manifest.metadata.name - } - } - } - - wait { - condition { - type = "Ready" - status = "True" - } - } -} - -resource "kubernetes_secret" "tenant_certificate" { - metadata { - name = var.operator_tenant_certificate_name - namespace = var.operator_namespace - annotations = { - "reflector.v1.k8s.emberstack.com/reflects" : "${kubernetes_namespace.namespace.metadata[0].name}/${kubernetes_manifest.internal_certificate.manifest.spec.secretName}" - } - } - - type = "kubernetes.io/tls" - - data = { - "tls.key" = "" - "tls.crt" = "" - "ca.crt" = "" - } - - lifecycle { - ignore_changes = [metadata[0].annotations] - } -} - -# Restart MinIO Operator Deployment to pickup new certificates -resource "null_resource" "restart_deployment" { - triggers = { - "operator-certificate" : kubernetes_manifest.operator_internal_certificate.object.metadata.uid - "tenant-certificate" : kubernetes_secret.tenant_certificate.id - } - - provisioner "local-exec" { - command = < [helm](#provider\_helm) | 3.1.1 | +| [kubernetes](#provider\_kubernetes) | 2.38.0 | +| [random](#provider\_random) | 3.7.2 | + +## Resources + +| Name | Type | +|------|------| +| [helm_release.grafana](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [helm_release.kube_state_metrics](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [helm_release.logs](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [helm_release.metrics](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [helm_release.otel_collector](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | +| [kubernetes_ingress_v1.ingress](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/ingress_v1) | resource | +| [kubernetes_manifest.certificate_authority](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | +| [kubernetes_manifest.ingress_certificate](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | +| [kubernetes_manifest.internal_certificate](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | +| [kubernetes_manifest.issuer](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | +| [kubernetes_manifest.network_observability](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | +| [kubernetes_manifest.public_issuer](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | +| [kubernetes_namespace.namespace](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | +| [kubernetes_secret.cloudflare_token](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource | +| [kubernetes_secret.observability_credentials](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource | +| [random_password.observability_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [acme\_server](#input\_acme\_server) | URL for the ACME Server to be used, defaults to production URL for LetsEncrypt | `string` | `"https://acme-v02.api.letsencrypt.org/directory"` | no | +| [app\_name](#input\_app\_name) | App name for deploying the Observability Stack | `string` | `"observability"` | no | +| [certificate\_authority\_name](#input\_certificate\_authority\_name) | Name of the Certificate Authority to be associated with Observability Platform | `string` | `"observability-certificate-authority"` | no | +| [cloudflare\_email](#input\_cloudflare\_email) | Email for generating Ingress Certificates to be associated with Observability Platform | `string` | n/a | yes | +| [cloudflare\_issuer\_name](#input\_cloudflare\_issuer\_name) | Name of the Cloudflare Issuer to be associated with Observability Platform | `string` | `"observability-cloudflare-issuer"` | no | +| [cloudflare\_token](#input\_cloudflare\_token) | Token for generating Ingress Certificates to be associated with Observability Platform | `string` | n/a | yes | +| [cluster\_issuer\_name](#input\_cluster\_issuer\_name) | Name for the Cluster Issuer to be used to generate internal self signed certificates | `string` | n/a | yes | +| [country\_name](#input\_country\_name) | Country name for deploying the Observability Stack | `string` | `"India"` | no | +| [domain](#input\_domain) | Domain for which Ingress Certificate is to be generated for | `string` | n/a | yes | +| [host\_name](#input\_host\_name) | Host name for which Ingress Certificate is to be generated for | `string` | `"observability"` | no | +| [ingress\_certificate\_name](#input\_ingress\_certificate\_name) | Name of the Ingress Certificate to be associated with Observability Platform | `string` | `"observability-ingress-certificate"` | no | +| [internal\_certificate\_name](#input\_internal\_certificate\_name) | Name of the Internal Certificate to be associated with Observability Platform | `string` | `"observability-internal-certificate"` | no | +| [issuer\_name](#input\_issuer\_name) | Name of the Issuer to be associated with Observability Platform | `string` | `"observability-certificate-issuer"` | no | +| [namespace](#input\_namespace) | Namespace to be used for deploying the Observability Stack | `string` | `"observability"` | no | +| [organization\_name](#input\_organization\_name) | Organization name for deploying the Observability Stack | `string` | `"cloud"` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [observability\_namespace](#output\_observability\_namespace) | Namespace where all components for observability are deployed | diff --git a/modules/valkey/README.md b/modules/valkey/README.md index f2be50b..4b666f1 100644 --- a/modules/valkey/README.md +++ b/modules/valkey/README.md @@ -4,6 +4,7 @@ OpenTofu Module to deploy [Valkey](https://valkey.io/) In Memory Database on the Required Modules to deploy Valkey In Memory Database: 1. [Cluster Issuer](../cluster-issuer) +2. [Observability](../observability) ## Providers @@ -42,9 +43,13 @@ Required Modules to deploy Valkey In Memory Database: | [image](#input\_image) | Docker image to be used for deployment of Valkey | `string` | `"valkey"` | no | | [internal\_certificate\_name](#input\_internal\_certificate\_name) | Name of the Internal Certificate to be associated with Valkey Cache Solution | `string` | `"valkey-internal-certificate"` | no | | [issuer\_name](#input\_issuer\_name) | Name of the Issuer to be associated with Valkey Cache Solution | `string` | `"valkey-certificate-issuer"` | no | +| [metrics\_image](#input\_metrics\_image) | Docker image to be used for deployment of Valkey Metrics | `string` | `"redis_exporter"` | no | +| [metrics\_repository](#input\_metrics\_repository) | Repository to be used for deployment of Valkey Metrics | `string` | `"docker.io/oliver006"` | no | +| [metrics\_tag](#input\_metrics\_tag) | Docker tag to be used for deployment of Valkey Metrics | `string` | `"v1.81.0-alpine"` | no | | [namespace](#input\_namespace) | Namespace to be used for deploying Valkey Cache Solution | `string` | `"valkey"` | no | +| [observability\_namespace](#input\_observability\_namespace) | Namespace where all components for observability are deployed | `string` | n/a | yes | | [organization\_name](#input\_organization\_name) | Organization name for deploying Valkey Cache Solution | `string` | `"cloud"` | no | -| [replicas](#input\_replicas) | Number of replicas to run for Valkey Cluster | `number` | `6` | no | +| [replicas](#input\_replicas) | Number of replicas to run for Valkey Cluster | `number` | `3` | no | | [repository](#input\_repository) | Repository to be used for deployment of Valkey | `string` | `"docker.io/valkey"` | no | | [tag](#input\_tag) | Docker tag to be used for deployment of Valkey | `string` | `"9.0"` | no |