Merge pull request 'Scaffold terragrunt layout and CI' (#1) from benvin/scaffold into main

Reviewed-on: #1

.gitignore

@@ -0,0 +1,7 @@
+.terraform/
+.terragrunt-cache/
+*.tfstate
+*.tfstate.*
+*.tfplan
+tfplan
+crash.log

.pre-commit-config.yaml

@@ -0,0 +1,24 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: end-of-file-fixer
+        types: [yaml]
+      - id: trailing-whitespace
+        types: [yaml]
+  - repo: https://github.com/gruntwork-io/pre-commit
+    rev: v0.1.30
+    hooks:
+      - id: tofu-fmt
+      - id: tofu-validate
+      - id: tflint
+      - id: terragrunt-hcl-fmt
+  - repo: https://github.com/adrienverge/yamllint.git
+    rev: v1.37.1
+    hooks:
+      - id: yamllint
+        args:
+          [
+            "-d {extends: relaxed, rules: {line-length: disable}}",
+            "-s",
+          ]

.woodpecker/apply.yaml

@@ -0,0 +1,24 @@
+when:
+  - event: push
+    branch: main
+
+steps:
+  - name: apply
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/opentofu:0.1.0
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
+    commands:
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - make plan
+      - make apply
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-binarylane
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/plan.yaml

@@ -0,0 +1,22 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: plan
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/opentofu:0.1.0
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
+    commands:
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - make plan
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-binarylane
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/pre-commit.yaml

@@ -0,0 +1,18 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/opentofu:0.1.0
+    commands:
+      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

Makefile

@@ -0,0 +1,38 @@
+.PHONY: init plan apply format pre-commit
+
+VAULT_AUTH_METHOD ?= approle
+VAULT_K8S_ROLE ?= woodpecker_terraform_binarylane
+VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
+VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
+
+define vault_env
+	@export VAULT_ADDR="https://vault.service.consul:8200" && \
+	if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
+		export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
+	else \
+		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
+	fi && \
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-binarylane) && \
+	export TF_VAR_binarylane_token=$$(vault kv get -mount=kv -field=token service/terraform/binarylane)
+endef
+
+init:
+	@$(call vault_env) && \
+	terragrunt run --all --non-interactive init -- -upgrade
+
+plan: init
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false
+
+apply: init
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 2 --non-interactive apply
+
+format:
+	@echo "Formatting OpenTofu files..."
+	@tofu fmt -recursive .
+	@echo "Formatting Terragrunt files..."
+	@terragrunt hcl fmt
+
+pre-commit:
+	@uvx pre-commit run --all-files

README.md

@@ -1,3 +1,22 @@
 # terraform-binarylane
 
-Terraform for BinaryLane cloud infrastructure
+Terraform/Terragrunt for BinaryLane cloud infrastructure.
+
+## Layout
+
+```
+environments/root.hcl                # consul state backend
+environments/global/terragrunt.hcl
+modules/binarylane/
+```
+
+`make plan` / `make apply` reconcile every unit. `make pre-commit` runs the
+hooks. State lives in Consul under `infra/terraform/binarylane/<unit>/state`.
+
+## Auth
+
+The BinaryLane API token is read from `kv/service/terraform/binarylane` (field
+`token`) and passed in as `TF_VAR_binarylane_token`; Consul state creds come
+from `consul_root/au/syd1/creds/terraform-binarylane`. Both are granted to the
+`terraform_binarylane` AppRole and the `woodpecker_terraform_binarylane` k8s
+role in terraform-vault.

environments/global/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path   = find_in_parent_folders("root.hcl")
+  expose = true
+}
+
+terraform {
+  source = "${get_repo_root()}/modules/binarylane"
+}

environments/root.hcl

@@ -0,0 +1,15 @@
+generate "backend" {
+  path      = "backend.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<EOF
+terraform {
+  backend "consul" {
+    address = "https://consul.service.consul"
+    path    = "infra/terraform/binarylane/${path_relative_to_include()}/state"
+    scheme  = "https"
+    lock    = true
+    ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
+  }
+}
+EOF
+}

modules/binarylane/.tflint.hcl

@@ -0,0 +1,3 @@
+rule "terraform_unused_declarations" {
+  enabled = false
+}

modules/binarylane/variables.tf

@@ -0,0 +1,5 @@
+variable "binarylane_token" {
+  description = "BinaryLane API token, exported as TF_VAR_binarylane_token from kv/service/terraform/binarylane."
+  type        = string
+  sensitive   = true
+}

modules/binarylane/versions.tf

@@ -0,0 +1,3 @@
+terraform {
+  required_version = ">= 1.10"
+}