From 5bce3998c510404cd7c49193c942ca25e054c479 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 12 Oct 2026 00:34:03 +1100 Subject: [PATCH 1/2] Scaffold terragrunt layout, consul backend and woodpecker pipelines --- .gitignore | 8 +++++++ .pre-commit-config.yaml | 22 +++++++++++++++++ .woodpecker/apply.yaml | 24 +++++++++++++++++++ .woodpecker/plan.yaml | 22 +++++++++++++++++ .woodpecker/pre-commit.yaml | 18 ++++++++++++++ Makefile | 38 ++++++++++++++++++++++++++++++ README.md | 21 ++++++++++++++++- environments/global/terragrunt.hcl | 8 +++++++ environments/root.hcl | 15 ++++++++++++ modules/binarylane/variables.tf | 5 ++++ modules/binarylane/versions.tf | 3 +++ 11 files changed, 183 insertions(+), 1 deletion(-) create mode 100644 .gitignore create mode 100644 .pre-commit-config.yaml create mode 100644 .woodpecker/apply.yaml create mode 100644 .woodpecker/plan.yaml create mode 100644 .woodpecker/pre-commit.yaml create mode 100644 Makefile create mode 100644 environments/global/terragrunt.hcl create mode 100644 environments/root.hcl create mode 100644 modules/binarylane/variables.tf create mode 100644 modules/binarylane/versions.tf diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4c26d7a --- /dev/null +++ b/.gitignore @@ -0,0 +1,8 @@ +.terraform/ +.terragrunt-cache/ +*.tfstate +*.tfstate.* +*.tfplan +tfplan +crash.log +.terraform.lock.hcl diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..0439d93 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,22 @@ +repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + types: [yaml] + - id: trailing-whitespace + types: [yaml] + - repo: https://github.com/gruntwork-io/pre-commit + rev: v0.1.30 + hooks: + - id: tofu-fmt + - id: terragrunt-hcl-fmt + - repo: https://github.com/adrienverge/yamllint.git + rev: v1.37.1 + hooks: + - id: yamllint + args: + [ + "-d {extends: relaxed, rules: {line-length: disable}}", + "-s", + ] diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml new file mode 100644 index 0000000..3495664 --- /dev/null +++ b/.woodpecker/apply.yaml @@ -0,0 +1,24 @@ +when: + - event: push + branch: main + +steps: + - name: apply + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/opentofu:0.1.0 + environment: + VAULT_AUTH_METHOD: kubernetes + VAULT_VERSION: "1.20.0" + commands: + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt + - make plan + - make apply + backend_options: + kubernetes: + serviceAccountName: terraform-binarylane + resources: + requests: + memory: 512Mi + cpu: 1 + limits: + memory: 2Gi + cpu: 2 diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml new file mode 100644 index 0000000..8e32e95 --- /dev/null +++ b/.woodpecker/plan.yaml @@ -0,0 +1,22 @@ +when: + - event: pull_request + +steps: + - name: plan + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/opentofu:0.1.0 + environment: + VAULT_AUTH_METHOD: kubernetes + VAULT_VERSION: "1.20.0" + commands: + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt + - make plan + backend_options: + kubernetes: + serviceAccountName: terraform-binarylane + resources: + requests: + memory: 512Mi + cpu: 1 + limits: + memory: 2Gi + cpu: 2 diff --git a/.woodpecker/pre-commit.yaml b/.woodpecker/pre-commit.yaml new file mode 100644 index 0000000..3f48f3c --- /dev/null +++ b/.woodpecker/pre-commit.yaml @@ -0,0 +1,18 @@ +when: + - event: pull_request + +steps: + - name: pre-commit + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/opentofu:0.1.0 + commands: + - uvx pre-commit run --all-files + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 512Mi + cpu: 1 + limits: + memory: 2Gi + cpu: 2 diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..2136202 --- /dev/null +++ b/Makefile @@ -0,0 +1,38 @@ +.PHONY: init plan apply format pre-commit + +VAULT_AUTH_METHOD ?= approle +VAULT_K8S_ROLE ?= woodpecker_terraform_binarylane +VAULT_K8S_MOUNT ?= auth/k8s/au/syd1 +VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token + +define vault_env + @export VAULT_ADDR="https://vault.service.consul:8200" && \ + if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \ + export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \ + else \ + export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \ + fi && \ + export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-binarylane) && \ + export TF_VAR_binarylane_token=$$(vault kv get -mount=kv -field=token service/terraform/binarylane) +endef + +init: + @$(call vault_env) && \ + terragrunt run --all --non-interactive init -- -upgrade + +plan: init + @$(call vault_env) && \ + terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false + +apply: init + @$(call vault_env) && \ + terragrunt run --all --parallelism 2 --non-interactive apply + +format: + @echo "Formatting OpenTofu files..." + @tofu fmt -recursive . + @echo "Formatting Terragrunt files..." + @terragrunt hcl fmt + +pre-commit: + @uvx pre-commit run --all-files diff --git a/README.md b/README.md index 501e4d4..b2069fb 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,22 @@ # terraform-binarylane -Terraform for BinaryLane cloud infrastructure \ No newline at end of file +Terraform/Terragrunt for BinaryLane cloud infrastructure. + +## Layout + +``` +environments/root.hcl # consul state backend +environments/global/terragrunt.hcl +modules/binarylane/ +``` + +`make plan` / `make apply` reconcile every unit. `make pre-commit` runs the +hooks. State lives in Consul under `infra/terraform/binarylane//state`. + +## Auth + +The BinaryLane API token is read from `kv/service/terraform/binarylane` (field +`token`) and passed in as `TF_VAR_binarylane_token`; Consul state creds come +from `consul_root/au/syd1/creds/terraform-binarylane`. Both are granted to the +`terraform_binarylane` AppRole and the `woodpecker_terraform_binarylane` k8s +role in terraform-vault. diff --git a/environments/global/terragrunt.hcl b/environments/global/terragrunt.hcl new file mode 100644 index 0000000..c35cfb3 --- /dev/null +++ b/environments/global/terragrunt.hcl @@ -0,0 +1,8 @@ +include "root" { + path = find_in_parent_folders("root.hcl") + expose = true +} + +terraform { + source = "${get_repo_root()}/modules/binarylane" +} diff --git a/environments/root.hcl b/environments/root.hcl new file mode 100644 index 0000000..9b046fa --- /dev/null +++ b/environments/root.hcl @@ -0,0 +1,15 @@ +generate "backend" { + path = "backend.tf" + if_exists = "overwrite_terragrunt" + contents = < Date: Mon, 12 Oct 2026 00:41:37 +1100 Subject: [PATCH 2/2] Add tofu-validate and tflint hooks, track lock files --- .gitignore | 1 - .pre-commit-config.yaml | 2 ++ modules/binarylane/.tflint.hcl | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 modules/binarylane/.tflint.hcl diff --git a/.gitignore b/.gitignore index 4c26d7a..d0d7001 100644 --- a/.gitignore +++ b/.gitignore @@ -5,4 +5,3 @@ *.tfplan tfplan crash.log -.terraform.lock.hcl diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0439d93..2d8aea7 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -10,6 +10,8 @@ repos: rev: v0.1.30 hooks: - id: tofu-fmt + - id: tofu-validate + - id: tflint - id: terragrunt-hcl-fmt - repo: https://github.com/adrienverge/yamllint.git rev: v1.37.1 diff --git a/modules/binarylane/.tflint.hcl b/modules/binarylane/.tflint.hcl new file mode 100644 index 0000000..3a2ace1 --- /dev/null +++ b/modules/binarylane/.tflint.hcl @@ -0,0 +1,3 @@ +rule "terraform_unused_declarations" { + enabled = false +}