diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml index 81fd676b..e0cbe7bc 100644 --- a/.github/workflows/pre-commit.yaml +++ b/.github/workflows/pre-commit.yaml @@ -12,8 +12,8 @@ on: permissions: read-all env: - TERRAFORM_DOCS_VERSION: v0.16.0 - TFLINT_VERSION: v0.50.3 + TERRAFORM_DOCS_VERSION: v0.19.0 + TFLINT_VERSION: v0.53.0 concurrency: group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}' @@ -31,7 +31,7 @@ jobs: - name: Get root directories id: dirs - uses: clowdhaus/terraform-composite-actions/directories@v1.9.0 + uses: clowdhaus/terraform-composite-actions/directories@v1.11.1 preCommitMinVersions: name: Min TF pre-commit @@ -58,14 +58,14 @@ jobs: - '${{ matrix.directory }}/*.tf' - name: Terraform min/max versions - uses: clowdhaus/terraform-min-max@v1.3.0 + uses: clowdhaus/terraform-min-max@v1.3.1 if: steps.changes.outputs.src== 'true' id: minMax with: directory: ${{ matrix.directory }} - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }} - uses: clowdhaus/terraform-composite-actions/pre-commit@v1.9.0 + uses: clowdhaus/terraform-composite-actions/pre-commit@v1.11.1 # Run only validate pre-commit check on min version supported if: ${{ matrix.directory != '.' && steps.changes.outputs.src== 'true' }} with: @@ -73,7 +73,7 @@ jobs: args: 'terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*' - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }} - uses: clowdhaus/terraform-composite-actions/pre-commit@v1.9.0 + uses: clowdhaus/terraform-composite-actions/pre-commit@v1.11.1 # Run only validate pre-commit check on min version supported if: ${{ matrix.directory == '.' && steps.changes.outputs.src== 'true' }} with: @@ -100,11 +100,11 @@ jobs: - name: Terraform min/max versions id: minMax - uses: clowdhaus/terraform-min-max@v1.3.0 + uses: clowdhaus/terraform-min-max@v1.3.1 if: steps.changes.outputs.src== 'true' - name: Pre-commit Terraform ${{ steps.minMax.outputs.maxVersion }} - uses: clowdhaus/terraform-composite-actions/pre-commit@v1.9.0 + uses: clowdhaus/terraform-composite-actions/pre-commit@v1.11.1 if: steps.changes.outputs.src== 'true' with: terraform-version: ${{ steps.minMax.outputs.maxVersion }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 448c8845..4aa97216 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,6 +1,6 @@ repos: - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.6.0 + rev: v5.0.0 hooks: - id: trailing-whitespace args: ['--markdown-linebreak-ext=md'] diff --git a/README.md b/README.md index ff59b330..eafcdf6f 100644 --- a/README.md +++ b/README.md @@ -123,6 +123,7 @@ module "eks" { |------|------| | [aws_autoscaling_group_tag.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_group_tag) | resource | | [aws_autoscaling_lifecycle_hook.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_lifecycle_hook) | resource | +| [aws_cloudformation_stack.usage_telemetry](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudformation_stack) | resource | | [aws_cloudwatch_event_rule.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource | | [aws_cloudwatch_event_rule.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource | | [aws_cloudwatch_event_target.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource | @@ -182,7 +183,7 @@ module "eks" { | [bottlerocket\_shadow](#input\_bottlerocket\_shadow) | Bottlerocket Update Operator CRDs configuration values | `any` | `{}` | no | | [bottlerocket\_update\_operator](#input\_bottlerocket\_update\_operator) | Bottlerocket Update Operator add-on configuration values | `any` | `{}` | no | | [cert\_manager](#input\_cert\_manager) | cert-manager add-on configuration values | `any` | `{}` | no | -| [cert\_manager\_route53\_hosted\_zone\_arns](#input\_cert\_manager\_route53\_hosted\_zone\_arns) | List of Route53 Hosted Zone ARNs that are used by cert-manager to create DNS records | `list(string)` | 
[
  "arn:aws:route53:::hostedzone/*"
]
| no | +| [cert\_manager\_route53\_hosted\_zone\_arns](#input\_cert\_manager\_route53\_hosted\_zone\_arns) | List of Route53 Hosted Zone ARNs that are used by cert-manager to create DNS records | `list(string)` | 
[
  "arn:aws:route53:::hostedzone/*"
]
| no | | [cluster\_autoscaler](#input\_cluster\_autoscaler) | Cluster Autoscaler add-on configuration values | `any` | `{}` | no | | [cluster\_endpoint](#input\_cluster\_endpoint) | Endpoint for your Kubernetes API server | `string` | n/a | yes | | [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster | `string` | n/a | yes | @@ -225,9 +226,9 @@ module "eks" { | [external\_dns](#input\_external\_dns) | external-dns add-on configuration values | `any` | `{}` | no | | [external\_dns\_route53\_zone\_arns](#input\_external\_dns\_route53\_zone\_arns) | List of Route53 zones ARNs which external-dns will have access to create/manage records (if using Route53) | `list(string)` | `[]` | no | | [external\_secrets](#input\_external\_secrets) | External Secrets add-on configuration values | `any` | `{}` | no | -| [external\_secrets\_kms\_key\_arns](#input\_external\_secrets\_kms\_key\_arns) | List of KMS Key ARNs that are used by Secrets Manager that contain secrets to mount using External Secrets | `list(string)` | 
[
  "arn:aws:kms:*:*:key/*"
]
| no | -| [external\_secrets\_secrets\_manager\_arns](#input\_external\_secrets\_secrets\_manager\_arns) | List of Secrets Manager ARNs that contain secrets to mount using External Secrets | `list(string)` | 
[
  "arn:aws:secretsmanager:*:*:secret:*"
]
| no | -| [external\_secrets\_ssm\_parameter\_arns](#input\_external\_secrets\_ssm\_parameter\_arns) | List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets | `list(string)` | 
[
  "arn:aws:ssm:*:*:parameter/*"
]
| no | +| [external\_secrets\_kms\_key\_arns](#input\_external\_secrets\_kms\_key\_arns) | List of KMS Key ARNs that are used by Secrets Manager that contain secrets to mount using External Secrets | `list(string)` | 
[
  "arn:aws:kms:*:*:key/*"
]
| no | +| [external\_secrets\_secrets\_manager\_arns](#input\_external\_secrets\_secrets\_manager\_arns) | List of Secrets Manager ARNs that contain secrets to mount using External Secrets | `list(string)` | 
[
  "arn:aws:secretsmanager:*:*:secret:*"
]
| no | +| [external\_secrets\_ssm\_parameter\_arns](#input\_external\_secrets\_ssm\_parameter\_arns) | List of Systems Manager Parameter ARNs that contain secrets to mount using External Secrets | `list(string)` | 
[
  "arn:aws:ssm:*:*:parameter/*"
]
| no | | [fargate\_fluentbit](#input\_fargate\_fluentbit) | Fargate fluentbit add-on config | `any` | `{}` | no | | [fargate\_fluentbit\_cw\_log\_group](#input\_fargate\_fluentbit\_cw\_log\_group) | AWS Fargate Fluentbit CloudWatch Log Group configurations | `any` | `{}` | no | | [gatekeeper](#input\_gatekeeper) | Gatekeeper add-on configuration | `any` | `{}` | no | @@ -240,6 +241,7 @@ module "eks" { | [karpenter\_sqs](#input\_karpenter\_sqs) | Karpenter SQS queue for native node termination handling configuration values | `any` | `{}` | no | | [kube\_prometheus\_stack](#input\_kube\_prometheus\_stack) | Kube Prometheus Stack add-on configurations | `any` | `{}` | no | | [metrics\_server](#input\_metrics\_server) | Metrics Server add-on configurations | `any` | `{}` | no | +| [observability\_tag](#input\_observability\_tag) | Tag to identify EKS Blueprints usage within observability tools | `string` | `"qs-1ubotj5kl"` | no | | [oidc\_provider\_arn](#input\_oidc\_provider\_arn) | The ARN of the cluster OIDC Provider | `string` | n/a | yes | | [secrets\_store\_csi\_driver](#input\_secrets\_store\_csi\_driver) | CSI Secrets Store Provider add-on configurations | `any` | `{}` | no | | [secrets\_store\_csi\_driver\_provider\_aws](#input\_secrets\_store\_csi\_driver\_provider\_aws) | CSI Secrets Store Provider add-on configurations | `any` | `{}` | no | diff --git a/main.tf b/main.tf index dbf8360b..0c52457b 100644 --- a/main.tf +++ b/main.tf @@ -3814,3 +3814,26 @@ module "bottlerocket_update_operator" { # https://github.com/bottlerocket-os/bottlerocket-update-operator/tree/develop/deploy/charts/bottlerocket-update-operator depends_on = [module.bottlerocket_shadow] } + +################################################################################ +# Usage Telemetry +################################################################################ + +resource "aws_cloudformation_stack" "usage_telemetry" { + count = var.observability_tag != null ? 1 : 0 + + name = var.cluster_name + + on_failure = "DO_NOTHING" + template_body = jsonencode({ + AWSTemplateFormatVersion = "2010-09-09", + Description = "Usage telemetry for EKS Blueprints. (${var.observability_tag})", + Resources = { + EmptyResource = { + Type = "AWS::CloudFormation::WaitConditionHandle" + } + } + }) + + tags = var.tags +} diff --git a/tests/complete/README.md b/tests/complete/README.md index 5fb5c7a1..2875b516 100644 --- a/tests/complete/README.md +++ b/tests/complete/README.md @@ -32,25 +32,24 @@ terraform destroy | Name | Version | |------|---------| -| [terraform](#requirement\_terraform) | >= 1.3 | -| [aws](#requirement\_aws) | >= 5.38 | -| [helm](#requirement\_helm) | >= 2.8 | +| [terraform](#requirement\_terraform) | >= 1.3.2 | +| [aws](#requirement\_aws) | >= 5.70 | +| [helm](#requirement\_helm) | >= 2.9 | | [kubernetes](#requirement\_kubernetes) | >= 2.20 | ## Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | >= 5.38 | -| [aws.virginia](#provider\_aws.virginia) | >= 5.38 | +| [aws](#provider\_aws) | >= 5.70 | +| [aws.virginia](#provider\_aws.virginia) | >= 5.70 | ## Modules | Name | Source | Version | |------|--------|---------| -| [adot\_irsa](#module\_adot\_irsa) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | ~> 5.20 | | [ebs\_csi\_driver\_irsa](#module\_ebs\_csi\_driver\_irsa) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | ~> 5.20 | -| [eks](#module\_eks) | terraform-aws-modules/eks/aws | ~> 20.4 | +| [eks](#module\_eks) | terraform-aws-modules/eks/aws | ~> 20.26 | | [eks\_blueprints\_addons](#module\_eks\_blueprints\_addons) | ../../ | n/a | | [velero\_backup\_s3\_bucket](#module\_velero\_backup\_s3\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 3.0 | | [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 5.0 | diff --git a/tests/complete/main.tf b/tests/complete/main.tf index ebd40e92..8da0ce05 100644 --- a/tests/complete/main.tf +++ b/tests/complete/main.tf @@ -34,7 +34,13 @@ provider "helm" { } } -data "aws_availability_zones" "available" {} +data "aws_availability_zones" "available" { + # Do not include local zones + filter { + name = "opt-in-status" + values = ["opt-in-not-required"] + } +} data "aws_ecrpublic_authorization_token" "token" { provider = aws.virginia @@ -82,10 +88,6 @@ module "eks_blueprints_addons" { most_recent = true } kube-proxy = {} - adot = { - most_recent = true - service_account_role_arn = module.adot_irsa.iam_role_arn - } } enable_aws_efs_csi_driver = true @@ -237,10 +239,10 @@ module "eks_blueprints_addons" { module "eks" { source = "terraform-aws-modules/eks/aws" - version = "~> 20.4" + version = "~> 20.26" cluster_name = local.name - cluster_version = "1.29" + cluster_version = "1.31" cluster_endpoint_public_access = true vpc_id = module.vpc.vpc_id @@ -359,24 +361,3 @@ module "ebs_csi_driver_irsa" { tags = local.tags } - -module "adot_irsa" { - source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" - version = "~> 5.20" - - role_name_prefix = "${local.name}-adot-" - - role_policy_arns = { - prometheus = "arn:aws:iam::aws:policy/AmazonPrometheusRemoteWriteAccess" - xray = "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess" - cloudwatch = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy" - } - oidc_providers = { - main = { - provider_arn = module.eks.oidc_provider_arn - namespace_service_accounts = ["opentelemetry-operator-system:opentelemetry-operator"] - } - } - - tags = local.tags -} diff --git a/tests/complete/versions.tf b/tests/complete/versions.tf index 16a3b7ce..bdbcc335 100644 --- a/tests/complete/versions.tf +++ b/tests/complete/versions.tf @@ -1,14 +1,14 @@ terraform { - required_version = ">= 1.3" + required_version = ">= 1.3.2" required_providers { aws = { source = "hashicorp/aws" - version = ">= 5.38" + version = ">= 5.70" } helm = { source = "hashicorp/helm" - version = ">= 2.8" + version = ">= 2.9" } kubernetes = { source = "hashicorp/kubernetes" diff --git a/variables.tf b/variables.tf index 928c8cff..95466769 100644 --- a/variables.tf +++ b/variables.tf @@ -609,3 +609,13 @@ variable "create_kubernetes_resources" { type = bool default = true } + +################################################################################ +# Usage Telemetry +################################################################################ + +variable "observability_tag" { + description = "Tag to identify EKS Blueprints usage within observability tools" + type = string + default = "qs-1ubotj5kl" +}