add: terraform infrastructure

deploy/terraform/.gitignore

@@ -0,0 +1,36 @@
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version 
+# control as they are data points which are potentially sensitive and subject 
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+out.tf

deploy/terraform/Makefile

@@ -0,0 +1,13 @@
+help:
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(firstword $(MAKEFILE_LIST)) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
+
+setup: ## Copy sample files 
+	cp terraform.tfvars.sample terraform.tfvars
+	terraform init
+
+apply: ## Up the docker-compose without cache or orphans
+	terraform plan -out out.tfplan
+	terraform apply "out.tfplan"
+
+.PHONY: help
+

deploy/terraform/main.tf

@@ -0,0 +1,40 @@
+
+resource "random_password" "rdb_instance_password" {
+  length           = 16
+  min_numeric      = 2
+  min_upper        = 2
+  min_special      = 2
+  override_special = var.override_special
+}
+
+resource "scaleway_rdb_instance" "rdb_instance" {
+  project_id     = var.scw_project_id
+  name           = var.rdb_instance.name
+  node_type      = var.rdb_instance.type
+  engine         = var.rdb_instance.engine
+  is_ha_cluster  = var.rdb_instance.is_ha_cluster
+  disable_backup = var.rdb_instance.disable_backup
+  user_name      = var.rdb_instance.user_name
+  password       = random_password.rdb_instance_password.result
+}
+
+module "rdb" {
+  source = "./modules/rdb"
+
+  depends_on = [scaleway_rdb_instance.rdb_instance]
+  for_each   = var.environments
+
+  environment      = each.value
+  override_special = var.override_special
+  rdb_instance_id  = scaleway_rdb_instance.rdb_instance.id
+}
+
+module "k8s" {
+  source = "./modules/k8s"
+
+  scw_project_id       = var.scw_project_id
+  cluster              = var.k8s_cluster
+  pool                 = var.k8s_pool
+  install_ingress      = var.install_ingress
+  install_cert_manager = var.install_cert_manager
+}

deploy/terraform/modules/k8s/main.tf

@@ -0,0 +1,39 @@
+resource "scaleway_k8s_cluster" "k8s_cluster" {
+  project_id  = var.scw_project_id
+  name        = var.cluster.name
+  tags        = var.cluster.tags
+  version     = var.cluster.version
+  cni         = var.cluster.cni
+
+  auto_upgrade {
+    enable                        = true
+    maintenance_window_day        = var.cluster.maintenance_window_day
+    maintenance_window_start_hour = var.cluster.maintenance_window_start_hour
+  }
+
+  autoscaler_config {
+    disable_scale_down              = false
+    scale_down_delay_after_add      = "5m"
+    estimator                       = "binpacking"
+    expander                        = "random"
+    ignore_daemonsets_utilization   = true
+    balance_similar_node_groups     = true
+    expendable_pods_priority_cutoff = -5
+  }
+}
+
+resource "scaleway_k8s_pool" "k8s_pool" {
+  depends_on = [scaleway_k8s_cluster.k8s_cluster]
+
+  cluster_id          = scaleway_k8s_cluster.k8s_cluster.id
+  name                = var.pool.name
+  tags                = var.pool.tags
+  node_type           = var.pool.type
+  size                = var.pool.min_size
+  min_size            = var.pool.min_size
+  max_size            = var.pool.max_size
+  autoscaling         = true
+  autohealing         = true
+  wait_for_pool_ready = true
+  container_runtime   = "containerd"
+}

deploy/terraform/modules/k8s/outputs.tf

@@ -0,0 +1,23 @@
+output "cluster_id" {
+  value = scaleway_k8s_cluster.k8s_cluster.id
+}
+
+output "cluster_host" {
+  value = scaleway_k8s_cluster.k8s_cluster.kubeconfig[0].host
+}
+
+output "cluster_token" {
+  value = scaleway_k8s_cluster.k8s_cluster.kubeconfig[0].token
+}
+
+output "cluster_ca_certificate" {
+  value = scaleway_k8s_cluster.k8s_cluster.kubeconfig[0].cluster_ca_certificate
+}
+
+output "cluster_pool_id" {
+  value = scaleway_k8s_pool.k8s_pool.id
+}
+
+output "cluster_kubeconfig" {
+  value = scaleway_k8s_cluster.k8s_cluster.kubeconfig[0].config_file
+}

deploy/terraform/modules/k8s/packages.tf

@@ -0,0 +1,72 @@
+# Ingress controller ------------------------------------------------
+
+resource "kubernetes_namespace" "ingress" {
+  depends_on = [scaleway_k8s_pool.k8s_pool]
+  count = var.install_ingress ? 1 : 0
+  metadata {
+    name = "ingress"
+  }
+}
+
+resource "helm_release" "ingress" {
+  depends_on = [kubernetes_namespace.ingress]
+  count      = var.install_ingress ? 1 : 0
+
+  name      = "ingress-nginx"
+  namespace = "ingress"
+
+  repository = "https://kubernetes.github.io/ingress-nginx"
+  chart      = "ingress-nginx"
+
+  set {
+    name  = "controller.service.externalTrafficPolicy"
+    value = "Local"
+  }
+}
+
+# Certificate manager -----------------------------------------------
+
+resource "kubernetes_namespace" "cert_manager" {
+  depends_on = [scaleway_k8s_pool.k8s_pool]
+  count = var.install_cert_manager ? 1 : 0
+  metadata {
+    name = "cert-manager"
+  }
+}
+
+resource "helm_release" "cert_manager" {
+  depends_on = [kubernetes_namespace.cert_manager]
+  count      = var.install_cert_manager ? 1 : 0
+
+  name      = "cert-manager"
+  namespace = "cert-manager"
+
+  repository = "https://charts.jetstack.io"
+  chart      = "cert-manager"
+  set {
+    name  = "installCRDs"
+    value = "true"
+  }
+}
+
+resource "kubectl_manifest" "cluster_issuer" {
+  depends_on = [helm_release.cert_manager]
+  count      = var.install_cert_manager ? 1 : 0
+
+  yaml_body = <<YAML
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: [email protected]
+    server: "https://acme-v02.api.letsencrypt.org/directory"
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+    - http01:
+        ingress:
+          class: nginx
+YAML
+}

deploy/terraform/modules/k8s/providers.tf

@@ -0,0 +1,22 @@
+terraform {
+  required_version = ">= 0.13"
+
+  required_providers {
+    scaleway = {
+      source  = "scaleway/scaleway"
+      version = "2.2.0"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.9.0"
+    }
+    helm = {
+      source  = "hashicorp/helm"
+      version = "2.4.1"
+    }
+    kubectl = {
+      source  = "gavinbunney/kubectl"
+      version = "1.13.1"
+    }
+  }
+}