Skip to content

Commit 94245cd

Browse files
ShibraAmin18ShibraAmin18
committed
separated aws and gcp components
1 parent b6048e5 commit 94245cd

File tree

21 files changed

+516
-192
lines changed

21 files changed

+516
-192
lines changed

‎aws/main.tf‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
locals {
2+
oidc_provider = replace(
3+
data.aws_eks_cluster.kubernetes_cluster.identity[0].oidc[0].issuer,
4+
"/^https:///",
5+
""
6+
)
7+
}
8+
9+
data "aws_caller_identity" "current" {}
10+
11+
data "aws_eks_cluster" "kubernetes_cluster" {
12+
name = var.cluster_name
13+
}
14+
15+
resource "aws_secretsmanager_secret" "mysql_user_password" {
16+
name = format("%s/%s/%s", var.mysqldb_config.environment, var.mysqldb_config.name, "mysql")
17+
recovery_window_in_days = var.recovery_window_aws_secret
18+
}
19+
20+
resource "aws_secretsmanager_secret_version" "mysql_user_password" {
21+
secret_id = aws_secretsmanager_secret.mysql_user_password.id
22+
secret_string = <<EOF
23+
{
24+
"root_user": "root",
25+
"root_password": "${var.root_password}",
26+
"custom_username": "${var.mysqldb_config.custom_user_username}",
27+
"custom_user_password": "${var.custom_user_password}",
28+
"replication_user": "replicator",
29+
"replication_password": "${var.replication_password}",
30+
"exporter_user": "mysqld_exporter",
31+
"exporter_password": "${var.exporter_password}"
32+
}
33+
EOF
34+
}
35+
36+
37+
resource "aws_iam_role" "mysql_backup_role" {
38+
name = format("%s-%s-%s", var.cluster_name, var.mysqldb_config.name, "mysql-backup")
39+
assume_role_policy = jsonencode({
40+
Version = "2012-10-17",
41+
Statement = [
42+
{
43+
Effect = "Allow",
44+
Principal = {
45+
Federated = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${local.oidc_provider}"
46+
},
47+
Action = "sts:AssumeRoleWithWebIdentity",
48+
Condition = {
49+
StringEquals = {
50+
"${local.oidc_provider}:aud" = "sts.amazonaws.com",
51+
"${local.oidc_provider}:sub" = "system:serviceaccount:${var.namespace}:sa-mysql-backup"
52+
}
53+
}
54+
}
55+
]
56+
})
57+
inline_policy {
58+
name = "AllowS3PutObject"
59+
policy = jsonencode({
60+
Version = "2012-10-17"
61+
Statement = [
62+
{
63+
Action = [
64+
"s3:GetObject",
65+
"s3:PutObject",
66+
"s3:DeleteObject",
67+
"s3:ListBucket",
68+
"s3:AbortMultipartUpload",
69+
"s3:ListMultipartUploadParts"
70+
]
71+
Effect = "Allow"
72+
Resource = "*"
73+
}
74+
]
75+
})
76+
}
77+
}
78+
79+
80+
resource "aws_iam_role" "mysql_restore_role" {
81+
name = format("%s-%s-%s", var.cluster_name, var.mysqldb_config.name, "mysql-restore")
82+
assume_role_policy = jsonencode({
83+
Version = "2012-10-17",
84+
Statement = [
85+
{
86+
Effect = "Allow",
87+
Principal = {
88+
Federated = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${local.oidc_provider}"
89+
},
90+
Action = "sts:AssumeRoleWithWebIdentity",
91+
Condition = {
92+
StringEquals = {
93+
"${local.oidc_provider}:aud" = "sts.amazonaws.com",
94+
"${local.oidc_provider}:sub" = "system:serviceaccount:${var.namespace}:sa-mysql-restore"
95+
}
96+
}
97+
}
98+
]
99+
})
100+
inline_policy {
101+
name = "AllowS3PutObject"
102+
policy = jsonencode({
103+
Version = "2012-10-17"
104+
Statement = [
105+
{
106+
Action = [
107+
"s3:GetObject",
108+
"s3:PutObject",
109+
"s3:DeleteObject",
110+
"s3:ListBucket",
111+
"s3:AbortMultipartUpload",
112+
"s3:ListMultipartUploadParts"
113+
]
114+
Effect = "Allow"
115+
Resource = "*"
116+
}
117+
]
118+
})
119+
}
120+
}
121+
122+
output "iam_role_arn_backup" {
123+
value = aws_iam_role.mysql_backup_role.arn
124+
description = "IAM role arn for mysql backup"
125+
}
126+
127+
output "iam_role_arn_restore" {
128+
value = aws_iam_role.mysql_restore_role.arn
129+
description = "IAM role arn for mysql restore"
130+
}

‎aws/variables.tf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
variable "mysqldb_config" {
2+
type = any
3+
default = {
4+
name = ""
5+
environment = ""
6+
values_yaml = ""
7+
architecture = ""
8+
storage_class_name = ""
9+
custom_user_username = ""
10+
primary_db_volume_size = ""
11+
secondary_db_volume_size = ""
12+
secondary_db_replica_count = 1
13+
}
14+
description = "Specify the configuration settings for MySQL, including the name, environment, storage options, replication settings, and custom YAML values."
15+
}
16+
17+
variable "recovery_window_aws_secret" {
18+
type = number
19+
default = 0
20+
description = "Number of days that AWS Secrets Manager will wait before deleting a secret. This value can be set to 0 to force immediate deletion, or to a value between 7 and 30 days to allow for recovery."
21+
}
22+
23+
variable "cluster_name" {
24+
type = string
25+
default = ""
26+
description = "Specifies the name of the EKS cluster to deploy the MySQL application on."
27+
}
28+
29+
variable "root_password" {
30+
description = "Root user password for MySQL"
31+
type = string
32+
}
33+
34+
variable "custom_user_password" {
35+
description = "Password for the custom MySQL user"
36+
type = string
37+
}
38+
39+
variable "replication_password" {
40+
description = "Password for the replication user"
41+
type = string
42+
}
43+
44+
variable "exporter_password" {
45+
description = "Password for the mysqld_exporter user"
46+
type = string
47+
}

‎backup/templates/backup-secret.yaml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,3 @@ metadata:
66
labels:
77
data:
88
MYSQL_BUCKET_URI: {{ .Values.backup.bucket_uri | b64enc | quote }}
9-
---
10-
apiVersion: v1
11-
kind: Secret
12-
metadata:
13-
name: aws-mysql
14-
namespace: {{ .Release.Namespace }}
15-
labels:
16-
data:
17-
AWS_DEFAULT_REGION: {{ .Values.backup.aws_default_region | b64enc }}
18-
---

‎backup/templates/cronjob.yaml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@ spec:
1919
serviceAccountName: sa-mysql-backup
2020
containers:
2121
- name: backup-mysqldb
22-
image: squareops01/mysqlbackup:latest
22+
image: asia-south1-docker.pkg.dev/fresh-sanctuary-389006/roboshop/mysql-backup:1
23+
imagePullPolicy: Always
2324
env:
2425
- name: MYSQL_HOST
2526
value: mysqldb-secondary-headless.{{ .Release.Namespace }}.svc.cluster.local
@@ -35,9 +36,7 @@ spec:
3536
secretKeyRef:
3637
name: mysql-bucket-uri
3738
key: MYSQL_BUCKET_URI
39+
- name: CLOUD
40+
value: {{ .Values.provider_type }}
3841
- name: AWS_DEFAULT_REGION
39-
valueFrom:
40-
secretKeyRef:
41-
name: aws-mysql
42-
key: AWS_DEFAULT_REGION
43-
42+
value: {{ .Values.backup.aws_default_region }}

‎backup/templates/service_account.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,7 @@ apiVersion: v1
22
kind: ServiceAccount
33
metadata:
44
name: sa-mysql-backup
5-
annotations:
6-
eks.amazonaws.com/role-arn: {{ .Values.s3.role_arn }}
5+
namespace: mysqldb
6+
annotations: {{.Values.annotations}}
7+
# iam.gke.io/gcp-service-account: test-mysql-backup@fresh-sanctuary-389006.iam.gserviceaccount.com
8+
# eks.amazonaws.com/role-arn: {{ .Values.s3.role_arn }}

‎examples/complete/main.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,26 +10,26 @@ locals {
1010
}
1111

1212
module "mysql" {
13-
source = "squareops/mysql/kubernetes"
13+
source = "../../"
1414
cluster_name = ""
1515
mysqldb_config = {
1616
name = local.name
1717
values_yaml = file("./helm/values.yaml")
1818
environment = local.environment
1919
architecture = "replication"
20-
storage_class_name = "gp3"
20+
storage_class_name = "standard"
2121
custom_user_username = "admin"
2222
primary_db_volume_size = "10Gi"
2323
secondary_db_volume_size = "10Gi"
2424
secondary_db_replica_count = 2
2525
}
26-
mysqldb_backup_enabled = true
26+
mysqldb_backup_enabled = false
2727
mysqldb_backup_config = {
2828
s3_bucket_uri = "s3://bucket_name"
2929
s3_bucket_region = "bucket_region"
3030
cron_for_full_backup = "* * * * *"
3131
}
32-
mysqldb_restore_enabled = true
32+
mysqldb_restore_enabled = false
3333
mysqldb_restore_config = {
3434
s3_bucket_uri = "s3://bucket_name/filename"
3535
s3_bucket_region = "bucket_region"

‎examples/complete/provider.tf‎

Lines changed: 42 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,53 @@
1-
provider "aws" {
2-
region = local.region
3-
default_tags {
4-
tags = local.additional_tags
5-
}
6-
}
1+
# provider "aws" {
2+
# region = local.region
3+
# default_tags {
4+
# tags = local.additional_tags
5+
# }
6+
# }
77

88

9-
data "aws_eks_cluster" "cluster" {
10-
name = ""
11-
}
9+
# data "aws_eks_cluster" "cluster" {
10+
# name = ""
11+
# }
1212

13-
data "aws_eks_cluster_auth" "cluster" {
14-
name = ""
15-
}
13+
# data "aws_eks_cluster_auth" "cluster" {
14+
# name = ""
15+
# }
1616

1717

18-
provider "kubernetes" {
19-
host = data.aws_eks_cluster.cluster.endpoint
20-
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
21-
token = data.aws_eks_cluster_auth.cluster.token
18+
# provider "kubernetes" {
19+
# host = data.aws_eks_cluster.cluster.endpoint
20+
# cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
21+
# token = data.aws_eks_cluster_auth.cluster.token
22+
23+
# }
24+
25+
# provider "helm" {
26+
# kubernetes {
27+
# host = data.aws_eks_cluster.cluster.endpoint
28+
# cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
29+
# token = data.aws_eks_cluster_auth.cluster.token
2230

31+
# }
32+
# }
33+
data "google_client_config" "default" {}
34+
35+
data "google_container_cluster" "primary" {
36+
name = "test-dev-gke-cluster"
37+
location = "asia-south1"
38+
project = "fresh-sanctuary-389006"
39+
}
40+
41+
provider "kubernetes" {
42+
host = "https://${data.google_container_cluster.primary.endpoint}"
43+
token = data.google_client_config.default.access_token
44+
cluster_ca_certificate = base64decode(data.google_container_cluster.primary.master_auth.0.cluster_ca_certificate)
2345
}
2446

2547
provider "helm" {
2648
kubernetes {
27-
host = data.aws_eks_cluster.cluster.endpoint
28-
cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
29-
token = data.aws_eks_cluster_auth.cluster.token
30-
49+
host = "https://${data.google_container_cluster.primary.endpoint}"
50+
token = data.google_client_config.default.access_token
51+
cluster_ca_certificate = base64decode(data.google_container_cluster.primary.master_auth.0.cluster_ca_certificate)
3152
}
32-
}
53+
}

‎gcp/main.tf‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
resource "google_service_account" "mysql_backup" {
2+
project = var.project_id
3+
account_id = format("%s-%s", var.environment, var.gcp_gsa_backup_name)
4+
display_name = "Service Account for Mysql Backup"
5+
}
6+
7+
resource "google_project_iam_member" "secretadmin" {
8+
project = var.project_id
9+
role = "roles/storage.objectAdmin"
10+
member = "serviceAccount:${google_service_account.mysql_backup.email}"
11+
}
12+
13+
resource "google_project_iam_member" "service_account_token_creator" {
14+
project = var.project_id
15+
role = "roles/iam.serviceAccountTokenCreator"
16+
member = "serviceAccount:${google_service_account.mysql_backup.email}"
17+
}
18+
19+
resource "google_service_account_iam_member" "pod_identity" {
20+
role = "roles/iam.workloadIdentityUser"
21+
member = "serviceAccount:${var.project_id}.svc.id.goog[mysqldb/${var.gcp_ksa_backup_name}]"
22+
service_account_id = google_service_account.mysql_backup.name
23+
}
24+
25+
resource "google_service_account" "mysql_restore" {
26+
project = var.project_id
27+
account_id = format("%s-%s", var.environment, var.gcp_gsa_restore_name)
28+
display_name = "Service Account for Mysql restore"
29+
}
30+
31+
resource "google_project_iam_member" "secretadmin" {
32+
project = var.project_id
33+
role = "roles/storage.objectAdmin"
34+
member = "serviceAccount:${google_service_account.mysql_restore.email}"
35+
}
36+
37+
resource "google_project_iam_member" "service_account_token_creator" {
38+
project = var.project_id
39+
role = "roles/iam.serviceAccountTokenCreator"
40+
member = "serviceAccount:${google_service_account.mysql_restore.email}"
41+
}
42+
43+
resource "google_service_account_iam_member" "pod_identity" {
44+
role = "roles/iam.workloadIdentityUser"
45+
member = "serviceAccount:${var.project_id}.svc.id.goog[mysqldb/${var.gcp_ksa_restore_name}]"
46+
service_account_id = google_service_account.mysql_restore.name
47+
}
48+
49+
output "service_account_backup" {
50+
value = google_service_account.mysql_restore.email
51+
description = "Google Cloud Service Account name for backup"
52+
}
53+
54+
output "service_account_restore" {
55+
value = google_service_account.mysql_restore.email
56+
description = "Google Cloud Service Account name for restore"
57+
}

0 commit comments

Comments
 (0)