Skip to content

Commit ef3b140

Browse files
RohitSquareopsRohitSquareops
committed
updated release
1 parent 060df8b commit ef3b140

File tree

14 files changed

+257
-107
lines changed

14 files changed

+257
-107
lines changed

‎IAM.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,14 @@ The Policy required to deploy this module:
1919
"Sid": "VisualEditor1",
2020
"Effect": "Allow",
2121
"Action": [
22-
"iam:CreateRole",
23-
"iam:DeleteRole",
2422
"iam:GetRole",
23+
"iam:CreateRole",
24+
"iam:DeleteRole",
2525
"iam:GetRolePolicy",
26-
"iam:ListAttachedRolePolicies",
27-
"iam:ListInstanceProfilesForRole",
26+
"iam:PutRolePolicy",
2827
"iam:ListRolePolicies",
29-
"iam:PutRolePolicy"
28+
"iam:ListAttachedRolePolicies",
29+
"iam:ListInstanceProfilesForRole"
3030
],
3131
"Resource": [
3232
"*"
@@ -38,10 +38,10 @@ The Policy required to deploy this module:
3838
"Action": [
3939
"secretsmanager:CreateSecret",
4040
"secretsmanager:DeleteSecret",
41-
"secretsmanager:DescribeSecret",
42-
"secretsmanager:GetResourcePolicy",
41+
"secretsmanager:DescribeSecret",
4342
"secretsmanager:GetSecretValue",
44-
"secretsmanager:PutSecretValue"
43+
"secretsmanager:PutSecretValue",
44+
"secretsmanager:GetResourcePolicy"
4545
],
4646
"Resource": [
4747
"*"

‎README.md‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -11,25 +11,25 @@
1111
```hcl
1212
module "mysql" {
1313
source = "../.."
14-
mysqldb_backup_enabled = false
15-
mysqldb_exporter_enabled = false
16-
cluster_name = "cluster-name"
14+
cluster_name = "dev-skaf"
1715
mysqldb_config = {
18-
name = "skaf"
19-
environment = "prod"
20-
architecture = "replication"
21-
custom_user_username = "admin"
22-
primary_pod_volume_size = "10Gi"
23-
secondary_pod_replica_count = 1
24-
secondary_pod_volume_size = "10Gi"
25-
storage_class_name = "infra-service-sc"
26-
values_yaml = file("./helm/values.yaml")
16+
name = "skaf"
17+
values_yaml = ""
18+
environment = "prod"
19+
architecture = "replication"
20+
storage_class_name = "infra-service-sc"
21+
custom_user_username = "admin"
22+
primary_db_volume_size = "10Gi"
23+
secondary_db_volume_size = "10Gi"
24+
secondary_db_replica_count = 2
2725
}
26+
mysqldb_backup_enabled = true
2827
mysqldb_backup_config = {
29-
s3_bucket_uri = "s3://bucketname"
30-
s3_bucket_region = "bucket-region"
31-
cron_for_full_backup = "* * * * *"
28+
s3_bucket_uri = "s3://bucket-name"
29+
s3_bucket_region = "bucket-region"
30+
cron_for_full_backup = "*/2 * * * *"
3231
}
32+
mysqldb_exporter_enabled = true
3333
}
3434
3535
@@ -71,10 +71,12 @@ No modules.
7171
| Name | Type |
7272
|------|------|
7373
| [aws_iam_role.mysql_backup_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
74+
| [aws_iam_role.mysql_restore_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
7475
| [aws_secretsmanager_secret.mysql_user_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
7576
| [aws_secretsmanager_secret_version.mysql_user_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |
7677
| [helm_release.mysqldb](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
7778
| [helm_release.mysqldb_backup](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
79+
| [helm_release.mysqldb_restore](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
7880
| [kubernetes_namespace.mysqldb](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
7981
| [random_password.mysqldb_custom_user_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
8082
| [random_password.mysqldb_exporter_user_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
@@ -90,10 +92,13 @@ No modules.
9092
| <a name="input_app_version"></a> [app\_version](#input\_app\_version) | App version | `string` | `"8.0.29-debian-11-r9"` | no |
9193
| <a name="input_chart_version"></a> [chart\_version](#input\_chart\_version) | Chart version | `string` | `"9.2.0"` | no |
9294
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster | `string` | `""` | no |
93-
| <a name="input_mysqldb_backup_config"></a> [mysqldb\_backup\_config](#input\_mysqldb\_backup\_config) | Mysql Backup configurations | `any` | <pre>{<br> "cron_for_full_backup": "*/5 * * * *",<br> "s3_bucket_region": "us-east-2",<br> "s3_bucket_uri": "s3://mysqlbackupp"<br>}</pre> | no |
95+
| <a name="input_create_namespace"></a> [create\_namespace](#input\_create\_namespace) | Set it to true to create given namespace | `string` | `true` | no |
96+
| <a name="input_mysqldb_backup_config"></a> [mysqldb\_backup\_config](#input\_mysqldb\_backup\_config) | Mysql Backup configurations | `any` | <pre>{<br> "cron_for_full_backup": "",<br> "s3_bucket_region": "",<br> "s3_bucket_uri": ""<br>}</pre> | no |
9497
| <a name="input_mysqldb_backup_enabled"></a> [mysqldb\_backup\_enabled](#input\_mysqldb\_backup\_enabled) | Set true to enable mysql backups | `bool` | `false` | no |
95-
| <a name="input_mysqldb_config"></a> [mysqldb\_config](#input\_mysqldb\_config) | Mysql configurations | `any` | <pre>{<br> "architecture": "",<br> "custom_user_username": "",<br> "environment": "",<br> "name": "",<br> "primary_pod_volume_size": "",<br> "secondary_pod_replica_count": 1,<br> "secondary_pod_volume_size": "",<br> "storage_class_name": "",<br> "values_yaml": ""<br>}</pre> | no |
98+
| <a name="input_mysqldb_config"></a> [mysqldb\_config](#input\_mysqldb\_config) | Mysql configurations | `any` | <pre>{<br> "architecture": "",<br> "custom_user_username": "",<br> "environment": "",<br> "name": "",<br> "primary_db_volume_size": "",<br> "secondary_db_replica_count": 1,<br> "secondary_db_volume_size": "",<br> "storage_class_name": "",<br> "values_yaml": ""<br>}</pre> | no |
9699
| <a name="input_mysqldb_exporter_enabled"></a> [mysqldb\_exporter\_enabled](#input\_mysqldb\_exporter\_enabled) | Set true to deploy mysqldb exporters to get metrics in grafana | `bool` | `false` | no |
100+
| <a name="input_mysqldb_restore_config"></a> [mysqldb\_restore\_config](#input\_mysqldb\_restore\_config) | Mysql Restore configurations | `any` | <pre>{<br> "s3_bucket_region": "",<br> "s3_bucket_uri": ""<br>}</pre> | no |
101+
| <a name="input_mysqldb_restore_enabled"></a> [mysqldb\_restore\_enabled](#input\_mysqldb\_restore\_enabled) | Set true to enable mysql restore | `bool` | `true` | no |
97102
| <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace name | `string` | `"mysqldb"` | no |
98103
| <a name="input_recovery_window_aws_secret"></a> [recovery\_window\_aws\_secret](#input\_recovery\_window\_aws\_secret) | Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. | `number` | `0` | no |
99104

‎examples/complete/README.md‎

Lines changed: 6 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -16,44 +16,23 @@ No requirements.
1616
| Name | Version |
1717
|------|---------|
1818
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
19-
| <a name="provider_helm"></a> [helm](#provider\_helm) | n/a |
20-
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | n/a |
21-
| <a name="provider_random"></a> [random](#provider\_random) | n/a |
2219

2320
## Modules
2421

25-
No modules.
22+
| Name | Source | Version |
23+
|------|--------|---------|
24+
| <a name="module_mysql"></a> [mysql](#module\_mysql) | ../../ | n/a |
2625

2726
## Resources
2827

2928
| Name | Type |
3029
|------|------|
31-
| [aws_iam_role.mysql_backup_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
32-
| [aws_secretsmanager_secret.mysql_user_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |
33-
| [aws_secretsmanager_secret_version.mysql_user_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |
34-
| [helm_release.mysqldb](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
35-
| [helm_release.mysqldb_backup](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
36-
| [kubernetes_namespace.mysqldb](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
37-
| [random_password.mysqldb_custom_user_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
38-
| [random_password.mysqldb_exporter_user_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
39-
| [random_password.mysqldb_replication_user_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
40-
| [random_password.mysqldb_root_password](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
41-
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
42-
| [aws_eks_cluster.kubernetes_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
30+
| [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
31+
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
4332

4433
## Inputs
4534

46-
| Name | Description | Type | Default | Required |
47-
|------|-------------|------|---------|:--------:|
48-
| <a name="input_app_version"></a> [app\_version](#input\_app\_version) | App version | `string` | `"8.0.29-debian-11-r9"` | no |
49-
| <a name="input_chart_version"></a> [chart\_version](#input\_chart\_version) | Chart version | `string` | `"9.2.0"` | no |
50-
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster | `string` | `""` | no |
51-
| <a name="input_mysqldb_backup_config"></a> [mysqldb\_backup\_config](#input\_mysqldb\_backup\_config) | Mysql Backup configurations | `any` | <pre>{<br> "aws_access_key_id": "AKIAT6J7AJ7XMR7TDC7R",<br> "aws_secret_access_key": "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",<br> "cron_for_full_backup": "*/5 * * * *",<br> "s3_bucket_region": "us-east-2",<br> "s3_bucket_uri": "s3://mysqlbackupp"<br>}</pre> | no |
52-
| <a name="input_mysqldb_backup_enabled"></a> [mysqldb\_backup\_enabled](#input\_mysqldb\_backup\_enabled) | Set true to enable mysql backups | `bool` | `false` | no |
53-
| <a name="input_mysqldb_config"></a> [mysqldb\_config](#input\_mysqldb\_config) | Mysql configurations | `any` | <pre>{<br> "architecture": "",<br> "custom_user_username": "",<br> "environment": "",<br> "name": "",<br> "primary_pod_volume_size": "",<br> "secondary_pod_replica_count": 1,<br> "secondary_pod_volume_size": "",<br> "storage_class_name": "",<br> "values_yaml": ""<br>}</pre> | no |
54-
| <a name="input_mysqldb_exporter_enabled"></a> [mysqldb\_exporter\_enabled](#input\_mysqldb\_exporter\_enabled) | Set true to deploy mysqldb exporters to get metrics in grafana | `bool` | `false` | no |
55-
| <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace name | `string` | `"mysqldb"` | no |
56-
| <a name="input_recovery_window_aws_secret"></a> [recovery\_window\_aws\_secret](#input\_recovery\_window\_aws\_secret) | Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. | `number` | `0` | no |
35+
No inputs.
5736

5837
## Outputs
5938

@@ -65,4 +44,3 @@ No modules.
6544
| <a name="output_mysql_secondary_endpoint"></a> [mysql\_secondary\_endpoint](#output\_mysql\_secondary\_endpoint) | n/a |
6645
| <a name="output_mysql_secondary_headless_endpoint"></a> [mysql\_secondary\_headless\_endpoint](#output\_mysql\_secondary\_headless\_endpoint) | n/a |
6746
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
68-

‎examples/complete/helm/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
primary:
2-
affinity:
2+
affinity:
33
nodeAffinity:
44
requiredDuringSchedulingIgnoredDuringExecution:
55
nodeSelectorTerms:
@@ -10,7 +10,7 @@ primary:
1010
- "true"
1111

1212
secondary:
13-
affinity:
13+
affinity:
1414
nodeAffinity:
1515
requiredDuringSchedulingIgnoredDuringExecution:
1616
nodeSelectorTerms:

‎examples/complete/main.tf‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,34 @@
11
locals {
2-
region = "us-east-2"
3-
name = "skaf"
4-
environment = "prod"
2+
name = "test"
3+
region = "ap-south-1"
4+
environment = "squareops"
55
}
66

77
module "mysql" {
8-
source = "../.."
9-
mysqldb_backup_enabled = true
10-
mysqldb_exporter_enabled = false
11-
cluster_name = "cluster-name"
8+
source = "../../"
9+
cluster_name = "test-squareops"
1210
mysqldb_config = {
13-
name = local.name
14-
environment = local.environment
15-
architecture = "replication"
16-
custom_user_username = "admin"
17-
primary_pod_volume_size = "10Gi"
18-
secondary_pod_replica_count = 1
19-
secondary_pod_volume_size = "10Gi"
20-
storage_class_name = "infra-service-sc"
21-
values_yaml = file("./helm/values.yaml")
11+
name = local.name
12+
values_yaml = file("./helm/values.yaml")
13+
environment = local.environment
14+
architecture = "replication"
15+
storage_class_name = "infra-service-sc"
16+
custom_user_username = "admin"
17+
primary_db_volume_size = "10Gi"
18+
secondary_db_volume_size = "10Gi"
19+
secondary_db_replica_count = 2
2220
}
21+
mysqldb_backup_enabled = true
2322
mysqldb_backup_config = {
24-
s3_bucket_uri = "s3://bucketname"
25-
s3_bucket_region = "bucket_region"
23+
s3_bucket_uri = "s3://mysqlbackupp"
24+
s3_bucket_region = "us-east-2"
2625
cron_for_full_backup = "*/2 * * * *"
2726
}
27+
mysqldb_restore_enabled = true
28+
mysqldb_restore_config = {
29+
s3_bucket_uri = "s3://mysqldumprestore/20-ratings.sql"
30+
s3_bucket_region = "us-east-2"
2831

29-
30-
}
32+
}
33+
mysqldb_exporter_enabled = false
34+
}

‎examples/complete/provider.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ provider "aws" {
44

55

66
data "aws_eks_cluster" "cluster" {
7-
name = ""
7+
name = "dev-skaf"
88
}
99

1010
data "aws_eks_cluster_auth" "cluster" {
11-
name = ""
11+
name = "dev-skaf"
1212
}
1313

1414

‎helm/values/restore/values.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
restore:
2+
bucket_uri: ${s3_bucket_uri}
3+
aws_default_region: ${s3_bucket_region}
4+
5+
auth:
6+
username: "${custom_user_username}"
7+
8+
s3:
9+
role_arn: "${s3_role_arn}"

‎main.tf‎

Lines changed: 73 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -57,35 +57,32 @@ resource "kubernetes_namespace" "mysqldb" {
5757
count = var.create_namespace ? 1 : 0
5858
metadata {
5959
annotations = {}
60-
61-
name = var.namespace
60+
name = var.namespace
6261
}
6362
}
6463

6564
resource "helm_release" "mysqldb" {
6665
depends_on = [kubernetes_namespace.mysqldb]
67-
6866
name = "mysqldb"
69-
repository = "https://charts.bitnami.com/bitnami"
7067
chart = "mysql"
71-
namespace = var.namespace
7268
version = var.chart_version
7369
timeout = 600
74-
70+
namespace = var.namespace
71+
repository = "https://charts.bitnami.com/bitnami"
7572
values = [
7673
templatefile("${path.module}/helm/values/mysqldb/values.yaml", {
7774
app_version = var.app_version,
7875
architecture = var.mysqldb_config.architecture,
79-
mysqldb_root_password = random_password.mysqldb_root_password.result,
76+
primary_pod_size = var.mysqldb_config.primary_db_volume_size,
77+
secondary_pod_size = var.mysqldb_config.secondary_db_volume_size,
78+
storage_class_name = var.mysqldb_config.storage_class_name,
8079
custom_user_username = var.mysqldb_config.custom_user_username,
8180
custom_user_password = random_password.mysqldb_custom_user_password.result,
8281
replication_password = random_password.mysqldb_replication_user_password.result,
83-
primary_pod_size = var.mysqldb_config.primary_pod_volume_size,
84-
secondary_pod_replica_count = var.mysqldb_config.secondary_pod_replica_count,
85-
secondary_pod_size = var.mysqldb_config.secondary_pod_volume_size,
86-
metrics_exporter_password = random_password.mysqldb_exporter_user_password.result,
82+
mysqldb_root_password = random_password.mysqldb_root_password.result,
8783
mysqldb_exporter_enabled = var.mysqldb_exporter_enabled,
88-
storage_class_name = var.mysqldb_config.storage_class_name
84+
metrics_exporter_password = random_password.mysqldb_exporter_user_password.result,
85+
secondary_pod_replica_count = var.mysqldb_config.secondary_db_replica_count
8986
}),
9087
var.mysqldb_config.values_yaml
9188
]
@@ -96,15 +93,15 @@ resource "helm_release" "mysqldb_backup" {
9693
count = var.mysqldb_backup_enabled ? 1 : 0
9794
name = "mysqldb-backup"
9895
chart = "${path.module}/backup"
99-
namespace = var.namespace
10096
timeout = 600
97+
namespace = var.namespace
10198
values = [
10299
templatefile("${path.module}/helm/values/backup/values.yaml", {
100+
s3_role_arn = aws_iam_role.mysql_backup_role.arn
103101
s3_bucket_uri = var.mysqldb_backup_config.s3_bucket_uri,
104102
s3_bucket_region = var.mysqldb_backup_config.s3_bucket_region,
105103
cron_for_full_backup = var.mysqldb_backup_config.cron_for_full_backup,
106-
custom_user_username = "root",
107-
s3_role_arn = aws_iam_role.mysql_backup_role.arn
104+
custom_user_username = "root"
108105
})
109106
]
110107
}
@@ -136,10 +133,70 @@ resource "aws_iam_role" "mysql_backup_role" {
136133
Statement = [
137134
{
138135
Action = [
139-
"s3:ListBucket",
140136
"s3:GetObject",
137+
"s3:PutObject",
141138
"s3:DeleteObject",
139+
"s3:ListBucket",
140+
"s3:AbortMultipartUpload",
141+
"s3:ListMultipartUploadParts"
142+
]
143+
Effect = "Allow"
144+
Resource = "*"
145+
}
146+
]
147+
})
148+
}
149+
}
150+
151+
## DB dump restore
152+
resource "helm_release" "mysqldb_restore" {
153+
depends_on = [helm_release.mysqldb]
154+
count = var.mysqldb_restore_enabled ? 1 : 0
155+
name = "mysqldb-restore"
156+
chart = "${path.module}/restore"
157+
timeout = 600
158+
namespace = var.namespace
159+
values = [
160+
templatefile("${path.module}/helm/values/restore/values.yaml", {
161+
s3_role_arn = aws_iam_role.mysql_restore_role.arn
162+
s3_bucket_uri = var.mysqldb_restore_config.s3_bucket_uri,
163+
s3_bucket_region = var.mysqldb_restore_config.s3_bucket_region,
164+
custom_user_username = "root"
165+
})
166+
]
167+
}
168+
169+
resource "aws_iam_role" "mysql_restore_role" {
170+
name = format("%s-%s-%s", var.cluster_name, var.mysqldb_config.name, "mysql-restore")
171+
assume_role_policy = jsonencode({
172+
Version = "2012-10-17",
173+
Statement = [
174+
{
175+
Effect = "Allow",
176+
Principal = {
177+
Federated = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${local.oidc_provider}"
178+
},
179+
Action = "sts:AssumeRoleWithWebIdentity",
180+
Condition = {
181+
StringEquals = {
182+
"${local.oidc_provider}:aud" = "sts.amazonaws.com",
183+
"${local.oidc_provider}:sub" = "system:serviceaccount:${var.namespace}:sa-mysql-restore"
184+
}
185+
}
186+
}
187+
]
188+
})
189+
inline_policy {
190+
name = "AllowS3PutObject"
191+
policy = jsonencode({
192+
Version = "2012-10-17"
193+
Statement = [
194+
{
195+
Action = [
196+
"s3:GetObject",
142197
"s3:PutObject",
198+
"s3:DeleteObject",
199+
"s3:ListBucket",
143200
"s3:AbortMultipartUpload",
144201
"s3:ListMultipartUploadParts"
145202
]

0 commit comments

Comments
 (0)