Skip to content

Commit 4422e2f

Browse files
elamaran11elamaran11
committed
Terraform EKS Observability Accelerator Workflows
Signed-off-by: Elamaran Shanmugam <[email protected]>
1 parent ee99d63 commit 4422e2f

File tree

3 files changed

+257
-0
lines changed

3 files changed

+257
-0
lines changed

‎packages/argo-workflows-templates/base/cluster-workflow-tf-eks-observability-cleanup.yaml‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: ClusterWorkflowTemplate
3+
metadata:
4+
annotations:
5+
workflows.argoproj.io/description: Runs Cleanup of Terraform EKS Observability Accelerator.
6+
name: terraform-tf-eks-observability
7+
spec:
8+
activeDeadlineSeconds: 3600
9+
ttlStrategy:
10+
secondsAfterCompletion: 86400
11+
secondsAfterSuccess: 43200
12+
secondsAfterFailure: 86400
13+
serviceAccountName: tf-eks-observability
14+
entrypoint: main
15+
arguments:
16+
parameters:
17+
- name: backstage-entity-name
18+
- name: script-location
19+
- name: admin-role
20+
volumes:
21+
- name: tf-state
22+
secret:
23+
secretName: "{{workflow.parameters.backstage-entity-name}}-tf-state"
24+
templates:
25+
- name: main
26+
steps:
27+
- - name: remove-resources
28+
template: remove-resources
29+
- - name: cleanup-tf
30+
template: cleanup-tf
31+
- name: remove-resources
32+
inputs:
33+
artifacts:
34+
- name: go-template
35+
path: /tmp/go-template
36+
raw:
37+
data: |
38+
{{- range .items -}}
39+
{{- if not .metadata.ownerReferences -}}
40+
{{- if eq .spec.type "LoadBalancer" -}}
41+
{{.metadata.name}} {{.metadata.namespace}}{{"\n"}}
42+
{{- end }}
43+
{{- end -}}
44+
{{- end -}}
45+
script:
46+
image: public.ecr.aws/m8u6z8z4/manabu-test:tf-manager-v0.0.15
47+
volumeMounts:
48+
- name: tf-state
49+
mountPath: /var/run/tf
50+
command:
51+
- bash
52+
source: |
53+
set -e -o pipefail
54+
set +x
55+
echo 'restoring tfstate from secret'
56+
gunzip -c /var/run/tf/tfstate > /tmp/tfstate
57+
cluster_arn=$(jq -r '.resources[] | select(.module == "module.eks" and .type == "aws_eks_cluster")| .instances[0].attributes.arn' /tmp/tfstate)
58+
if [[ -z "${cluster_arn// }" ]]; then
59+
exit 0
60+
fi
61+
cluster_name=$(echo $cluster_arn | cut -d '/' -f 2)
62+
region=$(echo $cluster_arn | cut -d ':' -f 4)
63+
mkdir ~/.kube/
64+
aws eks update-kubeconfig --name $cluster_name --region $region
65+
echo 'removing kubernetes services with loadbalancers'
66+
lbs=$(kubectl get svc -A -o go-template-file=/tmp/go-template)
67+
echo $lbs | while IFS= read -r line; do
68+
if [[ -z "${line// }" ]]; then
69+
continue
70+
fi
71+
name=$(echo ${line} | cut -f1 -d" ");
72+
namespace=$(echo ${line} | cut -f2 -d" ");
73+
echo "delete $name in $namespace";
74+
kubectl delete svc $name -n $namespace;
75+
done
76+
77+
echo 'removing cluster information from backstage'
78+
rm ~/.kube/config
79+
80+
kubectl -n backstage get secrets k8s-config -o yaml | yq '.data."k8s-config.yaml"' | base64 -d > /tmp/config
81+
data=$(yq eval "del(.clusters[] | select(.name == \"$cluster_name\"))" /tmp/config | base64)
82+
kubectl -n backstage get secrets k8s-config -o yaml | yq ".data.\"k8s-config.yaml\" = \"$data\"" | kubectl apply -f -
83+
kubectl -n backstage rollout restart deployment backstage
84+
85+
- name: cleanup-tf
86+
retryStrategy:
87+
limit: "2"
88+
retryPolicy: "Always"
89+
inputs:
90+
artifacts:
91+
- name: tf-eks-observability
92+
path: /src/tf-eks-observability
93+
git:
94+
repo: https://github.com/aws-observability/terraform-aws-observability-accelerator.git
95+
revision: main
96+
script:
97+
image: public.ecr.aws/m8u6z8z4/manabu-test:tf-manager-v0.0.15
98+
volumeMounts:
99+
- mountPath: /var/run/tf
100+
name: tf-state
101+
command:
102+
- bash
103+
source: |
104+
set -e -o pipefail
105+
cd /src/tf-eks-observability/{{workflow.parameters.script-location}}
106+
echo 'getting tf state from secrets'
107+
gunzip -c /var/run/tf/tfstate > terraform.tfstate
108+
cluster_arn=$(jq -r '.resources[] | select(.module == "module.eks" and .type == "aws_eks_cluster")| .instances[0].attributes.arn' terraform.tfstate)
109+
region=$(echo $cluster_arn | cut -d '/' -f 4)
110+
echo 'running cleanup script'
111+
terraform init
112+
set +e +o pipefail
113+
printf "$region\n" | ./cleanup.sh
114+
status=$?
115+
gzip -k -c terraform.tfstate | base64 -w 0 > tfstate
116+
kubectl get secret -n {{workflow.namespace}} {{workflow.parameters.backstage-entity-name}}-tf-state -o yaml > secret.yaml
117+
data=$(cat tfstate) yq -i ".data.tfstate = env(data)" secret.yaml
118+
kubectl apply -f secret.yaml
119+
exit $status

‎packages/argo-workflows-templates/base/cluster-workflow-tf-eks-observability.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: ClusterWorkflowTemplate
3+
metadata:
4+
annotations:
5+
workflows.argoproj.io/description: Runs Terraform EKS Observability Accelerator.
6+
name: terraform-eks-observability
7+
spec:
8+
activeDeadlineSeconds: 3600
9+
ttlStrategy:
10+
secondsAfterCompletion: 86400
11+
secondsAfterSuccess: 43200
12+
secondsAfterFailure: 86400
13+
serviceAccountName: tf-eks-observability
14+
entrypoint: main
15+
arguments:
16+
parameters:
17+
- name: backstage-entity-name
18+
- name: script-location
19+
- name: admin-role
20+
templates:
21+
- name: main
22+
steps:
23+
- - name: run
24+
template: run
25+
- - name: restart-backstage
26+
template: restart-backstage
27+
- - name: cleanup
28+
template: cleanup
29+
- name: run
30+
inputs:
31+
artifacts:
32+
- name: tf-eks-observability
33+
path: /src/tf-eks-observability
34+
git:
35+
repo: https://github.com/aws-observability/terraform-aws-observability-accelerator.git
36+
revision: main
37+
volumes:
38+
- name: tf-cm
39+
configMap:
40+
name: "{{workflow.parameters.backstage-entity-name}}-tf-cm"
41+
container:
42+
image: public.ecr.aws/cnoe-io/misc:tf-manager-v0.0.1
43+
tty: true
44+
stdin: true
45+
volumeMounts:
46+
- mountPath: /var/run/tf
47+
name: tf-cm
48+
env:
49+
- name: BACKSTAGE_ENT_NAME
50+
value: "{{workflow.parameters.backstage-entity-name}}"
51+
- name: SCRIPT_LOCATION
52+
value: "/src/tf-eks-observability/{{workflow.parameters.script-location}}"
53+
- name: ADMIN_ROLE
54+
value: "{{workflow.parameters.admin-role}}"
55+
- name: TFVAR_LOCATION
56+
value: /var/run/tf/terraform.tfvars.json
57+
- name: restart-backstage
58+
script:
59+
image: public.ecr.aws/cnoe-io/misc:tf-manager-v0.0.1
60+
command:
61+
- bash
62+
source: |
63+
kubectl -n backstage rollout restart deployment backstage
64+
- name: cleanup
65+
resource:
66+
action: delete
67+
manifest: |
68+
apiVersion: v1
69+
kind: ConfigMap
70+
metadata:
71+
name: "{{workflow.parameters.backstage-entity-name}}-tf-cm"
72+
namespace: "{{workflow.namespace}}"

‎packages/argo-workflows-templates/base/sa-tf-eks-observability.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: data-on-eks
5+
labels:
6+
app: data-on-eks
7+
---
8+
kind: Role
9+
apiVersion: rbac.authorization.k8s.io/v1
10+
metadata:
11+
name: data-on-eks
12+
namespace: data-on-eks
13+
labels:
14+
app: data-on-eks
15+
rules:
16+
- apiGroups: [""]
17+
resources: ["secrets", "configmaps"]
18+
verbs: ["get", "list", "watch", "patch", "create", "update", "delete"]
19+
---
20+
kind: RoleBinding
21+
apiVersion: rbac.authorization.k8s.io/v1
22+
metadata:
23+
name: data-on-eks
24+
namespace: data-on-eks
25+
labels:
26+
app: data-on-eks
27+
subjects:
28+
- kind: ServiceAccount
29+
name: data-on-eks
30+
roleRef:
31+
kind: Role
32+
name: data-on-eks
33+
apiGroup: rbac.authorization.k8s.io
34+
35+
# allow for updating backstage config
36+
---
37+
kind: Role
38+
apiVersion: rbac.authorization.k8s.io/v1
39+
metadata:
40+
name: data-on-eks
41+
namespace: backstage
42+
labels:
43+
app: data-on-eks
44+
rules:
45+
- apiGroups: [""]
46+
resources: ["secrets"]
47+
verbs: ["get", "list", "watch", "patch", "update"]
48+
- apiGroups: [ "apps" ]
49+
resources: [ "deployments", "replicasets", "pods" ]
50+
verbs: [ "get", "patch" ]
51+
---
52+
kind: RoleBinding
53+
apiVersion: rbac.authorization.k8s.io/v1
54+
metadata:
55+
name: data-on-eks
56+
namespace: backstage
57+
labels:
58+
app: data-on-eks
59+
subjects:
60+
- kind: ServiceAccount
61+
name: data-on-eks
62+
namespace: data-on-eks
63+
roleRef:
64+
kind: Role
65+
name: data-on-eks
66+
apiGroup: rbac.authorization.k8s.io

0 commit comments

Comments
 (0)