fix: adding tls to custom metrics

Author: marcelorobj

5-appinfra/modules/cicd-pipeline/project-iam-bindings.tf

@@ -156,7 +156,7 @@ module "cb-gke-project-iam-bindings" {
   for_each   = local.gke_projects
   project_id = each.value
 
-  project_roles           = ["roles/container.admin", "roles/container.developer", "roles/gkehub.viewer", "roles/gkehub.gatewayEditor", "roles/cloudbuild.workerPoolUser", "roles/containeranalysis.notes.attacher"]
+  project_roles           = ["roles/privateca.admin", "roles/container.admin", "roles/container.developer", "roles/gkehub.viewer", "roles/gkehub.gatewayEditor", "roles/cloudbuild.workerPoolUser", "roles/containeranalysis.notes.attacher"]
   prefix                  = "serviceAccount"
   service_account_address = google_service_account.cloud_build.email
 }

5-appinfra/modules/htc-infra/agent/modules/config_apply/k8s/adapter_new_resource_model.yaml.templ

@@ -144,7 +144,8 @@ kind: APIService
 metadata:
   name: v1beta1.custom.metrics.k8s.io
 spec:
-  insecureSkipTLSVerify: true
+  insecureSkipTLSVerify: false
+  caBundle: ${ca_bundle}
   group: custom.metrics.k8s.io
   groupPriorityMinimum: 100
   versionPriority: 100
@@ -158,7 +159,8 @@ kind: APIService
 metadata:
   name: v1beta2.custom.metrics.k8s.io
 spec:
-  insecureSkipTLSVerify: true
+  insecureSkipTLSVerify: false
+  caBundle: ${ca_bundle}
   group: custom.metrics.k8s.io
   groupPriorityMinimum: 100
   versionPriority: 200
@@ -172,7 +174,8 @@ kind: APIService
 metadata:
   name: v1beta1.external.metrics.k8s.io
 spec:
-  insecureSkipTLSVerify: true
+  insecureSkipTLSVerify: false
+  caBundle: ${ca_bundle}
   group: external.metrics.k8s.io
   groupPriorityMinimum: 100
   versionPriority: 100

5-appinfra/modules/htc-infra/agent/modules/config_apply/main.tf

@@ -126,6 +126,7 @@ resource "null_resource" "cluster_init" {
       "adapter_new_resource_model_yaml" = templatefile(
         "${path.module}/k8s/adapter_new_resource_model.yaml.templ", {
           namespace = var.namespace
+          ca_bundle = local.ca_bundle_base64
       }),
       "volume_claim_yaml" = templatefile(
         "${path.module}/k8s/volume_claim.yaml.templ", {
@@ -137,7 +138,6 @@ resource "null_resource" "cluster_init" {
   triggers = {
     template       = each.value
     cluster_change = local.cluster_config
-    test           = true
   }
 
   provisioner "local-exec" {

5-appinfra/modules/htc-infra/agent/modules/config_apply/privateca.tf

@@ -0,0 +1,68 @@
+
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+  ca_bundle_base64 = base64encode(google_privateca_certificate_authority.custom_metrics_ca.pem_ca_certificates[0])
+}
+
+resource "google_privateca_ca_pool" "custom_metrics_ca_pool" {
+  project  = var.cluster_project_id
+  location = var.region
+  name     = "custom-metrics-ca-pool"
+  tier     = "DEVOPS"
+
+  publishing_options {
+    publish_ca_cert = true
+    publish_crl     = false
+  }
+}
+
+resource "google_privateca_certificate_authority" "custom_metrics_ca" {
+  project                  = var.cluster_project_id
+  location                 = var.region
+  pool                     = google_privateca_ca_pool.custom_metrics_ca_pool.name
+  certificate_authority_id = "custom-metrics-stackdriver-adapter-ca"
+  lifetime                 = "31536000s" # 1 year
+  deletion_protection      = false
+
+  config {
+    subject_config {
+      subject {
+        organization = "HTC Infra"
+        common_name  = "custom-metrics-ca"
+      }
+    }
+    x509_config {
+      ca_options {
+        is_ca = true
+      }
+      key_usage {
+        base_key_usage {
+          cert_sign = true
+          crl_sign  = true
+        }
+        extended_key_usage {
+          server_auth = false
+          client_auth = false
+        }
+      }
+    }
+  }
+  key_spec {
+    algorithm = "RSA_PKCS1_4096_SHA256"
+  }
+}

5-appinfra/modules/htc-infra/agent/modules/config_apply/variables.tf

@@ -138,50 +138,30 @@ variable "parallelstore_access_points" {
   type        = string
   default     = null
   description = "Access points for the parallel store. Must be provided if parallelstore_enabled is true."
-  validation {
-    condition     = var.parallelstore_enabled ? var.parallelstore_access_points != null : true
-    error_message = "parallelstore_access_points must be set when parallelstore_enabled is true."
-  }
 }
 
 variable "parallelstore_vpc_name" {
   type        = string
   default     = null
   description = "Name of the VPC associated with the parallel store. Required when parallelstore_enabled is true."
-  validation {
-    condition     = var.parallelstore_enabled ? var.parallelstore_vpc_name != null : true
-    error_message = "parallelstore_vpc_name must be set when parallelstore_enabled is true."
-  }
 }
 
 variable "parallelstore_location" {
   type        = string
   default     = null
   description = "Location of the parallel store. Mandatory if parallelstore_enabled is true."
-  validation {
-    condition     = var.parallelstore_enabled ? var.parallelstore_location != null : true
-    error_message = "parallelstore_location must be set when parallelstore_enabled is true."
-  }
 }
 
 variable "parallelstore_instance_name" {
   type        = string
   default     = null
   description = "Name of the parallel store instance. Must be specified when parallelstore_enabled is true."
-  validation {
-    condition     = var.parallelstore_enabled ? var.parallelstore_instance_name != null : true
-    error_message = "parallelstore_instance_name must be set when parallelstore_enabled is true."
-  }
 }
 
 variable "parallelstore_capacity_gib" {
   type        = number
   default     = null
   description = "Capacity of the parallel store in GiB. Required if parallelstore_enabled is true."
-  validation {
-    condition     = var.parallelstore_enabled ? var.parallelstore_capacity_gib != null : true
-    error_message = "parallelstore_capacity_gib must be set when parallelstore_enabled is true."
-  }
 }
 
 variable "namespace" {

5-appinfra/modules/htc-infra/agent/modules/gke/outputs.tf

@@ -32,11 +32,6 @@ output "test_scripts_list" {
   ])
 }
 
-output "first_test_script" {
-  description = "First test script"
-  value       = length(var.gke_cluster_names) > 0 ? module.config_apply[0].test_scripts : ""
-}
-
 # Cluster
 output "cluster_urls" {
   description = "Cluster urls"

5-appinfra/modules/htc-infra/apis.tf

@@ -23,7 +23,8 @@ module "enabled_google_apis" {
     "bigquery.googleapis.com",
     "parallelstore.googleapis.com",
     "container.googleapis.com",
-    "logging.googleapis.com"
+    "logging.googleapis.com",
+    "privateca.googleapis.com"
   ]
 }
 
@@ -34,7 +35,8 @@ resource "google_project_iam_member" "team_roles_infra_project" {
     "roles/pubsub.publisher",
     "roles/pubsub.viewer",
     "roles/pubsub.subscriber",
-    "roles/monitoring.viewer"
+    "roles/monitoring.viewer",
+    "roles/privateca.admin"
   ])
 
   project = var.infra_project
@@ -49,7 +51,8 @@ resource "google_project_iam_member" "team_roles_cluster_project" {
     "roles/pubsub.publisher",
     "roles/pubsub.viewer",
     "roles/pubsub.subscriber",
-    "roles/monitoring.viewer"
+    "roles/monitoring.viewer",
+    "roles/privateca.admin"
   ])
 
   project = var.cluster_project_id

examples/htc/README.md

@@ -121,7 +121,7 @@ The steps below assume that you are checked out on the same level as `terraform-
 1. Retrieve HTC repositories created on 4-appfactory.
 
     ```bash
-    cd eab-applicationfactory/envs/production/
+    cd eab-applicationfactory/envs/shared/
     terraform init
 
     export htc_project=$(terraform output -json app-group | jq -r '.["htc.htc"]["app_admin_project_id"]')