Skip to content

Commit c715cfb

Browse files
maciaszczykmmaciaszczykm
authored
Merge pull request #89 from pluralsh/azure-core-infra
feat: Azure core infra
2 parents 8547e32 + c5f8bfd commit c715cfb

11 files changed

Lines changed: 231 additions & 14 deletions

File tree

‎setup/stacks/core-infra.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,20 @@ spec:
1616
name: mgmt
1717
namespace: infra
1818
variables:
19+
project: [[ .Project ]]
1920
region: [[ .Region ]]
2021
cluster_name: [[ .Cluster ]]
22+
[[ if eq .Provider "azure" ]]
23+
resource_group_name: [[ .Project ]]
24+
subscription_id: [[ .Context.SubscriptionId ]]
25+
tenant_id: [[ .Context.TenantId ]]
26+
client_id: {{ .StacksIdentity }}
27+
jobSpec:
28+
namespace: plrl-deploy-operator
29+
labels:
30+
azure.workload.identity/use: "true"
31+
serviceAccount: "stacks"
32+
[[ end ]]
2133
git:
2234
ref: main
2335
folder: terraform/core-infra

‎templates/setup/stacks/azure.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ metadata:
44
name: stacks
55
namespace: plrl-deploy-operator
66
annotations:
7-
azure.workload.identity/client-id: {{ .StacksIdentity }}
7+
azure.workload.identity/client-id: {{ .StacksIdentity }}

‎terraform/clouds/azure/iam.tf‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,6 @@ resource "azurerm_role_assignment" "aks-network-identity-ssi" {
1414
depends_on = [module.aks, azurerm_virtual_network.network]
1515
}
1616

17-
18-
1917
resource "azurerm_user_assigned_identity" "stacks" {
2018
resource_group_name = local.resource_group.name
2119
location = local.resource_group.location
@@ -32,8 +30,8 @@ resource "azurerm_role_assignment" "stacks-ssi" {
3230
resource "azurerm_federated_identity_credential" "stacks" {
3331
name = "${var.cluster_name}-stacks"
3432
resource_group_name = local.resource_group.name
35-
audience = ["api://AzureADTokenExchange"]
33+
audience = ["api://AzureADTokenExchange"]
3634
issuer = module.aks.oidc_issuer_url
3735
parent_id = azurerm_user_assigned_identity.stacks.id
3836
subject = "system:serviceaccount:plrl-deploy-operator:stacks"
39-
}
37+
}

‎terraform/clouds/azure/variables.tf‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,10 +63,6 @@ variable "postgres_sku" {
6363
default = "GP_Standard_D4s_v3"
6464
}
6565

66-
variable "db_sku" {
67-
default = "GP_Gen5_2"
68-
}
69-
7066
variable "workload_identity_enabled" {
7167
type = bool
7268
default = true

‎terraform/core-infra/aws/versions.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ terraform {
55
aws = {
66
source = "hashicorp/aws"
77
}
8-
98
plural = {
109
source = "pluralsh/plural"
1110
version = ">= 0.2.9"
@@ -18,4 +17,4 @@ provider "aws" {
1817
}
1918

2019

21-
provider "plural" { }
20+
provider "plural" {}

‎terraform/core-infra/azure/cluster.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "plural_service_context" "mgmt" {
2+
name = "plrl/clusters/mgmt"
3+
configuration = jsonencode({
4+
region = var.region
5+
cluster_name = var.cluster_name
6+
})
7+
}

‎terraform/core-infra/azure/context.tf‎

Whitespace-only changes.

‎terraform/core-infra/azure/identity.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
resource "plural_service_context" "identity" {
2+
name = "plrl/azure/identity"
3+
configuration = jsonencode({
4+
subscription_id = var.subscription_id
5+
tenant_id = var.tenant_id
6+
client_id = var.client_id
7+
})
8+
}

‎terraform/core-infra/azure/network.tf‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
data "azurerm_resource_group" "default" {
2+
name = var.resource_group_name
3+
}
4+
5+
data "azurerm_private_dns_zone" "postgres" {
6+
name = var.postgres_dns_zone
7+
resource_group_name = data.azurerm_resource_group.default.name
8+
}
9+
10+
data "azurerm_virtual_network" "plural" {
11+
name = var.network_name
12+
resource_group_name = data.azurerm_resource_group.default.name
13+
}
14+
15+
data "azurerm_subnet" "plural_sn" {
16+
name = "${var.network_name}-sn"
17+
resource_group_name = data.azurerm_resource_group.default.name
18+
virtual_network_name = data.azurerm_virtual_network.plural.name
19+
}
20+
21+
data "azurerm_subnet" "plural_pg" {
22+
name = "${var.network_name}-pg"
23+
resource_group_name = data.azurerm_resource_group.default.name
24+
virtual_network_name = data.azurerm_virtual_network.plural.name
25+
}
26+
27+
resource "plural_service_context" "plural" {
28+
name = "plrl/network/plural"
29+
configuration = jsonencode({
30+
location = data.azurerm_virtual_network.plural.location
31+
network_name = data.azurerm_virtual_network.plural.name
32+
network_id = data.azurerm_virtual_network.plural.id
33+
sn_subnet_name = data.azurerm_subnet.plural_sn.name
34+
sn_subnet_id = data.azurerm_subnet.plural_sn.id
35+
pg_subnet_name = data.azurerm_subnet.plural_pg.name
36+
pg_subnet_id = data.azurerm_subnet.plural_pg.id
37+
dns_zone_name = data.azurerm_private_dns_zone.postgres.name
38+
dns_zone_id = data.azurerm_private_dns_zone.postgres.id
39+
})
40+
}
41+
42+
resource "azurerm_virtual_network" "dev" {
43+
name = "dev"
44+
resource_group_name = data.azurerm_resource_group.default.name
45+
location = var.region
46+
address_space = var.network_cidrs
47+
}
48+
49+
resource "azurerm_subnet" "dev_sn" {
50+
name = "dev-sn"
51+
resource_group_name = data.azurerm_resource_group.default.name
52+
virtual_network_name = azurerm_virtual_network.dev.name
53+
address_prefixes = var.subnet_cidrs
54+
enforce_private_link_endpoint_network_policies = true
55+
}
56+
57+
resource "azurerm_subnet" "dev_pg" {
58+
name = "dev-pg"
59+
resource_group_name = data.azurerm_resource_group.default.name
60+
virtual_network_name = azurerm_virtual_network.dev.name
61+
address_prefixes = var.postgres_cidrs
62+
service_endpoints = ["Microsoft.Storage"]
63+
64+
delegation {
65+
name = "fs"
66+
service_delegation {
67+
name = "Microsoft.DBforPostgreSQL/flexibleServers"
68+
actions = [
69+
"Microsoft.Network/virtualNetworks/subnets/join/action",
70+
]
71+
}
72+
}
73+
}
74+
75+
resource "azurerm_private_dns_zone_virtual_network_link" "dev_pg" {
76+
name = "dev.postgres.com"
77+
resource_group_name = data.azurerm_resource_group.default.name
78+
private_dns_zone_name = data.azurerm_private_dns_zone.postgres.name
79+
virtual_network_id = azurerm_virtual_network.dev.id
80+
}
81+
82+
resource "plural_service_context" "dev" {
83+
name = "plrl/network/dev"
84+
configuration = jsonencode({
85+
location = azurerm_virtual_network.dev.location
86+
network_name = azurerm_virtual_network.dev.name
87+
network_id = azurerm_virtual_network.dev.id
88+
sn_subnet_name = azurerm_subnet.dev_sn.name
89+
sn_subnet_id = azurerm_subnet.dev_sn.id
90+
pg_subnet_name = azurerm_subnet.dev_pg.name
91+
pg_subnet_id = azurerm_subnet.dev_pg.id
92+
dns_zone_name = data.azurerm_private_dns_zone.postgres.name
93+
dns_zone_id = data.azurerm_private_dns_zone.postgres.id
94+
})
95+
}
96+
97+
resource "azurerm_virtual_network" "prod" {
98+
name = "prod"
99+
resource_group_name = data.azurerm_resource_group.default.name
100+
location = var.region
101+
address_space = var.network_cidrs
102+
}
103+
104+
resource "azurerm_subnet" "prod_sn" {
105+
name = "prod-sn"
106+
resource_group_name = data.azurerm_resource_group.default.name
107+
virtual_network_name = azurerm_virtual_network.prod.name
108+
address_prefixes = var.subnet_cidrs
109+
enforce_private_link_endpoint_network_policies = true
110+
}
111+
112+
resource "azurerm_subnet" "prod_pg" {
113+
name = "prod-pg"
114+
resource_group_name = data.azurerm_resource_group.default.name
115+
virtual_network_name = azurerm_virtual_network.prod.name
116+
address_prefixes = var.postgres_cidrs
117+
service_endpoints = ["Microsoft.Storage"]
118+
119+
delegation {
120+
name = "fs"
121+
service_delegation {
122+
name = "Microsoft.DBforPostgreSQL/flexibleServers"
123+
actions = [
124+
"Microsoft.Network/virtualNetworks/subnets/join/action",
125+
]
126+
}
127+
}
128+
}
129+
130+
resource "azurerm_private_dns_zone_virtual_network_link" "prod_pg" {
131+
name = "prod.postgres.com"
132+
resource_group_name = data.azurerm_resource_group.default.name
133+
private_dns_zone_name = data.azurerm_private_dns_zone.postgres.name
134+
virtual_network_id = azurerm_virtual_network.prod.id
135+
}
136+
137+
resource "plural_service_context" "prod" {
138+
name = "plrl/network/prod"
139+
configuration = jsonencode({
140+
location = azurerm_virtual_network.prod.location
141+
network_name = azurerm_virtual_network.prod.name
142+
network_id = azurerm_virtual_network.prod.id
143+
sn_subnet_name = azurerm_subnet.prod_sn.name
144+
sn_subnet_id = azurerm_subnet.prod_sn.id
145+
pg_subnet_name = azurerm_subnet.prod_pg.name
146+
pg_subnet_id = azurerm_subnet.prod_pg.id
147+
dns_zone_name = data.azurerm_private_dns_zone.postgres.name
148+
dns_zone_id = data.azurerm_private_dns_zone.postgres.id
149+
})
150+
}

‎terraform/core-infra/azure/variables.tf‎

Lines changed: 42 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,48 @@
1+
variable "cluster_name" {
2+
type = string
3+
}
4+
5+
variable "resource_group_name" {
6+
type = string
7+
}
8+
9+
variable "network_name" {
10+
type = string
11+
default = "plural"
12+
}
13+
114
variable "region" {
215
type = string
316
default = "us-east-2"
417
}
518

6-
variable "cluster_name" {
19+
variable "subscription_id" {
20+
type = string
21+
}
22+
23+
variable "tenant_id" {
24+
type = string
25+
}
26+
27+
variable "client_id" {
728
type = string
8-
}
29+
}
30+
31+
variable "postgres_dns_zone" {
32+
default = "plrl.postgres.database.azure.com"
33+
}
34+
35+
variable "network_cidrs" {
36+
type = list(string)
37+
default = ["10.52.0.0/16"]
38+
}
39+
40+
variable "subnet_cidrs" {
41+
type = list(string)
42+
default = ["10.52.0.0/20"]
43+
}
44+
45+
variable "postgres_cidrs" {
46+
type = list(string)
47+
default = ["10.52.16.0/24"]
48+
}

0 commit comments

Comments
 (0)