#terraform - October 2024

terraform {
  source = "git::<https://github.com/cloudposse/terraform-aws-helm-release.git//?ref=0.10.1>"
}

  # helm_release.this[0] will be updated in-place
  ~ resource "helm_release" "this" {
        id                         = "myapp"
      ~ metadata                   = [
          - {
              - app_version = "v2.8.6"
              - chart       = "myapp"
              - name        = "myapp"
              - namespace   = "myapp"
              - revision    = 16
              - values      = jsonencode(
                    {
...

locals {
  cluster_name = var.cluster_name
}

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "20.15.0"

  cluster_name    = local.cluster_name
  cluster_version = "1.29"

  cluster_endpoint_public_access           = true
  enable_cluster_creator_admin_permissions = true

  cluster_addons = {
    aws-ebs-csi-driver = {
      service_account_role_arn = module.irsa-ebs-csi.iam_role_arn
    }
  }

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  eks_managed_node_group_defaults = {
    ami_type = var.ami_type

  }

  eks_managed_node_groups = {
    one = {
      name = "node-group-1"

      instance_types = ["t3.medium"]

      min_size     = var.min_size
      max_size     = var.max_size
      desired_size = var.desired_size
    }

    two = {
      name = "node-group-2"

      instance_types = ["t3.medium"]

      min_size     = var.min_size
      max_size     = var.max_size
      desired_size = var.desired_size
    }
  }
}

module "lb_role" {
  source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"

  role_name                              = "shop_eks_lb"
  attach_load_balancer_controller_policy = true

  oidc_providers = {
    main = {
      provider_arn               = module.eks.oidc_provider_arn
      namespace_service_accounts = ["kube-system:aws-load-balancer-controller"]
    }
  }

  depends_on = [
    module.eks
  ]
}

resource "kubernetes_service_account" "service-account" {
  metadata {
    name      = "aws-load-balancer-controller"
    namespace = "kube-system"
    labels = {
      "<http://app.kubernetes.io/name|app.kubernetes.io/name>"      = "aws-load-balancer-controller"
      "<http://app.kubernetes.io/component|app.kubernetes.io/component>" = "controller"
    }
    annotations = {
      "<http://eks.amazonaws.com/role-arn|eks.amazonaws.com/role-arn>"               = module.lb_role.iam_role_arn
      "<http://eks.amazonaws.com/sts-regional-endpoints|eks.amazonaws.com/sts-regional-endpoints>" = "true"
    }
  }

  depends_on = [
    module.lb_role
  ]
}

resource "helm_release" "alb-controller" {
  name       = "aws-load-balancer-controller"
  repository = "<https://aws.github.io/eks-charts>"
  chart      = "aws-load-balancer-controller"
  namespace  = "kube-system"

  set {
    name  = "region"
    value = "eu-west-3"
  }

  set {
    name  = "vpcId"
    value = module.vpc.vpc_id
  }

  set {
    name  = "serviceAccount.create"
    value = "false"
  }

  set {
    name  = "serviceAccount.name"
    value = "aws-load-balancer-controller"
  }

  set {
    name  = "clusterName"
    value = local.cluster_name
  }

  depends_on = [
    kubernetes_service_account.service-account
  ]
}

ecs/service/application{{ if .tenant }}/{{ .tenant }}{{ end }}:
  ...
ecs/service/api{{ if .tenant }}/{{ .tenant }}{{ end }}:
  ...
...

atmos terraform apply ecs/service/application/demo-a -s uw2-dev
atmos terraform apply ecs/service/api/demo-a -s uw2-dev
...

base_path: "./"

components:
  terraform:
    command: "tofu"
    base_path: "components/terraform"
    apply_auto_approve: false
    deploy_run_init: true
    init_run_reconfigure: true
    auto_generate_backend_file: false

stacks:
  base_path: "stacks"
  included_paths:
    - "deploy/**/*"
  # excluded_paths:
  #   - "**/_defaults.yaml"
  name_pattern: "{stage}/{region}"

logs:
  file: "/dev/stderr"
  level: Debug

exec: "terraform": executable file not found in $PATH

% atmos terraform plan keycloak_sg -s deploy/dev/us-east-1

Variables for the component 'keycloak_sg' in the stack 'deploy/dev/us-east-1':
aws_account_profile: [redacted]
cloud_provider: aws
environment: dev
region: us-east-1
team: [redacted]
tfstate_bucket: [redacted]
vpc_cidr_blocks:
    - 172.80.0.0/16
    - 172.81.0.0/16
vpc_id: [redacted]

Writing the variables to file:
components/terraform/sg/-keycloak_sg.terraform.tfvars.json

Using ENV vars:
TF_IN_AUTOMATION=true

Executing command:
/opt/homebrew/bin/tofu init -reconfigure

Initializing the backend...
Initializing modules...

Initializing provider plugins...
- Reusing previous version of hashicorp/aws from the dependency lock file
- Using previously-installed hashicorp/aws v5.70.0

OpenTofu has been successfully initialized!

Command info:
Terraform binary: tofu
Terraform command: plan
Arguments and flags: []
Component: keycloak_sg
Terraform component: sg
Stack: deploy/dev/us-east-1
Working dir: components/terraform/sg

Executing command:
/opt/homebrew/bin/tofu workspace select -keycloak_sg
Usage: tofu [global options] workspace select NAME

  Select a different OpenTofu workspace.

Options:

    -or-create=false    Create the OpenTofu workspace if it doesn't exist.

    -var 'foo=bar'      Set a value for one of the input variables in the root
                        module of the configuration. Use this option more than
                        once to set more than one variable.

    -var-file=filename  Load variable values from the given file, in addition
                        to the default files terraform.tfvars and *.auto.tfvars.
                        Use this option more than once to include more than one
                        variables file.
Error parsing command-line flags: flag provided but not defined: -keycloak_sg


Executing command:
/opt/homebrew/bin/tofu workspace new -keycloak_sg
Usage: tofu [global options] workspace new [OPTIONS] NAME

  Create a new OpenTofu workspace.

Options:

    -lock=false         Don't hold a state lock during the operation. This is
                        dangerous if others might concurrently run commands
                        against the same workspace.

    -lock-timeout=0s    Duration to retry a state lock.

    -state=path         Copy an existing state file into the new workspace.


    -var 'foo=bar'      Set a value for one of the input variables in the root
                        module of the configuration. Use this option more than
                        once to set more than one variable.

    -var-file=filename  Load variable values from the given file, in addition
                        to the default files terraform.tfvars and *.auto.tfvars.
                        Use this option more than once to include more than one
                        variables file.
Error parsing command-line flags: flag provided but not defined: -keycloak_sg

exit status 1

goroutine 1 [running]:
runtime/debug.Stack()
        runtime/debug/stack.go:26 +0x64
runtime/debug.PrintStack()
        runtime/debug/stack.go:18 +0x1c
<http://github.com/cloudposse/atmos/pkg/utils.LogError({0x105c70460|github.com/cloudposse/atmos/pkg/utils.LogError({0x105c70460>, 0x14000b306e0})
        <http://github.com/cloudposse/atmos/pkg/utils/log_utils.go:61|github.com/cloudposse/atmos/pkg/utils/log_utils.go:61> +0x18c
<http://github.com/cloudposse/atmos/pkg/utils.LogErrorAndExit(|github.com/cloudposse/atmos/pkg/utils.LogErrorAndExit(>{0x105c70460, 0x14000b306e0})
        <http://github.com/cloudposse/atmos/pkg/utils/log_utils.go:35|github.com/cloudposse/atmos/pkg/utils/log_utils.go:35> +0x30
<http://github.com/cloudposse/atmos/cmd.init.func17(0x10750ef60|github.com/cloudposse/atmos/cmd.init.func17(0x10750ef60>, {0x14000853480, 0x4, 0x4})
        <http://github.com/cloudposse/atmos/cmd/terraform.go:33|github.com/cloudposse/atmos/cmd/terraform.go:33> +0x150
<http://github.com/spf13/cobra.(*Command).execute(0x10750ef60|github.com/spf13/cobra.(*Command).execute(0x10750ef60>, {0x14000853480, 0x4, 0x4})
        <http://github.com/spf13/cobra@v1.8.1/command.go:989|github.com/spf13/cobra@v1.8.1/command.go:989> +0x81c
<http://github.com/spf13/cobra.(*Command).ExecuteC(0x10750ec80)|github.com/spf13/cobra.(*Command).ExecuteC(0x10750ec80)>
        <http://github.com/spf13/cobra@v1.8.1/command.go:1117|github.com/spf13/cobra@v1.8.1/command.go:1117> +0x344
<http://github.com/spf13/cobra.(*Command).Execute(...)|github.com/spf13/cobra.(*Command).Execute(...)>
        <http://github.com/spf13/cobra@v1.8.1/command.go:1041|github.com/spf13/cobra@v1.8.1/command.go:1041>
<http://github.com/cloudposse/atmos/cmd.Execute()|github.com/cloudposse/atmos/cmd.Execute()>
        <http://github.com/cloudposse/atmos/cmd/root.go:88|github.com/cloudposse/atmos/cmd/root.go:88> +0x214
main.main()
        <http://github.com/cloudposse/atmos/main.go:9|github.com/cloudposse/atmos/main.go:9> +0x1c

variable "vpcs" {
  description = "List of VPCs"
  type        = list(map(any))

  default = [
    {
      name    = "vpc-1"
      cidr    = "10.0.0.0/16"
      subnets = [
        {
          name = "subnet-1"
          cidr = "10.0.1.0/24"
        },
        {
          name = "subnet-2"
          cidr = "10.0.2.0/24"
        }
      ]
    },
    {
      name    = "vpc-2"
      cidr    = "10.0.0.0/16"
      subnets = [
        {
          name = "subnet-3"
          cidr = "10.0.3.0/24"
        },
        {
          name = "subnet-4"
          cidr = "10.0.4.0/24"
        }
      ]
    }
  ]
}

for_each = { for v in var.vpcs, s in v.subnets : "${v.name}-${s.name}" => s }

The "count" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use the
│ -target argument to first apply only the resources that the count depends on.

allow_ingress_from_this_vpc

│ Error: Inconsistent conditional result types
│
│   on .terraform/modules/redis_clusters.redis.aws_security_group/normalize.tf line 81, in locals:
│   81:   all_ingress_rules = local.inline ? [for r in local.all_inline_rules : r if r.type == "ingress"] : []
│     ├────────────────
│     │ local.all_inline_rules is tuple with 3 elements
│     │ local.inline is false
│
│ The true and false result expressions must have consistent types. The 'true' tuple has length 2, but the 'false' tuple has length 0.
╵
exit status 1