From 9d8f57247631ce563fc8360d445bde4d59356995 Mon Sep 17 00:00:00 2001 From: Schuyler Fenton Date: Wed, 26 Feb 2025 07:52:20 +0000 Subject: [PATCH 1/9] Refactor variables to separate keys --- terraform/main.tf | 6 +++--- terraform/variables.tf | 20 +++++++++----------- 2 files changed, 12 insertions(+), 14 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index 5967ec6..44244c0 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -1,7 +1,7 @@ provider "aws" { - shared_config_files = var.aws_config.shared_config_files - shared_credentials_files = var.aws_config.shared_credentials_files - profile = var.aws_config.profile + access_key = var.aws_access_key + secret_key = var.aws_secret_key + region = var.aws_region default_tags { tags = { diff --git a/terraform/variables.tf b/terraform/variables.tf index 1879adf..5587437 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -1,15 +1,13 @@ -variable "aws_config" { - type = object({ - shared_config_files = list(string) - shared_credentials_files = list(string) - profile = string - }) +variable "aws_access_key" { + type = string +} - default = { - shared_config_files = [] - shared_credentials_files = [] - profile = "default" - } +variable "aws_secret_key" { + type = string +} + +variable "aws_region" { + type = string } variable "cloudflare_api_token" { From b041516ba09e4bf6cf5cbe74a732a3ecd46af44a Mon Sep 17 00:00:00 2001 From: Schuyler Fenton Date: Wed, 26 Feb 2025 08:10:12 +0000 Subject: [PATCH 2/9] Create terraform plan CD job --- .github/workflows/terraform-plan.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .github/workflows/terraform-plan.yml diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml new file mode 100644 index 0000000..b1f7135 --- /dev/null +++ b/.github/workflows/terraform-plan.yml @@ -0,0 +1,25 @@ +name: Create terraform plan + +on: + pull_request: + branches: + - main + +permissions: + contents: read + pull-requests: write + +jobs: + plan: + runs-on: ubuntu-latest + name: Create a plan for a terraform configuration (and comment on PR for review) + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: terraform plan + uses: dflook/terraform-plan@v1 + with: + path: ./terraform/main.tf \ No newline at end of file From 6eac10696312c262aad20b33f4598667762d1021 Mon Sep 17 00:00:00 2001 From: Schuyler Fenton Date: Wed, 26 Feb 2025 08:11:17 +0000 Subject: [PATCH 3/9] Fix path --- .github/workflows/terraform-plan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml index b1f7135..dda3f16 100644 --- a/.github/workflows/terraform-plan.yml +++ b/.github/workflows/terraform-plan.yml @@ -22,4 +22,4 @@ jobs: - name: terraform plan uses: dflook/terraform-plan@v1 with: - path: ./terraform/main.tf \ No newline at end of file + path: /terraform \ No newline at end of file From 7ea2b9a11ada6f9b33607cd9b872e271fe88b9e7 Mon Sep 17 00:00:00 2001 From: Schuyler Fenton Date: Wed, 26 Feb 2025 08:12:07 +0000 Subject: [PATCH 4/9] Actually fix path possibly --- .github/workflows/terraform-plan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml index dda3f16..484bfca 100644 --- a/.github/workflows/terraform-plan.yml +++ b/.github/workflows/terraform-plan.yml @@ -22,4 +22,4 @@ jobs: - name: terraform plan uses: dflook/terraform-plan@v1 with: - path: /terraform \ No newline at end of file + path: terraform \ No newline at end of file From 20742c37dfabd775f359de302412dcdf071412b3 Mon Sep 17 00:00:00 2001 From: Schuyler Fenton Date: Wed, 26 Feb 2025 08:20:16 +0000 Subject: [PATCH 5/9] Regenerate lock file --- terraform/.terraform.lock.hcl | 68 +++++++++++++++++------------------ 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl index edffe16..e940b5e 100644 --- a/terraform/.terraform.lock.hcl +++ b/terraform/.terraform.lock.hcl @@ -2,48 +2,48 @@ # Manual edits may be lost in future updates. provider "registry.terraform.io/cloudflare/cloudflare" { - version = "4.49.1" + version = "4.52.0" constraints = "~> 4.0" hashes = [ - "h1:z4oKPWJNl2HKC+RMASmezyNnRY5+a6G4/mKcOpNBZIg=", - "zh:0b8b0d1e843e30538e62855b7c4b8d6a31b19213c238b5f92bfd88ef6c0e78f0", - "zh:485799332114da08e683f2b7ebf0d25f73d2f1542ebe30ef33fe66902b700120", - "zh:486a07fd96dabda4a3ae2a4314a27dc49a6eee5220fc92ecfd2e68821a0e5109", - "zh:5d8b76c8bbc99c5b1197c61ad32ae140b13d5785d5ff0297fc052d35f61eeea9", - "zh:66c75f38c6ec63c237dbd81e251c97f5c14e18191f20a45f23fbaa6409763c17", - "zh:792bcc98fddf3d65608a7a1977d4713bbcc2b3e70082d5c17f5511b50abcc2b9", + "h1:NTaOQfYINA0YTG/V1/9+SYtgX1it63+cBugj4WK4FWc=", + "zh:19be1a91c982b902c42aba47766860dfa5dc151eed1e95fd39ca642229381ef0", + "zh:1de451c4d1ecf7efbe67b6dace3426ba810711afdd644b0f1b870364c8ae91f8", + "zh:352b4a2120173298622e669258744554339d959ac3a95607b117a48ee4a83238", + "zh:3c6f1346d9154afbd2d558fabb4b0150fc8d559aa961254144fe1bc17fe6032f", + "zh:4c4c92d53fb535b1e0eff26f222bbd627b97d3b4c891ec9c321268676d06152f", + "zh:53276f68006c9ceb7cdb10a6ccf91a5c1eadd1407a28edb5741e84e88d7e29e8", + "zh:7925a97773948171a63d4f65bb81ee92fd6d07a447e36012977313293a5435c9", + "zh:7dfb0a4496cfe032437386d0a2cd9229a1956e9c30bd920923c141b0f0440060", "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f", - "zh:97e5dc2a26a786e7b91a4a57268c3fb00ecbf454762f0a4f4dd7f06059bbe391", - "zh:9ce3abaf4f92454ed1270f3797fd5293f234076e932d7120835f64c6c47f3d27", - "zh:9face526228efc7e80919293b5f7a6a7e2970269fd73368b34276ccf4f6b7a34", - "zh:caefbbdfbe506e72fb8f5db2c8cb84708a6758d787292ba64d396738954fb83a", - "zh:d0eac35becf8b05a5f9435702bcb6659a91d4ce45597d56b69ac7102491f722b", - "zh:dba8e44ec593123d993c8dc1a179128d398a0302c2dbab1f7c427b5eb0f69151", - "zh:dcc09dcc54879251c32562e1251b85cdcec3970257a00721915af80a236aa209", - "zh:e010fe2fd67d96e19b022333c90df7113878f059e020b15eff73c0fa0916cfcd", + "zh:8d4aa79f0a414bb4163d771063c70cd991c8fac6c766e685bac2ee12903c5bd6", + "zh:a67540c13565616a7e7e51ee9366e88b0dc60046e1d75c72680e150bd02725bb", + "zh:a936383a4767f5393f38f622e92bf2d0c03fe04b69c284951f27345766c7b31b", + "zh:d4887d73c466ff036eecf50ad6404ba38fd82ea4855296b1846d244b0f13c380", + "zh:e9093c8bd5b6cd99c81666e315197791781b8f93afa14fc2e0f732d1bb2a44b7", + "zh:efd3b3f1ec59a37f635aa1d4efcf178734c2fcf8ddb0d56ea690bec342da8672", ] } provider "registry.terraform.io/hashicorp/aws" { - version = "5.82.2" - constraints = ">= 4.40.0, ~> 5.0, >= 5.37.0, >= 5.70.0, >= 5.75.1, >= 5.79.0" + version = "5.88.0" + constraints = ">= 3.74.0, >= 4.22.0, >= 4.40.0, ~> 5.0, >= 5.37.0, >= 5.72.1, >= 5.75.1, >= 5.79.0, >= 5.83.0" hashes = [ - "h1:RuPaHbllUB8a2TGTyc149wJfoh6zhIEjUvFYKR6iP2E=", - "zh:0262fc96012fb7e173e1b7beadd46dfc25b1dc7eaef95b90e936fc454724f1c8", - "zh:397413613d27f4f54d16efcbf4f0a43c059bd8d827fe34287522ae182a992f9b", - "zh:436c0c5d56e1da4f0a4c13129e12a0b519d12ab116aed52029b183f9806866f3", - "zh:4d942d173a2553d8d532a333a0482a090f4e82a2238acf135578f163b6e68470", - "zh:624aebc549bfbce06cc2ecfd8631932eb874ac7c10eb8466ce5b9a2fbdfdc724", + "h1:PXaP+z5Z9pcUUcJqS6ea09wR/cscBq1F9jRsNqe39rM=", + "zh:24f852b1cca276d91f950cb7fb575cacc385f55edccf4beec1f611cdd7626cf5", + "zh:2a3b3f5ac513f8d6448a31d9619f8a96e0597dd354459de3a4698e684c909f96", + "zh:3700499885a8e0e532eccba3cb068340e411cf9e616bf8a59e815d3b62ca3e46", + "zh:4aab3605468244a74cbde66784ea1d30dc0fc6caf26d1b099427ecd5790f7c4d", + "zh:74eca9314d6dd80b215d7bc1c4be37d81e1045d625d5b512995f3a352d7a43bc", + "zh:77d9a06c63a4ad615bc97f67f948250397267f15698ebb2547fbdd20f734983c", + "zh:82d6aaef1eb0caf9ca451887fdbdcff10ab09318b1d60faa883a013283ab2b15", + "zh:8dbcfb121b887ce8572f5ab8174d592a729390ca32dc5fdacac4c7c1c508411a", + "zh:95d51e80b55ff9064f5c1bc61d78f992e2f89c986ba2b10546ea4461d35c24f9", "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:9e632dee2dfdf01b371cca7854b1ec63ceefa75790e619b0642b34d5514c6733", - "zh:a07567acb115b60a3df8f6048d12735b9b3bcf85ec92a62f77852e13d5a3c096", - "zh:ab7002df1a1be6432ac0eb1b9f6f0dd3db90973cd5b1b0b33d2dae54553dfbd7", - "zh:bc1ff65e2016b018b3e84db7249b2cd0433cb5c81dc81f9f6158f2197d6b9fde", - "zh:bcad84b1d767f87af6e1ba3dc97fdb8f2ad5de9224f192f1412b09aba798c0a8", - "zh:cf917dceaa0f9d55d9ff181b5dcc4d1e10af21b6671811b315ae2a6eda866a2a", - "zh:d8e90ecfb3216f3cc13ccde5a16da64307abb6e22453aed2ac3067bbf689313b", - "zh:d9054e0e40705df729682ad34c20db8695d57f182c65963abd151c6aba1ab0d3", - "zh:ecf3a4f3c57eb7e89f71b8559e2a71e4cdf94eea0118ec4f2cb37e4f4d71a069", + "zh:9ead5de0e123020926a0edaf88d9eed5cb86afe438a875528f6d11d0d27eed73", + "zh:ab7c940cbb2081314f4af3cdd61ed2c1d59fd7a60fa3db27770887d63072fbdd", + "zh:d52cd68006fd6fa8d028cdf569a6620fbc31726019beb7c75affa8764622d398", + "zh:f179ca86ad5d5fb88dfd8e8e7c448f2c0ad550d22152f939b8465baeaf9289e9", + "zh:f54dda271fa6dfee06537066278669a3f92c872e7dfa5a0184cd9117f7e47b8c", ] } @@ -109,7 +109,7 @@ provider "registry.terraform.io/hashicorp/null" { provider "registry.terraform.io/kreuzwerker/docker" { version = "3.0.2" - constraints = ">= 3.0.0" + constraints = ">= 3.0.0, ~> 3.0" hashes = [ "h1:cT2ccWOtlfKYBUE60/v2/4Q6Stk1KYTNnhxSck+VPlU=", "zh:15b0a2b2b563d8d40f62f83057d91acb02cd0096f207488d8b4298a59203d64f", From 0589573a58d9004477d63b85f74e7be616b19312 Mon Sep 17 00:00:00 2001 From: Schuyler Fenton Date: Wed, 26 Feb 2025 09:20:02 +0000 Subject: [PATCH 6/9] Refactor api_address to use strings vs. object --- terraform/api.tf | 2 +- terraform/dns.tf | 6 +++--- terraform/variables.tf | 18 +++++++++++++----- 3 files changed, 17 insertions(+), 9 deletions(-) diff --git a/terraform/api.tf b/terraform/api.tf index 6183f7c..218d5a6 100644 --- a/terraform/api.tf +++ b/terraform/api.tf @@ -1,5 +1,5 @@ locals { - fqdn = "${var.api_address.subdomain}.${var.api_address.domain}" + fqdn = "${var.api_address_subdomain}.${var.api_address_domain}" } module "api_gateway" { diff --git a/terraform/dns.tf b/terraform/dns.tf index e7ebbec..e509a2b 100644 --- a/terraform/dns.tf +++ b/terraform/dns.tf @@ -4,17 +4,17 @@ provider "cloudflare" { data "cloudflare_zones" "skyfenton_com" { filter { - name = var.api_address.domain + name = var.api_address_domain } } # create a DNS record for the API gateway resource "cloudflare_record" "api_gateway_record" { zone_id = data.cloudflare_zones.skyfenton_com.zones[0].id - name = var.api_address.subdomain + name = var.api_address_subdomain content = module.api_gateway.domain_name_target_domain_name type = "CNAME" proxied = true comment = "CNAME record for the Waller API gateway; Terraform" -} \ No newline at end of file +} diff --git a/terraform/variables.tf b/terraform/variables.tf index 5587437..d97b735 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -14,11 +14,19 @@ variable "cloudflare_api_token" { type = string } -variable "api_address" { - type = object({ - subdomain = string - domain = string - }) +# variable "api_address" { +# type = object({ +# subdomain = string +# domain = string +# }) +# } + +variable "api_address_subdomain" { + type = string +} + +variable "api_address_domain" { + type = string } variable "domain_cert_arn" { From 65378563491c7bbcff4ea647b878c2416a147a65 Mon Sep 17 00:00:00 2001 From: Schuyler Fenton Date: Wed, 26 Feb 2025 09:20:21 +0000 Subject: [PATCH 7/9] Use production environment in CD job --- .github/workflows/terraform-plan.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml index 484bfca..83c1c71 100644 --- a/.github/workflows/terraform-plan.yml +++ b/.github/workflows/terraform-plan.yml @@ -12,6 +12,7 @@ permissions: jobs: plan: runs-on: ubuntu-latest + environment: production name: Create a plan for a terraform configuration (and comment on PR for review) env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -21,5 +22,9 @@ jobs: - name: terraform plan uses: dflook/terraform-plan@v1 + env: + TF_VAR_aws_secret_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + TF_VAR_cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }} with: - path: terraform \ No newline at end of file + path: terraform + \ No newline at end of file From e6f1e7b9055238da30b124638c7c41c68492e989 Mon Sep 17 00:00:00 2001 From: Schuyler Fenton Date: Wed, 26 Feb 2025 09:37:52 +0000 Subject: [PATCH 8/9] Try extracting all variables and secrets with step --- .github/workflows/terraform-plan.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml index 83c1c71..dfadae1 100644 --- a/.github/workflows/terraform-plan.yml +++ b/.github/workflows/terraform-plan.yml @@ -20,6 +20,15 @@ jobs: - name: Checkout uses: actions/checkout@v4 + - name: Setup environment variables + run: | + echo "$ALLMYSECRETS" + echo "$ALLMYVARS" + shell: bash + env: + ALLMYSECRETS: ${{ toJSON(secrets) }} + ALLMYVARS: ${{ toJSON(vars) }} + - name: terraform plan uses: dflook/terraform-plan@v1 env: From 34dfc8d7ef2aa1add0fab2c156861691f58e1cc5 Mon Sep 17 00:00:00 2001 From: Schuyler Fenton Date: Wed, 26 Feb 2025 09:46:58 +0000 Subject: [PATCH 9/9] Force add all vars --- .github/workflows/terraform-plan.yml | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml index dfadae1..99c5990 100644 --- a/.github/workflows/terraform-plan.yml +++ b/.github/workflows/terraform-plan.yml @@ -20,20 +20,23 @@ jobs: - name: Checkout uses: actions/checkout@v4 - - name: Setup environment variables - run: | - echo "$ALLMYSECRETS" - echo "$ALLMYVARS" - shell: bash - env: - ALLMYSECRETS: ${{ toJSON(secrets) }} - ALLMYVARS: ${{ toJSON(vars) }} + # - name: Setup environment variables + # run: | + # echo "$ALLMYVARS" + # shell: bash + # env: + # ALLMYVARS: ${{ toJSON(vars) }} - name: terraform plan uses: dflook/terraform-plan@v1 env: TF_VAR_aws_secret_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} TF_VAR_cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }} + TF_VAR_api_address_domain: ${{ vars.API_ADDRESS_DOMAIN }} + TF_VAR_api_address_subdomain: ${{ vars.API_ADDRESS_SUBDOMAIN }} + TF_VAR_aws_region: ${{ vars.AWS_REGION }} + TF_VAR_aws_access_key: ${{ vars.AWS_ACCESS_KEY_ID }} + TF_VAR_domain_cert_arn: ${{ vars.DOMAIN_CERT_ARN }} with: path: terraform \ No newline at end of file