43 Commits

Author SHA1 Message Date
dandds
058ee57527 Create database with separate script.
Creating the ATAT database requires a separate connection to one of the
default Postgres databases, like `postgres`. This updates the scripts
and secrets-tool command to handle creating the database. It also
removes database creation from Terraform and updates the documentation.
2020-01-27 13:17:09 -05:00
Rob Gil
daa07f8631 Removes unnecessary locals in the bucket module 2020-01-23 20:26:27 -05:00
Rob Gil
e0d59eb166 Finally fixes subnet list output
This finally fixes the output coming from the vpc module so that it
returns a full list of subnets. Now they can be referenced just like the
redis module is using in this commit.
2020-01-23 20:22:53 -05:00
Rob Gil
3f5bbf2c5e Cleans out comments 2020-01-23 19:58:06 -05:00
Rob Gil
0f5f5bd926 Converts redis to use service_endpoints
This is still a WIP.
2020-01-23 19:16:00 -05:00
Rob Gil
38ce1ef2b2 Adds list of users for access to storage and more service endpoints
This sets up the rest of the service endpoints on the subnets. It also
adds a variable map specifically to grant IP access to the storage
buckets. This new variable map is necessary since the azure storage ip
rules do not accept /32 CIDR ranges. The rest of the services do support
cidr ranges.
2020-01-23 18:41:29 -05:00
Rob Gil
536eccdb90 Container registry private networking and bucket cidr range fix 2020-01-23 13:13:56 -05:00
Rob Gil
dab6cdb7dc Locks down keyvaults to subnets and administrator ip addresses 2020-01-23 11:02:12 -05:00
Rob Gil
c31d68a18c Makes client vpn cidr range configurable 2020-01-23 10:50:16 -05:00
Rob Gil
48482785ac Adds IP whitelisting to storage buckets 2020-01-23 10:02:31 -05:00
Rob Gil
635ccb0fd3 Fixes postgres character collation 2020-01-22 19:36:33 -05:00
Rob Gil
01703b1488 Configures storage buckets to be optionally exposed via service endpoints 2020-01-22 19:35:54 -05:00
Rob Gil
9042a960bb Adds configurable service endpoints to subnets in the vpc module 2020-01-22 19:35:19 -05:00
dandds
83de5d38d9 Terraform initial database.
This addes TF config for creating the initial database for the selected
ATAT environment. The datatase name format is [environment]-atat.
2020-01-21 19:52:09 -05:00
dandds
9f2bdd4a9f Updated dev environment for JEDI.
- Updated environment name.
- Updated variables.
- AKS service principal creds moved to the operator Key Vault.
2020-01-21 10:08:27 -05:00
Rob Gil
4eded23051 Adds keyvault outputs 2020-01-20 14:04:51 -05:00
Rob Gil
9c429e35da 170237669 - Converts postgres secrets to use keyvault
This changes the configuration of the postgres master username and
password. Instead of committing to source (short term hack), this now
sources those secrets from KeyVault. Those secrets are generated and
populated via secrets-tool.
2020-01-17 13:30:00 -05:00
Rob Gil
7aaad51f81 170268346 - Enables access for admins to manage certificates in keyvault
Grants access to the admins to manage certificates in keyvault
2020-01-17 09:28:42 -05:00
Rob Gil
deead852b5 169163334 - Initial secrets-tool commit
Adds admin_users map and keyvault policy

This adds an admin_users map as well as a new policy in the keyvault
module. When run, this will apply an administrator policy for users in
the admin_users map. With these permissions, the admin users will be
able to manage secrets and keys in keyvault.

169163334 - Initial secrets-tool commit

Adds admin_users map and keyvault policy

This adds an admin_users map as well as a new policy in the keyvault
module. When run, this will apply an administrator policy for users in
the admin_users map. With these permissions, the admin users will be
able to manage secrets and keys in keyvault.

170237669 - Makes the read only policy for keyvault optional and only create the policy if a principal_id is passed

170237669 - Adds new operator keyvault for secrets

This is a new keyvault specifically for storing operator secrets and
things that would not be accessible to applications. The primary use
case for this is for launching things like postgres (root postgres
creds) and other services which would require secrets to be added to the
terraform configuration. This approach avoids adding secrets to
terraform.

An accompanying script will be added to populate the new keyvault.
2020-01-16 17:27:49 -05:00
Rob Gil
53cf42103e Fix resource names for module.vpc 2020-01-13 10:29:12 -05:00
Rob Gil
623368b8dd 169163334 - Switches to SystemAssigned managed identity
The SystemAssigned managed identity requires a preview feature to be
enabled.

```
rgil@rem5:~/atst/terraform/providers/dev$ az feature list|grep MSIPreview
    "id": "/subscriptions/95934d54-980d-47cc-9bce-3a96bf9a2d1b/providers/Microsoft.Features/providers/Microsoft.ContainerService/features/MSIPreview",
    "name": "Microsoft.ContainerService/MSIPreview",
rgil@rem5:~/atst/terraform/providers/dev$ az feature register --namespace Microsoft.ContainerService --name MSIPreview
Once the feature 'MSIPreview' is registered, invoking 'az provider register -n Microsoft.ContainerService' is required to get the change propagated
{
  "id": "/subscriptions/95934d54-980d-47cc-9bce-3a96bf9a2d1b/providers/Microsoft.Features/providers/Microsoft.ContainerService/features/MSIPreview",
  "name": "Microsoft.ContainerService/MSIPreview",
  "properties": {
    "state": "Registering"
  },
  "type": "Microsoft.Features/providers/features"
}
rgil@rem5:~/atst/terraform/providers/dev$ az provider register -n Microsoft.ContainerService
rgil@rem5:~/atst/terraform/providers/dev$
```

This also now integrates the policy for keyvault with the k8s managed
identity (system assigned).
2020-01-13 10:29:12 -05:00
Rob Gil
11404a6e5b Adds IAM roles for the Managed Identity Module
This adds the ability to pass in a list of roles to be assigned to the
managed identity user.
2020-01-07 14:00:27 -05:00
Rob Gil
a5ea2e3757 Testing k8s config 2020-01-06 18:21:48 -05:00
Rob Gil
0b7ff0679a 170237476 - Autoscaling fix
Specifying the node count breaks the autoscaling min/max. When this
happens, the k8s cluster needs to be manually reconfigured. Terraform
does not remove the node count even when the node count option is
removed. The k8s cluster resource needed to be destroyed and re-created
in order to resolve the issue with node count and min/max options being
specified at the same time.
2019-12-30 12:57:57 -05:00
Rob Gil
62a02234a4 169163334 - Adds TF bucket module
Basic bucket module to create a bucket
2019-12-26 13:28:31 -05:00
Rob Gil
5eeb5f976a 169163334 - Adds autoscaling to k8s
This adds node autoscaling the k8s. Pod autoscaling needs to be
configured in the kubectl config.
2019-12-26 09:10:48 -05:00
Jay R. Newlin (PromptWorks)
1a89f73ca2
Merge branch 'staging' into 169163334-dns-fix 2019-12-24 13:40:13 -05:00
Rob Gil
b98bc5953f 169163334 - Adds public ips to k8s nodes for internet access
Temporary fix. This should be replaced with a NAT GW (which I need MSFT
to enable or fix the registry registration)
2019-12-23 18:39:55 -05:00
Rob Gil
ec5c3e0ce0 169163334 - Adds more configuration elements per call with Dan
This adds the start of the identity module but also cleans up a bunch of
things like the LBs. Originally I was managing the LBs, but k8s manages
this for us so I disabled the LBs for now.
2019-12-20 15:10:57 -05:00
dandds
7dbdeb3ae7
Merge pull request #1270 from robgil-dds/169163334-ssl-vpn
169163334 - Adds Virtual Network Gateway for VPN
2019-12-20 10:22:27 -05:00
Rob Gil
866b789b6c 169163334 - Adds Virtual Network Gateway for VPN
The Virtual Network Gateway is required for OpenVPN connectivity. The
change to the VPC module also adds a subnet which is exclusively used
for the Gateway.
2019-12-19 22:33:27 -05:00
Rob Gil
74b2510730 169163334 - Adds Azure Container Registry
Adds the ACR. Georeplication disabled for the moment until we add the DR
site.
2019-12-19 20:12:20 -05:00
dandds
f10ae654c3
Merge pull request #1267 from robgil-dds/169163334-lb
169163334 - Adds LB module
2019-12-19 09:40:13 -05:00
Rob Gil
7aeda9377e 169163334 - Adds LB module 2019-12-18 20:55:58 -05:00
Rob Gil
0925c73c68 Terraform fmt across new modules 2019-12-18 18:47:02 -05:00
Rob Gil
6d64665474 169163334 - Adds CDN module
Basic CDN module with configurable origin.
2019-12-18 18:45:25 -05:00
Rob Gil
83690ccf1a 169163334 - Adds redis module
Adds basic redis module.
2019-12-18 15:14:22 -05:00
dandds
1eef40a1cf
Merge pull request #1253 from robgil-dds/169163334-keyvault
169163334 - Enables KeyVault server in dev TF env
2019-12-16 09:23:18 -05:00
Rob Gil
3b05f9b830 Adds rgil to keyvault access policy 2019-12-16 09:20:40 -05:00
Rob Gil
fd6bf723db 169163334 - Enables KeyVault server in dev TF env
This keyvault server will be used for db, redis, ad, k8s, and app
secrets for this environment.
2019-12-16 09:20:40 -05:00
Rob Gil
b11dc849f3 169163334 - Adds more variables to postgres TF module 2019-12-16 09:19:28 -05:00
Rob Gil
f104803b6d 169163334 - Adds postgres module and configures dev to run pg
Adds the postgres module and configures it in the development
environment.
2019-12-16 09:19:28 -05:00
Rob Gil
955a1c483b 169163334 - Initial VPC TF and structure
169163334 - Make supernet configurable

169163334 - Makes DNS servers configurable

169163334 - Adds bucket for state storage

169163334 - Adds k8s, keyvault, azuread provider

169163334 - Adds route tables

169163334 - Adds route table associations

169163334 - Adds default routes to route tables and fixes route table association flapping
2019-12-16 09:12:24 -05:00