deps(terraform): upgrade providers, modules & pinned tool versions

platform/terraform/core_services/main.tf

@@ -4,16 +4,20 @@ terraform {
 
   required_providers {
     harbor = {
-      source = "goharbor/harbor"
+      source  = "goharbor/harbor"
+      version = "~> 3.0"
     }
     sonarqube = {
-      source = "jdamata/sonarqube"
+      source  = "jdamata/sonarqube"
+      version = "~> 0.16"
     }
     restapi = {
-      source = "Mastercard/restapi"
+      source  = "Mastercard/restapi"
+      version = "~> 3.0"
     }
     vault = {
-      source = "hashicorp/vault"
+      source  = "hashicorp/vault"
+      version = "~> 5.0"
     }
   }
 }

platform/terraform/modules/cloud_aws/eks.tf

@@ -2,7 +2,7 @@
 
 module "eks" {
   source                         = "terraform-aws-modules/eks/aws"
-  version                        = "~>19.16.0"
+  version                        = "~> 20.37"
   cluster_name                   = local.name
   cluster_version                = local.cluster_version
   cluster_endpoint_public_access = true
@@ -51,8 +51,12 @@ module "eks" {
   subnet_ids               = module.vpc.private_subnets
   control_plane_subnet_ids = module.vpc.intra_subnets
 
-  create_aws_auth_configmap       = (local.node_group_type == "SELF") ? true : false
-  manage_aws_auth_configmap       = (local.node_group_type == "SELF") ? true : false
+  # EKS module v20 replaced the in-module aws-auth ConfigMap management with EKS
+  # Access Entries. API_AND_CONFIG_MAP keeps the ConfigMap honored for backward
+  # compatibility (and for SELF-managed node registration, which must now be done
+  # via the dedicated terraform-aws-modules/eks/aws//modules/aws-auth submodule).
+  authentication_mode                      = "API_AND_CONFIG_MAP"
+  enable_cluster_creator_admin_permissions = true
 
   create_node_security_group      = false
   eks_managed_node_group_defaults = {

platform/terraform/modules/cloud_aws/versions.tf

@@ -4,11 +4,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 4.47, < 6.0"
+      version = ">= 5.0, < 6.0"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = ">= 2.10"
+      version = ">= 2.20, < 4.0"
     }
   }
 }

platform/terraform/modules/cloud_aws/vpc.tf

@@ -1,6 +1,6 @@
 module "vpc" {
   source  = "terraform-aws-modules/vpc/aws"
-  version = "~> 5.0"
+  version = "~> 5.21"
 
   name = "${local.name}-vpc"
   cidr = local.vpc_cidr

platform/terraform/modules/cloud_azure/aks.tf

@@ -34,9 +34,9 @@ resource "azurerm_kubernetes_cluster" "aks_cluster" {
     vnet_subnet_id         = azurerm_subnet.private_subnet.id
     zones                  = local.azs
     node_labels            = var.cluster_node_labels
-    enable_auto_scaling    = local.enable_native_auto_scaling
-    enable_host_encryption = false
-    enable_node_public_ip  = false
+    auto_scaling_enabled   = local.enable_native_auto_scaling
+    host_encryption_enabled = false
+    node_public_ip_enabled = false
     node_count             = local.default_node_group.desired_size
     min_count              = local.enable_native_auto_scaling ? local.default_node_group.min_size : null
     max_count              = local.enable_native_auto_scaling ? local.default_node_group.max_size : null
@@ -73,7 +73,6 @@ resource "azurerm_kubernetes_cluster" "aks_cluster" {
   }
 
   azure_active_directory_role_based_access_control {
-    managed            = true
     tenant_id          = data.azurerm_client_config.current.tenant_id
     azure_rbac_enabled = true
   }
@@ -111,7 +110,7 @@ resource "azurerm_kubernetes_cluster_node_pool" "node_pool" {
   node_taints           = each.value.gpu_enabled == true ? ["group-type=gpu-enabled:NoSchedule"] : []
   orchestrator_version  = var.cluster_version
   tags                  = local.tags
-  enable_node_public_ip = false
+  node_public_ip_enabled = false
   max_pods              = local.max_pods
   priority              = each.value.capacity_type
 

platform/terraform/modules/cloud_azure/key_vault.tf

@@ -10,7 +10,7 @@ resource "azurerm_key_vault" "key_vault" {
   enabled_for_deployment          = false
   enabled_for_disk_encryption     = true
   enabled_for_template_deployment = false
-  enable_rbac_authorization       = true
+  rbac_authorization_enabled      = true
   purge_protection_enabled        = true
   public_network_access_enabled   = true
 

platform/terraform/modules/cloud_azure/main.tf

@@ -2,11 +2,11 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~>3.86"
+      version = "~> 4.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~>3.5.1"
+      version = "~> 3.9"
     }
   }
 }

platform/terraform/modules/cloud_azure/network.tf

@@ -17,7 +17,7 @@ resource "azurerm_subnet" "public_subnet" {
   resource_group_name                           = azurerm_resource_group.rg.name
   virtual_network_name                          = azurerm_virtual_network.vnet.name
   address_prefixes                              = [cidrsubnet(var.cluster_network_cidr, 4, 0)]
-  private_endpoint_network_policies_enabled     = false
+  private_endpoint_network_policies             = "Disabled"
   private_link_service_network_policies_enabled = true
 }
 
@@ -26,7 +26,7 @@ resource "azurerm_subnet" "private_subnet" {
   resource_group_name                           = azurerm_resource_group.rg.name
   virtual_network_name                          = azurerm_virtual_network.vnet.name
   address_prefixes                              = [cidrsubnet(var.cluster_network_cidr, 4, 1)]
-  private_endpoint_network_policies_enabled     = false
+  private_endpoint_network_policies             = "Disabled"
   private_link_service_network_policies_enabled = true
   service_endpoints                             = ["Microsoft.KeyVault", "Microsoft.Storage"]
 }
@@ -36,7 +36,7 @@ resource "azurerm_subnet" "internal_subnet" {
   resource_group_name                           = azurerm_resource_group.rg.name
   virtual_network_name                          = azurerm_virtual_network.vnet.name
   address_prefixes                              = [cidrsubnet(var.cluster_network_cidr, 4, 2)]
-  private_endpoint_network_policies_enabled     = false
+  private_endpoint_network_policies             = "Disabled"
   private_link_service_network_policies_enabled = true
 }
 

platform/terraform/modules/cloud_gcp/main.tf

@@ -2,11 +2,11 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = "~> 5.45.0"
+      version = "~> 6.0"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.5.1"
+      version = "~> 3.9"
     }
   }
 }

platform/terraform/modules/vcs_gitlab/repository/main.tf

@@ -19,7 +19,7 @@ resource "gitlab_project" "repo" {
   visibility_level                 = var.visibility
   initialize_with_readme           = var.auto_init
   archive_on_destroy               = var.archive_on_destroy
-  issues_enabled                   = var.has_issues
+  issues_access_level              = var.has_issues ? "enabled" : "disabled"
   remove_source_branch_after_merge = var.delete_branch_on_merge
   namespace_id                     = var.vcs_owner
   # disable shared runners and force usage of group runners provided by the platform
@@ -45,14 +45,12 @@ resource "gitlab_branch_protection" "this" {
   branch           = var.default_branch_name
   allow_force_push = false
 
-  dynamic "allowed_to_push" {
-    for_each = var.vcs_subscription_plan && var.allow_push_to_protected ? [1] : []
-
-    content {
+  # gitlab provider v17+ exposes allowed_to_push as a list attribute instead of a nested block
+  allowed_to_push = var.vcs_subscription_plan && var.allow_push_to_protected ? [
+    {
       user_id = data.gitlab_current_user.current.id
     }
-
-  }
+  ] : []
 }
 
 output "repo_name" {

platform/terraform/secrets/main.tf

@@ -4,7 +4,8 @@ terraform {
 
   required_providers {
     vault = {
-      source = "hashicorp/vault"
+      source  = "hashicorp/vault"
+      version = "~> 5.0"
     }
   }
 }

tools/cli/common/const/const.py

@@ -11,10 +11,10 @@
 PLATFORM_USER_NAME = "cgdevx-bot"
 FALLBACK_AUTHOR_EMAIL = "cg-devx-automation@cloudgeometry.io"
 ARGOCD_REGISTRY_APP_PATH = "gitops-pipelines/delivery/clusters/cc-cluster/core-services"
-KUBECTL_VERSION = "1.33.1"
-TERRAFORM_VERSION = "1.6.4"
-GITLAB_TF_REQUIRED_PROVIDER_VERSION = "18.2.0"
-GITHUB_TF_REQUIRED_PROVIDER_VERSION = "5.42.0"
+KUBECTL_VERSION = "1.33.13"
+TERRAFORM_VERSION = "1.15.6"
+GITLAB_TF_REQUIRED_PROVIDER_VERSION = "19.1.0"
+GITHUB_TF_REQUIRED_PROVIDER_VERSION = "6.0"
 WL_REPOSITORY_URL = "https://github.com/CloudGeometry/cg-devx-wl-template.git"
 WL_REPOSITORY_BRANCH = "main"
 WL_PR_BRANCH_NAME_PREFIX = "feature/"