Maintenance and fixes (#163)

* Initial maintenance and fixes

Bump version of nginx ingress controller, cluster autoscaler, cert manager
Change helm repo of cluster autoscaler, cert manager
Move db-ops file into templates/scripts/ because we need to hook into the actual steps of the apply

* Moved execution of db scripts into templated makefile, some small fixes

* Fixes to annotations and config for upgraded charts

* Update metrics-server to new chart

Author: bmonkman

Makefile

@@ -1,37 +1,12 @@
 SHELL := /bin/bash
-CREATE_DB_USERS := $(shell kubectl -n ${PROJECT_NAME} get secrets ${PROJECT_NAME} > /dev/null 2>&1; echo $$?)
 
-run: make-apply create-application-user create-auth-user
+.EXPORT_ALL_VARIABLES:
+
+run: make-apply
 
 make-apply:
 	cd $(PROJECT_DIR) && AUTO_APPROVE="-auto-approve" make
 
-create-application-user:
-	[[ "${CREATE_DB_USERS}" != "0" ]] && \
-	REGION=${region} \
-	SEED=${randomSeed} \
-	PROJECT_NAME=${PROJECT_NAME} \
-	ENVIRONMENT=${ENVIRONMENT} \
-	NAMESPACE=${PROJECT_NAME} \
-	DATABASE_TYPE=${database} \
-	DATABASE_NAME=${PROJECT_NAME} \
-	USER_NAME=${PROJECT_NAME} \
-	CREATE_SECRET=secret-application.yml.tpl \
-	sh ./db-ops/create-db-user.sh || echo
-
-create-auth-user:
-	[[ "${CREATE_DB_USERS}" != "0" && "${userAuth}" == "yes" ]] && \
-	REGION=${region} \
-	SEED=${randomSeed} \
-	PROJECT_NAME=${PROJECT_NAME} \
-	ENVIRONMENT=${ENVIRONMENT} \
-	NAMESPACE=user-auth \
-	DATABASE_TYPE=${database} \
-	DATABASE_NAME=user_auth \
-	USER_NAME=kratos \
-	CREATE_SECRET=secret-user-auth.yml.tpl \
-	sh ./db-ops/create-db-user.sh || echo
-
 summary:
 	@echo "zero-aws-eks-stack:"
 	@echo "- Repository URL: ${REPOSITORY}"

templates/kubernetes/terraform/modules/kubernetes/cert_manager.tf

@@ -1,5 +1,5 @@
 locals {
-  cert_manager_version     = "0.14.2"
+  cert_manager_version     = "1.0.4"
   cluster_issuer_name      = var.cert_manager_use_production_acme_environment ? "clusterissuer-letsencrypt-production" : "clusterissuer-letsencrypt-staging"
   cert_manager_acme_server = var.cert_manager_use_production_acme_environment ? "https://acme-v02.api.letsencrypt.org/directory" : "https://acme-staging-v02.api.letsencrypt.org/directory"
 }
@@ -15,25 +15,27 @@ data "aws_route53_zone" "public" {
   name = var.external_dns_zone
 }
 
-# Cert-manager CRD manifest
-# https://github.com/jetstack/cert-manager/releases/download/v0.14.2/cert-manager.crds.yaml
-data "local_file" "cert_manager" {
-  filename = "${path.module}/files/cert-manager.crds.yaml"
-}
+resource "helm_release" "cert_manager" {
+  name       = "cert-manager"
+  repository = "https://charts.jetstack.io"
+  chart      = "cert-manager"
+  version    = local.cert_manager_version
+  namespace  = kubernetes_namespace.cert_manager.metadata[0].name
 
-# Install the cert manager Custom Resource Definitions (this can't be done via helm/terraform)
-resource "null_resource" "cert_manager" {
-  triggers = {
-    manifest_sha1 = sha1(data.local_file.cert_manager.content)
+  set {
+    name  = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
+    value = module.iam_assumable_role_cert_manager.this_iam_role_arn
   }
-  # local exec call requires kubeconfig to be updated
-  provisioner "local-exec" {
-    command = "kubectl apply --validate=false -f ${path.module}/files/cert-manager.crds.yaml"
+  set {
+    name  = "securityContext.fsGroup"
+    value = "1001"
+  }
+  set {
+    name  = "installCRDs"
+    value = true
   }
-  depends_on = [kubernetes_namespace.cert_manager]
 }
 
-
 # Cert-manager issuer manifest
 data "template_file" "cert_manager_issuer" {
   template = file("${path.module}/files/cert_manager_issuer.yaml.tpl")
@@ -57,33 +59,9 @@ resource "null_resource" "cert_manager_issuer" {
   provisioner "local-exec" {
     command = "kubectl apply -f - <<EOF\n${data.template_file.cert_manager_issuer.rendered}\nEOF"
   }
-  depends_on = [null_resource.cert_manager]
-}
-
-resource "helm_release" "cert_manager" {
-  name       = "cert-manager"
-  repository = "https://charts.jetstack.io"
-  chart      = "cert-manager"
-  version    = local.cert_manager_version
-  namespace  = kubernetes_namespace.cert_manager.metadata[0].name
-
-  set {
-    type  = "string"
-    name  = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
-    value = module.iam_assumable_role_cert_manager.this_iam_role_arn
-  }
-  set {
-    type  = "string"
-    name  = "podAnnotations.eks\\.amazonaws\\.com/role-arn"
-    value = module.iam_assumable_role_cert_manager.this_iam_role_arn
-  }
-  set {
-    name  = "securityContext.fsGroup"
-    value = "1001"
-  }
+  depends_on = [helm_release.cert_manager]
 }
 
-
 # Create a role using oidc to map service accounts
 module "iam_assumable_role_cert_manager" {
   source                        = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"

templates/kubernetes/terraform/modules/kubernetes/cluster_autoscaler.tf

@@ -5,8 +5,9 @@ locals {
 
 resource "helm_release" "cluster_autoscaler" {
   name       = "cluster-autoscaler"
-  repository = "https://kubernetes-charts.storage.googleapis.com"
-  chart      = "cluster-autoscaler"
+  repository = "https://kubernetes.github.io/autoscaler"
+  chart      = "cluster-autoscaler-chart"
+  version    = "1.1.1"
   namespace  = local.cluster_autoscaler_namespace
 
   set {
@@ -19,7 +20,7 @@ resource "helm_release" "cluster_autoscaler" {
   }
   set {
     type  = "string"
-    name  = "rbac.serviceAccountAnnotations.eks\\.amazonaws\\.com/role-arn"
+    name  = "rbac.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
     value = module.iam_assumable_role_cluster_autoscaler.this_iam_role_arn
   }
   set {
@@ -41,7 +42,7 @@ module "iam_assumable_role_cluster_autoscaler" {
   role_name                     = "${var.project}-k8s-${var.environment}-cluster-autoscaler"
   provider_url                  = replace(data.aws_eks_cluster.cluster.identity.0.oidc.0.issuer, "https://", "")
   role_policy_arns              = [aws_iam_policy.cluster_autoscaler.arn]
-  oidc_fully_qualified_subjects = ["system:serviceaccount:${local.cluster_autoscaler_namespace}:cluster-autoscaler-aws-cluster-autoscaler"]
+  oidc_fully_qualified_subjects = ["system:serviceaccount:${local.cluster_autoscaler_namespace}:cluster-autoscaler-aws-cluster-autoscaler-chart"]
 }
 
 resource "aws_iam_policy" "cluster_autoscaler" {

templates/kubernetes/terraform/modules/kubernetes/ingress/main.tf

@@ -1,5 +1,5 @@
 locals {
-  log_format = <<EOF
+  log_format       = <<EOF
 {
  "timestamp": "$time_iso8601",
  "remote_addr": "$remote_addr",
@@ -20,7 +20,8 @@ locals {
  "http_x_forwarded_for": "$proxy_add_x_forwarded_for"
 }
 EOF
-
+  controller_image = "k8s.gcr.io/ingress-nginx/controller"
+  controller_tag   = "v0.41.2"
 }
 
 resource "kubernetes_namespace" "ingress_nginx" {
@@ -232,7 +233,7 @@ resource "kubernetes_deployment" "nginx_ingress_controller" {
       spec {
         container {
           name  = "nginx-ingress-controller"
-          image = "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.30.0"
+          image = "${local.controller_image}:${local.controller_tag}"
           args = [
             "/nginx-ingress-controller",
             "--configmap=$(POD_NAMESPACE)/nginx-configuration",

templates/kubernetes/terraform/modules/kubernetes/metrics_server.tf

@@ -5,17 +5,16 @@ locals {
 
 resource "helm_release" "metrics_server" {
   name       = "metrics-server"
-  repository = "https://kubernetes-charts.storage.googleapis.com"
+  # @TODO : The central chart repo was deprecated but as of late 2020 this chart didn't have an official home.
+  # Switch away from this bitnami one when possible. https://github.com/kubernetes-sigs/metrics-server/issues/572
+  repository = "https://charts.bitnami.com/bitnami"
   chart      = "metrics-server"
+  version    = "5.0.2"
   namespace  = local.metrics_server_namespace
 
   set {
-    name  = "args"
-    value = "{--kubelet-preferred-address-types=InternalIP}"
-  }
-  set {
-    name  = "image.tag"
-    value = "v0.3.6"
+    name  = "apiService.create"
+    value = true
   }
 }