From 9a1058a920b8bc6bc575709dc9e47fbd46ee6f53 Mon Sep 17 00:00:00 2001 From: Florian Nowarre Date: Thu, 27 Feb 2025 10:49:19 +0100 Subject: [PATCH] chore: adding stackit to collie-hub chore: adding stackit to collie-hub chore: adding stackit to collie-hub chore: adding stackit to collie-hub --- kit/stackit/bootstrap/README.md | 61 ++++++ kit/stackit/bootstrap/documentation.tf | 14 ++ kit/stackit/bootstrap/main.tf | 76 +++++++ kit/stackit/bootstrap/outputs.tf | 0 kit/stackit/bootstrap/variables.tf | 32 +++ kit/stackit/bootstrap/versions.tf | 12 ++ .../projects/buildingblock/README.md | 72 +++++++ .../projects/buildingblock/main.tf | 191 ++++++++++++++++++ .../projects/buildingblock/outputs.tf | 7 + .../buildingblock/projects.tftest.hcl | 43 ++++ .../projects/buildingblock/variables.tf | 51 +++++ .../projects/buildingblock/versions.tf | 38 ++++ 12 files changed, 597 insertions(+) create mode 100644 kit/stackit/bootstrap/README.md create mode 100644 kit/stackit/bootstrap/documentation.tf create mode 100644 kit/stackit/bootstrap/main.tf create mode 100644 kit/stackit/bootstrap/outputs.tf create mode 100644 kit/stackit/bootstrap/variables.tf create mode 100644 kit/stackit/bootstrap/versions.tf create mode 100644 kit/stackit/buildingblocks/projects/buildingblock/README.md create mode 100644 kit/stackit/buildingblocks/projects/buildingblock/main.tf create mode 100644 kit/stackit/buildingblocks/projects/buildingblock/outputs.tf create mode 100644 kit/stackit/buildingblocks/projects/buildingblock/projects.tftest.hcl create mode 100644 kit/stackit/buildingblocks/projects/buildingblock/variables.tf create mode 100644 kit/stackit/buildingblocks/projects/buildingblock/versions.tf diff --git a/kit/stackit/bootstrap/README.md b/kit/stackit/bootstrap/README.md new file mode 100644 index 00000000..64f60603 --- /dev/null +++ b/kit/stackit/bootstrap/README.md @@ -0,0 +1,61 @@ +# STACKIT Cloud Custom Platform + +## Overview +This Terraform project enables seamless self-service provisioning and management of STACKIT Projects for development teams. The platform is based on the STACKIT Cloud and is designed to provide a secure and compliant environment for development teams to deploy and manage their applications. + +## Documentation +For more information, check our [Guide for STACKIT](/likvid-cloudfoundation/meshstack/guides/guide_stackit.html). + +## Usage +1. Initialize the Terraform configuration: + ```sh + terraform init + ``` +2. Apply the Terraform configuration: + ```sh + terraform apply + ``` + +## Requirements +- Terraform 0.12 or later +- STACKIT Cloud account + +## Providers +- `stackitcloud/stackit` version `0.37.1` +- `hashicorp/null` version `3.2.2` + + +## Requirements + +| Name | Version | +|------|---------| +| [null](#requirement\_null) | 3.2.2 | +| [stackit](#requirement\_stackit) | 0.37.1 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [null_resource.platform_admin](https://registry.terraform.io/providers/hashicorp/null/3.2.2/docs/resources/resource) | resource | +| [null_resource.platform_users](https://registry.terraform.io/providers/hashicorp/null/3.2.2/docs/resources/resource) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [api\_url](#input\_api\_url) | Base API URL | `string` | `"https://authorization.api.stackit.cloud"` | no | +| [organization\_id](#input\_organization\_id) | Organization ID of your stackit cloud account | `string` | n/a | yes | +| [platform\_admins](#input\_platform\_admins) | List of members to add with their roles and subjects | 
list(object({
    role    = string
    subject = string
  }))
| n/a | yes | +| [platform\_users](#input\_platform\_users) | List of members to add with their roles and subjects | 
list(object({
    role    = string
    subject = string
  }))
| n/a | yes | +| [token](#input\_token) | Bearer token for authentication | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| [documentation\_md](#output\_documentation\_md) | n/a | + \ No newline at end of file diff --git a/kit/stackit/bootstrap/documentation.tf b/kit/stackit/bootstrap/documentation.tf new file mode 100644 index 00000000..8ca022af --- /dev/null +++ b/kit/stackit/bootstrap/documentation.tf @@ -0,0 +1,14 @@ +output "documentation_md" { + value = < +## Requirements + +| Name | Version | +|------|---------| +| [aws](#requirement\_aws) | 5.65.0 | +| [null](#requirement\_null) | 3.2.2 | +| [stackit](#requirement\_stackit) | 0.37.1 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [null_resource.create_user](https://registry.terraform.io/providers/hashicorp/null/3.2.2/docs/resources/resource) | resource | +| [null_resource.project_admin](https://registry.terraform.io/providers/hashicorp/null/3.2.2/docs/resources/resource) | resource | +| [null_resource.project_editor](https://registry.terraform.io/providers/hashicorp/null/3.2.2/docs/resources/resource) | resource | +| [null_resource.project_reader](https://registry.terraform.io/providers/hashicorp/null/3.2.2/docs/resources/resource) | resource | +| [stackit_resourcemanager_project.projects](https://registry.terraform.io/providers/stackitcloud/stackit/0.37.1/docs/resources/resourcemanager_project) | resource | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [api\_url](#input\_api\_url) | Base API URL | `string` | `"https://authorization.api.stackit.cloud"` | no | +| [aws\_account\_id](#input\_aws\_account\_id) | this is for the tfstates Backend. in our case AWS. | `string` | n/a | yes | +| [organization\_id](#input\_organization\_id) | id of the organization | `string` | n/a | yes | +| [parent\_container\_id](#input\_parent\_container\_id) | The stackit Cloud parent container id for the project | `string` | n/a | yes | +| [project\_id](#input\_project\_id) | Projects last block in name | `string` | n/a | yes | +| [token](#input\_token) | Bearer token for authentication | `string` | n/a | yes | +| [users](#input\_users) | Users and their roles provided by meshStack (Note that users must exist in stackit) | 
list(object(
    {
      meshIdentifier = string
      username       = string
      firstName      = string
      lastName       = string
      email          = string
      euid           = string
      roles          = list(string)
    }
  ))
| n/a | yes | +| [workspace\_id](#input\_workspace\_id) | Projects first block in name | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| [stackit\_login\_link](#output\_stackit\_login\_link) | n/a | +| [tenant\_id](#output\_tenant\_id) | n/a | + diff --git a/kit/stackit/buildingblocks/projects/buildingblock/main.tf b/kit/stackit/buildingblocks/projects/buildingblock/main.tf new file mode 100644 index 00000000..3262f871 --- /dev/null +++ b/kit/stackit/buildingblocks/projects/buildingblock/main.tf @@ -0,0 +1,191 @@ +locals { + admins = { for user in var.users : user.username => user if contains(user.roles, "admin") } + editors = { for user in var.users : user.username => user if contains(user.roles, "user") } + readers = { for user in var.users : user.username => user if contains(user.roles, "reader") } + owner_email = values(local.admins)[0]["email"] + all_users = [for user in concat(values(local.admins), values(local.editors), values(local.readers)) : + { subject = user.email } + ] + + admin_members = [for admin in values(local.admins) : { subject = admin["email"], role = "owner" }] + editor_members = [for editor in values(local.editors) : { subject = editor["email"], role = "editor" }] + reader_members = [for reader in values(local.readers) : { subject = reader["email"], role = "reader" }] +} + +resource "null_resource" "create_user" { + # Trigger creation and destruction of resources based on the lifecycle + triggers = { + members = jsonencode(local.all_users) # This should be a list of emails + url = var.api_url + token = var.token + organization_id = var.organization_id + } + + # Provisioner for the 'create' action + provisioner "local-exec" { + when = create + command = < 0 + error_message = "No users provided" + } +} diff --git a/kit/stackit/buildingblocks/projects/buildingblock/variables.tf b/kit/stackit/buildingblocks/projects/buildingblock/variables.tf new file mode 100644 index 00000000..7faae5dc --- /dev/null +++ b/kit/stackit/buildingblocks/projects/buildingblock/variables.tf @@ -0,0 +1,51 @@ +variable "api_url" { + description = "Base API URL" + type = string + default = "https://authorization.api.stackit.cloud" +} + +variable "token" { + description = "Bearer token for authentication" + type = string + sensitive = true +} + +variable "workspace_id" { + type = string + description = "Projects first block in name" +} + +variable "organization_id" { + type = string + description = "id of the organization" +} + +variable "project_id" { + type = string + description = "Projects last block in name" +} + +variable "parent_container_id" { + type = string + description = "The stackit Cloud parent container id for the project" +} + +variable "aws_account_id" { + description = "this is for the tfstates Backend. in our case AWS." + type = string +} + +variable "users" { + type = list(object( + { + meshIdentifier = string + username = string + firstName = string + lastName = string + email = string + euid = string + roles = list(string) + } + )) + description = "Users and their roles provided by meshStack (Note that users must exist in stackit)" +} diff --git a/kit/stackit/buildingblocks/projects/buildingblock/versions.tf b/kit/stackit/buildingblocks/projects/buildingblock/versions.tf new file mode 100644 index 00000000..ddf14847 --- /dev/null +++ b/kit/stackit/buildingblocks/projects/buildingblock/versions.tf @@ -0,0 +1,38 @@ +terraform { + required_providers { + stackit = { + source = "stackitcloud/stackit" + version = "0.37.1" + } + aws = { + source = "hashicorp/aws" + version = "5.65.0" + } + null = { + source = "hashicorp/null" + version = "3.2.2" + } + } +} + +provider "stackit" { + region = "eu01" + service_account_token = var.token +} + +#TODO: we are using AWS as our Terraform backend. Its up to you where your TF state will hosted. +terraform { + backend "s3" { + bucket = "buildingblocks-tfstates-p32kj" # Must match what's configured in automation backend + key = "terraform/stackit-project" + region = "eu-central-1" + } +} + +provider "aws" { + region = "eu-central-1" + + assume_role { + role_arn = "arn:aws:iam::${var.aws_account_id}:role/LikvidBuildingBlockServiceRole" # Must match what's configured in automation backend + } +}