upgrade to tf 1.5.7

[splattner]

No description provided.

[github-actions]

Terraform Format and Style 🖌success

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Validation Output

Success! The configuration is valid.

Terraform Plan 📖success

Show Plan

terraform
module.training-cluster.tls_private_key.terraform: Refreshing state... [id=5b2b1ef56404169e3835af252f5ebfc823dbc222]
module.training-cluster.hcloud_load_balancer.lb: Refreshing state... [id=1371818]
module.training-cluster.random_password.argocd-admin-password: Refreshing state... [id=none]
module.training-cluster.hcloud_network.network: Refreshing state... [id=3164600]
module.training-cluster.random_password.student-passwords[1]: Refreshing state... [id=none]
module.training-cluster.hcloud_placement_group.controlplane: Refreshing state... [id=187331]
module.training-cluster.random_password.student-passwords[3]: Refreshing state... [id=none]
module.training-cluster.random_password.student-passwords[0]: Refreshing state... [id=none]
module.training-cluster.random_password.student-passwords[2]: Refreshing state... [id=none]
module.training-cluster.random_password.rke2_cluster_secret: Refreshing state... [id=none]
module.training-cluster.hcloud_ssh_key.terraform: Refreshing state... [id=13562986]
module.training-cluster.hcloud_network_subnet.subnet: Refreshing state... [id=3164600-10.0.0.0/24]
module.training-cluster.module.api-aaaa-record.restapi_object.aaaa-record[0]: Refreshing state... [id=2785173]
module.training-cluster.module.api-a-record.restapi_object.a-record[0]: Refreshing state... [id=2785174]
module.training-cluster.hcloud_load_balancer_service.rke2: Refreshing state... [id=1371818__9345]
module.training-cluster.hcloud_load_balancer_network.lb: Refreshing state... [id=1371818-3164600]
module.training-cluster.hcloud_load_balancer_service.api: Refreshing state... [id=1371818__6443]
module.training-cluster.hcloud_load_balancer_target.controlplane: Refreshing state... [id=lb-label-selector-tgt-28ad2ff0dac499e2dc5a0d327c5a84fa206b6f31e5813b70c1978ece66225a11-1371818]
module.training-cluster.hcloud_server.worker[0]: Refreshing state... [id=37174636]
module.training-cluster.hcloud_server.worker[1]: Refreshing state... [id=37174637]
module.training-cluster.hcloud_server_network.worker[1]: Refreshing state... [id=37174637-3164600]
module.training-cluster.hcloud_server_network.worker[0]: Refreshing state... [id=37174636-3164600]
module.training-cluster.hcloud_server.controlplane[2]: Refreshing state... [id=35304321]
module.training-cluster.hcloud_server.controlplane[0]: Refreshing state... [id=35304324]
module.training-cluster.hcloud_server.controlplane[1]: Refreshing state... [id=35304325]
module.training-cluster.hcloud_server_network.controlplane[2]: Refreshing state... [id=35304321-3164600]
module.training-cluster.hcloud_server_network.controlplane[1]: Refreshing state... [id=35304325-3164600]
module.training-cluster.hcloud_server_network.controlplane[0]: Refreshing state... [id=35304324-3164600]
module.training-cluster.hcloud_firewall.firewall: Refreshing state... [id=986372]
module.training-cluster.null_resource.wait_for_k8s_api: Refreshing state... [id=3514550289398218606]
module.training-cluster.ssh_resource.getkubeconfig: Refreshing state... [id=2953639524585512285]
module.training-cluster.kubernetes_namespace.argocd: Refreshing state... [id=argocd]
module.training-cluster.helm_release.argocd: Refreshing state... [id=argocd]
module.training-cluster.time_sleep.wait_for_bootstrap: Refreshing state... [id=2023-07-27T11:05:16Z]
module.training-cluster.time_sleep.wait_for_argocd-cleanup: Refreshing state... [id=2023-07-27T11:04:46Z]
module.training-cluster.helm_release.appset-trainee-webshell[0]: Refreshing state... [id=trainee-webshell]
module.training-cluster.helm_release.appset-trainee-env[0]: Refreshing state... [id=trainee-env]
module.training-cluster.kubernetes_secret.secretstore-secret: Refreshing state... [id=external-secrets/credentials-training.cluster.acend.ch]
module.training-cluster.kubernetes_secret.argocd-cluster: Refreshing state... [id=argocd/training]
module.training-cluster.null_resource.cleanup-argo-cr-before-destroy: Refreshing state... [id=2400821005921542469]
module.training-cluster.kubernetes_manifest.external-secrets-secretstore["kube-system"]: Refreshing state...
module.training-cluster.kubernetes_manifest.external-secrets-secretstore["cert-manager"]: Refreshing state...

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.training-cluster.helm_release.argocd will be updated in-place
  ~ resource "helm_release" "argocd" {
        id                         = "argocd"
      ~ metadata                   = [
          - {
              - app_version = "v2.7.8"
              - chart       = "argo-cd"
              - name        = "argocd"
              - namespace   = "argocd"
              - revision    = 49
              - values      = jsonencode(
                    {
                      - configs    = {
                          - cm     = {
                              - "dex.config" = <<-EOT
                                    connectors:
                                      - type: gitea
                                        id: gitea
                                        name: Gitea
                                        config:
                                          clientID: $gitea-oauthclient-argocd:client_id
                                          clientSecret: $gitea-oauthclient-argocd:client_secret
                                          redirectURI: https://argocd.training.cluster.acend.ch/api/dex/callback
                                          baseURL: https://gitea.training.cluster.acend.ch
                                          loadAllGroups: true
                                EOT
                              - url          = "https://argocd.training.cluster.acend.ch"
                            }
                          - params = {
                              - "application.namespaces" = "user*"
                              - "server.insecure"        = true
                            }
                          - rbac   = {
                              - "policy.csv" = <<-EOT
                                    p, role:student, applications, *, */*, allow
                                    
                                    p, role:student, applications, *, infra/*, deny
                                    p, role:student, applications, *, trainee-environment/*, deny
                                    
                                    p, role:student, clusters, get, *, allow
                                    p, role:student, clusters, update, *, allow
                                    p, role:student, repositories, get, *, allow
                                    p, role:student, repositories, create, *, allow
                                    p, role:student, repositories, update, *, allow
                                    p, role:student, repositories, delete, *, allow
                                    
                                    p, role:student, projects, get, *, allow
                                    p, role:student, projects, create, *, allow
                                    p, role:student, projects, update, *, allow
                                    p, role:student, projects, delete, *, allow
                                    
                                    p, role:student, projects, *, infra, deny
                                    p, role:student, projects, *, trainee-environment, deny
                                    
                                    g, acend:trainees, role:student
                                    
                                    g, user1, role:student
                                    g, user2, role:student
                                    g, user3, role:student
                                    g, user4, role:student
                                    
                                    g, acend:admins, role:admin
                                EOT
                            }
                          - secret = {
                              - argocdServerAdminPassword = "$2a$10$CMmgI1yAXMXcNcF1w9QchuPP5.RgtrnhTxLMgC7exj4toGez1.zuG"
                              - extra                     = {
                                  - "accounts.user1.password"      = "$2a$10$jtulh9IovQMPF4RfwCmXzeErcUYG16EIRHARW3x/op8sFDW5Bai12"
                                  - "accounts.user1.passwordMtime" = "2023-10-05T09:44:03Z"
                                  - "accounts.user2.password"      = "$2a$10$AE1ypCUQR3SM5cIHP7kOkuUP6Jp1uWwMkgNeC3097cmAfisUpaoIW"
                                  - "accounts.user2.passwordMtime" = "2023-10-05T09:44:03Z"
                                  - "accounts.user3.password"      = "$2a$10$Fg/LVTplg1ZWCYz88phgyOt17DfPPooDGUPOGdLGh5eY5uRN.MLQ."
                                  - "accounts.user3.passwordMtime" = "2023-10-05T09:44:03Z"
                                  - "accounts.user4.password"      = "$2a$10$rBXIkprrgDQOGIhNRFXSZurV5jZO/nklxk.GjUbsCVmpevM5smspi"
                                  - "accounts.user4.passwordMtime" = "2023-10-05T09:44:03Z"
                                }
                            }
                        }
                      - controller = {
                          - metrics = {
                              - enabled = true
                            }
                        }
                      - global     = {
                          - nodeSelector = {
                              - "node-role.kubernetes.io/control-plane" = "true"
                            }
                          - tolerations  = [
                              - {
                                  - effect   = "NoSchedule"
                                  - key      = "node-role.kubernetes.io/control-plane"
                                  - operator = "Equal"
                                  - value    = "true"
                                },
                            ]
                        }
                      - server     = {
                          - config      = {
                              - "accounts.user1"         = "apiKey, login"
                              - "accounts.user2"         = "apiKey, login"
                              - "accounts.user3"         = "apiKey, login"
                              - "accounts.user4"         = "apiKey, login"
                              - "kustomize.buildOptions" = "--enable-helm"
                              - "resource.exclusions"    = <<-EOT
                                    - kinds:
                                      - "CiliumIdentity"
                                      - "ciliumidentities"
                                      - "CiliumEndpoint"
                                      - "ciliumendpoints"
                                      - "CiliumNode"
                                      - "ciliumnodes"
                                EOT
                            }
                          - ingress     = {
                              - enabled          = true
                              - hosts            = [
                                  - "argocd.training.cluster.acend.ch",
                                ]
                              - ingressClassName = "haproxy"
                              - tls              = [
                                  - {
                                      - hosts      = [
                                          - "argocd.training.cluster.acend.ch",
                                        ]
                                      - secretName = "acend-wildcard"
                                    },
                                ]
                            }
                          - ingressGrpc = {
                              - enabled          = true
                              - hosts            = [
                                  - "argocd-grpc.training.cluster.acend.ch",
                                ]
                              - ingressClassName = "haproxy"
                              - tls              = [
                                  - {
                                      - hosts      = [
                                          - "argocd-grpc.training.cluster.acend.ch",
                                        ]
                                      - secretName = "acend-wildcard"
                                    },
                                ]
                            }
                        }
                    }
                )
              - version     = "5.41.1"
            },
        ] -> (known after apply)
        name                       = "argocd"
      ~ values                     = [
          - (sensitive value),
          - <<-EOT
                configs:
                  rbac: 
                    policy.csv: |
                      p, role:student, applications, *, */*, allow
                
                      p, role:student, applications, *, infra/*, deny
                      p, role:student, applications, *, trainee-environment/*, deny
                
                      p, role:student, clusters, get, *, allow
                      p, role:student, clusters, update, *, allow
                      p, role:student, repositories, get, *, allow
                      p, role:student, repositories, create, *, allow
                      p, role:student, repositories, update, *, allow
                      p, role:student, repositories, delete, *, allow
                
                      p, role:student, projects, get, *, allow
                      p, role:student, projects, create, *, allow
                      p, role:student, projects, update, *, allow
                      p, role:student, projects, delete, *, allow
                
                      p, role:student, projects, *, infra, deny
                      p, role:student, projects, *, trainee-environment, deny
                
                      g, acend:trainees, role:student
                
                      g, user1, role:student
                      g, user2, role:student
                      g, user3, role:student
                      g, user4, role:student
                
                      g, acend:admins, role:admin
            EOT,
          - <<-EOT
                global:
                  nodeSelector:
                    node-role.kubernetes.io/control-plane: "true"
                  tolerations:
                  - key: node-role.kubernetes.io/control-plane
                    operator: Equal
                    value: "true"
                    effect: "NoSchedule"
                
                controller:
                  metrics:
                    enabled: true
                
                configs:
                  cm:
                    dex.config: |
                      connectors:
                        - type: gitea
                          id: gitea
                          name: Gitea
                          config:
                            clientID: $gitea-oauthclient-argocd:client_id
                            clientSecret: $gitea-oauthclient-argocd:client_secret
                            redirectURI: https://argocd.training.cluster.acend.ch/api/dex/callback
                            baseURL: https://gitea.training.cluster.acend.ch
                            loadAllGroups: true
                  params:
                    server.insecure: true
                    application.namespaces: user*
                
                server:
                  config:
                    kustomize.buildOptions: "--enable-helm"
                    resource.exclusions: |
                      - kinds:
                        - "CiliumIdentity"
                        - "ciliumidentities"
                        - "CiliumEndpoint"
                        - "ciliumendpoints"
                        - "CiliumNode"
                        - "ciliumnodes"
                  ingress:
                    enabled: true
                    ingressClassName: haproxy
                    tls:
                    - secretName: acend-wildcard
                  ingressGrpc:
                    enabled: true
                    ingressClassName: haproxy
                    tls:
                    - secretName: acend-wildcard
            EOT,
        ] -> (known after apply)
        # (26 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pusher: @splattner, Workflow: Deploy