diff --git a/README.md b/README.md index df8b96b..3c314d7 100644 --- a/README.md +++ b/README.md @@ -46,12 +46,12 @@ No modules. | [blob\_storage\_cors\_allowed\_maxage](#input\_blob\_storage\_cors\_allowed\_maxage) | List of allowed maxage for CORS of storage account | `number` | `3000` | no | | [blob\_storage\_cors\_allowed\_methods](#input\_blob\_storage\_cors\_allowed\_methods) | List of allowed methods for CORS of storage account | `list(string)` | 
[
  "GET",
  "POST",
  "PUT"
]
| no | | [blob\_storage\_cors\_allowed\_origins](#input\_blob\_storage\_cors\_allowed\_origins) | List of allowed origin for CORS of storage account | `list(string)` | 
[
  "*"
]
| no | -| [cloud\_integration\_azuread\_application\_enable\_override](#input\_cloud\_integration\_azuread\_application\_enable\_override) | Enable overriding the name of azuread application. This will only be used if feature\_cloud\_integration\_azuread\_application\_enabled is true. You need to pass cloud\_integration\_azuread\_application\_override\_name to pass the azuread application name | `bool` | `false` | no | -| [cloud\_integration\_azuread\_application\_override\_name](#input\_cloud\_integration\_azuread\_application\_override\_name) | Azuread application name. Only used if cloud\_integration\_azuread\_application\_enable\_override is true | `string` | `""` | no | -| [cloud\_integration\_service\_principal\_password\_expiry\_end\_date](#input\_cloud\_integration\_service\_principal\_password\_expiry\_end\_date) | End date post which service principal password would expire | `string` | `"2124-02-12T09:42:53Z"` | no | -| [cloud\_integration\_service\_principal\_role](#input\_cloud\_integration\_service\_principal\_role) | Role that will be assigned to the service principal on AKS cluster | `string` | `"Reader"` | no | -| [cloud\_integration\_sign\_in\_audience](#input\_cloud\_integration\_sign\_in\_audience) | sign\_in\_audience of the cloud integration | `string` | `"AzureADMyOrg"` | no | | [cluster\_id](#input\_cluster\_id) | ID of the AKS cluster | `string` | n/a | yes | +| [cluster\_integration\_azuread\_application\_enable\_override](#input\_cluster\_integration\_azuread\_application\_enable\_override) | Enable overriding the name of azuread application. This will only be used if feature\_cluster\_integration\_azuread\_application\_enabled is true. You need to pass cluster\_integration\_azuread\_application\_override\_name to pass the azuread application name | `bool` | `false` | no | +| [cluster\_integration\_azuread\_application\_override\_name](#input\_cluster\_integration\_azuread\_application\_override\_name) | Azuread application name. Only used if cluster\_integration\_azuread\_application\_enable\_override is true | `string` | `""` | no | +| [cluster\_integration\_service\_principal\_password\_expiry\_end\_date](#input\_cluster\_integration\_service\_principal\_password\_expiry\_end\_date) | End date post which service principal password would expire | `string` | `"2124-02-12T09:42:53Z"` | no | +| [cluster\_integration\_service\_principal\_role](#input\_cluster\_integration\_service\_principal\_role) | Role that will be assigned to the service principal on AKS cluster | `string` | `"Reader"` | no | +| [cluster\_integration\_sign\_in\_audience](#input\_cluster\_integration\_sign\_in\_audience) | sign\_in\_audience of the cluster integration | `string` | `"AzureADMyOrg"` | no | | [cluster\_name](#input\_cluster\_name) | Name of the AKS cluster | `string` | n/a | yes | | [container\_registry\_admin\_enabled](#input\_container\_registry\_admin\_enabled) | Enable admin for the docker registry | `bool` | `true` | no | | [container\_registry\_enable\_override](#input\_container\_registry\_enable\_override) | Enable overriding the name of container registry. This will only be used if feature\_container\_registry\_enabled is true. You need to pass container\_registry\_override\_name to pass the container registry name | `bool` | `false` | no | @@ -59,7 +59,7 @@ No modules. | [container\_registry\_public\_network\_access\_enabled](#input\_container\_registry\_public\_network\_access\_enabled) | Whether public network access is allowed for the container registry | `bool` | `true` | no | | [container\_registry\_sku](#input\_container\_registry\_sku) | SKU of the docker registry | `string` | `"Standard"` | no | | [feature\_blob\_storage\_enabled](#input\_feature\_blob\_storage\_enabled) | Enable blob storage feature in the platform | `bool` | `true` | no | -| [feature\_cloud\_integration\_enabled](#input\_feature\_cloud\_integration\_enabled) | Enable the support of cloud integration | `bool` | `true` | no | +| [feature\_cluster\_integration\_enabled](#input\_feature\_cluster\_integration\_enabled) | Enable the support of cluster integration | `bool` | `true` | no | | [feature\_container\_registry\_enabled](#input\_feature\_container\_registry\_enabled) | Enable docker registry feature in the platform | `bool` | `true` | no | | [location](#input\_location) | Location of the storage account and container registry. This should be kept similar to resource group for ideal performance. | `string` | n/a | yes | | [platform\_feature\_enabled](#input\_platform\_feature\_enabled) | Enable platform features like container registry and storage account | `bool` | `true` | no | @@ -77,12 +77,12 @@ No modules. | [truefoundry\_blob\_storage\_account\_primary\_location](#output\_truefoundry\_blob\_storage\_account\_primary\_location) | Storage account primary location | | [truefoundry\_blob\_storage\_account\_primary\_web\_host](#output\_truefoundry\_blob\_storage\_account\_primary\_web\_host) | Storage account primary web host url | | [truefoundry\_blob\_storage\_root\_url](#output\_truefoundry\_blob\_storage\_root\_url) | Storage account root URL for blob storage | -| [truefoundry\_cloud\_integrations\_azuread\_application\_client\_id](#output\_truefoundry\_cloud\_integrations\_azuread\_application\_client\_id) | Azure AD application client ID | -| [truefoundry\_cloud\_integrations\_azuread\_application\_id](#output\_truefoundry\_cloud\_integrations\_azuread\_application\_id) | Azure AD application ID | -| [truefoundry\_cloud\_integrations\_azuread\_application\_name](#output\_truefoundry\_cloud\_integrations\_azuread\_application\_name) | n/a | -| [truefoundry\_cloud\_integrations\_service\_principal\_name](#output\_truefoundry\_cloud\_integrations\_service\_principal\_name) | n/a | -| [truefoundry\_cloud\_integrations\_service\_principal\_password](#output\_truefoundry\_cloud\_integrations\_service\_principal\_password) | n/a | -| [truefoundry\_cloud\_integrations\_service\_principal\_tenant\_id](#output\_truefoundry\_cloud\_integrations\_service\_principal\_tenant\_id) | n/a | +| [truefoundry\_cluster\_integrations\_azuread\_application\_client\_id](#output\_truefoundry\_cluster\_integrations\_azuread\_application\_client\_id) | Azure AD application client ID | +| [truefoundry\_cluster\_integrations\_azuread\_application\_id](#output\_truefoundry\_cluster\_integrations\_azuread\_application\_id) | Azure AD application ID | +| [truefoundry\_cluster\_integrations\_azuread\_application\_name](#output\_truefoundry\_cluster\_integrations\_azuread\_application\_name) | n/a | +| [truefoundry\_cluster\_integrations\_service\_principal\_name](#output\_truefoundry\_cluster\_integrations\_service\_principal\_name) | n/a | +| [truefoundry\_cluster\_integrations\_service\_principal\_password](#output\_truefoundry\_cluster\_integrations\_service\_principal\_password) | n/a | +| [truefoundry\_cluster\_integrations\_service\_principal\_tenant\_id](#output\_truefoundry\_cluster\_integrations\_service\_principal\_tenant\_id) | n/a | | [truefoundry\_container\_registry\_admin\_password](#output\_truefoundry\_container\_registry\_admin\_password) | Container registry admin password | | [truefoundry\_container\_registry\_admin\_username](#output\_truefoundry\_container\_registry\_admin\_username) | Container registry admin username | | [truefoundry\_container\_registry\_id](#output\_truefoundry\_container\_registry\_id) | Container registry ID | diff --git a/cloud_integration.tf b/cluster_integration.tf similarity index 68% rename from cloud_integration.tf rename to cluster_integration.tf index 12e47e5..5dcd10e 100644 --- a/cloud_integration.tf +++ b/cluster_integration.tf @@ -1,24 +1,24 @@ resource "azuread_application" "truefoundry_platform_features_application" { - count = var.platform_feature_enabled ? var.feature_cloud_integration_enabled ? 1 : 0 : 0 + count = var.platform_feature_enabled ? var.feature_cluster_integration_enabled ? 1 : 0 : 0 display_name = local.azuread_application - sign_in_audience = var.cloud_integration_sign_in_audience + sign_in_audience = var.cluster_integration_sign_in_audience } resource "azuread_service_principal" "truefoundry_platform_features_service_principal" { - count = var.platform_feature_enabled ? var.feature_cloud_integration_enabled ? 1 : 0 : 0 + count = var.platform_feature_enabled ? var.feature_cluster_integration_enabled ? 1 : 0 : 0 client_id = azuread_application.truefoundry_platform_features_application[0].client_id } resource "azuread_service_principal_password" "truefoundry_platform_features_service_principal_password" { - count = var.platform_feature_enabled ? var.feature_cloud_integration_enabled ? 1 : 0 : 0 + count = var.platform_feature_enabled ? var.feature_cluster_integration_enabled ? 1 : 0 : 0 service_principal_id = azuread_service_principal.truefoundry_platform_features_service_principal[0].object_id display_name = local.service_principal_password - end_date = var.cloud_integration_service_principal_password_expiry_end_date + end_date = var.cluster_integration_service_principal_password_expiry_end_date } resource "azurerm_role_assignment" "truefoundry_reader_role_assignment" { - count = var.platform_feature_enabled ? var.feature_cloud_integration_enabled ? 1 : 0 : 0 + count = var.platform_feature_enabled ? var.feature_cluster_integration_enabled ? 1 : 0 : 0 scope = var.cluster_id - role_definition_name = var.cloud_integration_service_principal_role + role_definition_name = var.cluster_integration_service_principal_role principal_id = azuread_service_principal.truefoundry_platform_features_service_principal[0].object_id -} \ No newline at end of file +} diff --git a/container.tf b/container.tf index 7087736..67418fd 100644 --- a/container.tf +++ b/container.tf @@ -31,4 +31,4 @@ resource "azurerm_storage_container" "truefoundry_platform_container" { count = var.platform_feature_enabled ? var.feature_blob_storage_enabled ? 1 : 0 : 0 name = local.container_name storage_account_name = azurerm_storage_account.truefoundry_platform_storage_account[0].name -} \ No newline at end of file +} diff --git a/locals.tf b/locals.tf index 32fad16..720e44b 100644 --- a/locals.tf +++ b/locals.tf @@ -3,7 +3,7 @@ locals { storage_account_name = var.blob_storage_account_enable_override ? var.blob_storage_account_override_name : "${substr(local.cluster_name, 0, 22)}sa" container_name = var.blob_container_enable_override ? var.blob_container_override_name : "${substr(var.cluster_name, 0, 62)}cn" container_registry_name = var.container_registry_enable_override ? var.container_registry_override_name : "${substr(local.cluster_name, 5, 47)}reg" - azuread_application = var.cloud_integration_azuread_application_enable_override ? var.cloud_integration_azuread_application_override_name : "${substr(var.cluster_name, 0, 117)}app" + azuread_application = var.cluster_integration_azuread_application_enable_override ? var.cluster_integration_azuread_application_override_name : "${substr(var.cluster_name, 0, 117)}app" service_principal_password = "${local.cluster_name}sp" tags = merge( { @@ -13,4 +13,4 @@ locals { "truefoundry" = "managed" }, var.tags) -} \ No newline at end of file +} diff --git a/output.tf b/output.tf index 767a6bc..c3f1f21 100644 --- a/output.tf +++ b/output.tf @@ -64,33 +64,33 @@ output "truefoundry_container_registry_admin_password" { } ################################################################################## -## Cloud Integrations +## Cluster Integrations ################################################################################## -output "truefoundry_cloud_integrations_azuread_application_id" { - value = var.feature_cloud_integration_enabled ? azuread_application.truefoundry_platform_features_application[0].id : "" +output "truefoundry_cluster_integrations_azuread_application_id" { + value = var.feature_cluster_integration_enabled ? azuread_application.truefoundry_platform_features_application[0].id : "" description = "Azure AD application ID" } -output "truefoundry_cloud_integrations_azuread_application_client_id" { - value = var.feature_cloud_integration_enabled ? azuread_application.truefoundry_platform_features_application[0].client_id : "" +output "truefoundry_cluster_integrations_azuread_application_client_id" { + value = var.feature_cluster_integration_enabled ? azuread_application.truefoundry_platform_features_application[0].client_id : "" description = "Azure AD application client ID" } -output "truefoundry_cloud_integrations_service_principal_name" { - value = var.feature_cloud_integration_enabled ? azuread_service_principal_password.truefoundry_platform_features_service_principal_password[0].value : "" +output "truefoundry_cluster_integrations_service_principal_name" { + value = var.feature_cluster_integration_enabled ? azuread_service_principal_password.truefoundry_platform_features_service_principal_password[0].value : "" sensitive = true } -output "truefoundry_cloud_integrations_service_principal_tenant_id" { - value = var.feature_cloud_integration_enabled ? azuread_service_principal.truefoundry_platform_features_service_principal[0].application_tenant_id : "" +output "truefoundry_cluster_integrations_service_principal_tenant_id" { + value = var.feature_cluster_integration_enabled ? azuread_service_principal.truefoundry_platform_features_service_principal[0].application_tenant_id : "" } -output "truefoundry_cloud_integrations_service_principal_password" { - value = var.feature_cloud_integration_enabled ? azuread_service_principal_password.truefoundry_platform_features_service_principal_password[0].value : "" +output "truefoundry_cluster_integrations_service_principal_password" { + value = var.feature_cluster_integration_enabled ? azuread_service_principal_password.truefoundry_platform_features_service_principal_password[0].value : "" sensitive = true } -output "truefoundry_cloud_integrations_azuread_application_name" { - value = var.feature_cloud_integration_enabled ? local.cluster_name : "" -} \ No newline at end of file +output "truefoundry_cluster_integrations_azuread_application_name" { + value = var.feature_cluster_integration_enabled ? local.cluster_name : "" +} diff --git a/registry.tf b/registry.tf index 40b5ec2..414807a 100644 --- a/registry.tf +++ b/registry.tf @@ -8,4 +8,3 @@ resource "azurerm_container_registry" "truefoundry_container_registry" { public_network_access_enabled = var.container_registry_public_network_access_enabled tags = local.tags } - diff --git a/variables.tf b/variables.tf index adbb0b9..66bc876 100644 --- a/variables.tf +++ b/variables.tf @@ -161,44 +161,44 @@ variable "container_registry_public_network_access_enabled" { } ################################################################################## -## Cloud Integration +## Cluster Integration ################################################################################## -variable "feature_cloud_integration_enabled" { - description = "Enable the support of cloud integration" +variable "feature_cluster_integration_enabled" { + description = "Enable the support of cluster integration" default = true type = bool } -variable "cloud_integration_azuread_application_enable_override" { - description = "Enable overriding the name of azuread application. This will only be used if feature_cloud_integration_azuread_application_enabled is true. You need to pass cloud_integration_azuread_application_override_name to pass the azuread application name" +variable "cluster_integration_azuread_application_enable_override" { + description = "Enable overriding the name of azuread application. This will only be used if feature_cluster_integration_azuread_application_enabled is true. You need to pass cluster_integration_azuread_application_override_name to pass the azuread application name" type = bool default = false } -variable "cloud_integration_azuread_application_override_name" { - description = "Azuread application name. Only used if cloud_integration_azuread_application_enable_override is true" +variable "cluster_integration_azuread_application_override_name" { + description = "Azuread application name. Only used if cluster_integration_azuread_application_enable_override is true" type = string default = "" validation { - condition = var.cloud_integration_azuread_application_override_name == "" || can(regex("^[a-z0-9-]{0,119}[a-z0-9]$", var.cloud_integration_azuread_application_override_name)) + condition = var.cluster_integration_azuread_application_override_name == "" || can(regex("^[a-z0-9-]{0,119}[a-z0-9]$", var.cluster_integration_azuread_application_override_name)) error_message = "Container name must be alphanumeric with length between 120 characters" } } -variable "cloud_integration_sign_in_audience" { - description = "sign_in_audience of the cloud integration" +variable "cluster_integration_sign_in_audience" { + description = "sign_in_audience of the cluster integration" type = string default = "AzureADMyOrg" } -variable "cloud_integration_service_principal_password_expiry_end_date" { +variable "cluster_integration_service_principal_password_expiry_end_date" { description = "End date post which service principal password would expire" type = string default = "2124-02-12T09:42:53Z" } -variable "cloud_integration_service_principal_role" { +variable "cluster_integration_service_principal_role" { description = "Role that will be assigned to the service principal on AKS cluster" type = string default = "Reader" @@ -212,4 +212,4 @@ variable "tags" { description = "A map of tags to add to all resources" type = map(string) default = {} -} \ No newline at end of file +} diff --git a/versions.tf b/versions.tf index 46f0788..8b1bc0a 100644 --- a/versions.tf +++ b/versions.tf @@ -11,4 +11,4 @@ terraform { version = "2.47.0" } } -} \ No newline at end of file +}