diff --git a/ci/pipeline.yml b/ci/pipeline.yml index 3b40a7af..3c6921df 100644 --- a/ci/pipeline.yml +++ b/ci/pipeline.yml @@ -194,22 +194,10 @@ jobs: CF_CLIENT_ID: ((cf-client-id-development)) CF_CLIENT_SECRET: ((cf-client-secret-development)) TF_VAR_remote_state_bucket: ((tf-state-bucket)) - TF_VAR_external_remote_state_reader_access_key_id: ((development-tf-state-access-key-id)) - TF_VAR_external_remote_state_reader_secret_access_key: ((development-tf-state-secret-access-key)) - TF_VAR_external_remote_state_reader_region: ((development-tf-state-region)) TF_VAR_domain_name: dev.us-gov-west-1.aws-us-gov.cloud.gov TF_VAR_iaas_stack_name: development TF_VAR_tooling_stack_name: tooling TF_VAR_aws_lb_listener_ssl_policy: "ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04" - TF_VAR_remote_state_bucket_external: ((tf-state-bucket-external)) - TF_VAR_external_stack_name: external-development - TF_VAR_csb_aws_region_govcloud: ((aws-region)) - TF_VAR_csb_aws_region_commercial: ((csb-aws-region-commercial)) - TF_VAR_csb_cg_smtp_aws_ses_zone: appmail.dev.us-gov-west-1.aws-us-gov.cloud.gov - TF_VAR_csb_docker_image_name: ((csb-docker-image-name)) - TF_VAR_csb_org_name: ((csb-org-name)) - TF_VAR_csb_space_name: ((csb-space-name)) - TF_VAR_csb_broker_route_domain: ((csb-broker-route-domain-development)) - put: slack params: text_file: terraform-state/message.txt diff --git a/terraform/modules/csb/main.tf b/terraform/modules/csb/main.tf deleted file mode 100644 index e99076e8..00000000 --- a/terraform/modules/csb/main.tf +++ /dev/null @@ -1,85 +0,0 @@ -data "cloudfoundry_space" "services" { - name = var.space_name - org_name = var.org_name -} - -resource "random_password" "csb_app_password" { - length = 32 - special = false - min_special = 0 - min_upper = 5 - min_numeric = 5 - min_lower = 5 -} - -resource "cloudfoundry_app" "csb" { - name = "csb" - space = data.cloudfoundry_space.services.id - - docker_image = "${var.docker_image_name}${var.docker_image_version}" - docker_credentials = { - "username" = var.ecr_access_key_id - "password" = var.ecr_secret_access_key - } - - command = "/app/csb serve" - instances = var.instances - memory = 1 * 1024 # 1GB - disk_quota = 7 * 1024 # 7GB - - environment = { - # General broker configuration - BROKERPAK_UPDATES_ENABLED = true - DB_HOST = var.rds_host - DB_NAME = var.rds_name - DB_PASSWORD = var.rds_password - DB_PORT = var.rds_port - DB_TLS = true - DB_USERNAME = var.rds_name - SECURITY_USER_NAME = "broker" - SECURITY_USER_PASSWORD = random_password.csb_app_password.result - TERRAFORM_UPGRADES_ENABLED = true - - # Access keys for managing resources provisioned by brokerpaks - AWS_ACCESS_KEY_ID_GOVCLOUD = var.aws_access_key_id_govcloud - AWS_SECRET_ACCESS_KEY_GOVCLOUD = var.aws_secret_access_key_govcloud - AWS_REGION_GOVCLOUD = var.aws_region_govcloud - AWS_ACCESS_KEY_ID_COMMERCIAL = var.aws_access_key_id_commercial - AWS_SECRET_ACCESS_KEY_COMMERCIAL = var.aws_secret_access_key_commercial - AWS_REGION_COMMERCIAL = var.aws_region_commercial - - # Other values that are used by convention by all brokerpaks - CLOUD_GOV_ENVIRONMENT = var.iaas_stack_name - - # Brokerpak-specific variables - CG_SMTP_AWS_ZONE = var.cg_smtp_aws_ses_zone - } - - routes { - route = cloudfoundry_route.csb.id - } -} - -data "cloudfoundry_domain" "platform_components" { - name = var.broker_route_domain -} - -resource "cloudfoundry_route" "csb" { - domain = data.cloudfoundry_domain.platform_components.id - hostname = "services" - space = data.cloudfoundry_space.services.id -} - -resource "cloudfoundry_service_broker" "csb" { - name = "csb" - password = random_password.csb_app_password.result - url = "https://${cloudfoundry_route.csb.hostname}.${data.cloudfoundry_domain.platform_components.domain}" - username = "broker" - - depends_on = [cloudfoundry_app.csb] -} - -resource "cloudfoundry_service_plan_access" "smtp" { - plan = cloudfoundry_service_broker.csb.service_plans["cg-smtp/base"] - public = true -} diff --git a/terraform/modules/csb/variables.tf b/terraform/modules/csb/variables.tf deleted file mode 100644 index 475fa361..00000000 --- a/terraform/modules/csb/variables.tf +++ /dev/null @@ -1,108 +0,0 @@ -variable "iaas_stack_name" { - type = string - description = "Like development, staging, or production." -} - -# Database credentials - -variable "rds_host" { - type = string - description = "Hostname of the RDS instance for the Cloud Service Broker." -} - -variable "rds_port" { - type = string - description = "Port of the RDS instance for the Cloud Service Broker." -} - -variable "rds_name" { - type = string - description = "Database name within the RDS instance for the Cloud Service Broker." -} - -variable "rds_username" { - type = string - description = "Database username of the RDS instance for the Cloud Service Broker." -} - -variable "rds_password" { - type = string - sensitive = true - description = "Database password of the RDS instance for the Cloud Service Broker." -} - -# Application variables - -variable "ecr_access_key_id" { - description = "For pulling the CSB image from ECR." - type = string -} - -variable "ecr_secret_access_key" { - description = "For pulling the CSB image from ECR." - sensitive = true - type = string -} - -variable "instances" { - description = "Number of instances of the CSB app to run." - type = number -} - -variable "cg_smtp_aws_ses_zone" { - type = string - description = "When the user does not provide a domain, a subdomain will be created for them under this DNS zone." -} - -// Broker credentials -variable "aws_access_key_id_govcloud" { - type = string -} - -variable "aws_secret_access_key_govcloud" { - type = string - sensitive = true -} - -variable "aws_region_govcloud" { - type = string -} - -variable "aws_access_key_id_commercial" { - type = string -} - -variable "aws_secret_access_key_commercial" { - type = string - sensitive = true -} - -variable "aws_region_commercial" { - type = string -} - -variable "org_name" { - type = string - description = "The name of the Cloud Foundry organization in which the broker will be deployed." -} - -variable "space_name" { - type = string - description = "The name of the Cloud Foundry space in which the broker will be deployed." -} - -variable "docker_image_name" { - type = string - description = "Full name (but not tag or SHA) of the Docker image the broker will use." -} - -variable "docker_image_version" { - type = string - description = "Tag or SHA of the Docker image the broker will use. For example, ':latest' or '@sha256:abc123...'." - default = ":latest" -} - -variable "broker_route_domain" { - type = string - description = "The domain under which the broker's route will be created. For example, 'fr.cloud.gov'." -} diff --git a/terraform/modules/csb/versions.tf b/terraform/modules/csb/versions.tf deleted file mode 100644 index d08d6103..00000000 --- a/terraform/modules/csb/versions.tf +++ /dev/null @@ -1,9 +0,0 @@ -terraform { - required_version = "< 2.0.0" - required_providers { - cloudfoundry = { - source = "cloudfoundry-community/cloudfoundry" - version = "< 1.0" - } - } -} diff --git a/terraform/stack/apps.tf b/terraform/stack/apps.tf index eda4e9ec..31240319 100644 --- a/terraform/stack/apps.tf +++ b/terraform/stack/apps.tf @@ -8,33 +8,3 @@ module "test_cdn" { cloudfoundry = cloudfoundry } } - -module "csb" { - source = "../modules/csb" - - count = var.iaas_stack_name == "development" ? 1 : 0 - - iaas_stack_name = var.iaas_stack_name - - rds_host = data.terraform_remote_state.iaas.outputs.csb.rds.host - rds_port = data.terraform_remote_state.iaas.outputs.csb.rds.port - rds_name = data.terraform_remote_state.iaas.outputs.csb.rds.name - rds_username = data.terraform_remote_state.iaas.outputs.csb.rds.username - rds_password = data.terraform_remote_state.iaas.outputs.csb.rds.password - - ecr_access_key_id = data.terraform_remote_state.iaas.outputs.csb.ecr_user.access_key_id_curr - ecr_secret_access_key = data.terraform_remote_state.iaas.outputs.csb.ecr_user.secret_access_key_curr - instances = 1 - cg_smtp_aws_ses_zone = var.csb_cg_smtp_aws_ses_zone - aws_access_key_id_govcloud = data.terraform_remote_state.iaas.outputs.csb.broker_user.access_key_id_curr - aws_secret_access_key_govcloud = data.terraform_remote_state.iaas.outputs.csb.broker_user.secret_access_key_curr - aws_region_govcloud = var.csb_aws_region_govcloud - aws_access_key_id_commercial = data.terraform_remote_state.external.outputs.csb.broker_user.access_key_id_curr - aws_secret_access_key_commercial = data.terraform_remote_state.external.outputs.csb.broker_user.secret_access_key_curr - aws_region_commercial = var.csb_aws_region_commercial - - org_name = var.csb_org_name - space_name = var.csb_space_name - docker_image_name = var.csb_docker_image_name - broker_route_domain = var.csb_broker_route_domain -} diff --git a/terraform/stack/data.tf b/terraform/stack/data.tf index a8c640e5..8e23cc26 100644 --- a/terraform/stack/data.tf +++ b/terraform/stack/data.tf @@ -13,14 +13,3 @@ data "terraform_remote_state" "tooling" { key = "${var.tooling_stack_name}/terraform.tfstate" } } - -data "terraform_remote_state" "external" { - backend = "s3" - config = { - access_key = var.external_remote_state_reader_access_key_id - secret_key = var.external_remote_state_reader_secret_access_key - region = var.external_remote_state_reader_region - bucket = var.remote_state_bucket_external - key = "${var.external_stack_name}/terraform.tfstate" - } -} diff --git a/terraform/stack/variables.tf b/terraform/stack/variables.tf index 29dda270..036d09a2 100644 --- a/terraform/stack/variables.tf +++ b/terraform/stack/variables.tf @@ -7,57 +7,5 @@ variable "tooling_stack_name" { variable "iaas_stack_name" { } -variable "remote_state_bucket_external" { - type = string -} - -variable "external_remote_state_reader_access_key_id" { - type = string - description = "Access key ID for the IAM user that has permission to read from the state bucket." -} - -variable "external_remote_state_reader_secret_access_key" { - type = string - sensitive = true - description = "Secret access key for the IAM user that has permission to read from the state bucket." -} - -variable "external_remote_state_reader_region" { - type = string - description = "The region in which the remote state bucket is located." -} - -variable "external_stack_name" { - type = string -} - variable "domain_name" { } - -variable "csb_aws_region_govcloud" { - type = string -} - -variable "csb_aws_region_commercial" { - type = string -} - -variable "csb_cg_smtp_aws_ses_zone" { - type = string -} - -variable "csb_docker_image_name" { - type = string -} - -variable "csb_org_name" { - type = string -} - -variable "csb_space_name" { - type = string -} - -variable "csb_broker_route_domain" { - type = string -}