feat: add nightly testing eks

.github/bundles/uds-bundle.yaml

@@ -0,0 +1,50 @@
+kind: UDSBundle
+metadata:
+  name: uds-core-eks-nightly
+  description: A UDS bundle for deploying EKS and UDS Core
+  # x-release-please-start-version
+  version: "0.17.0"
+  # x-release-please-end
+
+packages:
+  - name: init
+    repository: ghcr.io/defenseunicorns/packages/init
+    # renovate: datasource=github-tags depName=defenseunicorns/zarf versioning=semver
+    ref: v0.32.4
+
+  - name: core
+    path: ../../build/
+    # x-release-please-start-version
+    ref: 0.17.0
+    # x-release-please-end
+    overrides:
+      velero:
+        velero:
+          variables:
+            - name: VELERO_USE_SECRET
+              description: "Toggle use secret off to use IRSA."
+              path: credentials.useSecret
+            - name: VELERO_IRSA_ANNOTATION
+              description: "IRSA ARN annotation to use for Velero"
+              path: serviceAccount.server.annotations
+      loki:
+        loki:
+          variables:
+            - name: LOKI_CHUNKS_BUCKET
+              description: "The object storage bucket for Loki chunks"
+              path: loki.storage.bucketNames.chunks
+            - name: LOKI_RULER_BUCKET
+              description: "The object storage bucket for Loki ruler"
+              path: loki.storage.bucketNames.ruler
+            - name: LOKI_ADMIN_BUCKET
+              description: "The object storage bucket for Loki admin"
+              path: loki.storage.bucketNames.admin
+            - name: LOKI_S3_ENDPOINT
+              description: "The S3 endpoint"
+              path: loki.storage.s3.endpoint
+            - name: LOKI_S3_REGION
+              description: "The S3 region"
+              path: loki.storage.s3.region
+            - name: LOKI_IRSA_ANNOTATION
+              description: "The irsa role annotation"
+              path: loki.serviceAccount.annotations

.github/bundles/uds-config.yaml

@@ -0,0 +1,21 @@
+# Overwritten by ci-iac-aws package
+options:
+  architecture: amd64
+
+variables:
+  core:
+    loki_chunks_bucket: ${ZARF_VAR_LOKI_S3_BUCKET}
+    loki_ruler_bucket: ${ZARF_VAR_LOKI_S3_BUCKET}
+    loki_admin_bucket: ${ZARF_VAR_LOKI_S3_BUCKET}
+    loki_s3_region: ${ZARF_VAR_LOKI_S3_AWS_REGION}
+    loki_s3-endpoint: ""
+    loki_irsa_annotation:
+      eks.amazonaws.com/role-arn: ${ZARF_VAR_LOKI_S3_ROLE_ARN}
+    velero_use_secret: false
+    velero_irsa_annotation:
+      eks.amazonaws.com/role-arn: "${ZARF_VAR_VELERO_S3_ROLE_ARN}"
+    velero_bucket: ${ZARF_VAR_VELERO_S3_BUCKET}
+    velero_bucket_region: ${ZARF_VAR_VELERO_S3_AWS_REGION}
+    velero_bucket_provider_url: ""
+    velero_bucket_credential_name: ""
+    velero_bucket_credential_key: ""

.github/test-infra/ci-iac-aws/extract.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+set +o xtrace
+
+# Check if the runtime environment is Darwin (Mac OS X) or Linux
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  ARCH_NAME=darwin
+elif [[ "$OSTYPE" == "linux-gnu"* ]]; then
+  ARCH_NAME=linux
+elif [[ "$OSTYPE" == "msys" ]]; then
+  ARCH_NAME=windows
+elif [[ "$OSTYPE" == "cygwin" ]]; then
+  ARCH_NAME=windows
+else
+  echo "The OS is not supported"
+  exit 1
+fi
+
+# Check the processor architecture
+if [[ $(uname -m) == "x86_64" ]]; then
+  echo "The processor architecture is 64-bit"
+  ARCH_PROC=amd64
+elif [[ $(uname -m) == "i686" || $(uname -m) == "i386" ]]; then
+  echo "The processor architecture is 32-bit"
+  echo "The processor is not AMD or ARM"
+elif [[ $(uname -m) == "arm64" ]]; then
+  ARCH_PROC=arm64
+else
+# default...
+  ARCH_PROC=amd64
+fi
+
+echo "HI!"
+echo "ARCH_NAME: ${ARCH_NAME}"
+echo "ARCH_PROC: ${ARCH_PROC}"
+
+# todo: actually use the terraform binary we download
+mkdir -p run/loki && chmod -R ugo+rwx run/loki
+mkdir -p run/velero && chmod -R ugo+rwx run/velero
+unzip -o -q tmp/terraform_${1}_${ARCH_NAME}_${ARCH_PROC}.zip -d run

.github/test-infra/ci-iac-aws/loki/.gitignore

@@ -0,0 +1,2 @@
+.terraform/*
+.terraform.lock.hcl

.github/test-infra/ci-iac-aws/loki/README.md

@@ -0,0 +1,52 @@
+# Loki 
+
+Terraform for deploying resources necessary for Loki
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 4.67.0 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_S3"></a> [S3](#module\_S3) | github.com/defenseunicorns/delivery-aws-iac//modules/s3-irsa | v0.0.4-alpha |
+| <a name="module_generate_kms"></a> [generate\_kms](#module\_generate\_kms) | github.com/defenseunicorns/uds-iac-aws-kms | uds-core-test |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_eks_cluster.existing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
+| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_force_destroy"></a> [force\_destroy](#input\_force\_destroy) | Option to set force destroy | `bool` | `false` | no |
+| <a name="input_key_alias"></a> [key\_alias](#input\_key\_alias) | alias for KMS Key | `string` | `"bigbang-loki"` | no |
+| <a name="input_key_owner_arns"></a> [key\_owner\_arns](#input\_key\_owner\_arns) | ARNS of KMS key owners, needed for use of key | `list(string)` | `[]` | no |
+| <a name="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn) | KMS Key ARN if known, if not, will be generated | `string` | `null` | no |
+| <a name="input_name"></a> [name](#input\_name) | Name for cluster | `any` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_aws_region"></a> [aws\_region](#output\_aws\_region) | n/a |
+| <a name="output_dynamodb_name"></a> [dynamodb\_name](#output\_dynamodb\_name) | n/a |
+| <a name="output_eks_cluster_oidc_arn"></a> [eks\_cluster\_oidc\_arn](#output\_eks\_cluster\_oidc\_arn) | The ARN of the OIDC Provider of the EKS Cluster |
+| <a name="output_irsa_role"></a> [irsa\_role](#output\_irsa\_role) | n/a |
+| <a name="output_s3"></a> [s3](#output\_s3) | n/a |
+| <a name="output_s3_bucket"></a> [s3\_bucket](#output\_s3\_bucket) | n/a |
+<!-- END_TF_DOCS -->

.github/test-infra/ci-iac-aws/loki/main.tf

@@ -0,0 +1,153 @@
+# test tf
+provider "aws" {
+  region = var.region
+
+  default_tags {
+    tags = {
+      PermissionsBoundary = var.permissions_boundary_name
+    }
+  }
+}
+
+terraform {
+  required_version = "1.5.7"
+  backend "s3" {
+  }
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.0, != 5.17.0"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "3.5.1"
+    }
+  }
+}
+
+# taken from zarf bb repo
+resource "random_id" "default" {
+  byte_length = 2
+}
+
+data "aws_eks_cluster" "existing" {
+  name = var.name
+}
+
+data "aws_caller_identity" "current" {}
+
+data "aws_partition" "current" {}
+
+data "aws_region" "current" {}
+
+locals {
+  oidc_url_without_protocol = substr(data.aws_eks_cluster.existing.identity[0].oidc[0].issuer, 8, -1)
+  oidc_arn                  = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${local.oidc_url_without_protocol}"
+
+  generate_kms_key              = var.create_kms_key ? 1 : 0
+  kms_key_arn                   = var.kms_key_arn == null ? module.generate_kms[0].kms_key_arn : var.kms_key_arn
+  name                          = "${var.name}-loki"
+  iam_role_permissions_boundary = var.use_permissions_boundary ? "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:policy/${var.permissions_boundary_name}" : null
+
+  # The conditional may need to look like this depending on how we decide to handle the way varf wants to template things
+  # generate_kms_key          = var.kms_key_arn == "" ? 1 : 0
+  # kms_key_arn               = var.kms_key_arn == "" ? module.generate_kms[0].kms_key_arn : var.kms_key_arn
+}
+
+module "S3" {
+  source                  = "github.com/defenseunicorns/terraform-aws-uds-s3?ref=v0.0.6"
+  name_prefix             = "${var.bucket_name}-"
+  kms_key_arn             = local.kms_key_arn
+  force_destroy           = var.force_destroy
+  create_bucket_lifecycle = true
+}
+
+resource "aws_s3_bucket_policy" "bucket_policy" {
+  bucket = module.S3.bucket_name
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "s3:ListBucket",
+          "s3:GetObject",
+          "s3:PutObject"
+        ]
+        Effect = "Allow"
+        Principal = {
+          AWS = module.irsa.role_arn
+        }
+        Resource = [
+          module.S3.bucket_arn,
+          "${module.S3.bucket_arn}/*"
+        ]
+      }
+    ]
+  })
+}
+
+module "generate_kms" {
+  count  = local.generate_kms_key
+  source = "github.com/defenseunicorns/terraform-aws-uds-kms?ref=v0.0.2"
+
+  key_owners = var.key_owner_arns
+  # A list of IAM ARNs for those who will have full key permissions (`kms:*`)
+  kms_key_alias_name_prefix = "${local.name}-" # Prefix for KMS key alias.
+  kms_key_deletion_window   = var.kms_key_deletion_window
+  # Waiting period for scheduled KMS Key deletion. Can be 7-30 days.
+  kms_key_description = "${var.name} UDS Core deployment Loki Key" # Description for the KMS key.
+  tags = {
+    Deployment = "UDS Core ${local.name}"
+  }
+}
+
+
+module "irsa" {
+  source                        = "github.com/defenseunicorns/terraform-aws-uds-irsa?ref=v0.0.2"
+  name                          = local.name
+  kubernetes_service_account    = var.kubernetes_service_account
+  kubernetes_namespace          = var.kubernetes_namespace
+  oidc_provider_arn             = local.oidc_arn
+  role_permissions_boundary_arn = local.iam_role_permissions_boundary
+
+  role_policy_arns = tomap({
+    "loki" = aws_iam_policy.loki_policy.arn
+  })
+
+}
+
+resource "random_id" "unique_id" {
+  byte_length = 4
+}
+
+
+resource "aws_iam_policy" "loki_policy" {
+  name        = "${local.name}-irsa-${random_id.unique_id.hex}"
+  path        = "/"
+  description = "IAM policy for Loki to have necessary permissions to use S3 for storing logs."
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["s3:ListBucket"]
+        Resource = ["arn:${data.aws_partition.current.partition}:s3:::${module.S3.bucket_name}"]
+      },
+      {
+        Effect   = "Allow"
+        Action   = ["s3:*Object"]
+        Resource = ["arn:${data.aws_partition.current.partition}:s3:::${module.S3.bucket_name}/*"]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "kms:GenerateDataKey",
+          "kms:Decrypt"
+        ]
+        Resource = [local.kms_key_arn]
+      }
+    ]
+  })
+}

.github/test-infra/ci-iac-aws/loki/output.tf

@@ -0,0 +1,24 @@
+output "aws_region" {
+  value = data.aws_region.current.name
+}
+
+output "irsa_role_arn" {
+  value = module.irsa.role_arn
+}
+
+output "s3" {
+  value = module.S3
+}
+
+output "s3_bucket" {
+  value = module.S3.bucket_name
+}
+
+output "kms_key_arn" {
+  description = "The ARN of the OIDC Provider of the EKS Cluster"
+  value       = local.kms_key_arn
+}
+
+output "force_destroy" {
+  value = var.force_destroy
+}

.github/test-infra/ci-iac-aws/loki/terraform.tfvars

@@ -0,0 +1,10 @@
+region        = "###ZARF_VAR_REGION###"
+name          = "###ZARF_VAR_CLUSTER_NAME###"
+bucket_name   = "###ZARF_VAR_CLUSTER_NAME###-loki"
+force_destroy = "true"
+
+kubernetes_service_account = "logging-loki"
+kubernetes_namespace       = "logging"
+
+permissions_boundary_name = "###ZARF_VAR_PERMISSIONS_BOUNDARY_NAME###"
+use_permissions_boundary  = "###ZARF_VAR_USE_PERMISSIONS_BOUNDARY###"