Skip to content

Commit ed20789

Browse files
ridwanbejoridwanbejo
committed
first commit!
0 parents  commit ed20789

34 files changed

+1125
-0
lines changed

‎.github/workflows/action.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: "Terraform-MongoDB-User Module"
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
8+
jobs:
9+
terraform-checks:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Check out code
13+
uses: actions/checkout@v2
14+
15+
- uses: hashicorp/setup-terraform@v1
16+
with:
17+
terraform_version: 1.6.3
18+
19+
- uses: terraform-linters/setup-tflint@v3
20+
name: Setup TFLint
21+
with:
22+
tflint_version: v0.44.1
23+
24+
- name: Terraform Init
25+
id: tf-init
26+
run: terraform init
27+
28+
- name: Terraform Validate
29+
id: tf-validate
30+
run: terraform validate
31+
32+
- name: Terraform Format Check
33+
id: tf-fmt-check
34+
run: terraform fmt -recursive -check
35+
continue-on-error: true
36+
37+
- name: Show version
38+
run: tflint --version
39+
40+
- name: Init TFLint
41+
run: tflint --init
42+
env:
43+
# https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/plugins.md#avoiding-rate-limiting
44+
GITHUB_TOKEN: ${{ github.token }}
45+
46+
- name: Run TFLint
47+
run: tflint -f compact
48+
49+
- name: TFSec
50+
uses: aquasecurity/[email protected]
51+
with:
52+
soft_fail: true

‎.gitignore‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
.DS_Store
2+
*.lock.hcl
3+
4+
# Local .terraform directories
5+
**/.terraform/*
6+
7+
# .tfstate files
8+
*.tfstate
9+
*.tfstate.*
10+
11+
# Crash log files
12+
crash.log
13+
crash.*.log
14+
15+
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
16+
# password, private keys, and other secrets. These should not be part of version
17+
# control as they are data points which are potentially sensitive and subject
18+
# to change depending on the environment.
19+
# *.tfvars
20+
*.tfvars.json
21+
22+
# Ignore override files as they are usually used to override resources locally and so
23+
# are not checked in
24+
override.tf
25+
override.tf.json
26+
*_override.tf
27+
*_override.tf.json
28+
29+
# Include override files you do wish to add to version control using negated pattern
30+
# !example_override.tf
31+
32+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
33+
# example: *tfplan*
34+
35+
# Ignore CLI configuration files
36+
.terraformrc
37+
terraform.rc

‎.pre-commit-config.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v2.3.0
4+
hooks:
5+
- id: trailing-whitespace
6+
- id: end-of-file-fixer
7+
- id: check-yaml
8+
- id: check-added-large-files
9+
- repo: https://github.com/antonbabenko/pre-commit-terraform
10+
rev: v1.64.1
11+
hooks:
12+
- id: terraform_validate
13+
- id: terraform_fmt
14+
- id: terraform_tflint
15+
- id: terraform_tfsec

‎LICENSE‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
BSD 3-Clause License
2+
3+
Copyright (c) 2023, ridwanfs
4+
5+
Redistribution and use in source and binary forms, with or without
6+
modification, are permitted provided that the following conditions are met:
7+
8+
1. Redistributions of source code must retain the above copyright notice, this
9+
list of conditions and the following disclaimer.
10+
11+
2. Redistributions in binary form must reproduce the above copyright notice,
12+
this list of conditions and the following disclaimer in the documentation
13+
and/or other materials provided with the distribution.
14+
15+
3. Neither the name of the copyright holder nor the names of its
16+
contributors may be used to endorse or promote products derived from
17+
this software without specific prior written permission.
18+
19+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
20+
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21+
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
22+
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
23+
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24+
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
25+
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26+
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27+
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

‎README.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Terraform Kubernetes IAM
2+
3+
This is a Terraform module for managing IAM at Kubernetes. You can use this module both for commercial or non-commercial purposes.
4+
5+
Currently, you can manage these resources in Kubernetes by using this module:
6+
7+
- service account
8+
- token requests
9+
- role
10+
- role binding
11+
- cluster role
12+
- cluster role binding
13+
14+
Tested in:
15+
16+
- Minikube
17+
18+
## A. Prerequisites
19+
20+
Requirements:
21+
22+
- Terraform with version >= 1.4
23+
24+
## B. How to use this module for your Terraform project ?
25+
26+
You can check any examples projects that use this module under `examples` directory.
27+
28+
- iam-1-basic
29+
- iam-2-role-binding
30+
- iam-3-cluster-role-binding
31+
- iam-4-token
32+
33+
## C. Understanding tfvars scenarios
34+
35+
You can check any examples tfvars that use this module under `examples` directory.
36+
37+
- iam-1-basic
38+
- iam-2-role-binding
39+
- iam-3-cluster-role-binding
40+
- iam-4-token
41+
42+
## D. Ensuring quality
43+
44+
I am trying to follow these approaches for ensuring quality of the tf-module:
45+
46+
- **validate**, ensure my Terraform module is in correct configuration based on Terraform guideline
47+
- **auto-format**, ensure my Terraform script is edited with correct format based on Terraform guideline
48+
- **linter**, ensure my Terraform script is in correct format based on Terraform guideline
49+
- **security**, ensure my Terraform module is free from CVE and stay compliance
50+
- **automation**, run all above steps by using automation tool to improve development time and keep best quality before or after merging to Git repository
51+
52+
53+
The tools:
54+
55+
- [terraform validate](https://developer.hashicorp.com/terraform/cli/commands)
56+
- [terraform fmt](https://developer.hashicorp.com/terraform/cli/commands)
57+
- [tflint](https://github.com/terraform-lint48ers/tflint)
58+
- [tfsec](https://github.com/aquasecurity/tfsec)
59+
- [Pre-commit](https://pre-commit.com/)
60+
- Github Action [Setup Terraform pipeline](https://github.com/hashicorp/setup-terraform)
61+
62+
## E. How to contribute ?
63+
64+
If you find any issue, you can raise it here at our [Issue Tracker](https://github.com/ridwanbejo/terraform-kubernetes-iam/issues)
65+
66+
If you have something that you want to merge to this repo, just raise [Pull Requests](https://github.com/ridwanbejo/terraform-kubernetes-iam/pulls)
67+
68+
Ensure that you install all the tools from section D. for development purpose.

‎TFDOCS.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
2+
# Terraform-Kubernetes-IAM module
3+
4+
## Requirements
5+
6+
| Name | Version |
7+
|------|---------|
8+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4 |
9+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | 2.25.1 |
10+
11+
## Providers
12+
13+
| Name | Version |
14+
|------|---------|
15+
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.25.1 |
16+
17+
## Modules
18+
19+
No modules.
20+
21+
## Resources
22+
23+
| Name | Type |
24+
|------|------|
25+
| [kubernetes_cluster_role_binding_v1.cluster_role_bindings](https://registry.terraform.io/providers/hashicorp/kubernetes/2.25.1/docs/resources/cluster_role_binding_v1) | resource |
26+
| [kubernetes_cluster_role_v1.cluster_roles](https://registry.terraform.io/providers/hashicorp/kubernetes/2.25.1/docs/resources/cluster_role_v1) | resource |
27+
| [kubernetes_role_binding_v1.role_bindings](https://registry.terraform.io/providers/hashicorp/kubernetes/2.25.1/docs/resources/role_binding_v1) | resource |
28+
| [kubernetes_role_v1.roles](https://registry.terraform.io/providers/hashicorp/kubernetes/2.25.1/docs/resources/role_v1) | resource |
29+
| [kubernetes_service_account_v1.service_accounts](https://registry.terraform.io/providers/hashicorp/kubernetes/2.25.1/docs/resources/service_account_v1) | resource |
30+
| [kubernetes_token_request_v1.tokens](https://registry.terraform.io/providers/hashicorp/kubernetes/2.25.1/docs/resources/token_request_v1) | resource |
31+
32+
## Inputs
33+
34+
| Name | Description | Type | Default | Required |
35+
|------|-------------|------|---------|:--------:|
36+
| <a name="input_cluster_role_bindings"></a> [cluster\_role\_bindings](#input\_cluster\_role\_bindings) | n/a | <pre>list(object({<br> metadata = object({<br> annotations = optional(map(any))<br> labels = optional(map(any))<br> name = string<br> })<br><br> role_ref = object({<br> api_group = string<br> kind = string<br> name = string <br> })<br><br> subject = list(object({<br> name = string<br> namespace = optional(string)<br> kind = string<br> api_group = optional(string)<br> }))<br> }))</pre> | n/a | yes |
37+
| <a name="input_cluster_roles"></a> [cluster\_roles](#input\_cluster\_roles) | n/a | <pre>list(object({<br> metadata = object({<br> annotations = optional(map(any))<br> labels = optional(map(any))<br> name = string<br> })<br><br> rule = optional(list(object({<br> verbs = list(string)<br> api_groups = optional(list(string))<br> resources = optional(list(string))<br> resource_names = optional(list(string))<br> non_resource_urls = optional(list(string))<br> })))<br><br> aggregation_rule = optional(object({<br> cluster_role_selectors = optional(object({<br> match_labels = optional(map(string))<br> match_expressions = optional(list(object({<br> key = optional(string)<br> operator = optional(string)<br> values = optional(list(string))<br> })))<br> }))<br> }))<br> }))</pre> | n/a | yes |
38+
| <a name="input_role_bindings"></a> [role\_bindings](#input\_role\_bindings) | n/a | <pre>list(object({<br> metadata = object({<br> annotations = optional(map(any))<br> labels = optional(map(any))<br> name = string<br> namespace = optional(string)<br> })<br><br> role_ref = object({<br> api_group = string<br> kind = string<br> name = string <br> })<br><br> subject = list(object({<br> name = string<br> namespace = optional(string)<br> kind = string<br> api_group = optional(string)<br> }))<br> }))</pre> | n/a | yes |
39+
| <a name="input_roles"></a> [roles](#input\_roles) | n/a | <pre>list(object({<br> metadata = object({<br> annotations = optional(map(any))<br> labels = optional(map(any))<br> name = string<br> namespace = optional(string)<br> })<br><br> rule = list(object({<br> verbs = list(string)<br> api_groups = optional(list(string))<br> resources = optional(list(string))<br> resource_names = optional(list(string))<br> }))<br> }))</pre> | n/a | yes |
40+
| <a name="input_service_accounts"></a> [service\_accounts](#input\_service\_accounts) | n/a | <pre>list(object({<br> metadata = object({<br> annotations = optional(map(any))<br> labels = optional(map(any))<br> name = string<br> namespace = optional(string)<br> })<br><br> secret = optional(list(object({<br> name = optional(string)<br> })))<br><br> image_pull_secret = optional(list(object({<br> name = optional(string)<br> })))<br><br> automount_service_account_token = optional(bool)<br> }))</pre> | n/a | yes |
41+
| <a name="input_token_requests"></a> [token\_requests](#input\_token\_requests) | n/a | <pre>list(object({<br> metadata = object({<br> annotations = optional(map(any))<br> labels = optional(map(any))<br> name = string<br> namespace = optional(string)<br> })<br><br> spec = optional(object({<br> expiration_seconds = optional(number)<br> audiences = optional(list(string))<br><br> bound_object_ref = optional(object({<br> api_version = optional(string)<br> kind = optional(string)<br> name = optional(list(string))<br> uid = optional(list(string))<br> }))<br> }))<br> }))</pre> | n/a | yes |
42+
43+
## Outputs
44+
45+
| Name | Description |
46+
|------|-------------|
47+
| <a name="output_kubernetes_cluster_role_bindings"></a> [kubernetes\_cluster\_role\_bindings](#output\_kubernetes\_cluster\_role\_bindings) | List of Kubernetes cluster role bindings |
48+
| <a name="output_kubernetes_cluster_roles"></a> [kubernetes\_cluster\_roles](#output\_kubernetes\_cluster\_roles) | List of Kubernetes cluster roles |
49+
| <a name="output_kubernetes_role_bindings"></a> [kubernetes\_role\_bindings](#output\_kubernetes\_role\_bindings) | List of Kubernetes role bindings |
50+
| <a name="output_kubernetes_roles"></a> [kubernetes\_roles](#output\_kubernetes\_roles) | List of Kubernetes roles |
51+
| <a name="output_kubernetes_service_accounts"></a> [kubernetes\_service\_accounts](#output\_kubernetes\_service\_accounts) | List of Kubernetes service accounts |
52+
| <a name="output_kubernetes_token_requests"></a> [kubernetes\_token\_requests](#output\_kubernetes\_token\_requests) | List of Kubernetes token requests |
53+
<!-- END_TF_DOCS -->

‎examples/iam-1-basic/README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Basic example for Terraform-Kubernetes-IAM module
2+
3+
To run this example you need to execute:
4+
5+
```
6+
$ terraform init
7+
$ terraform plan
8+
$ terraform apply
9+
```
10+
11+
<!-- BEGIN_TF_DOCS -->
12+
## Requirements
13+
14+
| Name | Version |
15+
|------|---------|
16+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4 |
17+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | 2.25.1 |
18+
19+
## Providers
20+
21+
No providers.
22+
23+
## Modules
24+
25+
| Name | Source | Version |
26+
|------|--------|---------|
27+
| <a name="module_tf_kube_iam"></a> [tf\_kube\_iam](#module\_tf\_kube\_iam) | ../../ | n/a |
28+
29+
## Resources
30+
31+
No resources.
32+
33+
## Inputs
34+
35+
| Name | Description | Type | Default | Required |
36+
|------|-------------|------|---------|:--------:|
37+
| <a name="input_kube_service_accounts"></a> [kube\_service\_accounts](#input\_kube\_service\_accounts) | n/a | `list(any)` | `[]` | no |
38+
39+
## Outputs
40+
41+
| Name | Description |
42+
|------|-------------|
43+
| <a name="output_kube_service_accounts"></a> [kube\_service\_accounts](#output\_kube\_service\_accounts) | Current Kubernetes service accounts |
44+
<!-- END_TF_DOCS -->

‎examples/iam-1-basic/main.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
module "tf_kube_iam" {
2+
source = "../../"
3+
4+
service_accounts = var.kube_service_accounts
5+
token_requests = []
6+
cluster_roles = []
7+
cluster_role_bindings = []
8+
roles = []
9+
role_bindings = []
10+
}

‎examples/iam-1-basic/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "kube_service_accounts" {
2+
description = "Current Kubernetes service accounts"
3+
value = module.tf_kube_iam.kubernetes_service_accounts
4+
}

‎examples/iam-1-basic/providers.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
terraform {
2+
required_version = ">= 1.4"
3+
4+
required_providers {
5+
kubernetes = {
6+
source = "hashicorp/kubernetes"
7+
version = "2.25.1"
8+
}
9+
}
10+
}
11+
12+
provider "kubernetes" {
13+
config_path = "~/.kube/config"
14+
config_context = "minikube"
15+
}

0 commit comments

Comments
 (0)