Skip to content

Commit 663f502

Browse files
sudharshanibmsudharshanibm
committed
Terraform for k8s-s390x-conformance job on ibmcloud
Signed-off-by: Sudharshan Muralidharan <[email protected]>
1 parent 4d343b8 commit 663f502

File tree

27 files changed

+854
-0
lines changed

27 files changed

+854
-0
lines changed

‎infra/ibmcloud/terraform/k8s-s390x-conformance/README.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# _TF: IBM K8s s390x Conformance_
2+
These define Terraform resources for setting up infrastructure for the Kubernetes on s390x conformance job.
3+
4+
---
5+
## Initial Setup
6+
7+
### Supporting infrastructure
8+
9+
#### Deploy k8s-infra-setup resources
10+
11+
- this covers things like Resource Group, s390x Virtual Server Workspace, Virtual Private Cloud, IBM Cloud Secret Manager Secrets, Transit Gateway, etc.
12+
- Once the deployment successfully completes, the `service_instance_id` and `secrets_manager_id` will be generated and should be used in the subsequent steps.
13+
14+
---
15+
#### Deploy k8s-s390x-conformance resources
16+
17+
**1. Navigate to the correct directory**
18+
<br> You need to be in the `k8s-s390x-conformance` directory to run the automation.
19+
20+
**2. Check the `versions.tf` file**
21+
<br> Set `secret_key` and `access_key` in `versions.tf` to configure the remote S3 backend (IBM Cloud COS).
22+
23+
**3. Initialize Terraform**
24+
<br> Execute the following command to initialize Terraform in your project directory. This command will download the necessary provider plugins and prepare the working environment.
25+
```
26+
terraform init -reconfigure
27+
```
28+
29+
**4. Check the `variables.tf` file**
30+
<br> Open the `variables.tf` file to review all the available variables. This file lists all customizable inputs for your Terraform configuration.
31+
32+
`ibmcloud_api_key`, `service_instance_id`, `secrets_manager_id` are the only required variables that you must set in order to proceed. You can set this key either by adding it to your `var.tfvars` file or by exporting it as an environment variable.
33+
34+
**Option 1:** Set in `var.tfvars` file
35+
Create `var.tfvars` file and set the following variables in `var.tfvars` file:
36+
```
37+
ibmcloud_api_key = "<YOUR_API_KEY>"
38+
secrets_manager_id = "<SECRETS_MANAGER_ID>"
39+
```
40+
41+
**Option 2:** Export as an environment variable
42+
Alternatively, you can export above as an environment variable before running Terraform:
43+
```
44+
export TF_VAR_ibmcloud_api_key="<YOUR_API_KEY>"
45+
export TF_VAR_secrets_manager_id="<SECRETS_MANAGER_ID>"
46+
```
47+
48+
**5. Run Terraform Apply**
49+
<br> After setting the necessary variables (particularly the API_KEY), execute the following command to apply the Terraform configuration and provision the infrastructure:
50+
```
51+
terraform apply -var-file var.tfvars
52+
```
53+
Terraform will display a plan of the actions it will take, and you'll be prompted to confirm the execution. Type `yes` to proceed.
54+
55+
**6. Get Output Information**
56+
<br> Once the infrastructure has been provisioned, use the terraform output command to list details about the provisioned resources.
57+
```
58+
terraform output
59+
```

‎infra/ibmcloud/terraform/k8s-s390x-conformance/main.tf

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
module "resource_group" {
18+
source = "./modules/resource_group"
19+
}
20+
module "iam_custom_role" {
21+
source = "./modules/iam/custom_role"
22+
}
23+
24+
module "service_ids" {
25+
depends_on = [module.iam_custom_role]
26+
source = "./modules/iam/service_ids"
27+
resource_group_id = module.resource_group.conformance_resource_group_id
28+
}
29+
30+
module "iam_access_groups" {
31+
depends_on = [module.iam_custom_role]
32+
source = "./modules/iam/access_groups"
33+
resource_group_id = module.resource_group.conformance_resource_group_id
34+
}
35+
36+
module "secrets_manager" {
37+
source = "./modules/secrets_manager"
38+
janitor_access_group_id = module.iam_access_groups.janitor_access_group_id
39+
secret_rotator_access_group_id = module.iam_access_groups.secret_rotator_access_group_id
40+
apikey = module.service_ids.sm_read_apikey
41+
resource_group_id = module.resource_group.conformance_resource_group_id
42+
secrets_manager_id = var.secrets_manager_id
43+
}
44+
module "vpc" {
45+
providers = {
46+
ibm = ibm.vpc
47+
}
48+
source = "./modules/vpc"
49+
zone = var.zone
50+
resource_group_id = module.resource_group.conformance_resource_group_id
51+
}

‎infra/ibmcloud/terraform/k8s-s390x-conformance/modules/iam/access_groups/access_groups.tf

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
resource "ibm_iam_access_group" "vpc_build_cluster" {
18+
name = "vpc-build-cluster-access"
19+
description = "Access group with the necessary permissions for provisioning VPC-based build clusters."
20+
}
21+
22+
resource "ibm_iam_access_group_policy" "vpc_build_cluster" {
23+
access_group_id = ibm_iam_access_group.vpc_build_cluster.id
24+
roles = ["VPCBuildClusterRole"]
25+
26+
resources {
27+
service = "is"
28+
resource_group_id = var.resource_group_id
29+
}
30+
}
31+
32+
resource "ibm_iam_access_group" "janitor" {
33+
name = "janitor-access"
34+
description = "Access group with the necessary permissions for the Boskos Janitor."
35+
}
36+
37+
resource "ibm_iam_access_group_policy" "janitor_vpc" {
38+
access_group_id = ibm_iam_access_group.janitor.id
39+
roles = ["JanitorVPCRole"]
40+
41+
resources {
42+
service = "is"
43+
resource_group_id = var.resource_group_id
44+
}
45+
}
46+
47+
resource "ibm_iam_access_group" "secret_rotator" {
48+
name = "secret-rotator"
49+
description = "Access group with the necessary permissions for secret-manager(rotator)."
50+
}
51+
52+
resource "ibm_iam_access_group_policy" "secret_rotator" {
53+
access_group_id = ibm_iam_access_group.secret_rotator.id
54+
roles = ["SecretRotator"]
55+
56+
resources {
57+
service = "secrets-manager"
58+
resource_group_id = var.resource_group_id
59+
}
60+
}

‎infra/ibmcloud/terraform/k8s-s390x-conformance/modules/iam/access_groups/outputs.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
output "vpc_build_cluster_access_group_id" {
18+
value = ibm_iam_access_group.vpc_build_cluster.id
19+
}
20+
21+
output "janitor_access_group_id" {
22+
value = ibm_iam_access_group.janitor.id
23+
}
24+
25+
output "secret_rotator_access_group_id" {
26+
value = ibm_iam_access_group.secret_rotator.id
27+
}
28+

‎infra/ibmcloud/terraform/k8s-s390x-conformance/modules/iam/access_groups/variables.tf

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
variable "resource_group_id" {}

‎infra/ibmcloud/terraform/k8s-s390x-conformance/modules/iam/access_groups/versions.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_providers {
19+
ibm = {
20+
source = "IBM-Cloud/ibm"
21+
}
22+
}
23+
}

‎infra/ibmcloud/terraform/k8s-s390x-conformance/modules/iam/custom_role/iam_custom_role.tf

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
resource "ibm_iam_custom_role" "vpc_build_cluster" {
18+
name = "VPCBuildClusterRole"
19+
display_name = "VPCBuildClusterRole"
20+
service = "is"
21+
actions = [
22+
"is.vpc.vpc.read",
23+
"is.vpc.vpc.create",
24+
"is.vpc.vpc.update",
25+
"is.vpc.vpc.list",
26+
"is.vpc.vpc.delete",
27+
]
28+
}
29+
30+
resource "ibm_iam_custom_role" "sm" {
31+
name = "SMRead"
32+
display_name = "SMRead"
33+
service = "secrets-manager"
34+
actions = [
35+
"secrets-manager.secrets.list",
36+
"secrets-manager.secret.read",
37+
]
38+
}
39+
40+
resource "ibm_iam_custom_role" "janitor_vpc" {
41+
name = "JanitorVPCRole"
42+
display_name = "JanitorVPCRole"
43+
service = "is"
44+
actions = [
45+
"is.instance.instance.delete",
46+
"is.subnet.subnet.delete",
47+
"is.security-group.security-group.delete",
48+
"is.floating-ip.floating-ip.delete",
49+
"is.vpc.vpc.read",
50+
"is.subnet.subnet.read",
51+
"is.security-group.security-group.read",
52+
"is.instance.instance.read",
53+
"resource-controller.instance.retrieve",
54+
"resource-controller.group.retrieve"
55+
]
56+
}
57+
58+
resource "ibm_iam_custom_role" "secret_rotator" {
59+
name = "SecretRotator"
60+
display_name = "SecretRotator"
61+
service = "secrets-manager"
62+
actions = [
63+
"secrets-manager.secret-version.read",
64+
"secrets-manager.secret-version.create",
65+
"secrets-manager.secret.read",
66+
"secrets-manager.secret.rotate",
67+
]
68+
}

‎infra/ibmcloud/terraform/k8s-s390x-conformance/modules/iam/custom_role/versions.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_providers {
19+
ibm = {
20+
source = "IBM-Cloud/ibm"
21+
}
22+
}
23+
}

‎infra/ibmcloud/terraform/k8s-s390x-conformance/modules/iam/service_ids/outputs.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
output "sm_read_apikey" {
18+
value = ibm_iam_service_api_key.service_id_apikey.apikey
19+
sensitive = true
20+
}

0 commit comments

Comments
 (0)