ingress-controller: terraform

ingress-controller/kustomize/crd/bases/README.md

@@ -0,0 +1 @@
+Origin: https://github.com/pomerium/ingress-controller/tree/main/config/crd/bases

ingress-controller/terraform/README.md

@@ -0,0 +1,12 @@
+This Terraform module installs the Pomerium Ingress Controller.
+
+Docs: https://www.pomerium.com/docs/deploying/k8s/install
+
+```terraform
+module "pomerium_ingress_controller" {
+    source = "git:https://github.com/pomerium/install//ingress-controller/terraform?ref=REF"
+}
+```
+
+Where `REF` may be an individual commit, a branch (i.e. `main`) or version tag (i.e. `v0.28.0`).
+

ingress-controller/terraform/cluster_role_bindings.tf

@@ -0,0 +1,19 @@
+resource "kubernetes_cluster_role_binding" "controller" {
+  metadata {
+    name   = var.controller_cluster_role_name
+    labels = var.cluster_role_labels
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = kubernetes_cluster_role.controller.metadata[0].name
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    name      = kubernetes_service_account.controller.metadata[0].name
+    namespace = var.namespace_name
+  }
+}
+

ingress-controller/terraform/cluster_roles.tf

@@ -0,0 +1,48 @@
+resource "kubernetes_cluster_role" "controller" {
+  metadata {
+    name   = var.controller_cluster_role_name
+    labels = var.cluster_role_labels
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["services", "endpoints", "secrets"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["services/status", "secrets/status", "endpoints/status"]
+    verbs      = ["get"]
+  }
+
+  rule {
+    api_groups = ["networking.k8s.io"]
+    resources  = ["ingresses", "ingressclasses"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["networking.k8s.io"]
+    resources  = ["ingresses/status"]
+    verbs      = ["get", "patch", "update"]
+  }
+
+  rule {
+    api_groups = ["ingress.pomerium.io"]
+    resources  = ["pomerium"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["ingress.pomerium.io"]
+    resources  = ["pomerium/status"]
+    verbs      = ["get", "update", "patch"]
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["events"]
+    verbs      = ["create", "patch"]
+  }
+}

ingress-controller/terraform/config.tf

@@ -0,0 +1,21 @@
+resource "kubectl_manifest" "pomerium_config" {
+  count = local.config != null ? 1 : 0
+
+  depends_on = [kubectl_manifest.pomerium_crd]
+  yaml_body = yamlencode({
+    apiVersion = "ingress.pomerium.io/v1"
+    kind       = "Pomerium"
+    metadata = {
+      name = "${var.pomerium_config_name}"
+    }
+    spec = local.config
+  })
+}
+
+locals {
+  default_config = {
+    secrets = "${var.namespace_name}/${local.secrets_name}"
+  }
+
+  config = var.config != null ? merge(local.default_config, var.config) : null
+}

ingress-controller/terraform/crd.tf

@@ -0,0 +1,4 @@
+resource "kubectl_manifest" "pomerium_crd" {
+  yaml_body = file("${path.module}/crd.yaml")
+}
+

ingress-controller/terraform/crd.yaml

@@ -0,0 +1 @@
+../kustomize/crd/bases/ingress.pomerium.io_pomerium.yaml

ingress-controller/terraform/deployment.tf

@@ -0,0 +1,149 @@
+resource "kubernetes_deployment" "pomerium" {
+  metadata {
+    name      = var.deployment_name
+    namespace = var.namespace_name
+    labels    = local.deployment_labels
+  }
+
+  depends_on = [
+    kubernetes_secret.bootstrap
+  ]
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations,
+      spec[0].template[0].metadata[0].annotations,
+      spec[0].template[0].spec[0].container[0].resources,
+      spec[0].template[0].spec[0].container[0].security_context,
+      spec[0].template[0].spec[0].toleration,
+      spec[0].template[0].spec[0].security_context,
+    ]
+  }
+
+  spec {
+    replicas = var.deployment_replicas
+
+    selector {
+      match_labels = local.pod_labels
+    }
+
+    template {
+      metadata {
+        labels = local.pod_labels
+      }
+
+      spec {
+        service_account_name             = kubernetes_service_account.controller.metadata[0].name
+        termination_grace_period_seconds = 10
+
+        security_context {
+          run_as_non_root = true
+        }
+
+        node_selector = local.node_selector
+
+        container {
+          name              = "pomerium-ingress-controller"
+          image             = "${var.image_repository}:${var.image_tag}"
+          image_pull_policy = var.image_pull_policy
+
+          args = compact([
+            "all-in-one",
+            "--pomerium-config=${var.pomerium_config_name}",
+            "--update-status-from-service=${var.namespace_name}/pomerium-proxy",
+            "--metrics-bind-address=$(POD_IP):9090",
+            var.enable_databroker ? "--databroker-auto-tls=pomerium-databroker.${var.namespace_name}.svc" : null,
+          ])
+
+          env {
+            name  = "TMPDIR"
+            value = "/tmp"
+          }
+
+          env {
+            name  = "XDG_CACHE_HOME"
+            value = "/tmp"
+          }
+
+          env {
+            name = "POD_IP"
+            value_from {
+              field_ref {
+                field_path = "status.podIP"
+              }
+            }
+          }
+
+          port {
+            container_port = 8443
+            name           = "https"
+            protocol       = "TCP"
+          }
+
+          port {
+            container_port = 8080
+            name           = "http"
+            protocol       = "TCP"
+          }
+
+          port {
+            container_port = 9090
+            name           = "metrics"
+            protocol       = "TCP"
+          }
+
+          dynamic "port" {
+            for_each = var.enable_databroker ? [1] : []
+            content {
+              container_port = 5443
+              name           = "databroker"
+              protocol       = "TCP"
+            }
+          }
+
+          resources {
+            limits = {
+              cpu    = var.resources_limits_cpu
+              memory = var.resources_limits_memory
+            }
+
+            requests = {
+              cpu    = var.resources_requests_cpu
+              memory = var.resources_requests_memory
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+            read_only_root_filesystem  = true
+            run_as_group               = 65532
+            run_as_non_root            = true
+            run_as_user                = 65532
+          }
+
+          volume_mount {
+            name       = "tmp"
+            mount_path = "/tmp"
+          }
+        }
+
+        dynamic "toleration" {
+          for_each = var.tolerations
+          content {
+            key                = lookup(toleration.value, "key", null)
+            operator           = lookup(toleration.value, "operator", null)
+            value              = lookup(toleration.value, "value", null)
+            effect             = lookup(toleration.value, "effect", null)
+            toleration_seconds = lookup(toleration.value, "toleration_seconds", null)
+          }
+        }
+
+        volume {
+          name = "tmp"
+
+          empty_dir {}
+        }
+      }
+    }
+  }
+}

ingress-controller/terraform/ingress_class.tf

@@ -0,0 +1,10 @@
+resource "kubernetes_ingress_class" "pomerium" {
+  metadata {
+    name   = var.ingress_class_name
+    labels = var.labels
+  }
+
+  spec {
+    controller = "pomerium.io/ingress-controller"
+  }
+}

ingress-controller/terraform/locals.tf

@@ -0,0 +1,23 @@
+locals {
+  default_node_selector = {
+    "kubernetes.io/os" = "linux"
+  }
+
+  node_selector = merge(local.default_node_selector, var.node_selector)
+
+  secrets_name = "bootstrap"
+
+  default_labels = {
+    "app.kubernetes.io/name"       = "pomerium-ingress-controller"
+    "app.kubernetes.io/version"    = var.image_tag
+    "app.kubernetes.io/managed-by" = "terraform"
+  }
+
+  default_pod_labels = {
+    "app.kubernetes.io/component" = "proxy"
+  }
+
+  deployment_labels = merge(local.default_labels, var.labels)
+  pod_labels        = merge(local.deployment_labels, local.default_pod_labels, var.pod_labels)
+}
+

ingress-controller/terraform/namespace.tf

@@ -0,0 +1,7 @@
+resource "kubernetes_namespace" "pomerium" {
+  count = var.use_external_namespace ? 0 : 1
+  metadata {
+    name   = var.namespace_name
+    labels = var.labels
+  }
+}

ingress-controller/terraform/outputs.tf

@@ -0,0 +1,6 @@
+output "bootstrap_secret" {
+  value = {
+    name      = kubernetes_secret.bootstrap.metadata[0].name
+    namespace = kubernetes_secret.bootstrap.metadata[0].namespace
+  }
+}

ingress-controller/terraform/providers.tf

@@ -0,0 +1,24 @@
+terraform {
+  required_version = ">= 0.13"
+  required_providers {
+    tls = {
+      source  = "hashicorp/tls"
+      version = "~> 4.0"
+    }
+
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.0"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
+
+    kubectl = {
+      source  = "gavinbunney/kubectl"
+      version = ">= 1.7.0"
+    }
+  }
+}

ingress-controller/terraform/secrets.tf

@@ -0,0 +1,31 @@
+resource "kubernetes_secret" "bootstrap" {
+  metadata {
+    name      = local.secrets_name
+    namespace = var.namespace_name
+  }
+
+  type = "Opaque"
+
+  binary_data = {
+    "shared_secret" = random_bytes.shared_secret.base64
+    "cookie_secret" = random_bytes.cookie_secret.base64
+  }
+
+  data = {
+    "signing_key" = tls_private_key.signing_key.private_key_pem
+  }
+}
+
+resource "tls_private_key" "signing_key" {
+  algorithm   = "ECDSA"
+  ecdsa_curve = "P256"
+}
+
+resource "random_bytes" "shared_secret" {
+  length = 32
+}
+
+resource "random_bytes" "cookie_secret" {
+  length = 32
+}
+

ingress-controller/terraform/service_accounts.tf

@@ -0,0 +1,8 @@
+resource "kubernetes_service_account" "controller" {
+  metadata {
+    name      = var.controller_service_account_name
+    namespace = var.namespace_name
+    labels    = var.service_account_labels
+  }
+}
+