From eae787208e73ad4eb539f7f5b85ac091e975cce7 Mon Sep 17 00:00:00 2001 From: Abderrahmane DKOUR Date: Thu, 12 Dec 2024 17:43:09 +0100 Subject: [PATCH] Added SQS support to ArmoniK.Infra --- service-account/aws/main.tf | 115 +++++++++++++++++++++++++++++++ service-account/aws/variables.tf | 38 ++++++++++ service-account/aws/versions.tf | 13 ++++ storage/aws/sqs/main.tf | 3 + storage/aws/sqs/outputs.tf | 9 +++ storage/aws/sqs/variables.tf | 14 ++++ 6 files changed, 192 insertions(+) create mode 100644 service-account/aws/main.tf create mode 100644 service-account/aws/variables.tf create mode 100644 service-account/aws/versions.tf create mode 100644 storage/aws/sqs/main.tf create mode 100644 storage/aws/sqs/outputs.tf create mode 100644 storage/aws/sqs/variables.tf diff --git a/service-account/aws/main.tf b/service-account/aws/main.tf new file mode 100644 index 000000000..f2b40894b --- /dev/null +++ b/service-account/aws/main.tf @@ -0,0 +1,115 @@ + + +locals { + prefix = var.prefix + tags = merge(var.tags, { module = "amazon-sqs" }) + oidc_arn = var.oidc_provider_arn + oidc_url = trimprefix(var.oidc_issuer_url, "https://") +} + +data "aws_iam_policy_document" "assume_role" { + statement { + effect = "Allow" + + principals { + type = "Service" + identifiers = ["pods.eks.amazonaws.com"] + } + + actions = [ + "sts:AssumeRole", + "sts:TagSession" + ] + } +} + +resource "aws_iam_role" "armonik" { + name = "${local.prefix}-eks-pod-identity-armonik" + #assume_role_policy = data.aws_iam_policy_document.assume_role.json + assume_role_policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Effect = "Allow" + Principal = { + Federated = local.oidc_arn + } + Action = "sts:AssumeRoleWithWebIdentity" + Condition = { + StringEquals = { + "${local.oidc_url}:aud" = "sts.amazonaws.com" + "${local.oidc_url}:sub" = [ + "system:serviceaccount:${var.namespace}:${var.service_account_name}", + ] + } + } + } + ] + }) + tags = local.tags +} + +resource "aws_iam_policy_attachment" "armonik_decrypt_object" { + name = "${local.prefix}-s3-encrypt-decrypt-armonik" + roles = [aws_iam_role.armonik.name] + policy_arn = var.decrypt_policy_arn +} + +data "aws_iam_policy_document" "sqs" { + statement { + sid = "SqsAdmin" + actions = [ + "sqs:*" + ] + effect = "Allow" + resources = ["*"] + } +} + +resource "aws_iam_policy" "sqs" { + name_prefix = "${local.prefix}-sqs-admin" + description = "Policy for allowing SQS admin access" + policy = data.aws_iam_policy_document.sqs.json + tags = local.tags +} + +resource "aws_iam_policy_attachment" "sqs" { + name = "${local.prefix}-sqs" + roles = [aws_iam_role.armonik.name] + policy_arn = aws_iam_policy.sqs.arn +} + +data "aws_iam_policy_document" "s3" { + statement { + sid = "S3Admin" + actions = [ + "s3:*" + ] + effect = "Allow" + resources = ["*"] + } +} + +resource "aws_iam_policy" "s3" { + name_prefix = "${local.prefix}-s3-admin" + description = "Policy for allowing S3 admin access" + policy = data.aws_iam_policy_document.s3.json + tags = local.tags +} + +resource "aws_iam_policy_attachment" "s3" { + name = "${local.prefix}-s3" + roles = [aws_iam_role.armonik.name] + policy_arn = aws_iam_policy.s3.arn +} + +resource "kubernetes_service_account" "armonik" { + metadata { + name = var.service_account_name + namespace = var.namespace + + annotations = { + "eks.amazonaws.com/role-arn" = aws_iam_role.armonik.arn + } + } +} \ No newline at end of file diff --git a/service-account/aws/variables.tf b/service-account/aws/variables.tf new file mode 100644 index 000000000..b6d49547f --- /dev/null +++ b/service-account/aws/variables.tf @@ -0,0 +1,38 @@ +variable "prefix" { + description = "Prefix to use for service account related resources" + type = string +} + +# Tags +variable "tags" { + description = "Tags for resource" + type = map(string) + default = {} +} + +variable "namespace" { + description = "Namespace of ArmoniK service account related resources" + type = string + default = "armonik" +} + +variable "service_account_name" { + description = "Name of the service account to create" + type = string +} + +variable "oidc_provider_arn" { + description = "ARN of the OIDC provider" + type = string +} + +variable "decrypt_policy_arn" { + description = "ARN of the S3 encrypt/decrypt IAM policy" + type = string +} + +variable "oidc_issuer_url" { + description = "URL of the OIDC issuer" + type = string +} + diff --git a/service-account/aws/versions.tf b/service-account/aws/versions.tf new file mode 100644 index 000000000..2082d6d72 --- /dev/null +++ b/service-account/aws/versions.tf @@ -0,0 +1,13 @@ +terraform { + required_version = ">= 1.0" + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 5.61" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = ">= 2.7.1" + } + } +} diff --git a/storage/aws/sqs/main.tf b/storage/aws/sqs/main.tf new file mode 100644 index 000000000..92c35b727 --- /dev/null +++ b/storage/aws/sqs/main.tf @@ -0,0 +1,3 @@ +locals { + prefix = var.prefix +} \ No newline at end of file diff --git a/storage/aws/sqs/outputs.tf b/storage/aws/sqs/outputs.tf new file mode 100644 index 000000000..9751abd87 --- /dev/null +++ b/storage/aws/sqs/outputs.tf @@ -0,0 +1,9 @@ +output "env" { + description = "Environment variables to pass to ArmoniK.Core" + value = { + "Components__QueueAdaptorSettings__ClassName" = "ArmoniK.Core.Adapters.SQS.QueueBuilder" + "Components__QueueAdaptorSettings__AdapterAbsolutePath" = "/adapters/queue/sqs/ArmoniK.Core.Adapters.SQS.dll" + "SQS__ServiceURL" = "https://sqs.${var.region}.amazonaws.com" + "SQS__Prefix" = local.prefix + } +} diff --git a/storage/aws/sqs/variables.tf b/storage/aws/sqs/variables.tf new file mode 100644 index 000000000..cd9ef24b8 --- /dev/null +++ b/storage/aws/sqs/variables.tf @@ -0,0 +1,14 @@ +variable "namespace" { + description = "Namespace of ArmoniK storage resources" + type = string + default = "armonik" +} + +variable "region" { + type = string +} + +variable "prefix" { + description = "Prefix to use for SQS queues" + type = string +}