Skip to content

Commit 037e8b0

Browse files
akashdan90akashdan90
committed
demo
1 parent dd50304 commit 037e8b0

31 files changed

+2858
-171
lines changed

‎arcadia/data.tf

Lines changed: 29 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,33 @@
1-
data "tfe_outputs" "infra" {
2-
organization = var.tf_cloud_organization
3-
workspace = "infra"
1+
# Read infra state from S3
2+
data "terraform_remote_state" "infra" {
3+
backend = "s3"
4+
config = {
5+
bucket = "akash-terraform-state-bucket" # Your S3 bucket name
6+
key = "infra/terraform.tfstate" # Path to infra's state file
7+
region = "us-east-1" # AWS region
8+
}
49
}
5-
data "tfe_outputs" "eks" {
6-
organization = var.tf_cloud_organization
7-
workspace = "eks"
10+
11+
12+
data "terraform_remote_state" "nap" {
13+
backend = "s3"
14+
config = {
15+
bucket = "akash-terraform-state-bucket" # Your S3 bucket name
16+
key = "nap/terraform.tfstate" # Path to NAP state file
17+
region = "us-east-1" # AWS region
18+
}
819
}
9-
data "tfe_outputs" "nap" {
10-
count = data.tfe_outputs.infra.values.nap ? 1 : 0
11-
organization = var.tf_cloud_organization
12-
workspace = "nap"
13-
}
14-
data "tfe_outputs" "nic" {
15-
count = data.tfe_outputs.infra.values.nic ? 1 : 0
16-
organization = var.tf_cloud_organization
17-
workspace = "nic"
20+
21+
data "terraform_remote_state" "eks" {
22+
backend = "s3"
23+
config = {
24+
bucket = "akash-terraform-state-bucket" # Your S3 bucket name
25+
key = "eks-cluster/terraform.tfstate" # Path to EKS state file
26+
region = "us-east-1" # AWS region
27+
}
1828
}
29+
30+
# Get EKS cluster auth using S3 state
1931
data "aws_eks_cluster_auth" "auth" {
20-
name = data.tfe_outputs.eks.values.cluster_name
21-
}
32+
name = data.terraform_remote_state.eks.outputs.cluster_name
33+
}

‎arcadia/locals.tf

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
locals {
2-
project_prefix = data.tfe_outputs.infra.values.project_prefix
3-
#external_name = try(data.tfe_outputs.nap.values.external_name, data.tfe_outputs.nic.values.external_name, "arcadia-cd-demo.sr.f5-cloud-demo.com")
4-
external_name = try(data.tfe_outputs.nap[0].values.external_name, data.tfe_outputs.nic[0].values.external_name)
5-
aws_region = data.tfe_outputs.infra.values.aws_region
6-
host = data.tfe_outputs.eks.values.cluster_endpoint
7-
cluster_ca_certificate = data.tfe_outputs.eks.values.kubeconfig-certificate-authority-data
8-
cluster_name = data.tfe_outputs.eks.values.cluster_name
9-
}
2+
project_prefix = data.terraform_remote_state.infra.outputs.project_prefix
3+
aws_region = data.terraform_remote_state.infra.outputs.aws_region
4+
external_name = try(data.terraform_remote_state.nap.outputs.external_name, "arcadia-cd-demo.sr.f5-cloud-demo.com")
5+
host = data.terraform_remote_state.eks.outputs.cluster_endpoint
6+
cluster_ca_certificate = data.terraform_remote_state.eks.outputs.kubeconfig-certificate-authority-data
7+
cluster_name = data.terraform_remote_state.eks.outputs.cluster_name
8+
}

‎arcadia/versions.tf

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,29 @@
11
terraform {
2-
required_version = ">= 0.14.0"
2+
required_version = ">= 1.6.0"
3+
34
required_providers {
4-
aws = ">= 4"
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 4.0.0"
8+
}
59
kubernetes = {
6-
source = "hashicorp/kubernetes"
7-
version = "2.16.1"
10+
source = "hashicorp/kubernetes"
11+
version = ">= 2.23.0"
812
}
913
helm = {
1014
source = "hashicorp/helm"
11-
version = ">=2.7.0"
15+
version = ">= 2.12.0"
16+
}
17+
kubectl = {
18+
source = "gavinbunney/kubectl"
19+
version = ">= 1.15.0"
1220
}
1321
}
14-
}
22+
backend "s3" {
23+
bucket = "akash-terraform-state-bucket" # Your S3 bucket name
24+
key = "arcadia/terraform.tfstate" # Path to state file
25+
region = "us-east-1" # AWS region
26+
dynamodb_table = "terraform-lock-table" # DynamoDB table for state locking
27+
encrypt = true # Encrypt state file at rest
28+
}
29+
}

‎arcadia/virtual.tf

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
resource "kubernetes_manifest" "arcadia_virtualserver" {
2+
manifest = {
3+
apiVersion = "k8s.nginx.org/v1"
4+
kind = "VirtualServer"
5+
metadata = {
6+
name = "arcadia-virtualserver"
7+
namespace = "default"
8+
}
9+
spec = {
10+
host = try(data.terraform_remote_state.nap.outputs.external_name, "arcadia-cd-demo.sr.f5-cloud-demo.com")
11+
12+
# Reference the WAF policy
13+
policies = [
14+
{
15+
name = "waf-policy" # Name of the WAF policy
16+
namespace = "default" # Namespace where the WAF policy is deployed
17+
}
18+
]
19+
20+
upstreams = [
21+
{
22+
name = "main-upstream"
23+
service = kubernetes_service.main.metadata[0].name
24+
port = 80
25+
},
26+
{
27+
name = "backend-upstream"
28+
service = kubernetes_service.backend.metadata[0].name
29+
port = 80
30+
},
31+
{
32+
name = "app2-upstream"
33+
service = kubernetes_service.app_2.metadata[0].name
34+
port = 80
35+
},
36+
{
37+
name = "app3-upstream"
38+
service = kubernetes_service.app_3.metadata[0].name
39+
port = 80
40+
}
41+
]
42+
routes = [
43+
{
44+
path = "/"
45+
action = {
46+
pass = "main-upstream"
47+
}
48+
},
49+
{
50+
path = "/files"
51+
action = {
52+
pass = "backend-upstream"
53+
}
54+
},
55+
{
56+
path = "/api"
57+
action = {
58+
pass = "app2-upstream"
59+
}
60+
},
61+
{
62+
path = "/app3"
63+
action = {
64+
pass = "app3-upstream"
65+
}
66+
}
67+
]
68+
}
69+
}
70+
}

‎arcadia/wafpolicy.tf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
resource "kubernetes_manifest" "waf_policy" {
2+
manifest = {
3+
apiVersion = "k8s.nginx.org/v1"
4+
kind = "Policy"
5+
metadata = {
6+
name = "waf-policy"
7+
namespace = "default" # Replace with your desired namespace
8+
}
9+
spec = {
10+
waf = {
11+
enable = true
12+
apBundle = "compiled_policy.tgz"
13+
}
14+
}
15+
}
16+
}

‎nap/charts/nginx-app-protect/values.yaml

Lines changed: 35 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,60 @@
11
---
22
controller:
3+
name: controller
4+
kind: deployment
5+
nginxplus: true
6+
mgmt:
7+
licenseTokenSecretName: "license-token"
8+
sslVerify: false
9+
nginxReloadTimeout: 60000
310
appprotect:
411
enable: true
512
v5: true
6-
volumes:
7-
- name: app-protect-bd-config
8-
emptyDir: {}
9-
- name: app-protect-config
10-
emptyDir: {}
11-
- name: app-protect-bundles
12-
emptyDir: {}
13-
14-
volumeMounts:
15-
- name: app-protect-bd-config
16-
mountPath: /etc/app_protect/bd-config
17-
- name: app-protect-config
18-
mountPath: /etc/app_protect/config
19-
- name: app-protect-bundles
20-
mountPath: /etc/app_protect/bundles
21-
## Configuration for App Protect WAF v5 Enforcer
2213
enforcer:
23-
# Host that the App Protect WAF v5 Enforcer runs on.
24-
# This will normally be "127.0.0.1" as the Enforcer container
25-
# will run in the same pod as the Ingress Controller container.
2614
host: "127.0.0.1"
27-
# Port that the App Protect WAF v5 Enforcer runs on.
28-
port: 50000
15+
port: 50000
2916
image:
30-
## The image repository of the App Protect WAF v5 Enforcer.
31-
repository: private-registry.nginx.com/nap/waf-enforcer
32-
tag: "3.6.1"
33-
## The pull policy for the App Protect WAF v5 Enforcer image.
17+
repository: private-registry.nginx.com/nap/waf-enforcer
18+
tag: "5.4.0"
3419
pullPolicy: IfNotPresent
35-
securityContext:
36-
readOnlyRootFilesystem: true
20+
securityContext:
21+
readOnlyRootFilesystem: false # Temporarily disabled for debugging
22+
allowPrivilegeEscalation: true
23+
runAsNonRoot: false
3724
configManager:
3825
image:
39-
## The image repository of the App Protect WAF v5 Configuration Manager.
4026
repository: private-registry.nginx.com/nap/waf-config-mgr
41-
## The tag of the App Protect WAF v5 Configuration Manager image.
42-
tag: "3.6.1"
43-
## The pull policy for the App Protect WAF v5 Configuration Manager image.
27+
tag: "5.4.0"
4428
pullPolicy: IfNotPresent
4529
securityContext:
46-
readOnlyRootFilesystem: true
47-
allowPrivilegeEscalation: false
48-
runAsUser: 101 #nginx
49-
runAsNonRoot: true
30+
readOnlyRootFilesystem: false # Temporarily disabled for debugging
31+
allowPrivilegeEscalation: true
32+
runAsNonRoot: false
5033
capabilities:
5134
drop:
5235
- all
53-
appprotectdos:
54-
enable: true
36+
volumeMounts:
37+
- name: app-protect-bd-config
38+
mountPath: /opt/app_protect/bd_config
39+
- name: app-protect-config
40+
mountPath: /opt/app_protect/config
41+
- name: app-protect-bundles
42+
mountPath: /etc/app_protect/bundles
5543
enableSnippets: true
5644
image:
57-
repository: private-registry.nginx.com/nginx-ic-dos/nginx-plus-ingress
58-
tag: "3.6.1"
59-
pullPolicy: Always
60-
nginxplus: true
45+
repository: private-registry.nginx.com/nginx-ic-nap-v5/nginx-plus-ingress
46+
tag: "4.0.1"
47+
pullPolicy: IfNotPresent
48+
securityContext:
49+
readOnlyRootFilesystem: false # Temporarily disabled for debugging
50+
allowPrivilegeEscalation: true
51+
logLevel: "debug" # Increased for debugging
6152
nginxStatus:
62-
allowCidrs: 0.0.0.0/0
53+
allowCidrs: "0.0.0.0/0"
6354
port: 9000
6455
readyStatus:
6556
initialDelaySeconds: 30
6657
serviceAccount:
67-
imagePullSecretName: regcred
58+
imagePullSecretName: regcred
6859
prometheus:
69-
create: true
60+
create: true

‎nap/charts/prometheus/values.yaml

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
---
22
prometheus:
33
pushgateway:
4-
enabled: false
4+
enabled: false
5+
server:
6+
persistentVolume:
7+
enabled: true
8+
alertmanager:
9+
persistentVolume:
10+
enabled: true
11+

0 commit comments

Comments
 (0)