diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..7220262 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,2 @@ +# These owners will be the default owners for everything in the repo. +@terraform-do-modules/approvers @clouddrove-ci @anmolnagpal diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..e414e28 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,12 @@ +## what +* Describe high-level what changed as a result of these commits (i.e. in plain-english, what do these changes mean?) +* Use bullet points to be concise and to the point. + +## why +* Provide the justifications for the changes (e.g. business case). +* Describe why these changes were made (e.g. why do these commits fix the problem?) +* Use bullet points to be concise and to the point. + +## references +* Link to any supporting jira issues or helpful documentation to add some context (e.g. stackoverflow). +* Use `closes #123`, if this PR closes a Jira issue `#123` diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2ed5c50 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,65 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + open-pull-requests-limit: 3 + assignees: + - "clouddrove-ci" + reviewers: + - "approvers" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 3 + assignees: + - "clouddrove-ci" + reviewers: + - "approvers" + + - package-ecosystem: "terraform" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "weekly" + # Add assignees + assignees: + - "clouddrove-ci" + # Add reviewer + reviewers: + - "approvers" + # Allow up to 3 open pull requests for pip dependencies + open-pull-requests-limit: 3 + + - package-ecosystem: "terraform" # See documentation for possible values + directory: "/_examples/basic" # Location of package manifests + schedule: + interval: "weekly" + # Add assignees + assignees: + - "clouddrove-ci" + # Add reviewer + reviewers: + - "approvers" + # Allow up to 3 open pull requests for pip dependencies + open-pull-requests-limit: 3 + + - package-ecosystem: "terraform" # See documentation for possible values + directory: "/_examples/complete" # Location of package manifests + schedule: + interval: "weekly" + # Add assignees + assignees: + - "clouddrove-ci" + # Add reviewer + reviewers: + - "approvers" + # Allow up to 3 open pull requests for pip dependencies + open-pull-requests-limit: 3 \ No newline at end of file diff --git a/.github/workflows/auto_assignee.yml b/.github/workflows/auto_assignee.yml new file mode 100644 index 0000000..fd2ebf1 --- /dev/null +++ b/.github/workflows/auto_assignee.yml @@ -0,0 +1,14 @@ +name: Auto Assign PRs + +on: + pull_request: + types: [opened, reopened] + + workflow_dispatch: +jobs: + assign-pr: + uses: clouddrove/github-shared-workflows/.github/workflows/auto_assignee.yml@master + secrets: + GITHUB: ${{ secrets.GITHUB }} + with: + assignees: 'clouddrove-ci' \ No newline at end of file diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml new file mode 100644 index 0000000..45b048e --- /dev/null +++ b/.github/workflows/changelog.yml @@ -0,0 +1,14 @@ +name: changelog +permissions: write-all +on: + push: + tags: + - "*" + workflow_dispatch: +jobs: + changelog: + uses: clouddrove/github-shared-workflows/.github/workflows/changelog.yml@master + secrets: + GITHUB: ${{ secrets.GITHUB }} + with: + branch: 'master' \ No newline at end of file diff --git a/.github/workflows/readme.doto b/.github/workflows/readme.doto deleted file mode 100644 index f432ea4..0000000 --- a/.github/workflows/readme.doto +++ /dev/null @@ -1,54 +0,0 @@ -#name: 'Create README.md file' -#on: -# push: -# branches: -# - master -# -#jobs: -# readme-create: -# name: 'readme-create' -# runs-on: ubuntu-latest -# steps: -# - name: 'Checkout' -# uses: actions/checkout@v2.3.4 -# -# - name: 'Set up Python 3.7' -# uses: actions/setup-python@v2 -# with: -# python-version: '3.x' -# -# - name: 'create readme' -# uses: 'clouddrove/github-actions@v9.0' -# with: -# actions_subcommand: 'readme' -# github_token: '${{ secrets.GITHUB }}' -# env: -# GITHUB_TOKEN: ${{ secrets.CLOUDDROVE_GITHUB_TOKEN }} -# -# -# - name: 'pre-commit check errors' -# uses: pre-commit/action@v2.0.0 -# continue-on-error: true -# -# - name: 'pre-commit fix errors' -# uses: pre-commit/action@v2.0.0 -# continue-on-error: true -# -# - name: 'push readme' -# uses: 'clouddrove/github-actions@v9.0' -# continue-on-error: true -# with: -# actions_subcommand: 'push' -# env: -# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} -# -# - name: 'Slack Notification' -# uses: clouddrove/action-slack@v2 -# with: -# status: ${{ job.status }} -# fields: repo,author -# author_name: 'CloudDrove' -# env: -# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # required -# SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_TERRAFORM }} # required -# if: always() diff --git a/.github/workflows/readme.yml b/.github/workflows/readme.yml new file mode 100644 index 0000000..750b00a --- /dev/null +++ b/.github/workflows/readme.yml @@ -0,0 +1,53 @@ +name: 'Create README.md file' +on: + push: + branches: + - master + +jobs: + readme-create: + name: 'readme-create' + runs-on: ubuntu-latest + steps: + - name: 'Checkout' + uses: actions/checkout@master + + - name: 'Set up Python 3.7' + uses: actions/setup-python@v2 + with: + python-version: '3.x' + + - name: 'create readme' + uses: 'clouddrove/github-actions@v9.0.2' + with: + actions_subcommand: 'readme' + github_token: '${{ secrets.GITHUB }}' + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: 'pre-commit check errors' + uses: pre-commit/action@v2.0.0 + continue-on-error: true + + - name: 'pre-commit fix erros' + uses: pre-commit/action@v2.0.0 + continue-on-error: true + + - name: 'push readme' + uses: 'clouddrove/github-actions@v9.0.2' + continue-on-error: true + with: + actions_subcommand: 'push' + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: 'Slack Notification' + uses: clouddrove/action-slack@v2 + with: + status: ${{ job.status }} + fields: repo,author + author_name: 'CloudDrove' + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # required + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_TERRAFORM }} # required + if: always() \ No newline at end of file diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml deleted file mode 100644 index ad21dd5..0000000 --- a/.github/workflows/terraform.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: 'Terraform GitHub Actions' -on: - pull_request: - branches: - - master - -jobs: - terraform: - name: 'Terraform' - runs-on: ubuntu-latest - steps: - - name: 'Checkout' - uses: actions/checkout@master - - - name: 'Terraform Format' - uses: 'clouddrove/github-actions@v9.0.1' - with: - actions_subcommand: 'fmt' - - - name: 'Terraform init' - uses: 'clouddrove/github-actions@v9.0.1' - with: - actions_subcommand: 'init' - tf_actions_working_dir: ./_example - - - name: 'Terraform validate' - uses: 'clouddrove/github-actions@v9.0.1' - with: - actions_subcommand: 'validate' - tf_actions_working_dir: ./_example - - - name: 'Slack Notification' - uses: clouddrove/action-slack@v2 - with: - status: ${{ job.status }} - fields: repo,author - author_name: 'CloudDrove' - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # required - SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_TERRAFORM }} # required - if: always() \ No newline at end of file diff --git a/.github/workflows/terratest.yml b/.github/workflows/terratest.yml deleted file mode 100644 index 8041f79..0000000 --- a/.github/workflows/terratest.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: 'Terratest GitHub Actions' -on: - pull_request: - branches: - - master - types: [labeled] - -jobs: - terraform: - name: 'Terraform' - runs-on: ubuntu-latest - steps: - - - name: 'Checkout' - uses: actions/checkout@master - - - name: Install doctl - uses: digitalocean/action-doctl@v2 - with: - token: ${{ secrets.DO_TOKEN }} - - - name: 'Terratest' - if: ${{ github.event.label.name == 'terratest' }} - uses: 'clouddrove/github-actions@v9.0.1' - with: - actions_subcommand: 'terratest' - tf_actions_working_dir: '_test' - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - DO_TOKEN: ${{ secrets.DO_TOKEN }} - - - - name: 'Slack Notification' - uses: clouddrove/action-slack@v2 - with: - status: ${{ job.status }} - fields: repo,author - author_name: 'CloudDrove' - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # required - SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_TERRAFORM }} # required - if: always() diff --git a/.github/workflows/tf-checks.yml b/.github/workflows/tf-checks.yml new file mode 100644 index 0000000..a0e9afa --- /dev/null +++ b/.github/workflows/tf-checks.yml @@ -0,0 +1,16 @@ +name: tf-checks +on: + push: + branches: [ master ] + pull_request: + workflow_dispatch: +jobs: + tf-complete-example: + uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master + with: + working_directory: './_examples/complete/' + + tf-basic-example: + uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master + with: + working_directory: './_examples/basic/' \ No newline at end of file diff --git a/.github/workflows/tflint.yml b/.github/workflows/tflint.yml new file mode 100644 index 0000000..99c6300 --- /dev/null +++ b/.github/workflows/tflint.yml @@ -0,0 +1,11 @@ +name: tf-lint +on: + push: + branches: [ master ] + pull_request: + workflow_dispatch: +jobs: + tf-lint: + uses: clouddrove/test-tfsec/.github/workflows/tflint.yaml@master + secrets: + GITHUB: ${{ secrets.GITHUB }} \ No newline at end of file diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml new file mode 100644 index 0000000..1c9272e --- /dev/null +++ b/.github/workflows/tfsec.yml @@ -0,0 +1,12 @@ +name: tfsec +permissions: write-all +on: + pull_request: + workflow_dispatch: +jobs: + tfsec: + uses: clouddrove/github-shared-workflows/.github/workflows/tfsec.yml@master + secrets: + GITHUB: ${{ secrets.GITHUB }} + with: + working_directory: '.' \ No newline at end of file diff --git a/.gitignore b/.gitignore index 797a1bb..7bacaf4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,210 @@ # ignored files +*~ + +# temporary files which can be created if a process still has a handle open of a deleted file +.fuse_hidden* + +# KDE directory preferences +.directory + +# Linux trash folder which might appear on any partition or disk +.Trash-* + +# .nfs files are created when an open file is removed but is still being accessed +.nfs* +### Eclipse template + +.metadata +bin/ +tmp/ +*.tmp +*.bak +*.swp +*~.nib +local.properties +.settings/ +.loadpath +.recommenders + +# External tool builders +.externalToolBuilders/ + +# Locally stored "Eclipse launch configurations" +*.launch + +# PyDev specific (Python IDE for Eclipse) +*.pydevproject + +# CDT-specific (C/C++ Development Tooling) +.cproject + +# Java annotation processor (APT) +.factorypath + +# PDT-specific (PHP Development Tools) +.buildpath + +# sbteclipse plugin +.target + +# Tern plugin +.tern-project + +# TeXlipse plugin +.texlipse + +# STS (Spring Tool Suite) +.springBeans + +# Code Recommenders +.recommenders/ + +# Scala IDE specific (Scala & Java development for Eclipse) +.cache-main +.scala_dependencies +.worksheet +### Windows template +# Windows thumbnail cache files +Thumbs.db +ehthumbs.db +ehthumbs_vista.db + +# Dump file +*.stackdump + +# Folder config file +[Dd]esktop.ini + +# Recycle Bin used on file shares +$RECYCLE.BIN/ + +# Windows Installer files +*.cab +*.msi +*.msm +*.msp + +# Windows shortcuts +*.lnk +### Ansible template +*.retry +### macOS template +# General +.DS_Store +.AppleDouble +.LSOverride + +# Icon must end with two \r +Icon + +# Thumbnails +._* + +# Files that might appear in the root of a volume +.DocumentRevisions-V100 +.fseventsd +.Spotlight-V100 +.TemporaryItems +.Trashes +.VolumeIcon.icns +.com.apple.timemachine.donotpresent + +# Directories potentially created on remote AFP share +.AppleDB +.AppleDesktop +Network Trash Folder +Temporary Items +.apdisk +### Archives template +# It's better to unpack these files and commit the raw source because +# git has its own built in compression methods. +*.7z +*.jar +*.rar +*.zip +*.gz +*.tgz +*.bzip +*.bz2 +*.xz +*.lzma +*.cab + +# Packing-only formats +*.iso +*.tar + +# Package management formats +*.dmg +*.xpi +*.gem +*.egg +*.deb +*.rpm +*.msi +*.msm +*.msp +### JetBrains template +# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm +# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839 + +/.idea/ +# User-specific stuff: +.idea/**/workspace.xml +.idea/**/tasks.xml +.idea/dictionaries + +# Sensitive or high-churn files: +.idea/**/dataSources/ +.idea/**/dataSources.ids +.idea/**/dataSources.xml +.idea/**/dataSources.local.xml +.idea/**/sqlDataSources.xml +.idea/**/dynamic.xml +.idea/**/uiDesigner.xml + +# Gradle: +.idea/**/gradle.xml +.idea/**/libraries + +# CMake +cmake-build-debug/ + +# Mongo Explorer plugin: +.idea/**/mongoSettings.xml + +## File-based project format: +*.iws + +## Plugin-specific files: + +# IntelliJ +out/ + +# mpeltonen/sbt-idea plugin +.idea_modules/ +# User-specific stuff: +.idea/* +# JIRA plugin +atlassian-ide-plugin.xml + +# Cursive Clojure plugin +.idea/replstate.xml + +# TFstste +*.tfstate* + +deployment/_logs/ansible-log.json +deployment/_logs/ansible-log.log +deployment/_logs/facts/* +deployment/_logs/retry/* +_app/* +ansible-log.json +.terraform +terraform.tfstate + *.tfstate *.tfstate.backup -.terraform -.idea *.iml +*.terraform.lock.hcl +*.lock.hcl \ No newline at end of file diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 9e713a5..2fc1df8 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,5 +1,4 @@ repos: - - repo: https://github.com/gruntwork-io/pre-commit rev: v0.1.12 # Get the latest from: https://github.com/gruntwork-io/pre-commit/releases hooks: @@ -18,4 +17,4 @@ repos: - id: check-merge-conflict - id: debug-statements - id: check-yaml - - id: check-added-large-files + - id: check-added-large-files \ No newline at end of file diff --git a/LICENSE b/LICENSE index 136d77d..6632b9b 100644 --- a/LICENSE +++ b/LICENSE @@ -1,21 +1,201 @@ -MIT License - -Copyright (c) 2019 Cloud Drove - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2021 CloudDrove Inc. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. \ No newline at end of file diff --git a/README.yaml b/README.yaml index 7f4522f..110eaf0 100644 --- a/README.yaml +++ b/README.yaml @@ -11,7 +11,7 @@ name : Terraform DigitalOcean Firewall license: "MIT" # Canonical GitHub repo -github_repo: clouddrove/terraform-digitalocean-firewall +github_repo: terraform-do-modules/terraform-digitalocean-firewall # Badges to display badges: @@ -38,10 +38,8 @@ usage : |- module "firewall" { source = "terraform-do-modules/firewall/digitalocean" version = "0.15.0" - name = "firewall" + name = "app" environment = "test" - label_order = ["environment", "name"] - enable_firewall = true allowed_ip = ["0.0.0.0/0"] allowed_ports = [22, 80] droplet_ids = module.droplet.id diff --git a/_example/example.tf b/_example/example.tf deleted file mode 100644 index 653395a..0000000 --- a/_example/example.tf +++ /dev/null @@ -1,58 +0,0 @@ - -provider "digitalocean" { - # You need to set this in your .bashrc - # export DIGITALOCEAN_TOKEN="Your API TOKEN" - # -} - -module "vpc" { - source = "terraform-do-modules/vpc/digitalocean" - version = "0.15.0" - name = "vpc" - environment = "test" - label_order = ["environment", "name"] - enable_vpc = true - region = "bangalore-1" - ip_range = "10.0.0.0/16" - -} - - -module "ssh_key" { - source = "terraform-do-modules/ssh-key/digitalocean" - version = "0.15.0" - key_path = "~/.ssh/id_rsa.pub" - key_name = "devops" - enable_ssh_key = true -} - - -module "droplet" { - source = "terraform-do-modules/droplet/digitalocean" - version = "0.15.0" - name = "droplet" - environment = "test" - label_order = ["environment", "name"] - droplet_count = 2 - region = "bangalore-1" - ssh_keys = [module.ssh_key.fingerprint] - vpc_uuid = module.vpc.id - droplet_size = "nano" - monitoring = false - private_networking = true - ipv6 = false - floating_ip = true - block_storage_size = 5 - user_data = file("user-data.sh") -} - -module "firewall" { - source = "./../" - name = "firewall" - environment = "test" - label_order = ["environment", "name"] - enable_firewall = true - allowed_ip = ["0.0.0.0/0"] - allowed_ports = [22, 80] - droplet_ids = module.droplet.id -} diff --git a/_example/versions.tf b/_example/versions.tf deleted file mode 100644 index ce94a0c..0000000 --- a/_example/versions.tf +++ /dev/null @@ -1,8 +0,0 @@ -terraform { - required_providers { - digitalocean = { - source = "digitalocean/digitalocean" - } - } - required_version = ">= 0.13" -} diff --git a/_examples/basic/example.tf b/_examples/basic/example.tf new file mode 100644 index 0000000..938216a --- /dev/null +++ b/_examples/basic/example.tf @@ -0,0 +1,15 @@ +provider "digitalocean" { + # token = "" +} + +##------------------------------------------------ +## Firewall module call +##------------------------------------------------ +module "firewall" { + source = "./../../" + name = "app" + environment = "test" + allowed_ip = ["0.0.0.0/0"] + allowed_ports = [22, 80] + # droplet_ids = "" #### Add droplet ids +} diff --git a/_example/outputs.tf b/_examples/basic/outputs.tf similarity index 60% rename from _example/outputs.tf rename to _examples/basic/outputs.tf index 3e64ffa..b2d03c1 100644 --- a/_example/outputs.tf +++ b/_examples/basic/outputs.tf @@ -1,4 +1,4 @@ output "name" { - value = module.firewall.*.name + value = module.firewall[0].name description = "The name of the Firewall." } \ No newline at end of file diff --git a/_examples/basic/versions.tf b/_examples/basic/versions.tf new file mode 100644 index 0000000..cb6c070 --- /dev/null +++ b/_examples/basic/versions.tf @@ -0,0 +1,10 @@ +# Terraform version +terraform { + required_version = ">= 1.4.6" + required_providers { + digitalocean = { + source = "digitalocean/digitalocean" + version = ">= 2.28.1" + } + } +} \ No newline at end of file diff --git a/_examples/complete/example.tf b/_examples/complete/example.tf new file mode 100644 index 0000000..fc6f35c --- /dev/null +++ b/_examples/complete/example.tf @@ -0,0 +1,50 @@ +provider "digitalocean" { + # token = "" +} + +##------------------------------------------------ +## VPC module call +##------------------------------------------------ +module "vpc" { + source = "git::https://github.com/terraform-do-modules/terraform-digitalocean-vpc.git?ref=internal-423" + name = "app" + environment = "test" + region = "blr1" + ip_range = "10.10.0.0/16" +} + +##------------------------------------------------ +## Droplet module call +##------------------------------------------------ +module "droplet" { + source = "git::https://github.com/terraform-do-modules/terraform-digitalocean-droplet.git?ref=internal-425" + name = "app" + environment = "test" + droplet_count = 1 + region = "blr1" + vpc_uuid = module.vpc.id + droplet_size = "s-1vcpu-1gb" + image_name = "ubuntu-18-04-x64" + ssh_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCbnaeXI+pAfwoMBLDl2r+fsRrBoqgRY54gcAawz0XJOiG6esHa13r28GGuEyAm5UGhDkVm6PZ8JAmLNpe8BTjJzF3BEZb+MMf0YLG+Gz6V5uyz9efuKxZqNTk2El36y5Z2dDUyrcT6FdayhRGtJPfUJc22tgucaTwA0I41SVJDb6OPeSYFalWIHk953RePWnJAjpRKyRqjnkbn6VUCqVQSNdJ+C4Qs7Zydullusm45UOMjhi20dgttdnnz6y9AOJDLws5IVmiee+Qwt1jO86RYSGyN2ikJQa6zB7Si1b8hlrVvDkBVGSxKs2mMJuLjXSx/SqdcwW17CDZLQoJ03WJgW3vs2sriyrtsFxWHCjssidl0sF83qVvUEsJKyNo7A6cXTAC++n2HlmWiDFpAns7qCrMkBJPOIT3hKDROozU+sLH8AL/mNd4yGpdTKDQGf+nDWq/5EGkHO4aq9RW9gQbGCX6H/zQTYudaDKLoVGf5LkYWtOC8+wfWmf2/dUA1KDU= devops" + monitoring = false + ipv6 = false + floating_ip = true + block_storage_size = 5 + user_data = file("user-data.sh") + + ####firewall + allowed_ip = ["10.10.0.0/16"] + allowed_ports = [22, 80] +} + +##------------------------------------------------ +## Firewall module call +##------------------------------------------------ +module "firewall" { + source = "./../../" + name = "app" + environment = "test" + allowed_ip = ["0.0.0.0/0"] + allowed_ports = [22, 80] + droplet_ids = module.droplet.id +} diff --git a/_examples/complete/outputs.tf b/_examples/complete/outputs.tf new file mode 100644 index 0000000..b2d03c1 --- /dev/null +++ b/_examples/complete/outputs.tf @@ -0,0 +1,4 @@ +output "name" { + value = module.firewall[0].name + description = "The name of the Firewall." +} \ No newline at end of file diff --git a/_example/user-data.sh b/_examples/complete/user-data.sh similarity index 58% rename from _example/user-data.sh rename to _examples/complete/user-data.sh index 3e32f67..5bef040 100644 --- a/_example/user-data.sh +++ b/_examples/complete/user-data.sh @@ -1,6 +1,8 @@ #!/bin/bash apt-get update -apt-get install python +apt-get install python -y sudo adduser ubuntu --gecos "First Last,RoomNumber,WorkPhone,HomePhone" --disabled-password echo "ubuntu ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers -usermod -aG sudo ubuntu \ No newline at end of file +usermod -aG sudo ubuntu +cp -r /root/.ssh /home/ubuntu +chown -R ubuntu:ubuntu /home/ubuntu/.ssh \ No newline at end of file diff --git a/_examples/complete/versions.tf b/_examples/complete/versions.tf new file mode 100644 index 0000000..cb6c070 --- /dev/null +++ b/_examples/complete/versions.tf @@ -0,0 +1,10 @@ +# Terraform version +terraform { + required_version = ">= 1.4.6" + required_providers { + digitalocean = { + source = "digitalocean/digitalocean" + version = ">= 2.28.1" + } + } +} \ No newline at end of file diff --git a/_test/firewall_test.go b/_test/firewall_test.go deleted file mode 100644 index 5697094..0000000 --- a/_test/firewall_test.go +++ /dev/null @@ -1,32 +0,0 @@ -// Managed By : CloudDrove -// Description : This Terratest is used to test the Terraform EC2 module. -// Copyright @ CloudDrove. All Right Reserved. -package test - -import ( - "testing" - "github.com/gruntwork-io/terratest/modules/terraform" - "github.com/stretchr/testify/assert" -) - -func Test(t *testing.T) { - t.Parallel() - - terraformOptions := &terraform.Options{ - // Source path of Terraform directory. - TerraformDir: "../_example", - Upgrade: true, - } - - // This will run 'terraform init' and 'terraform application' and will fail the test if any errors occur - terraform.InitAndApply(t, terraformOptions) - - // To clean up any resources that have been created, run 'terraform destroy' towards the end of the test - defer terraform.Destroy(t, terraformOptions) - - // To get the value of an output variable, run 'terraform output' - Id := terraform.Output(t, terraformOptions, "name") - - // Check that we get back the outputs that we expect - assert.Contains(t, Id, "firewall") -} diff --git a/_test/go.mod b/_test/go.mod deleted file mode 100644 index 811a40b..0000000 --- a/_test/go.mod +++ /dev/null @@ -1,8 +0,0 @@ -module github.com/clouddrove/terraform-digitalocean-firewall - -go 1.13 - -require ( - github.com/gruntwork-io/terratest v0.30.5 - github.com/stretchr/testify v1.6.1 -) \ No newline at end of file diff --git a/main.tf b/main.tf index 1b215e1..1502d13 100644 --- a/main.tf +++ b/main.tf @@ -1,32 +1,24 @@ -## Managed By : CloudDrove -##Description : This Script is used to create firewall. -## Copyright @ CloudDrove. All Right Reserved. - - #Module : Label #Description : This terraform module is designed to generate consistent label names and # tags for resources. You can use terraform-labels to implement a strict # naming convention. module "labels" { - source = "terraform-do-modules/labels/digitalocean" - version = "0.15.0" + source = "git::https://github.com/terraform-do-modules/terraform-digitalocean-labels.git?ref=internal-426m" name = var.name environment = var.environment + managedby = var.managedby label_order = var.label_order } -locals { - firewall_count = var.enable_firewall == true ? 1 : 0 -} - #Module : Firewall #Description : Provides a DigitalOcean Cloud Firewall resource. This can be used to create, modify, and delete Firewalls. -resource "digitalocean_firewall" "default" { - count = local.firewall_count - name = module.labels.id +#tfsec:ignore:digitalocean-compute-no-public-ingress ## because by default we use ["0.0.0.0/0"], do not use on prod env. +#tfsec:ignore:digitalocean-compute-no-public-egress ## The port is exposed for ingress from the internet, by default we use ["0.0.0.0/0", "::/0"]. +resource "digitalocean_firewall" "default" { + count = var.enabled == true ? 1 : 0 + name = format("%s-firewall", module.labels.id) droplet_ids = var.droplet_ids - dynamic "inbound_rule" { iterator = port for_each = var.allowed_ports diff --git a/outputs.tf b/outputs.tf index 4edc4ab..ef4db19 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,11 +1,26 @@ #Module : Firewall #Description : Provides a DigitalOcean Cloud Firewall resource. This can be used to create, modify, and delete Firewalls. output "id" { - value = join("", digitalocean_firewall.default.*.id) + value = join("", digitalocean_firewall.default[*].id) description = "A unique ID that can be used to identify and reference a Firewall." } output "name" { - value = join("", digitalocean_firewall.default.*.name) + value = join("", digitalocean_firewall.default[*].name) + description = "The name of the Firewall." +} + +output "droplet_ids" { + value = join("", digitalocean_firewall.default[*].droplet_ids) + description = "The list of the IDs of the Droplets assigned to the Firewall." +} + +output "inbound_rule" { + value = join("", digitalocean_firewall.default[*].inbound_rule) + description = "The inbound access rule block for the Firewall." +} + +output "outbound_rule" { + value = join("", digitalocean_firewall.default[*].outbound_rule) description = "The name of the Firewall." } diff --git a/variables.tf b/variables.tf index ddd7899..9e8ae80 100644 --- a/variables.tf +++ b/variables.tf @@ -15,20 +15,20 @@ variable "environment" { variable "label_order" { type = list(any) - default = [] + default = ["name", "environment"] description = "Label order, e.g. `name`,`application`." } -variable "delimiter" { +variable "managedby" { type = string - default = "-" - description = "Delimiter to be used between `organization`, `environment`, `name` and `attributes`." + default = "terraform-do-modules" + description = "ManagedBy, eg 'terraform-do-modules' or 'hello@clouddrove.com'" } -variable "enable_firewall" { +variable "enabled" { type = bool default = true - description = "Enable default Security Group with only Egress traffic allowed." + description = "Flag to control the firewall creation." } variable "allowed_ip" { diff --git a/versions.tf b/versions.tf index 174fcd8..cb6c070 100644 --- a/versions.tf +++ b/versions.tf @@ -1,9 +1,10 @@ # Terraform version terraform { - required_version = ">= 0.13" + required_version = ">= 1.4.6" required_providers { digitalocean = { - source = "digitalocean/digitalocean" + source = "digitalocean/digitalocean" + version = ">= 2.28.1" } } -} +} \ No newline at end of file