Wayfinder v2.7.1 (#44)

* Update AKS nodepool version to v1.28 (#37) * 2.6.5 (#39) * Provide support for Active Directory Certificate Services as an issuer for internal PKI (#42) * Allow ADCS as cert issuer type * feat: update to Wayfinder v2.7 and bump package versions (#43) * feat: update Wayfinder v2.7.0 and bump package versions * feat: update to Wayfinder v2.7.1 --------- Co-authored-by: Amir Tayabali <[email protected]> --------- Co-authored-by: Amir Tayabali <[email protected]> Co-authored-by: Tim Grant <[email protected]> Co-authored-by: Amir Tayabali <[email protected]>
appvia · May 24, 2024 · 1b67e31 · 1b67e31
1 parent 4a3156f
commit 1b67e31
Show file tree

Hide file tree

Showing 27 changed files with 700 additions and 412 deletions.
diff --git a/.github/workflows/terraform-module-validation.yml b/.github/workflows/terraform-module-validation.yml
@@ -8,6 +8,10 @@ on:
     - main
     - vnext
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   root-module-validation:
     uses: appvia/appvia-cicd-workflows/.github/workflows/terraform-module-validation.yml@main

diff --git a/.terraform-docs.yml b/.terraform-docs.yml
@@ -1,12 +1,12 @@
 content: |-
   # Terraform Module: Wayfinder on Azure
 
-  The "terraform-azurerm-wayfinder" Terraform Module can be used to provision and manage a licensed edition of [Appvia Wayfinder](https://www.appvia.io/product/) on Azure.
+  The "terraform-azurerm-wayfinder" Terraform Module can be used to provision and manage a licensed edition of [Appvia Wayfinder](https://www.appvia.io/wayfinder) on Azure.
 
   ## Requirements
 
   To run this module, you will need the following:
-  1. Product Licence Key & Instance ID: Contact [email protected] for more information.
+  1. Product Licence Key & Instance ID. Request a free licence key from the [Appvia Portal](https://portal.appvia.io/trial?utm_source=terraform-azurerm-wayfinder).
   2. (Optional) IDP App configuration details: Wayfinder integrates with an IDP for managing user access. You will need a valid Client ID, Client Secret and Server URL (or Azure Tenant ID) for setup. This does not need to be defined initially within Terraform, and can also be setup within the product. Wayfinder can provision a `localadmin` user for initial access if no IDP details are provided.
   3. A public Azure DNS Zone: This module will create DNS records for the Wayfinder API and UI endpoints, and performs a DNS01 challenge via the LetsEncrypt Issuer for valid domain certificates.
   4. Existing Virtual Network and Subnet: This module will deploy an AKS Cluster and so requires an existing vnet with outbound internet connectivity.

diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
diff --git a/Makefile b/Makefile
@@ -0,0 +1,146 @@
+#
+# Copyright (C) 2024  Appvia Ltd <[email protected]>
+#  
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+AUTHOR_EMAIL[email protected]
+
+.PHONY: all security lint format documentation documentation-examples validate-all validate validate-examples init
+
+default: all
+
+all: 
+	$(MAKE) init
+	$(MAKE) validate
+	$(MAKE) lint
+	$(MAKE) security
+	$(MAKE) format
+	$(MAKE) documentation
+
+examples:
+	$(MAKE) validate-examples
+	$(MAKE) lint-examples
+	$(MAKE) lint
+	$(MAKE) security
+	$(MAKE) format
+	$(MAKE) documentation
+
+documentation: 
+	@echo "--> Generating documentation"
+	@terraform-docs markdown table --output-file ${PWD}/README.md --output-mode inject .
+	$(MAKE) documentation-modules
+	$(MAKE) documentation-examples
+
+documentation-modules:
+	@echo "--> Generating documentation for modules"
+	@if [ -d modules ]; then \
+		find modules -type d -mindepth 1 -maxdepth 1 -exec terraform-docs markdown table --output-file README.md --output-mode inject {} \; ; \
+	fi
+
+documentation-examples:
+	@echo "--> Generating documentation examples"
+	@find examples -type d -mindepth 1 -maxdepth 1 -exec terraform-docs markdown table --output-file README.md --output-mode inject {} \;
+
+init: 
+	@echo "--> Running terraform init"
+	@terraform init -backend=false
+
+security: 
+	@echo "--> Running Security checks"
+	@tfsec .
+	$(MAKE) security-modules
+	$(MAKE) security-examples
+
+security-modules:
+	@echo "--> Running Security checks on modules"
+	@if [ -d modules ]; then \
+		find modules -type d -mindepth 1 -maxdepth 1 | while read -r dir; do \
+			echo "--> Validating $$dir"; \
+			tfsec $$dir; \
+		done; \
+	fi
+
+security-examples:
+	@echo "--> Running Security checks on examples"
+	@if [ -d examples ]; then \
+		find examples -type d -mindepth 1 -maxdepth 1 | while read -r dir; do \
+			echo "--> Validating $$dir"; \
+			tfsec $$dir; \
+		done; \
+	fi
+
+validate:
+	@echo "--> Running terraform validate"
+	@terraform init -backend=false
+	@terraform validate
+	$(MAKE) validate-modules
+	$(MAKE) validate-examples
+
+validate-modules:
+	@echo "--> Running terraform validate on modules"
+	@if [ -d modules ]; then \
+		find modules -type d -mindepth 1 -maxdepth 1 | while read -r dir; do \
+			echo "--> Validating $$dir"; \
+			terraform -chdir=$$dir init -backend=false; \
+			terraform -chdir=$$dir validate; \
+		done; \
+	fi
+
+validate-examples:
+	@echo "--> Running terraform validate on examples"
+	@if [ -d examples ]; then \
+		find examples -type d -mindepth 1 -maxdepth 1 | while read -r dir; do \
+			echo "--> Validating $$dir"; \
+			terraform -chdir=$$dir init -backend=false; \
+			terraform -chdir=$$dir validate; \
+		done; \
+	fi
+
+lint:
+	@echo "--> Running tflint"
+	@tflint --init 
+	@tflint -f compact
+	$(MAKE) lint-modules
+	$(MAKE) lint-examples
+
+lint-modules:
+	@echo "--> Running tflint on modules"
+	@if [ -d modules ]; then \
+		find modules -type d -mindepth 1 -maxdepth 1 | while read -r dir; do \
+			echo "--> Linting $$dir"; \
+			tflint --chdir=$$dir --init; \
+			tflint --chdir=$$dir -f compact; \
+		done; \
+	fi
+
+lint-examples:
+	@echo "--> Running tflint on examples"
+	@if [ -d examples ]; then \
+		find examples -type d -mindepth 1 -maxdepth 1 | while read -r dir; do \
+			echo "--> Linting $$dir"; \
+			tflint --chdir=$$dir --init; \
+			tflint --chdir=$$dir -f compact; \
+		done; \
+	fi
+
+format: 
+	@echo "--> Running terraform fmt"
+	@terraform fmt -recursive -write=true
+
+clean:
+	@echo "--> Cleaning up"
+	@find . -type d -name ".terraform" | while read -r dir; do \
+		echo "--> Removing $$dir"; \
+		rm -rf $$dir; \
+	done
diff --git a/README.md b/README.md
@@ -1,12 +1,12 @@
 <!-- BEGIN_TF_DOCS -->
 # Terraform Module: Wayfinder on Azure
 
-The "terraform-azurerm-wayfinder" Terraform Module can be used to provision and manage a licensed edition of [Appvia Wayfinder](https://www.appvia.io/product/) on Azure.
+The "terraform-azurerm-wayfinder" Terraform Module can be used to provision and manage a licensed edition of [Appvia Wayfinder](https://www.appvia.io/wayfinder) on Azure.
 
 ## Requirements
 
 To run this module, you will need the following:
-1. Product Licence Key & Instance ID: Contact [email protected] for more information.
+1. Product Licence Key & Instance ID. Request a free licence key from the [Appvia Portal](https://portal.appvia.io/trial?utm_source=terraform-azurerm-wayfinder).
 2. (Optional) IDP App configuration details: Wayfinder integrates with an IDP for managing user access. You will need a valid Client ID, Client Secret and Server URL (or Azure Tenant ID) for setup. This does not need to be defined initially within Terraform, and can also be setup within the product. Wayfinder can provision a `localadmin` user for initial access if no IDP details are provided.
 3. A public Azure DNS Zone: This module will create DNS records for the Wayfinder API and UI endpoints, and performs a DNS01 challenge via the LetsEncrypt Issuer for valid domain certificates.
 4. Existing Virtual Network and Subnet: This module will deploy an AKS Cluster and so requires an existing vnet with outbound internet connectivity.
@@ -31,21 +31,21 @@ The Authorized Redirect URI for the IDP Application should be set to: `https://$
 
 ```hcl
 wayfinder_idp_details = {
-  type         = "generic"
-  clientId     = "IDP-APP-CLIENT-ID"
-  clientSecret = "IDP-APP-CLIENT-SECRET"
-  serverUrl    = "https://example.okta.com" # Or "https://example.auth0.com/"
+    type         = "generic"
+    clientId     = "IDP-APP-CLIENT-ID"
+    clientSecret = "IDP-APP-CLIENT-SECRET"
+    serverUrl    = "https://example.okta.com" # Or "https://example.auth0.com/"
 }
 ```
 
 #### Example: Azure AD IDP Configuration
 
 ```hcl
 wayfinder_idp_details = {
-  type          = "aad"
-  clientId      = "IDP-APP-CLIENT-ID"
-  clientSecret  = "IDP-APP-CLIENT-SECRET"
-  azureTenantId = "12345678-1234-1234-1234-123456789012"
+    type          = "aad"
+    clientId      = "IDP-APP-CLIENT-ID"
+    clientSecret  = "IDP-APP-CLIENT-SECRET"
+    azureTenantId = "12345678-1234-1234-1234-123456789012"
 }
 ```
 
@@ -60,6 +60,8 @@ The `terraform-docs` utility is used to generate this README. Follow the below s
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_adcs"></a> [adcs](#input\_adcs) | ADCS variables required when using ADCS Issuer with Cert Manager | <pre>object({<br>    url                       = string<br>    username                  = string<br>    ca_bundle                 = string<br>    certificate_template_name = string<br>  })</pre> | `null` | no |
+| <a name="input_adcs_password"></a> [adcs\_password](#input\_adcs\_password) | ADCS password required when using ADCS Issuer with Cert Manager | `string` | `""` | no |
 | <a name="input_aks_agents_size"></a> [aks\_agents\_size](#input\_aks\_agents\_size) | The default size of the agents pool. | `string` | `"Standard_D2s_v3"` | no |
 | <a name="input_aks_api_server_authorized_ip_ranges"></a> [aks\_api\_server\_authorized\_ip\_ranges](#input\_aks\_api\_server\_authorized\_ip\_ranges) | The list of authorized IP ranges to contact the API server. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
 | <a name="input_aks_enable_host_encryption"></a> [aks\_enable\_host\_encryption](#input\_aks\_enable\_host\_encryption) | Whether to enable host encryption. | `bool` | `false` | no |
@@ -70,7 +72,7 @@ The `terraform-docs` utility is used to generate this README. Follow the below s
 | <a name="input_cert_manager_keyvault_cert_name"></a> [cert\_manager\_keyvault\_cert\_name](#input\_cert\_manager\_keyvault\_cert\_name) | Keyvault certificate name to use for cert-manager. Required if cluster issuer is keyvault | `string` | `null` | no |
 | <a name="input_cert_manager_keyvault_name"></a> [cert\_manager\_keyvault\_name](#input\_cert\_manager\_keyvault\_name) | Keyvault name to use for cert-manager. Required if cluster issuer is keyvault | `string` | `null` | no |
 | <a name="input_cluster_nodepool_version"></a> [cluster\_nodepool\_version](#input\_cluster\_nodepool\_version) | The Kubernetes version to use for the AKS cluster Nodepools. | `string` | `"1.28"` | no |
-| <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | The Kubernetes version to use for the AKS cluster. | `string` | `"1.28"` | no |
+| <a name="input_cluster_version"></a> [cluster\_version](#input\_cluster\_version) | The Kubernetes version to use for the AKS cluster. | `string` | `"1.29"` | no |
 | <a name="input_clusterissuer"></a> [clusterissuer](#input\_clusterissuer) | Cluster Issuer name to use for certs | `string` | `"letsencrypt-prod"` | no |
 | <a name="input_clusterissuer_email"></a> [clusterissuer\_email](#input\_clusterissuer\_email) | The email address to use for the cert-manager cluster issuer. | `string` | n/a | yes |
 | <a name="input_create_duration_delay"></a> [create\_duration\_delay](#input\_create\_duration\_delay) | Used to tune terraform apply when faced with errors caused by API caching or eventual consistency. Sets a custom delay period after creation of the specified resource type. | <pre>object({<br>    azurerm_role_definition         = optional(string, "180s")<br>    kubectl_manifest_cloud_identity = optional(string, "30s")<br>  })</pre> | `{}` | no |
@@ -100,7 +102,7 @@ The `terraform-docs` utility is used to generate this README. Follow the below s
 | <a name="input_wayfinder_instance_id"></a> [wayfinder\_instance\_id](#input\_wayfinder\_instance\_id) | The instance ID to use for Wayfinder. | `string` | n/a | yes |
 | <a name="input_wayfinder_licence_key"></a> [wayfinder\_licence\_key](#input\_wayfinder\_licence\_key) | The licence key to use for Wayfinder | `string` | n/a | yes |
 | <a name="input_wayfinder_release_channel"></a> [wayfinder\_release\_channel](#input\_wayfinder\_release\_channel) | The release channel to use for Wayfinder | `string` | `"wayfinder-releases"` | no |
-| <a name="input_wayfinder_version"></a> [wayfinder\_version](#input\_wayfinder\_version) | The version to use for Wayfinder | `string` | `"v2.6.4"` | no |
+| <a name="input_wayfinder_version"></a> [wayfinder\_version](#input\_wayfinder\_version) | The version to use for Wayfinder | `string` | `"v2.7.1"` | no |
 
 ## Outputs
 

diff --git a/aks.tf b/aks.tf
@@ -1,6 +1,7 @@
+#tfsec:ignore:azure-container-limit-authorized-ips
 module "aks" {
   source  = "Azure/aks/azurerm"
-  version = "7.3.1"
+  version = "8.0.0"
 
   prefix              = local.name
   resource_group_name = var.resource_group_name
@@ -38,7 +39,6 @@ module "aks" {
   private_cluster_enabled               = var.disable_internet_access
   private_cluster_public_fqdn_enabled   = false
   private_dns_zone_id                   = var.private_dns_zone_id
-  public_network_access_enabled         = !var.disable_internet_access
   rbac_aad                              = true
   rbac_aad_admin_group_object_ids       = var.aks_rbac_aad_admin_group_object_ids
   rbac_aad_managed                      = true

diff --git a/cert-manager.tf b/cert-manager.tf
@@ -67,7 +67,7 @@ resource "helm_release" "cert_manager" {
   name        = "cert-manager"
   repository  = "https://charts.jetstack.io"
   chart       = "cert-manager"
-  version     = "v1.11.0"
+  version     = "v1.14.5"
   max_history = 5
 
   values = [templatefile("${path.module}/manifests/cert-manager-values.yml.tpl", {