Add cert-manager root certificate

.pre-commit-config.yaml

@@ -12,7 +12,7 @@ repos:
       - id: check-symlinks
 
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.97.0
+    rev: v1.97.1
     hooks:
       - id: terraform_fmt
 
@@ -33,12 +33,12 @@ repos:
           - --hook-config=--create-file-if-not-exist=false
 
   - repo: https://github.com/bridgecrewio/checkov.git
-    rev: 3.2.357
+    rev: 3.2.360
     hooks:
       - id: checkov
         verbose: true
         args:
           - --download-external-modules=true
           - --skip-check
-          - "CKV_TF_1"
+          - "CKV_TF_1,CKV_TF_2"
           - --quiet

README.md

@@ -57,8 +57,9 @@ No providers.
 |------|--------|---------|
 | <a name="module_datadog"></a> [datadog](#module\_datadog) | github.com/osinfra-io/terraform-datadog-google-integration | v0.3.0 |
 | <a name="module_helpers"></a> [helpers](#module\_helpers) | github.com/osinfra-io/terraform-core-helpers//root | v0.1.2 |
+| <a name="module_kubernetes_cert_manager"></a> [kubernetes\_cert\_manager](#module\_kubernetes\_cert\_manager) | github.com/osinfra-io/terraform-kubernetes-cert-manager | tls |
 | <a name="module_kubernetes_engine"></a> [kubernetes\_engine](#module\_kubernetes\_engine) | github.com/osinfra-io/terraform-google-kubernetes-engine | v0.2.2 |
-| <a name="module_kubernetes_istio"></a> [kubernetes\_istio](#module\_kubernetes\_istio) | github.com/osinfra-io/terraform-kubernetes-istio | v0.1.7 |
+| <a name="module_kubernetes_istio"></a> [kubernetes\_istio](#module\_kubernetes\_istio) | github.com/osinfra-io/terraform-kubernetes-istio | ecdsa |
 | <a name="module_project"></a> [project](#module\_project) | github.com/osinfra-io/terraform-google-project | v0.4.5 |
 
 #### Resources
@@ -83,6 +84,8 @@ No resources.
 
 | Name | Description |
 |------|-------------|
+| <a name="output_kubernetes_cert_manager_tls_self_signed_cert_cert_manager_root_cert"></a> [kubernetes\_cert\_manager\_tls\_self\_signed\_cert\_cert\_manager\_root\_cert](#output\_kubernetes\_cert\_manager\_tls\_self\_signed\_cert\_cert\_manager\_root\_cert) | The self-signed certificate for the cert-manager root certificate |
+| <a name="output_kubernetes_cert_manager_tls_self_signed_cert_cert_manager_root_key"></a> [kubernetes\_cert\_manager\_tls\_self\_signed\_cert\_cert\_manager\_root\_key](#output\_kubernetes\_cert\_manager\_tls\_self\_signed\_cert\_cert\_manager\_root\_key) | The private key for the cert-manager root certificate |
 | <a name="output_kubernetes_engine_container_deployer_service_accounts"></a> [kubernetes\_engine\_container\_deployer\_service\_accounts](#output\_kubernetes\_engine\_container\_deployer\_service\_accounts) | The service accounts for the container deployer |
 | <a name="output_kubernetes_engine_workload_identity_service_account_emails"></a> [kubernetes\_engine\_workload\_identity\_service\_account\_emails](#output\_kubernetes\_engine\_workload\_identity\_service\_account\_emails) | The email addresses of the service accounts for the Kubernetes namespace workload identity |
 | <a name="output_kubernetes_istio_gateway_mci_global_address"></a> [kubernetes\_istio\_gateway\_mci\_global\_address](#output\_kubernetes\_istio\_gateway\_mci\_global\_address) | The IP address for the Istio Gateway multi-cluster ingress |

main.tf

@@ -12,6 +12,34 @@ module "datadog" {
   project                            = module.project.id
 }
 
+# Kubernetes cert-manager Module (osinfra.io)
+# https://github.com/osinfra-io/terraform-kubernetes-cert-manager
+
+module "kubernetes_cert_manager" {
+  source = "github.com/osinfra-io/terraform-kubernetes-cert-manager?ref=tls"
+}
+
+# Google Kubernetes Engine Module (osinfra.io)
+# https://github.com/osinfra-io/terraform-google-kubernetes-engine
+
+module "kubernetes_engine" {
+  source = "github.com/osinfra-io/terraform-google-kubernetes-engine?ref=v0.2.2"
+
+  namespaces = var.kubernetes_engine_namespaces
+  project    = module.project.id
+}
+
+# Kubernetes Istio Module (osinfra.io)
+# https://github.com/osinfra-io/terraform-kubernetes-istio
+
+module "kubernetes_istio" {
+  source = "github.com/osinfra-io/terraform-kubernetes-istio?ref=ecdsa"
+
+  gateway_dns = var.kubernetes_istio_gateway_dns
+  labels      = module.helpers.labels
+  project     = module.project.id
+}
+
 # Google Project Module (osinfra.io)
 # https://github.com/osinfra-io/terraform-google-project
 
@@ -48,24 +76,3 @@ module "project" {
     "trafficdirector.googleapis.com"
   ]
 }
-
-# Google Kubernetes Engine Module (osinfra.io)
-# https://github.com/osinfra-io/terraform-google-kubernetes-engine
-
-module "kubernetes_engine" {
-  source = "github.com/osinfra-io/terraform-google-kubernetes-engine?ref=v0.2.2"
-
-  namespaces = var.kubernetes_engine_namespaces
-  project    = module.project.id
-}
-
-# Kubernetes Istio Module (osinfra.io)
-# https://github.com/osinfra-io/terraform-kubernetes-istio
-
-module "kubernetes_istio" {
-  source = "github.com/osinfra-io/terraform-kubernetes-istio?ref=v0.1.7"
-
-  gateway_dns = var.kubernetes_istio_gateway_dns
-  labels      = module.helpers.labels
-  project     = module.project.id
-}

outputs.tf

@@ -11,6 +11,17 @@ output "kubernetes_engine_workload_identity_service_account_emails" {
   value       = module.kubernetes_engine.workload_identity_service_account_emails
 }
 
+output "kubernetes_cert_manager_tls_self_signed_cert_cert_manager_root_cert" {
+  description = "The self-signed certificate for the cert-manager root certificate"
+  value       = module.kubernetes_cert_manager.tls_self_signed_cert_cert_manager_root_cert
+}
+
+output "kubernetes_cert_manager_tls_self_signed_cert_cert_manager_root_key" {
+  description = "The private key for the cert-manager root certificate"
+  value       = module.kubernetes_cert_manager.tls_self_signed_cert_cert_manager_root_key
+  sensitive   = true
+}
+
 output "kubernetes_istio_gateway_mci_global_address" {
   description = "The IP address for the Istio Gateway multi-cluster ingress"
   value       = module.kubernetes_istio.gateway_mci_global_address

regional/cert-manager/README.md

@@ -9,7 +9,7 @@ No requirements.
 
 | Name | Version |
 |------|---------|
-| <a name="provider_google"></a> [google](#provider\_google) | 6.17.0 |
+| <a name="provider_google"></a> [google](#provider\_google) | 6.18.1 |
 
 ## Modules
 

regional/cert-manager/istio-csr/README.md

@@ -9,14 +9,15 @@ No requirements.
 
 | Name | Version |
 |------|---------|
-| <a name="provider_google"></a> [google](#provider\_google) | 6.17.0 |
+| <a name="provider_google"></a> [google](#provider\_google) | 6.18.1 |
+| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
 
 | Name | Source | Version |
 |------|--------|---------|
 | <a name="module_helpers"></a> [helpers](#module\_helpers) | github.com/osinfra-io/terraform-core-helpers//root | v0.1.2 |
-| <a name="module_kubernetes_cert_manager_istio_csr"></a> [kubernetes\_cert\_manager\_istio\_csr](#module\_kubernetes\_cert\_manager\_istio\_csr) | github.com/osinfra-io/terraform-kubernetes-cert-manager//regional/istio-csr | v0.1.4 |
+| <a name="module_kubernetes_cert_manager_istio_csr"></a> [kubernetes\_cert\_manager\_istio\_csr](#module\_kubernetes\_cert\_manager\_istio\_csr) | github.com/osinfra-io/terraform-kubernetes-cert-manager//regional/istio-csr | tls |
 
 ## Resources
 
@@ -26,10 +27,13 @@ No requirements.
 | [google_container_cluster.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/container_cluster) | data source |
 | [google_project.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
 | [google_projects.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/projects) | data source |
+| [terraform_remote_state.main](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/data-sources/remote_state) | data source |
 
 ## Inputs
 
-No inputs.
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_remote_bucket"></a> [remote\_bucket](#input\_remote\_bucket) | The remote bucket the `terraform_remote_state` data source retrieves the state from | `string` | n/a | yes |
 
 ## Outputs
 

regional/cert-manager/istio-csr/locals.tf

@@ -0,0 +1,6 @@
+# Local Values
+# https://www.terraform.io/docs/language/values/locals.html
+
+locals {
+  main = data.terraform_remote_state.main.outputs
+}

regional/cert-manager/istio-csr/main.tf

@@ -1,9 +1,25 @@
+# Terraform Remote State Datasource
+# https://www.terraform.io/docs/language/state/remote-state-data.html
+
+data "terraform_remote_state" "main" {
+  backend = "gcs"
+
+  config = {
+    bucket = var.remote_bucket
+    prefix = module.helpers.repository
+  }
+
+  workspace = "main-${module.helpers.environment}"
+}
+
 # Kubernetes cert-manager Module (osinfra.io)
 # https://github.com/osinfra-io/terraform-kubernetes-cert-manager
 
 module "kubernetes_cert_manager_istio_csr" {
-  source = "github.com/osinfra-io/terraform-kubernetes-cert-manager//regional/istio-csr?ref=v0.1.4"
+  source = "github.com/osinfra-io/terraform-kubernetes-cert-manager//regional/istio-csr?ref=tls"
 
-  artifact_registry = "us-docker.pkg.dev/plt-lz-services-tf79-prod/plt-docker-virtual"
-  cluster_prefix    = "plt"
+  artifact_registry                           = "us-docker.pkg.dev/plt-lz-services-tf79-prod/plt-docker-virtual"
+  cluster_prefix                              = "plt"
+  tls_self_signed_cert_cert_manager_root_cert = local.main.kubernetes_cert_manager_tls_self_signed_cert_cert_manager_root_cert
+  tls_self_signed_cert_cert_manager_root_key  = local.main.kubernetes_cert_manager_tls_self_signed_cert_cert_manager_root_key
 }

regional/cert-manager/istio-csr/tfvars/us-east1-b-non-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-ae26-nonprod"

regional/cert-manager/istio-csr/tfvars/us-east1-b-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-53a5-prod"

regional/cert-manager/istio-csr/tfvars/us-east1-b-sandbox.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-4312-sb"

regional/cert-manager/istio-csr/tfvars/us-east1-c-non-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-ae26-nonprod"

regional/cert-manager/istio-csr/tfvars/us-east1-c-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-53a5-prod"

regional/cert-manager/istio-csr/tfvars/us-east1-c-sandbox.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-4312-sb"

regional/cert-manager/istio-csr/tfvars/us-east1-d-non-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-ae26-nonprod"

regional/cert-manager/istio-csr/tfvars/us-east1-d-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-53a5-prod"

regional/cert-manager/istio-csr/tfvars/us-east1-d-sandbox.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-4312-sb"

regional/cert-manager/istio-csr/tfvars/us-east4-a-non-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-ae26-nonprod"

regional/cert-manager/istio-csr/tfvars/us-east4-a-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-53a5-prod"

regional/cert-manager/istio-csr/tfvars/us-east4-a-sandbox.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-4312-sb"

regional/cert-manager/istio-csr/tfvars/us-east4-b-non-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-ae26-nonprod"

regional/cert-manager/istio-csr/tfvars/us-east4-b-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-53a5-prod"

regional/cert-manager/istio-csr/tfvars/us-east4-b-sandbox.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-4312-sb"

regional/cert-manager/istio-csr/tfvars/us-east4-c-non-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-ae26-nonprod"

regional/cert-manager/istio-csr/tfvars/us-east4-c-production.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-53a5-prod"

regional/cert-manager/istio-csr/tfvars/us-east4-c-sandbox.tfvars

@@ -0,0 +1 @@
+remote_bucket = "plt-k8s-4312-sb"

regional/cert-manager/istio-csr/variables.tf

@@ -0,0 +1,7 @@
+# Input Variables
+# https://www.terraform.io/language/values/variables
+
+variable "remote_bucket" {
+  type        = string
+  description = "The remote bucket the `terraform_remote_state` data source retrieves the state from"
+}