-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: [PAYMCLOUD-192] Add OpenCost Terraform module for AKS deployment (
#395) * Add OpenCost Terraform module for AKS deployment This commit introduces a Terraform module to deploy OpenCost on AKS with Azure Managed Identities and Prometheus integration. It includes resources for role definitions, role assignments, Kubernetes configuration, and Helm chart deployments for OpenCost and Prometheus. Documentation (README) and input validation for variables are also provided. * Refactor variable usage and simplify role naming logic Replaced `prefix` variable with `project` and moved logic for `env_short` and `location` into `locals`. Removed unused variables to clean up the code. Adjusted Helm provider version to use a broader compatible range. * Update Helm provider version constraint in Terraform Changed the Helm provider version from "~> 2.0.0" to ">= 2.0.0" to allow for greater flexibility with newer versions. This ensures compatibility with future updates while maintaining the minimum required version. * Configure external Prometheus URL for OpenCost Add a new Helm value to set the `opencost.prometheus.external.url` pointing to the Prometheus service within the Kubernetes cluster. This enables OpenCost to connect to Prometheus using the specified external URL format. * Refactor Prometheus variables into a single configuration object Replaced standalone Prometheus variables with a unified `prometheus_config` object to simplify configuration and improve maintainability. Adjusted references in the main Terraform file to use the new structure. Updated default values and descriptions accordingly. * Swap `service_port` and `chart_version` in Prometheus config Reordered the variables in the `prometheus_config` object to align with expected types and defaults. This ensures clarity and maintains consistency in the configuration structure. No functional behavior is affected. * Remove Helm deployment for prometheus-opencost-exporter. Commented out the Helm release block for prometheus-opencost-exporter in the main Terraform configuration. This change effectively disables its deployment while retaining the code for potential future use. * Enable ServiceMonitor for metrics collection Added `metrics.serviceMonitor.enabled` configuration in the Helm chart setup to activate ServiceMonitor. This ensures metrics are properly collected and integrated with Prometheus. * Replace OpenCost Helm chart with Prometheus OpenCost Exporter Switched from the deprecated OpenCost Helm chart to the Prometheus OpenCost Exporter chart. Updated resource definitions to align with the new chart repository and version, and adjusted configurations where necessary. This ensures better compatibility and alignment with Prometheus ecosystem standards. * Add ServiceMonitor and cleanup Helm deployment block Introduced a ServiceMonitor resource for Prometheus to scrape OpenCost metrics. Removed the commented-out Helm deployment block for clarity and maintenance. Refined comments and output descriptions for better readability. * Add cost_analysis_enabled variable for Kubernetes cluster Introduced a new variable `cost_analysis_enabled` to enable cost analysis for Kubernetes clusters when set to true. This feature adds namespace and deployment details to Azure portal's Cost Analysis views, enhancing cost visibility and management. Defaults to false for backward compatibility. * Disable ServiceMonitor resource for OpenCost. Commented out the ServiceMonitor resource configuration, effectively disabling it. This change may be necessary to prevent conflicts or due to deprecation or operational adjustments. * Remove commented-out ServiceMonitor resource block The ServiceMonitor resource block was unused and commented out. Removing it helps to clean up the configuration and improve readability of the Terraform file.
- Loading branch information
Showing
8 changed files
with
286 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
|
|
||
| data "azurerm_kubernetes_cluster" "aks" { | ||
| name = var.aks_name | ||
| resource_group_name = var.aks_rg_name | ||
| } | ||
|
|
||
| data "kubernetes_namespace" "monitoring" { | ||
| metadata { | ||
| name = var.kubernetes_namespace | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,119 @@ | ||
| locals { | ||
| env_short = substr(var.env, 0, 1) | ||
| location = data.azurerm_kubernetes_cluster.aks.location | ||
| } | ||
|
|
||
| resource "azurerm_role_definition" "open_cost_role" { | ||
| name = "${var.project}-${local.env_short}-${local.location}-OpenCostRole" | ||
| scope = data.azurerm_subscription.current.id | ||
| description = "Rate Card query role" | ||
| permissions { | ||
| actions = [ | ||
| "Microsoft.Compute/virtualMachines/vmSizes/read", | ||
| "Microsoft.Resources/subscriptions/locations/read", | ||
| "Microsoft.Resources/providers/read", | ||
| "Microsoft.ContainerService/containerServices/read", | ||
| "Microsoft.Commerce/RateCard/read" | ||
| ] | ||
| not_actions = [] | ||
| } | ||
| assignable_scopes = [ | ||
| data.azurerm_subscription.current.id | ||
| ] | ||
| } | ||
|
|
||
| # Create an Azure User-Assigned Managed Identity (UAMI) | ||
| resource "azurerm_user_assigned_identity" "opencost_identity" { | ||
| name = "${var.project}-${local.env_short}-${local.location}-opencost-managed-identity" | ||
| location = local.location | ||
| resource_group_name = data.azurerm_kubernetes_cluster.aks.resource_group_name | ||
| } | ||
|
|
||
| # Assign role to UAMI | ||
| resource "azurerm_role_assignment" "opencost_identity_role" { | ||
| principal_id = azurerm_user_assigned_identity.opencost_identity.principal_id | ||
| role_definition_name = azurerm_role_definition.open_cost_role.name | ||
| scope = data.azurerm_subscription.current.id | ||
| } | ||
|
|
||
| # Identity Details | ||
| output "managed_identity_details" { | ||
| description = "Dettagli dell'identità gestita User-Assigned per OpenCost" | ||
| value = jsonencode({ | ||
| identity_id = azurerm_user_assigned_identity.opencost_identity.id | ||
| principal_id = azurerm_user_assigned_identity.opencost_identity.principal_id | ||
| client_id = azurerm_user_assigned_identity.opencost_identity.client_id | ||
| subscription = data.azurerm_subscription.current.id | ||
| tenant = data.azurerm_client_config.current.tenant_id | ||
| }) | ||
| } | ||
|
|
||
| # Kubernetes Secret configs and identity | ||
| resource "kubernetes_secret" "azure_managed_identity_refs" { | ||
| metadata { | ||
| name = "azure-managed-identity" | ||
| namespace = data.kubernetes_namespace.monitoring.metadata[0].name | ||
| } | ||
|
|
||
| data = { | ||
| "client-id" = azurerm_user_assigned_identity.opencost_identity.client_id | ||
| "principal-id" = azurerm_user_assigned_identity.opencost_identity.principal_id | ||
| "identity-id" = azurerm_user_assigned_identity.opencost_identity.id | ||
| "tenant-id" = data.azurerm_client_config.current.tenant_id | ||
| } | ||
|
|
||
| type = "Opaque" | ||
| } | ||
|
|
||
| # # Helm deployment for "prometheus-opencost-exporter" | ||
| resource "helm_release" "prometheus_opencost_exporter" { | ||
| name = "prometheus-opencost-exporter" | ||
| namespace = data.kubernetes_namespace.monitoring.metadata[0].name | ||
| chart = "prometheus-opencost-exporter" | ||
| repository = "https://prometheus-community.github.io/helm-charts" | ||
| version = "0.1.1" # Adjust the version as needed | ||
|
|
||
| # Set additional values for the Helm chart if required | ||
| set { | ||
| name = "extraVolumes[0].name" | ||
| value = "azure-managed-identity-secret" | ||
| } | ||
|
|
||
| set { | ||
| name = "extraVolumes[0].secret.secretName" | ||
| value = kubernetes_secret.azure_managed_identity_refs.metadata[0].name | ||
| } | ||
|
|
||
| set { | ||
| name = "opencost.exporter.extraVolumeMounts[0].mountPath" | ||
| value = "/var/secrets" | ||
| } | ||
|
|
||
| set { | ||
| name = "opencost.exporter.extraVolumeMounts[0].name" | ||
| value = "azure-managed-identity-secret" | ||
| } | ||
|
|
||
| set { | ||
| name = "opencost.prometheus.external.url" | ||
| value = var.prometheus_config.external_url | ||
| } | ||
|
|
||
| set { | ||
| name = "opencost.prometheus.internal.namespaceName" | ||
| value = var.prometheus_config.namespace | ||
| } | ||
| set { | ||
| name = "opencost.prometheus.internal.port" | ||
| value = var.prometheus_config.service_port | ||
| } | ||
| set { | ||
| name = "opencost.prometheus.internal.serviceName" | ||
| value = var.prometheus_config.service_name | ||
| } | ||
|
|
||
| set { | ||
| name = "metrics.serviceMonitor.enabled" | ||
| value = "true" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| variable "project" { | ||
| type = string | ||
| default = "cstar" | ||
| validation { | ||
| condition = ( | ||
| length(var.project) <= 6 | ||
| ) | ||
| error_message = "Max length is 6 chars." | ||
| } | ||
| } | ||
|
|
||
| variable "env" { | ||
| type = string | ||
| validation { | ||
| condition = ( | ||
| length(var.env) <= 3 | ||
| ) | ||
| error_message = "Max length is 3 chars." | ||
| } | ||
| } | ||
|
|
||
| # AKS Variables | ||
| ################### | ||
|
|
||
| variable "aks_name" { | ||
| type = string | ||
| description = "(Required) Name of AKS cluster in Azure" | ||
| } | ||
|
|
||
| variable "aks_rg_name" { | ||
| type = string | ||
| description = "(Required) Name of AKS cluster resource group in Azure" | ||
| } | ||
|
|
||
| variable "kubernetes_namespace" { | ||
| type = string | ||
| default = "monitoring" | ||
| } | ||
|
|
||
| # Prometheus variables | ||
| ######################## | ||
|
|
||
| variable "prometheus_config" { | ||
| type = object({ | ||
| service_port = string | ||
| external_url = optional(string, "") | ||
| namespace = string | ||
| service_name = string | ||
| chart_version = optional(string, "1.42.3") | ||
| }) | ||
| description = "Configuration object for Prometheus deployment, including chart version, optional external URL, namespace, service name, service port, and other related settings." | ||
| default = { | ||
| namespace = "monitoring" | ||
| service_name = "prometheus-service" | ||
| service_port = 9090 | ||
| chart_version = "1.42.3" | ||
| external_url = "" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| terraform { | ||
| required_version = ">= 1.3.0" | ||
|
|
||
| required_providers { | ||
| helm = { | ||
| source = "hashicorp/helm" | ||
| version = ">= 2.0.0" | ||
| } | ||
| kubernetes = { | ||
| source = "hashicorp/kubernetes" | ||
| version = "<= 2.33.0" | ||
| } | ||
| azurerm = { | ||
| source = "hashicorp/azurerm" | ||
| version = "<= 3.116.0" | ||
| } | ||
| } | ||
| } | ||
|
|
||
| provider "azurerm" { | ||
| features {} | ||
| # Configuration options | ||
| } | ||
|
|
||
| data "azurerm_subscription" "current" {} | ||
|
|
||
| data "azurerm_client_config" "current" {} |
Oops, something went wrong.