0d904fe130
HelmChart values schema changed in newer Traefik versions causing installation failures. Replaced with direct Deployment + RBAC manifests which work reliably with Traefik v3.2. Also adds SSH public key variable for admin access. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
128 lines
3 KiB
HCL
128 lines
3 KiB
HCL
# Foundation Infrastructure - Main Configuration
|
|
# RFC 0039: ADR-Compliant Foundation Infrastructure
|
|
#
|
|
# Architecture:
|
|
# - VPC with 3 AZs for high availability
|
|
# - EKS cluster with Karpenter for auto-scaling compute
|
|
# - CockroachDB 3-node cluster with FIPS 140-2
|
|
# - Shared NLB for all services
|
|
# - EBS gp3 and EFS storage
|
|
# - S3 for blob storage and backups
|
|
|
|
locals {
|
|
name = "${var.project_name}-${var.environment}"
|
|
|
|
common_tags = merge(var.tags, {
|
|
Project = var.project_name
|
|
Environment = var.environment
|
|
ManagedBy = "terraform"
|
|
RFC = "0039"
|
|
ADR = "0003,0004,0005"
|
|
})
|
|
|
|
# Get available AZs in the region
|
|
azs = slice(data.aws_availability_zones.available.names, 0, 3)
|
|
}
|
|
|
|
data "aws_availability_zones" "available" {
|
|
state = "available"
|
|
filter {
|
|
name = "opt-in-status"
|
|
values = ["opt-in-not-required"]
|
|
}
|
|
}
|
|
|
|
data "aws_caller_identity" "current" {}
|
|
|
|
# VPC Module - Multi-AZ networking
|
|
module "vpc" {
|
|
source = "./modules/vpc"
|
|
|
|
name = local.name
|
|
cidr = var.vpc_cidr
|
|
availability_zones = local.azs
|
|
enable_nat_gateway = true
|
|
single_nat_gateway = false # HA: one NAT per AZ
|
|
|
|
tags = local.common_tags
|
|
}
|
|
|
|
# EKS Module - Kubernetes with Karpenter
|
|
module "eks" {
|
|
source = "./modules/eks"
|
|
|
|
cluster_name = local.name
|
|
cluster_version = var.kubernetes_version
|
|
vpc_id = module.vpc.vpc_id
|
|
private_subnet_ids = module.vpc.private_subnet_ids
|
|
public_subnet_ids = module.vpc.public_subnet_ids
|
|
|
|
# Karpenter configuration
|
|
enable_karpenter = true
|
|
|
|
# FIPS compliance
|
|
enable_fips = var.enable_fips
|
|
|
|
tags = local.common_tags
|
|
|
|
depends_on = [module.vpc]
|
|
}
|
|
|
|
# IAM Module - Roles and IRSA
|
|
module "iam" {
|
|
source = "./modules/iam"
|
|
|
|
cluster_name = module.eks.cluster_name
|
|
cluster_oidc_issuer_url = module.eks.cluster_oidc_issuer_url
|
|
cluster_oidc_provider_arn = module.eks.oidc_provider_arn
|
|
|
|
tags = local.common_tags
|
|
|
|
depends_on = [module.eks]
|
|
}
|
|
|
|
# Storage Module - EBS, EFS, S3
|
|
module "storage" {
|
|
source = "./modules/storage"
|
|
|
|
name = local.name
|
|
vpc_id = module.vpc.vpc_id
|
|
private_subnet_ids = module.vpc.private_subnet_ids
|
|
availability_zones = local.azs
|
|
|
|
# Enable encryption for FIPS compliance
|
|
enable_encryption = var.enable_fips
|
|
|
|
tags = local.common_tags
|
|
|
|
depends_on = [module.vpc]
|
|
}
|
|
|
|
# NLB Module - Shared Network Load Balancer
|
|
# RFC 0046: Updated to support Elastic IPs for DNS glue records
|
|
module "nlb" {
|
|
source = "./modules/nlb"
|
|
|
|
name = local.name
|
|
vpc_id = module.vpc.vpc_id
|
|
public_subnet_ids = module.vpc.public_subnet_ids
|
|
|
|
# Static IPs disabled for initial deployment
|
|
enable_static_ips = false
|
|
elastic_ip_ids = []
|
|
|
|
tags = local.common_tags
|
|
|
|
depends_on = [module.vpc]
|
|
}
|
|
|
|
# S3 Module - Additional blob storage buckets
|
|
module "s3" {
|
|
source = "./modules/s3"
|
|
|
|
name = local.name
|
|
log_retention_days = var.log_retention_days
|
|
trace_retention_days = var.trace_retention_days
|
|
|
|
tags = local.common_tags
|
|
}
|