f5devcentral / terraform-modular-demo-framework Goto Github PK

Research and consider the use of Git Submodules for including Terraform modules from external repositories instead of copying files.

When running terragrunt run-all apply, the module in aws-site-1-app-vm complains about a missing input variable. Should the terragrunt.hcl.example be updated?

Error: No value for required variable
│ 
│   on variables.tf line 16:
│   16: variable "domain_name" {
│ 
│ The root module input variable "domain_name" is not set, and has no default
│ value. Use a -var or -var-file command line argument to provide a value for
│ this variable.
╵
ERRO[1578] Terraform invocation failed in /.../aws-site-1-app-vm/.terragrunt-cache/marble-farble-warble-garble  prefix=[/.../aws-site-1-app-vm] 
INFO[1578] Executing hook: missing_var                   prefix=[/.../aws-site-1-app-vm] 
missing required input variable. check your terragrunt.hcl input{} block.
ERRO[1578] Module /.../aws-site-1-app-vm has finished with an error: 1 error occurred:
        * exit status 1
  prefix=[/.../aws-site-1-app-vm] 
ERRO[1578] 1 error occurred:
        * exit status 1

Observed error upon tgrd
╷
│ Error: Failed to load plugin schemas
│
│ Error while loading schemas for plugin components: Failed to obtain
│ provider schema: Could not load the schema for provider
│ registry.terraform.io/volterraedge/volterra: failed to instantiate provider
│ "registry.terraform.io/volterraedge/volterra" to obtain schema: timeout
│ while waiting for plugin to start..
╵
ERRO[0118] Terraform invocation failed in /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-appstack-site/.terragrunt-cache/W03i2NcCBxPkAihAwHI-cI-Mtjg/m-blz7dzgTZbQLyV2mSyni8y6jQ prefix=[/mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-appstack-site]
ERRO[0118] Module /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-appstack-site has finished with an error: 1 error occurred:
* exit status 1
prefix=[/mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-appstack-site]
ERRO[0118] Dependency /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-appstack-site of module /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-base-1 just finished with an error. Module /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-base-1 will have to return an error too. prefix=[/mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-base-1]
ERRO[0118] Module /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-base-1 has finished with an error: Cannot process module Module /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-base-1 (excluded: false, assume
applied: false, dependencies: []) because one of its dependencies, Module /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-appstack-site (excluded: false, assume applied: false, dependencies: [/mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-base-1]), finished with an error: 1 error occurred:
* exit status 1
prefix=[/mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/azure-base-1]
╷
│ Error: Failed to load plugin schemas
│
│ Error while loading schemas for plugin components: 2 problems:
│
│ - Failed to obtain provider schema: Could not load the schema for provider
│ registry.terraform.io/hashicorp/aws: failed to instantiate provider
│ "registry.terraform.io/hashicorp/aws" to obtain schema: timeout while
│ waiting for plugin to start.
│ - Failed to obtain provider schema: Could not load the schema for provider
│ registry.terraform.io/volterraedge/volterra: failed to instantiate provider
│ "registry.terraform.io/volterraedge/volterra" to obtain schema: timeout
│ while waiting for plugin to start..
╵
ERRO[0183] Terraform invocation failed in /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/site-mesh-group/.terragrunt-cache/3OOCM52Mjn65U_kqwkivh2XPnaM/UvrRO2cFgLu-SIqyEzGfzEXNHmE prefix=[/mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/site-mesh-group]
ERRO[0183] Module /mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/site-mesh-group has finished with an error: 1 error occurred:
* exit status 1
prefix=[/mnt/c/Users/piyer/Desktop/GitHub Repos/expensive.food/site-mesh-group]

The appstack instance was still waiting for registration twenty minutes after the other sites were online.

command

terragrunt run-all apply

git

c165dff (HEAD -> main, origin/main) Merge pull request #20 from mjmenger/azure-appstack

a virtual kubernetes environment using the sites in a site group

an automated solution to validate that credentials with the requisite access are available before starting the build

If the credentials used by Terraform and the cloud credentials used for XC Site creation are inconsitent, an error will occur during the tf_params_action resource apply.

Documented steps to verify credential consistency are necessary. An automated solution for performing a pre-check for credential consistency would be ideal.

should include workflow for creating compatible modules

Investigate integrate with OpenPolicyAgent API to perform a compliance check on the parent terragrunt.hcl as a pre-check criteria, before triggering any TF deployments

Thinking ahead as I get ready to contribute and the questions I have after reading Contributing doc and the community beyond just F5 that hopefully evolves from this effort. Requesting review by @piyerf5 @sstarzh @JeffGiroux @jmcalalang, @mjmenger.

As a collaborator, I want to understand the conventions and workflow for contributing to this project as it grows.

Coding style

• Should we have any style guidelines for Terraform and Terragrunt? Is an enforced terraform fmt sufficient?
• Should we reuse the existing Terraform and Terragrunt guides?
• Do we refactor existing work which diverges from guidelines? E.g. camelCase where snake_case is recommended.

Development

• Prefer (require?) commit messages to confirm to a standard, say Conventional Commits?
  • Pros: tooling to support automatic CHANGELOG management, and semantic release management through GitHub Actions
  • Cons: new habit to establish, can seem petty
• Enforce squash and rebase PRs, or keep the history?

Community

• Contributors covenant or similar declaration?
• Declaration of (lack of) F5 support?
• Encourage F5 slack for Q&A or keep it all to GitHub issues?

What else am I missing?

secrets must be encrypted

a proper license should be included in all related respositories.

during the tfparam_action the following error was received

Error: Error Running terraform parameter action struct: CustomAPI RPC: Doing custom RPC using Rest: Unsuccessful custom API POST on /public/namespaces/system/terraform/aws_vpc_site/[sitename]/run, status 404, body {"code":5,"details":[],"message":"no terraform parameters entry system/ves-io-aws-vpc-site-sitename"}

A subsequent apply, without any modifications, successfully built the AWS VPC site.

Following a full build, running a terragrunt run-all destroy is leaving behind some objects in XC Console. Observed with aws-vpc-site-2 and virtual site object

while running terragrunt run-all destroy, the aws-appstack-site-1 module reported a successful destruction. When terragrunt subsequently tried to destroy aws-base-1, an error was returned that its subnets still had dependencies.

aws_subnet.f5-xc-services-internal["az1"]: Still destroying... [id=subnet-0758b315fde555be2, 20m0s elapsed]
╷
│ Error: deleting EC2 Subnet (subnet-0758b315fde555be2): DependencyViolation: The subnet 'subnet-0758b315fde555be2' has dependencies and cannot be deleted.
│       status code: 400, request id: 4c3bd14a-9062-4e9b-93e7-da6dd8e78dce
│ 
│ 
╵
╷
│ Error: deleting EC2 Internet Gateway (igw-0193033119e7a8755): error detaching EC2 Internet Gateway (igw-0193033119e7a8755) from VPC (vpc-0d67cd6e2397f6d6f): DependencyViolation: Network vpc-0d67cd6e2397f6d6f has some mapped public address(es). Please unmap those public address(es) before detaching the gateway.
│       status code: 400, request id: 14bd8f70-258d-4653-bbbf-41791f683495
│ 
│ 
╵
╷
│ Error: deleting EC2 Subnet (subnet-0f176f351fb7eadc5): DependencyViolation: The subnet 'subnet-0f176f351fb7eadc5' has dependencies and cannot be deleted.
│       status code: 400, request id: 35cba0e9-3f33-4f40-979f-100b39e45e1b
│ 
│ 
╵
╷
│ Error: deleting EC2 Subnet (subnet-04c0484d23a97cc9d): DependencyViolation: The subnet 'subnet-04c0484d23a97cc9d' has dependencies and cannot be deleted.
│       status code: 400, request id: 8e8767fb-5263-43fd-a8b8-c6127956bbb6
│ 
│ 
╵
ERRO[1224] Terraform invocation failed in /home/user/expensive.food/aws-base-1/.terragrunt-cache/AxdR91sFvJDz83Xpeya5EMk94PI/guhU0ixwR2xAA1bh1htXoRVtKtI  prefix=[/home/user/expensive.food/aws-base-1] 
ERRO[1224] 1 error occurred:
        * exit status 1

The F5 Distributed Cloud console showed the AWS VPC site created by aws-appstack-site-1. Trying to run terragrunt destroy in aws-appstack-site-1 resulted in no change because it believed everything was destroyed. Manually requesting a destroy and then a delete, removed the AWS and XC artifacts of the AWS VPC Site.

Deploy a demo app on AWS, and publish the app via AWS vpc site. This module will focus on deploying an app on EC2 instances, published via the AWS VPC Site created by XC.

Deploy NGINX API GW on Appstack (PoC to document procedure, caveats, limitations)

Deploy a jumphost on AWS in the external subnet and supply public access to trusted IPs. This module will focus on deploying an Ubuntu jumphost on an EC2 instance so it can be used to a securely access private workloads for testing.

Deploy/ Un-deploy Container Diagnostics app in XC AppStack Site and manage via XC.
Includes:

1. Deploy app from public repo
2. Create needed roles, role bindings, etc
3. Manage via XC - Demo of app management via mk8s
4. Destroy app and associated objects/roles/role-bindings

After the tf_params_action resource successfully completed, the sites remain 'waiting for registration' and never move into provisioning and finally into online status.

If there is an error with initializing the site such that they won't be provisioned, the terraform provider should return an error rather than a success.

Prompt for var.trusted_ip shows the following note:
IP to allow external access

Note should be modified to:
IP to allow external access ( eg: 192.168.1.10/32)

CIDR notation is a required input for trusted IP, and should be indicated in the note with an example

Ask @jmcalalang for details
Things like LDAP, DNS, IPAM, etc.