Table of Contents

Overview

In this blog post, will be implementing the terraform workflow with GitHub Actions to provision the infrastructure resources in AWS Cloud Platform

Getting Started

To get started , there are some pre-requisites to deal with such as

**AWS User Account**

For terraform to provision / read any data / resources on AWS. It needs to have access which is done via IAM User and Role.

Connect to AWS account via management,- Create an IAM user : ([https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html)), enabled programmatic access

**Cloudflare API Token**

Optional : Domain can be purchased in AWS itself. As I had my domain in Cloudflare, I am using the Cloudflare terarform provider to associate the AWS Hosted Zone NS records with Cloudflare recordsets. To generate an API token on Cloudflare

Setup GitHub Secrets

Terraform needs

So , in the previous steps we have got 3 secrets ie, AWS Access Key ID, Secret Key and Cloudflare Token. These secrets to be added to GitHub repository which will be used in our workflows to get terraform authenticated to AWS and Cloudflare.

GitHub Secrets are managed in 3 levels such as Environment, Repository and Organisation. In our demo, we are going with Repository Secrets.

Branching Strategy

At this stage, important thing to work on how we are going to structure our branches for the GitHub Actions workflows. Following a simple branching strategy ie

Branch by Environment :

Create a branch for infrastructure environment , ie dev, qa, staging, production, etc. These environments are isolated in AWS. In this project, environment is chosen as demo.

So, branch named demo is created , whenever there is a PullRequest to this branch, infrastructure changes (create,update,destroy) that will be carried out AWS.

Branch by Feature:

Create a branch by feature, ie for any specific need/requirement create branch prefixed with feature/. Whenever there is a Push on these feature branches then code scans and infrastructure plan will be generated. For example, in this phase we are building the AWS network resources hence naming the feature branch as feature/aws-network.

Code on Terraform

Define Providers & Terraform Block Terraform block to define the providers , State backend.

Configuration of the provider: - Providers used in this project, which are installed during terraform when they are declared in terraform block under required_providers

Configuration of the Backend:- s3 is configured as backend inorder to store the terraform state file in a bucket

Setup Remote State

Create S3 bucket with versioning enabled

aws s3api create-bucket --bucket > --region us-east-1

aws s3api put-bucket-versioning --bucket > --versioning-configuration Status=Enabled

Create DynamoDB table

aws dynamodb create-table

--table-name >

--attribute-definitions AttributeName=LockID,AttributeType=S

--key-schema AttributeName=LockID,KeyType=HASH

--provisioned-throughput ReadCapacityUnits=5,WriteCapacityUnits=5

Define Providers and Remote State

terraform

cloudflare =

required_version = ">=1.2.0"

backend "s3"

provider "aws"

provider "cloudflare"

Terraform Folder Structure

├── README.md└── infrastructure    ├── .auto.tfvars    ├── acm.tf    ├── outputs.tf    ├── route53.tf    ├── terraform.tf    ├── variables.tf    └── vpc.tfCreate .auto.tfvars file - terraform plan, apply and destroy uses this file .auto.tfvars by default to execute if there is no values for the variables are defined under variables.tf

region = "us-east-1"

r53record =

name = "eks-demo"

vpc =

tags =

cloudflare_api_token = "" Value declared in github secrets

Build AWS Network Resources

In this section we define the AWS Network resources that are to be provisioned in AWS account. Including SSL Ceritficate, Route53 Records sets and mapping nameservers in Cloudflare.

This block provisions AWS VPC, Subnets, Route Table, Routes, NAT Gateway, Internet Gateway, Default Security Group, etc.

Also SSL Certificate and Route53 Public Hosted Zone for *.environment.basedomain. Maps the nameservers of the *.environment.basedomain to Cloudflare basedomain

AWS Network Resources

Create VPC Network for EKS Infrastructure

This module provisions VPC network that includes

VPC , Subnets, Routes, Route Tables

Internet Gateway, NAT Gateway

Subnets - Public, Private and Database

module "vpc"

Route53 & Cloudflare Mapping

Hosted Zone

Public Hosted zone for the

sub domain $ and

base domain $

Allows the inbound from VPC private subnets

locals .$"

module "zones" " = (demo)"

tags = var.tags

tags = var.tags

adding NS to cloudflare

Base Domain is on CloudFlare

This resource is going to attach the AWS NS

entried of Hosted Zone to CloudFlare

data "cloudflare_zone" "main"

resource "cloudflare_record" "main"

SSL Certificate

SSL Cert for domain

Signed by AWS

Validation method: Route53 DNS

DomainName: "$.$"

SAN: "*.$.$"

module "acm" "

]

wait_for_validation = true

tags = merge(" },var.tags)

Create GitHub Workflows

GitHub Actions : Workflow Structure

To enable the GitHub Action on any repository, Yaml file must be created under .github/workflows.

In our project we have multiple yaml files which does code scans and terraform operations.

.github

└── workflows

├── checkov-check.yml

├── plan-deploy-infra.yml

├── destroy-infra.yml

├── terraform-apply.yml

├── terraform-destroy.yml

├── terraform-plan.yml

├── test-infracode.yml

├── tflint-check.yml

└── tfsec-check.yml

We have used the branching strategy (mentioned above in this article) with git operations such as Push and Pull Request to define our workflows.

Code Scans

Tools such as TFLint, TFSec and Checkov are used to scan Terraform code in this project.

TFLint

name: TflintCheckTerraformCode

on: [workflow_call]

jobs:

tflint-checks:

name: Tflint Checks on Terraform Code

defaults:

run:

shell: bash

runs-on: ubuntu-latest

steps:

Checkout Repository

Print TFLint version

run: tflint --version

Install plugins

run: tflint --init

Run tflint command in each directory recursively

run: tflint -f compact --recursive --minimum-failure-severity=error

TFSec

name: TfsecCheckTerraformCode

on: [workflow_call]

jobs:

tfsec-checks:

name: Tfsec Checks on Terraform Code

defaults:

run:

shell: bash

runs-on: ubuntu-latest

steps:

Checkout Repository

uses: actions/checkout}"

with:

approvers: prabhu-jumisa

minimum-approvals: 1

issue-title: "Deploying Terraform to Jumisa account"

issue-body: "Please approve or deny this deployment "

exclude-workflow-initiator-as-approver: false

additional-approved-words: ''

additional-denied-words: ''

Terraform Destroy : Manual Workflow

Execute GitHub Workflows

Push Request

Pull Request

Verify AWS Resources

Connect to AWS Account and cross verify the resources creation

CleanUp

Terraform Destroy

Next Steps

Thats All for the Phase 1. Hope this article explains the clarity on base setup.

Source code on [GitHub Repo](https://github.com/jumisa/terraform-eks-gitops)

Thanks for your attention and patience to read this article. Stay tuned for the Phases implementation on the upcoming posts.

Happing reading !!! Let us learn together !!!