terraform: Terraform module for AWS

.github/actions/upload_terraform_module/action.yml

@@ -0,0 +1,23 @@
+name: Upload Terraform module
+description: "Upload the Terraform module as an artifact."
+runs:
+  using: "composite"
+  steps:
+    - name: Copy Terraform module
+      shell: bash
+      run: |
+        cp -r terraform terraform-module
+        rm terraform-module/assets.go terraform-module/BUILD.bazel
+    - name: Zip terraform dir
+      shell: bash
+      run: |
+        zip -r terraform-module.zip terraform-module
+    - name: Upload artifact
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
+      with:
+        name: terraform-module
+        path: terraform-module.zip
+    - name: Cleanup Terraform module dir
+      shell: bash
+      run: |
+        rm -r terraform-module

.github/workflows/e2e-test-tf-module.yml

@@ -0,0 +1,187 @@
+name: e2e test Terraform module
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        type: string
+        description: "Git ref to checkout"
+        required: false
+      cloudProvider:
+        description: "Which cloud provider to use."
+        type: choice
+        options:
+          - "aws"
+        default: "aws"
+        required: true
+      regionZone:
+        description: "Region or zone to create the cluster in. Leave empty for default region/zone."
+        type: string
+        default: "us-east-2c"
+        required: true
+      image:
+        description: "Node image version of the cluster."
+        type: string
+        required: true
+      cliVersion:
+        description: "Constellation CLI version to use. Empty value means build from source."
+        type: string
+        default: ""
+        required: false
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        description: "Git ref to checkout"
+        required: false
+      cloudProvider:
+        description: "Which cloud provider to use."
+        type: string
+        default: "aws"
+      regionZone:
+        description: "Which zone to use."
+        type: string
+        default: "us-east-2c"
+      image:
+        description: "Node image reference which is compatible with the current dev release version."
+        type: string
+        required: true
+      cliVersion:
+        description: "Constellation CLI version to use. Empty value means build from source."
+        type: string
+        default: ""
+        required: false
+jobs:
+  build:
+    runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          ref: ${{ inputs.ref || github.head_ref }}
+
+      - name: Upload module
+        uses: ./.github/actions/upload_terraform_module
+
+      - name: Download Terraform module
+        uses: actions/download-artifact@v3
+        with:
+          name: terraform-module
+
+      - name: Unzip Terraform module
+        run: unzip terraform-module.zip
+
+      - name: Create resource prefix
+        id: create-prefix
+        shell: bash
+        run: |
+          run_id=${{ github.run_id }}
+          last_three="${run_id: -3}"
+          echo "prefix=e2e-${last_three}-${{ github.run_attempt }}" | tee -a "$GITHUB_OUTPUT"
+
+      - name: Create Terraform variable input file
+        if: inputs.cloudProvider == 'aws'
+        working-directory: ./terraform-module/aws-constellation
+        run: |
+          cat > terraform.tfvars <<EOF
+          name = "${{ steps.create-prefix.outputs.prefix }}"
+          image = "${{ inputs.image }}"
+          zone = "${{ inputs.regionZone }}"
+          name_prefix = "${{ steps.create-prefix.outputs.prefix }}"
+          node_groups = {
+            control_plane_default = {
+              role          = "control-plane"
+              zone          = "${{ inputs.regionZone }}"
+              instance_type = "m6a.xlarge"
+              disk_size     = 30
+              disk_type     = "gp3"
+              initial_count = 2
+            },
+            worker_default = {
+              role          = "worker"
+              zone          = "${{ inputs.regionZone }}"
+              instance_type = "m6a.xlarge"
+              disk_size     = 30
+              disk_type     = "gp3"
+              initial_count = 2
+            }
+          }
+          EOF
+          cat terraform.tfvars
+
+      - name: Install dependencies (Terraform)
+        run: |
+          sudo apt update && sudo apt install gpg
+          wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
+          gpg --no-default-keyring --keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg --fingerprint
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
+          sudo apt update
+          sudo apt install terraform=1.4.4-*
+
+      - name: Setup bazel
+        uses: ./.github/actions/setup_bazel_nix
+        with:
+          useCache: "true"
+          buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }}
+
+      - name: Log in to the Container registry
+        uses: ./.github/actions/container_registry_login
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build CLI
+        if: inputs.cliVersion == ''
+        uses: ./.github/actions/build_cli
+        with:
+          outputPath: "constellation"
+          enterpriseCLI: true
+          push: true
+
+      - name: Download CLI
+        if: inputs.cliVersion != ''
+        shell: bash
+        run: |
+          curl -fsSL -o constellation https://github.com/edgelesssys/constellation/releases/download/${{ inputs.cliVersion }}/constellation-linux-amd64
+          chmod u+x ./constellation
+          ./constellation version
+          sudo sh -c 'echo "127.0.0.1 license.confidential.cloud" >> /etc/hosts'
+
+      - name: Login to AWS (IAM + Cluster role)
+        if: inputs.cloudProvider == 'aws'
+        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
+        with:
+          role-to-assume: arn:aws:iam::795746500882:role/GithubActionsE2ETerraform
+          aws-region: eu-central-1
+          # extend token expiry to 6 hours to ensure constellation can terminate
+          role-duration-seconds: 21600
+
+      - name: Apply Terraform Cluster
+        id: apply_terraform
+        working-directory: ./terraform-module/${{ inputs.cloudProvider }}-constellation
+        run: |
+          cp ../../constellation .
+          terraform init
+          terraform apply -var-file=terraform.tfvars  -auto-approve
+
+      - name: Destroy Terraform Cluster
+        # outcome is part of the steps context (https://docs.github.com/en/actions/learn-github-actions/contexts#steps-context)
+        if: always() && steps.apply_terraform.outcome != 'skipped'
+        working-directory: ./terraform-module/${{ inputs.cloudProvider }}-constellation
+        run: |
+          terraform init
+          terraform destroy -var-file=terraform.tfvars -auto-approve
+
+      - name: Verify cleanup
+        working-directory: ./terraform-module/${{ inputs.cloudProvider }}-constellation
+        run: |
+          if [ -f constellation-mastersecret.json ] || [ -f constellation-conf.yaml ]; then
+            echo "Files  constellation-mastersecret.json or constellation-conf.yaml still exist"
+            exit 1
+          fi

.github/workflows/e2e-test-weekly.yml

@@ -10,7 +10,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        refStream: ["ref/main/stream/debug/?", "ref/release/stream/stable/?"]
+        refStream: ["ref/main/stream/nightly/?","ref/main/stream/debug/?", "ref/release/stream/stable/?"]
     name: Find latest image
     runs-on: ubuntu-22.04
     permissions:
@@ -19,6 +19,7 @@ jobs:
     outputs:
       image-main-debug: ${{ steps.relabel-output.outputs.image-main-debug }}
       image-release-stable: ${{ steps.relabel-output.outputs.image-release-stable }}
+      image-main-nightly: ${{ steps.relabel-output.outputs.image-main-nightly }}
     steps:
       - name: Checkout
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
@@ -365,3 +366,17 @@ jobs:
     uses: ./.github/workflows/e2e-windows.yml
     with:
       scheduled: ${{ github.event_name == 'schedule' }}
+
+  e2e-tf-module:
+    name: Test Terraform Module
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+    needs: [find-latest-image]
+    secrets: inherit
+    uses: ./.github/workflows/e2e-test-tf-module.yml
+    with:
+      cloudProvider: "aws"
+      regionZone: "eu-west-1b"
+      image: ${{ needs.find-latest-image.outputs.image-main-nightly }}

cli/internal/terraform/BUILD.bazel

@@ -9,89 +9,14 @@ go_library(
         "terraform.go",
         "variables.go",
     ],
-    embedsrcs = [
-        "terraform/aws/.terraform.lock.hcl",
-        "terraform/aws/main.tf",
-        "terraform/aws/modules/instance_group/main.tf",
-        "terraform/aws/modules/instance_group/variables.tf",
-        "terraform/aws/modules/load_balancer_target/main.tf",
-        "terraform/aws/modules/load_balancer_target/output.tf",
-        "terraform/aws/modules/load_balancer_target/variables.tf",
-        "terraform/aws/modules/public_private_subnet/main.tf",
-        "terraform/aws/modules/public_private_subnet/output.tf",
-        "terraform/aws/modules/public_private_subnet/variables.tf",
-        "terraform/aws/outputs.tf",
-        "terraform/aws/variables.tf",
-        "terraform/azure/.terraform.lock.hcl",
-        "terraform/azure/main.tf",
-        "terraform/azure/modules/load_balancer_backend/main.tf",
-        "terraform/azure/modules/load_balancer_backend/outputs.tf",
-        "terraform/azure/modules/load_balancer_backend/variables.tf",
-        "terraform/azure/modules/scale_set/main.tf",
-        "terraform/azure/modules/scale_set/variables.tf",
-        "terraform/azure/outputs.tf",
-        "terraform/azure/variables.tf",
-        "terraform/gcp/.terraform.lock.hcl",
-        "terraform/gcp/main.tf",
-        "terraform/gcp/modules/instance_group/main.tf",
-        "terraform/gcp/modules/instance_group/outputs.tf",
-        "terraform/gcp/modules/instance_group/variables.tf",
-        "terraform/gcp/modules/loadbalancer/main.tf",
-        "terraform/gcp/modules/loadbalancer/variables.tf",
-        "terraform/gcp/outputs.tf",
-        "terraform/gcp/variables.tf",
-        "terraform/iam/aws/README.md",
-        "terraform/iam/aws/main.tf",
-        "terraform/iam/aws/outputs.tf",
-        "terraform/iam/aws/variables.tf",
-        "terraform/iam/azure/README.md",
-        "terraform/iam/azure/main.tf",
-        "terraform/iam/azure/outputs.tf",
-        "terraform/iam/azure/variables.tf",
-        "terraform/iam/gcp/README.md",
-        "terraform/iam/gcp/main.tf",
-        "terraform/iam/gcp/outputs.tf",
-        "terraform/iam/gcp/variables.tf",
-        "terraform/qemu/.terraform.lock.hcl",
-        "terraform/qemu/main.tf",
-        "terraform/qemu/modules/instance_group/domain.xsl",
-        "terraform/qemu/modules/instance_group/main.tf",
-        "terraform/qemu/modules/instance_group/outputs.tf",
-        "terraform/qemu/modules/instance_group/variables.tf",
-        "terraform/qemu/outputs.tf",
-        "terraform/qemu/variables.tf",
-        "terraform/openstack/.terraform.lock.hcl",
-        "terraform/openstack/main.tf",
-        "terraform/openstack/modules/instance_group/main.tf",
-        "terraform/openstack/modules/instance_group/outputs.tf",
-        "terraform/openstack/modules/instance_group/variables.tf",
-        "terraform/openstack/modules/loadbalancer/main.tf",
-        "terraform/openstack/modules/loadbalancer/variables.tf",
-        "terraform/openstack/outputs.tf",
-        "terraform/openstack/variables.tf",
-        "terraform/qemu/modules/instance_group/tdx_domain.xsl",
-        "terraform/iam/aws/.terraform.lock.hcl",
-        "terraform/iam/azure/.terraform.lock.hcl",
-        "terraform/iam/gcp/.terraform.lock.hcl",
-        "terraform/gcp/modules/internal_load_balancer/main.tf",
-        "terraform/gcp/modules/internal_load_balancer/variables.tf",
-        "terraform/gcp/modules/jump_host/main.tf",
-        "terraform/gcp/modules/jump_host/outputs.tf",
-        "terraform/gcp/modules/jump_host/variables.tf",
-        "terraform/aws/modules/jump_host/main.tf",
-        "terraform/aws/modules/jump_host/output.tf",
-        "terraform/aws/modules/jump_host/variables.tf",
-        "terraform/azure/modules/jump_host/main.tf",
-        "terraform/azure/modules/jump_host/variables.tf",
-        "terraform/azure/modules/jump_host/outputs.tf",
-    ],
     importpath = "github.com/edgelesssys/constellation/v2/cli/internal/terraform",
     visibility = ["//cli:__subpackages__"],
     deps = [
         "//cli/internal/state",
         "//internal/cloud/cloudprovider",
         "//internal/constants",
         "//internal/file",
+        "//terraform",
         "@com_github_hashicorp_go_version//:go-version",
         "@com_github_hashicorp_hc_install//:hc-install",
         "@com_github_hashicorp_hc_install//fs",

cli/internal/terraform/loader.go

@@ -7,22 +7,18 @@ SPDX-License-Identifier: AGPL-3.0-only
 package terraform
 
 import (
-	"embed"
 	"errors"
 	"io/fs"
 	slashpath "path"
 	"path/filepath"
 	"strings"
 
+	"github.com/edgelesssys/constellation/v2/terraform"
+
 	"github.com/edgelesssys/constellation/v2/internal/file"
 	"github.com/spf13/afero"
 )
 
-//go:embed terraform/*
-//go:embed terraform/*/.terraform.lock.hcl
-//go:embed terraform/iam/*/.terraform.lock.hcl
-var terraformFS embed.FS
-
 // prepareWorkspace loads the embedded Terraform files,
 // and writes them into the workspace.
 func prepareWorkspace(rootDir string, fileHandler file.Handler, workingDir string) error {
@@ -32,7 +28,7 @@ func prepareWorkspace(rootDir string, fileHandler file.Handler, workingDir strin
 // terraformCopier copies the embedded Terraform files into the workspace.
 func terraformCopier(fileHandler file.Handler, rootDir, workingDir string) error {
 	goEmbedRootDir := filepath.ToSlash(rootDir)
-	return fs.WalkDir(terraformFS, goEmbedRootDir, func(path string, d fs.DirEntry, err error) error {
+	return fs.WalkDir(terraform.Assets, goEmbedRootDir, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
@@ -41,7 +37,7 @@ func terraformCopier(fileHandler file.Handler, rootDir, workingDir string) error
 		}
 
 		goEmbedPath := filepath.ToSlash(path)
-		content, err := terraformFS.ReadFile(goEmbedPath)
+		content, err := terraform.Assets.ReadFile(goEmbedPath)
 		if err != nil {
 			return err
 		}

dev-docs/workflows/release.md

@@ -30,6 +30,10 @@ Releases should be performed using [the automated release pipeline](https://gith
    git push origin ${working_branch}
    ```
 
+### Update CLI version for Terraform module
+
+Update the `version` inside `terraform/constellation-cluster/install-constellation.sh` to the new release.
+
 ### Patch release
 
 1. `cherry-pick` (only) the required commits from `main`