Add Azure infrastructure with Terraform #56
Conversation
Create Terraform files to automate the deployment of Azure resources including virtual networks, Kubernetes clusters, a container registry, and PostgreSQL servers. Define variables, outputs, and modules for resource management across network, Kubernetes, and registry configurations. Set up provider specifications and implement a main configuration to orchestrate these resources. Add .trivyignore and update .pre-commit-config.yaml to include Azure project settings and ignore specific security checks. Add README to document project setup and usage instructions. Add .idea and .github directories to .gitignore.
…for Azure - Add `.terraform.lock.hcl` for Azure environment to ensure consistent provider versions. - Update provider versions in `config` and `cluster` to use the latest compatible versions. - Modify `README.md` files to reflect provider version updates. - Add new NixOS `nixpkgs` reference to `devbox.lock` for development environment stability.
sander-1105
changed the title
baixiac
left a comment
baixiac
left a comment
There was a problem hiding this comment.
The new PR looks good. Added minor comments/questions.
.gitignore
Outdated
| misc/experimental | ||
| .DS_Store | ||
| .idea | ||
| .github |
There was a problem hiding this comment.
The .github is still needed for running GH actions so pls keep it version controlled.
.pre-commit-config.yaml
Outdated
| args: | ||
| - --args=--quiet | ||
| - --args=--download-external-modules False | ||
| - --args=--skip-check=CKV_TF_1,CKV_AZURE_165,CKV_AZURE_139,CKV_AZURE_166,CKV_AZURE_167,CKV_AZURE_233,CKV_AZURE_237,CKV_AZURE_164,CKV_AZURE_137,CKV2_AZURE_31 |
There was a problem hiding this comment.
Would be nicer to have inline #checkov:skips coz you can document why those rules were skipped, right next to where the Azure resources were defined.
.trivyignore
Outdated
| AVD-AZU-0040 | ||
| AVD-AZU-0039 |
There was a problem hiding this comment.
Could you add brief comments on why these rules were ignored?
azure/kubernetes/main.tf
Outdated
| #checkov:skip=CKV_AZURE_170,CKV_AZURE_141,CKV_AZURE_115,CKV_AZURE_117,CKV_AZURE_232,CKV_AZURE_226: ignore check | ||
| #checkov:skip=CKV_AZURE_116,CKV_AZURE_6,CKV_AZURE_171,CKV_AZURE_168,CKV_AZURE_4,CKV_AZURE_227: ignore check | ||
| #checkov:skip=CKV_TF_1,CKV_AZURE_237,CKV_AZURE_233,CKV_AZURE_167,CKV_AZURE_137,CKV_AZURE_164: ignore check | ||
| #checkov:skip=CKV_AZURE_165,CKV_AZURE_166,CKV_AZURE_139: ignore check |
There was a problem hiding this comment.
As aforementioned, would be nice to add more concrete messages describing why it is ok to ignore them.
| resource "azurerm_container_registry" "main" { | ||
| name = "${replace(var.project, "-", "")}${var.environment}acr" | ||
| resource_group_name = var.resource_group_name | ||
| location = var.location | ||
| sku = var.sku | ||
| admin_enabled = var.admin_enabled | ||
|
|
||
| tags = var.tags | ||
| } |
There was a problem hiding this comment.
If pull-through cache is not used, will a document/script be added to guide users through the process of syncing radar-base images between ACR and DockerHub?
There was a problem hiding this comment.
Users can decide which Radar-base images need to be synchronized according to their own needs. I will write a document explaining how to synchronize Radar-base images.
…ps for clarity and specificity
baixiac
left a comment
baixiac
left a comment
There was a problem hiding this comment.
LGTM! Thanks for adding documentation on the usage, very helpful.
resolved conflicts
resolved conflicts
2 participants
Create Terraform files to automate the deployment of Azure resources including virtual networks, Kubernetes clusters, a container registry, and PostgreSQL servers. Define variables, outputs, and modules for resource management across network, Kubernetes, and registry configurations. Set up provider specifications and implement a main configuration to orchestrate these resources. Add .trivyignore and update .pre-commit-config.yaml to include Azure project settings and ignore specific security checks. Add README to document project setup and usage instructions. Add .idea and .github directories to .gitignore.