Bug fixes and improvements

.gitignore

@@ -35,7 +35,7 @@ override.tf.json
 # !example_override.tf
 
 # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
-# example: *tfplan*
+*tfplan*
 
 # Ignore CLI configuration files
 .terraformrc

helm/cluster-issuer/chart/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/cluster-issuer/chart/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: cluster-issuer
+description: Cluster Issuer
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

helm/cluster-issuer/chart/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cluster-issuer.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "cluster-issuer.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "cluster-issuer.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "cluster-issuer.labels" -}}
+helm.sh/chart: {{ include "cluster-issuer.chart" . }}
+{{ include "cluster-issuer.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "cluster-issuer.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "cluster-issuer.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "cluster-issuer.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "cluster-issuer.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

helm/cluster-issuer/chart/templates/cluster-issuer.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ .Values.name }}
+spec:
+  acme:
+    server: {{ .Values.server }}
+    email: {{ required "A valid .Values.email is required" .Values.email }}
+    privateKeySecretRef:
+      name: {{ .Values.privateKeySecretName }}
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: {{ .Values.ingressClass }}

helm/cluster-issuer/chart/values.yaml

@@ -0,0 +1,4 @@
+name: letsencrypt
+server: https://acme-v02.api.letsencrypt.org/directory
+privateKeySecretName: letsencrypt-account-key
+ingressClass: nginx

helm/cluster-issuer/values.yaml

@@ -0,0 +1 @@
+email: ${email}

helm/external-dns/values.yaml

@@ -0,0 +1,36 @@
+provider:
+  name: webhook
+  webhook:
+    image:
+      repository: ghcr.io/amoniacou/external-dns-digitalocean-webhook
+      tag: "v0.1.3"
+    env:
+      - name: DO_TOKEN
+        valueFrom:
+          secretKeyRef:
+            name: external-dns-do-secret
+            key: password
+    args:
+      - --port=8080
+      - --log-level=info
+    securityContext:
+      runAsUser: 65532
+      runAsGroup: 65532
+      runAsNonRoot: true
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop:
+          - ALL
+    livenessProbe:
+      httpGet:
+        path: /healthz
+        port: http-webhook
+      initialDelaySeconds: 10
+      periodSeconds: 10
+    readinessProbe:
+      httpGet:
+        path: /healthz
+        port: http-webhook
+      initialDelaySeconds: 5
+      periodSeconds: 5

helm/gitlab/values.yaml

@@ -59,9 +59,12 @@ global:
     lfs:
       bucket: ${buckets["lfs"]}
       connection: {}
-    backups:
-      bucket: ${buckets["backups"]}
-      tmpBucket: ${buckets["tmp"]}
+    registry:
+      bucket: ${buckets["registry"]}
+      connection: {}
+
+  minio:
+    enabled: false
 
   time_zone: UTC
 
@@ -73,11 +76,10 @@ postgresql:
   install: false
 redis:
   install: false
-minio:
+gitlab-runner:
   install: false
 prometheus:
   install: false
 nginx-ingress:
   enabled: false
-certmanager:
-  install: false
+installCertmanager: false

helm/ingress-nginx/values.yaml

@@ -12,11 +12,10 @@ controller:
       service.beta.kubernetes.io/do-loadbalancer-name: "gitlab-lb"
       service.beta.kubernetes.io/do-loadbalancer-protocol: "tcp"
       service.beta.kubernetes.io/do-loadbalancer-size-unit: "1"
-      service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
     externalTrafficPolicy: Local
 
   config:
-    use-proxy-protocol: "true"
+    use-proxy-protocol: "false"
     ssl-redirect: "true"
     hsts: "true"
     hsts-max-age: "31536000"

terraform/dns.tf

@@ -7,11 +7,11 @@ resource "digitalocean_domain" "main" {
 }
 
 resource "digitalocean_record" "gitlab" {
-    count = local.lb_ip != null ? 1 : 0
+    count = 1
 
     domain = digitalocean_domain.main.name
     type = "A"
     name = var.gitlab_host
-    value = locals.lb_ip
+    value = local.lb_ip
     ttl = 300
 }

terraform/helm.tf

@@ -1,12 +1,17 @@
-resource "helm_release" "ingress_nginx" {
-    name = "ingress-nginx"
-    namespace = kubernetes_namespace_v1.ingress_nginx.metadata[0].name
-    repository = "https://kubernetes.github.io/ingress-nginx"
-    chart = "ingress-nginx"
-    version = "4.15.1"
+resource "helm_release" "external_dns" {
+    name = "external-dns"
+    namespace = kubernetes_namespace_v1.external_dns.metadata[0].name
+    repository = "https://kubernetes-sigs.github.io/external-dns"
+    chart = "external-dns"
+    version = "1.20.0"
 
     values = [
-        file("${path.module}/../helm/ingress-nginx/values.yaml")
+        file("${path.module}/../helm/external-dns/values.yaml")
+    ]
+
+    depends_on = [
+        kubernetes_namespace_v1.external_dns, 
+        kubernetes_secret_v1.external_dns_do_secret 
     ]
 }
 
@@ -22,33 +27,73 @@ resource "helm_release" "cert_manager" {
     ]
 }
 
+resource "helm_release" "cluster_issuer" {
+    name = "cluster-issuer"
+    namespace = kubernetes_namespace_v1.cert_manager.metadata[0].name
+    chart = "${path.module}/../helm/cluster-issuer/chart"
+
+    values = [
+        templatefile("${path.module}/../helm/cluster-issuer/values.yaml", 
+        {
+            email = var.email
+        })
+    ]
+
+    depends_on = [helm_release.cert_manager]
+}
+
+resource "helm_release" "ingress_nginx" {
+    name = "ingress-nginx"
+    namespace = kubernetes_namespace_v1.ingress_nginx.metadata[0].name
+    repository = "https://kubernetes.github.io/ingress-nginx"
+    chart = "ingress-nginx"
+    version = "4.15.1"
+
+    values = [
+        file("${path.module}/../helm/ingress-nginx/values.yaml")
+    ]
+}
+
 resource "helm_release" "gitlab" {
     name = "gitlab"
     namespace = kubernetes_namespace_v1.gitlab.metadata[0].name
     repository = "https://charts.gitlab.io/"
     chart = "gitlab"
     version = "9.10.3"
 
+    timeout = 1800
+    wait = true
+    wait_for_jobs = true
+
     values = [
         templatefile("${path.module}/../helm/gitlab/values.yaml", {
             domain = var.domain_name
             gitlab_host = var.gitlab_host
             registry_host = var.registry_host
-            postgres_host = digitalocean_database_cluster.postgres.private_host
-            postgres_port = digitalocean_database_cluster.postgres.port
+            postgres_host = digitalocean_database_connection_pool.main.private_host
+            postgres_port = digitalocean_database_connection_pool.main.port
             postgres_database = digitalocean_database_db.gitlab.name
-            postgres_username = digitalocean_database_user.gitlab.name
+            postgres_username = digitalocean_database_cluster.postgres.user
             redis_host = digitalocean_database_cluster.valkey.private_host
             redis_port = digitalocean_database_cluster.valkey.port
             buckets = {for key, bucket in digitalocean_spaces_bucket.gitlab : key => bucket.name}
         })
     ]
 
     depends_on = [
+        digitalocean_database_cluster.postgres,
+        digitalocean_database_postgresql_config.postgres,
+        digitalocean_database_db.gitlab,
+        digitalocean_database_user.gitlab,
+        digitalocean_database_connection_pool.main,
+        digitalocean_database_cluster.valkey,
+        helm_release.cert_manager,
+        helm_release.cluster_issuer,
+        helm_release.ingress_nginx,
+        digitalocean_record.gitlab,
         kubernetes_secret_v1.gitlab_initial_root_password,
         kubernetes_secret_v1.gitlab_postgres,
         kubernetes_secret_v1.gitlab_redis,
-        kubernetes_secret_v1.gitlab_s3_main,
-        digitalocean_database_db.gitlab
+        kubernetes_secret_v1.gitlab_s3_main
     ]
 }