Bug fixes and improvements

.gitignore

@@ -35,7 +35,7 @@ override.tf.json
 # !example_override.tf
 
 # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
-# example: *tfplan*
+*tfplan*
 
 # Ignore CLI configuration files
 .terraformrc

helm/cluster-issuer/chart/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/cluster-issuer/chart/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: cluster-issuer
+description: Cluster Issuer
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

helm/cluster-issuer/chart/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cluster-issuer.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "cluster-issuer.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "cluster-issuer.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "cluster-issuer.labels" -}}
+helm.sh/chart: {{ include "cluster-issuer.chart" . }}
+{{ include "cluster-issuer.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "cluster-issuer.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "cluster-issuer.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "cluster-issuer.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "cluster-issuer.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

helm/cluster-issuer/chart/templates/cluster-issuer.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ .Values.name }}
+spec:
+  acme:
+    server: {{ .Values.server }}
+    email: {{ .Values.email }}
+    privateKeySecretRef:
+      name: {{ .Values.privateKeySecretName }}
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: {{ .Values.ingressClass }}

helm/cluster-issuer/chart/values.yaml

@@ -0,0 +1,5 @@
+name: letsencrypt
+server: https://acme-v02.api.letsencrypt.org/directory
+email: webmaster@example.com
+privateKeySecretName: letsencrypt-account-key
+ingressClass: nginx

helm/cluster-issuer/values.yaml

@@ -0,0 +1 @@
+email: ${email}

helm/gitlab/values.yaml

@@ -63,6 +63,9 @@ global:
       bucket: ${buckets["backups"]}
       tmpBucket: ${buckets["tmp"]}
 
+  minio:
+    enabled: false
+
   time_zone: UTC
 
   extraEnv:
@@ -73,11 +76,10 @@ postgresql:
   install: false
 redis:
   install: false
-minio:
+gitlab-runner:
   install: false
 prometheus:
   install: false
 nginx-ingress:
   enabled: false
-certmanager:
-  install: false
+installCertmanager: false

terraform/dns.tf

@@ -7,11 +7,11 @@ resource "digitalocean_domain" "main" {
 }
 
 resource "digitalocean_record" "gitlab" {
-    count = local.lb_ip != null ? 1 : 0
+    count = 1
 
     domain = digitalocean_domain.main.name
     type = "A"
     name = var.gitlab_host
-    value = locals.lb_ip
+    value = local.lb_ip
     ttl = 300
 }

terraform/helm.tf

@@ -1,3 +1,30 @@
+resource "helm_release" "cert_manager" {
+    name = "cert-manager"
+    namespace = kubernetes_namespace_v1.cert_manager.metadata[0].name
+    repository = "oci://quay.io/jetstack/charts"
+    chart = "cert-manager"
+    version = "1.20.2"
+
+    values = [
+        file("${path.module}/../helm/cert-manager/values.yaml")
+    ]
+}
+
+resource "helm_release" "cluster_issuer" {
+    name = "cluster-issuer"
+    namespace = kubernetes_namespace_v1.cert_manager.metadata[0].name
+    chart = "${path.module}/../helm/cluster-issuer/chart"
+
+    values = [
+        templatefile("${path.module}/../helm/cluster-issuer/values.yaml", 
+        {
+            email = var.email
+        })
+    ]
+
+    depends_on = [helm_release.cert_manager]
+}
+
 resource "helm_release" "ingress_nginx" {
     name = "ingress-nginx"
     namespace = kubernetes_namespace_v1.ingress_nginx.metadata[0].name
@@ -8,18 +35,8 @@ resource "helm_release" "ingress_nginx" {
     values = [
         file("${path.module}/../helm/ingress-nginx/values.yaml")
     ]
-}
-
-resource "helm_release" "cert_manager" {
-    name = "cert-manager"
-    namespace = kubernetes_namespace_v1.cert_manager.metadata[0].name
-    repository = "oci://quay.io/jetstack/charts"
-    chart = "cert-manager"
-    version = "1.20.2"
 
-    values = [
-        file("${path.module}/../helm/cert-manager/values.yaml")
-    ]
+    depends_on = [helm_release.cert_manager]
 }
 
 resource "helm_release" "gitlab" {
@@ -29,6 +46,10 @@ resource "helm_release" "gitlab" {
     chart = "gitlab"
     version = "9.10.3"
 
+    timeout = 1800
+    wait = true
+    wait_for_jobs = true
+
     values = [
         templatefile("${path.module}/../helm/gitlab/values.yaml", {
             domain = var.domain_name
@@ -45,10 +66,15 @@ resource "helm_release" "gitlab" {
     ]
 
     depends_on = [
+        digitalocean_database_cluster.postgres,
+        digitalocean_database_db.gitlab,
+        digitalocean_database_user.gitlab,
+        digitalocean_database_cluster.valkey,
+        helm_release.cluster_issuer,
+        digitalocean_record.gitlab,
         kubernetes_secret_v1.gitlab_initial_root_password,
         kubernetes_secret_v1.gitlab_postgres,
         kubernetes_secret_v1.gitlab_redis,
-        kubernetes_secret_v1.gitlab_s3_main,
-        digitalocean_database_db.gitlab
+        kubernetes_secret_v1.gitlab_s3_main
     ]
 }

terraform/kubernetes.tf

@@ -22,14 +22,6 @@ resource "kubernetes_namespace_v1" "gitlab" {
     depends_on = [ digitalocean_kubernetes_cluster.main ]
 }
 
-resource "kubernetes_manifest" "cluster_issuer" {
-    manifest = yamldecode(templatefile("${path.module}/../kubernetes/cluster-issuer.yaml", {
-        email = var.email
-    }))
-
-    depends_on = [ helm_release.cert_manager ]
-}
-
 resource "random_password" "gitlab_root" {
     length = 64
 }
@@ -132,11 +124,16 @@ resource "kubernetes_secret_v1" "gitlab_s3_backup" {
     type = "Opaque"
 }
 
+resource "time_sleep" "wait_for_lb" {
+    depends_on = [ helm_release.ingress_nginx ]
+    create_duration = "120s"
+}
+
 data "kubernetes_service_v1" "ingress_nginx" {
     metadata {
         name = "ingress-nginx-controller"
         namespace = kubernetes_namespace_v1.ingress_nginx.metadata[0].name
     }
 
-    depends_on = [helm_release.ingress_nginx]
+    depends_on = [ time_sleep.wait_for_lb ]
 }

terraform/versions.tf

@@ -18,5 +18,9 @@ terraform {
         source = "hashicorp/random"
         version = "~> 3.8.1"
       }
+      time = {
+        source = "hashicorp/time"
+        version = "~> 0.13.1"
+      }
     }
 }