+ acm + rds

2025-11-24 09:18:15 +01:00
parent 98b7c5712b
commit a096815aa3
12 changed files with 920 additions and 0 deletions
--- a/services/rds/README.md
+++ b/services/rds/README.md
@@ -0,0 +1,90 @@
+# Best Practices
+
+1) Name scheming
+
+Nom des resources = <kind>-<app>-<environment>
+
+2) Tagging
+
+# Providers
+
+| Name | Version |
+|---|---|
+| [provider-aws-rds](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1) | 1.2.1 |
+| [provider-aws-iam](https://marketplace.upbound.io/providers/upbound/provider-aws-iam/v1.2.1) | 1.2.1 |
+| [provider-aws-ec2](https://marketplace.upbound.io/providers/upbound/provider-aws-ec2/v1.2.1) | 1.2.1 |
+
+# CompositeResources
+
+| Provider | Kind |
+|---|---|
+| [IAM](https://marketplace.upbound.io/providers/upbound/provider-aws-iam/v1.2.1) | [Role](https://marketplace.upbound.io/providers/upbound/provider-aws-iam/v1.2.1/resources/iam.aws.upbound.io/Role/v1beta1) |
+| [RDS](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1) | [Cluster](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1/resources/rds.aws.upbound.io/Cluster/v1beta1) |
+| [RDS](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1) | [ClusterRoleAssociation](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1/resources/rds.aws.upbound.io/ClusterRoleAssociation/v1beta1) |
+| [RDS](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1) | [SubnetGroup](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1/resources/rds.aws.upbound.io/SubnetGroup/v1beta1) |
+| [RDS](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1) | [ClusterInstance](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1/resources/rds.aws.upbound.io/ClusterInstance/v1beta1) |
+| [RDS](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1) | [Instance](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1/resources/rds.aws.upbound.io/Instance/v1beta2) |
+| [RDS](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1) | [ClusterParameterGroup](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1/resources/rds.aws.upbound.io/ClusterParameterGroup/v1beta1) |
+| [RDS](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1) | [ParameterGroup](https://marketplace.upbound.io/providers/upbound/provider-aws-rds/v1.2.1/resources/rds.aws.upbound.io/ParameterGroup/v1beta1) |
+| [EC2](https://marketplace.upbound.io/providers/upbound/provider-aws-ec2/v1.2.1) | [SecurityGroup](https://marketplace.upbound.io/providers/upbound/provider-aws-ec2/v1.2.1/resources/ec2.aws.upbound.io/SecurityGroup/v1beta1) |
+| [EC2](https://marketplace.upbound.io/providers/upbound/provider-aws-ec2/v1.2.1) | [SecurityGroupRule](https://marketplace.upbound.io/providers/upbound/provider-aws-ec2/v1.2.1/resources/ec2.aws.upbound.io/SecurityGroupRule/v1beta1) |
+| [EC2](https://marketplace.upbound.io/providers/upbound/provider-aws-ec2/v1.2.1) | [SecurityGroupIngressRule](https://marketplace.upbound.io/providers/upbound/provider-aws-ec2/v1.2.1/resources/ec2.aws.upbound.io/SecurityGroupIngressRule/v1beta1) |
+| [EC2](https://marketplace.upbound.io/providers/upbound/provider-aws-ec2/v1.2.1) | [SecurityGroupEgressRule](https://marketplace.upbound.io/providers/upbound/provider-aws-ec2/v1.2.1/resources/ec2.aws.upbound.io/SecurityGroupEgressRule/v1beta1) |
+
+# Claim example
+
+```yaml
+apiVersion: crossplane.evina/v1alpha1
+kind: RDS
+metadata:
+  namespace: crossplane-system
+  name: claimed-
+spec:
+  compositionRef:
+    name: rds-composition
+  parameters:
+    region: 
+    app: 
+    environment:
+    engine: 
+```
+
+## Inputs
+
+| Name | Description | Value |Required |
+|---|---|---|---|
+| region | AWS Region where the provider will operate | eu-west-1 | Required |
+| app | Name of the app (Used for Tagging/Naming) | dcbprotect / karpenter / brandprotect / grafana | Required |
+| environment | Environment where the claim will operate (Used for Tag/Naming) | dev / staging / production | Required |
+| account | Environment where the claim will operate (Used for Tagging) | 169590266381 | Recommended |
+| engineVersion | The engine version to use | 5.7.mysql_aurora.2.11.2 | Required |
+| providerConfigRef | Target a specific account | provider-aws-config.yaml | Required |
+| instanceClass | Instance used to host the database | db.t3.medium | Required |
+
+# Outputs
+
+# TODO
+
+- [x] Import and observe all resources from terraform
+- [ ] Create a managed resources with crossplane
+  - [x] IAM
+    - [x] Role
+  - [x] RDS
+    - [ ] Cluster
+    - [x] SubnetGroup
+    - [ ] ClusterInstance
+    - [x] Instance
+    - [x] ClusterParameterGroup
+    - [x] ParameterGroup
+  - [x] EC2
+    - [x] SecurityGroup
+    - [ ] SecurityGroupRule (Générer une managedResources pour faire le lien entre une compo RDS et APP)
+    - [ ] SecurityGroupIngressRule (Générer une managedResources pour faire le lien entre une compo RDS et APP)
+    - [x] SecurityGroupEgressRule
+- [ ] Check Tags
+- [ ] Check when to use Refs
+- [ ] How to create more instances from claim
+- [ ] Create a certIdentifier ?
+- [ ] Ajouter une resource roleAssociation for RDS and IAM role created
+- [ ] Ajoute automatiquement la description "Managed by terraform" SubnetGroup ??
+- [ ] Create composition and definition
--- a/services/rds/composition.yaml.stop
+++ b/services/rds/composition.yaml.stop
@@ -0,0 +1,289 @@
+apiVersion: apiextensions.crossplane.io/v1
+kind: Composition
+metadata:
+  name: rds-composition
+  labels:
+    crossplane/provider: default
+    crossplane/xrd: xrdss.crossplane.evina
+spec:
+  compositeTypeRef:
+    apiVersion: crossplane.evina/v1alpha1
+    kind: XRDS
+  patchSets:
+  - name: region
+    patches:
+    - type: FromCompositeFieldPath
+      fromFieldPath: spec.parameters.region
+      toFieldPath: spec.forProvider.region
+  - name: providerConfigRef
+    patches:
+    - type: FromCompositeFieldPath
+      fromFieldPath: spec.parameters.providerConfigRef
+      toFieldPath: spec.providerConfigRef.name
+  writeConnectionSecretsToNamespace: crossplane
+  resources:
+###################################################################################################
+    - name: Role
+      base:
+        apiVersion: iam.aws.upbound.io/v1beta1
+        kind: Role
+        metadata:
+          labels: 
+            claim: rds
+            provider: iam
+            kind: role
+            app: mathodprotect
+            environment: dev
+        spec:
+          forProvider:
+            assumeRolePolicy: |
+              {
+                "Version": "2012-10-17",
+                "Statement": [
+                  {
+                    "Action": "sts:AssumeRole",
+                    "Effect": "Allow",
+                    "Principal": {
+                      "Service": "rds.amazonaws.com"
+                    }
+                  }
+                ]
+              }
+            tags:
+              region: eu-west-1
+              app: mathodprotect
+              environment: dev
+              account: "169590266381"
+              composition: rds
+              managedResources: role
+      patches:
+      - type: PatchSet
+        patchSetName: providerConfigRef
+      - type: CombineFromComposite
+        combine:
+          variables: 
+            - fromFieldPath: spec.parameters.app
+            - fromFieldPath: spec.parameters.environment
+          strategy: string
+          string:
+            fmt: "rds-iam-role-%s-%s"
+        toFieldPath: "metadata.annotations[crossplane.io/external-name]"
+###################################################################################################
+#    - name: Cluster
+#      base:
+#        apiVersion: rds.aws.upbound.io/v1beta1
+#        kind: Cluster
+#        metadata:
+#          name: cluster-mathodprotect-dev
+#          labels:
+#            resources: Cluster
+#        spec:
+#          forProvider:
+#            availabilityZones:
+#              - eu-west-1a
+#              - eu-west-1b
+#              - eu-west-1c
+#            engine: aurora-mysql
+#            engineMode: provisioned
+#            engineVersion: 5.7.mysql_aurora.2.11.2
+#            databaseName: mathodProtect
+#            autoGeneratePassword: true
+#            masterPasswordSecretRef:
+#              key: tropsecure
+#              name: cluster-mathodprotect-dev-password
+#              namespace: crossplane-system
+#            port: 3306
+#            dbClusterParameterGroupName: clusterparametergroup-mathodprotect-dev
+#        #    iamRoles:
+#        #    - arn:aws:iam::453702081005:role/IAM-Role-Aurora
+#        #    vpcSecurityGroupIds: 
+#        #      - sg-0292740ac642cbce9
+#            vpcSecurityGroupIdRefs:
+#              - name: securitygroup-mathodprotect-dev
+#            masterUsername: mathod
+#            copyTagsToSnapshot: true
+#            finalSnapshotIdentifier: test-final
+#            dbSubnetGroupName: subnetgroup-mathodprotect-dev
+#        #    dbSubnetGroupNameRef: 
+#            backupRetentionPeriod: 1
+#            preferredBackupWindow: 23:48-00:18
+#            preferredMaintenanceWindow: tue:22:51-tue:23:21
+#            tags:
+#              region: eu-west-1
+#              project: mathodprotect
+#              environment: dev
+#              account: "169590266381"
+#              composition: rds
+#              managedResources: cluster
+#          writeConnectionSecretToRef:
+#            name: rds-mathod-protect-password
+#            namespace: crossplane-system
+#      patches:
+#      - type: PatchSet
+#        patchSetName: region
+#      - type: PatchSet
+#        patchSetName: providerConfigRef
+###################################################################################################
+#    - name: SubnetGroup
+#      base:
+#        apiVersion: rds.aws.upbound.io/v1beta1
+#        kind: SubnetGroup
+#        metadata:
+#          name: subnetgroup-mathodprotect-dev
+#          labels:
+#            resource: SubnetGroup
+#        spec:
+#          forProvider:
+#            subnetIds: # Replace to use subnetIdRefs
+#              - subnet-0c0a38354f2a028c8
+#              - subnet-06dc47da5b4eae974
+#              - subnet-0f3ee2a757ce85ad1
+#        #    subnetIdRefs:
+#            tags:
+#              region: eu-west-1
+#              project: mathodprotect
+#              environment: dev
+#              account: "169590266381"
+#              composition: rds
+#              managedResources: subnetgroup
+#      patches:
+#      - type: PatchSet
+#        patchSetName: region
+#      - type: PatchSet
+#        patchSetName: providerConfigRef
+###################################################################################################
+#    - name: ClusterInstance
+#      base:
+#        apiVersion: rds.aws.upbound.io/v1beta1
+#        kind: ClusterInstance
+#        metadata:
+#          name: clusterinstance-mathodprotect-dev
+#          labels:
+#            resources: ClusterInstance
+#        spec:
+#          forProvider:
+#        #    clusterIdentifier: cluster-mathodprotect-dev
+#        #    id: backoffice-staging-eu-west-1-aurora-cluster-instance-0
+#            clusterIdentifierRef:
+#              name: cluster-mathodprotect-dev
+#            engine: aurora-mysql
+#            instanceClass: db.t3.medium
+#            publiclyAccessible: false
+#            caCertIdentifier: rds-ca-2019
+#        #    dbParameterGroupName:
+#            dbParameterGroupNameRef:
+#              name: parametergroup-mathodprotect-dev
+#        #    dbSubnetGroupName:
+#            dbSubnetGroupNameRef:
+#              name: subnetgroup-mathodprotect-dev
+#      patches:
+#      - type: PatchSet
+#        patchSetName: region
+#      - type: PatchSet
+#        patchSetName: providerConfigRef
+###################################################################################################
+#    - name: ClusterParameterGroup
+#      base:
+#        apiVersion: rds.aws.upbound.io/v1beta1
+#        kind: ClusterParameterGroup
+#        metadata:
+#          name: clusterparametergroup-mathodprotect-dev
+#          labels:
+#            resources: ClusterParameterGroup
+#        spec:
+#          forProvider:
+#            family: aurora-mysql5.7
+#            parameter:
+#            - applyMethod: immediate
+#              name: aurora_load_from_s3_role
+#              value: arn:aws:iam::169590266381:role/role-mathodprotect-dev
+#            - applyMethod: immediate
+#              name: aurora_select_into_s3_role
+#              value: arn:aws:iam::169590266381:role/role-mathodprotect-dev
+#            - applyMethod: immediate
+#              name: aws_default_s3_role
+#              value: arn:aws:iam::169590266381:role/role-mathodprotect-dev
+#            - applyMethod: immediate
+#              name: innodb_online_alter_log_max_size
+#              value: "21474836480"
+#            - applyMethod: immediate
+#              name: slow_query_log
+#              value: "1"
+#            tags:
+#              region: eu-west-1
+#              app: mathodprotect
+#              environment: dev
+#              account: "169590266381"
+#              composition: rds
+#              managedResources: clusterparametergroup
+#      patches:
+#      - type: PatchSet
+#        patchSetName: region
+#      - type: PatchSet
+#      patchSetName: providerConfigRef
+###################################################################################################
+#    - name: ParameterGroup
+#      base:
+#        apiVersion: rds.aws.upbound.io/v1beta1
+#        kind: ParameterGroup
+#        metadata:
+#          name: parametergroup-mathodprotect-dev
+#          labels: 
+#            resources: ParameterGroup
+#        spec:
+#          forProvider:
+#            family: aurora-mysql5.7
+#            tags:
+#              region: eu-west-1
+#              app: mathodprotect
+#              environment: dev
+#              account: "169590266381"
+#              composition: rds
+#              managedResources: parametergroup
+#      patches:
+#      - type: PatchSet
+#        patchSetName: region
+#      - type: PatchSet
+#        patchSetName: providerConfigRef
+###################################################################################################
+#    - name: SecurityGroup
+#      base:
+#        apiVersion: ec2.aws.upbound.io/v1beta1
+#        kind: SecurityGroup
+#        metadata:
+#          name: securitygroup-mathodprotect-dev
+#        spec:
+#          forProvider:
+#            name: securitygroup-mathodprotect-dev
+#            vpcId: vpc-029aa16a171ccb018
+#        #    vpcIdRef:
+#            tags:
+#              region: eu-west-1
+#              app: mathodprotect
+#              environment: dev
+#              account: "169590266381"
+#              composition: rds
+#              managedResources: securitygroup
+#      patches:
+#      - type: PatchSet
+#        patchSetName: region
+#      - type: PatchSet
+#        patchSetName: providerConfigRef
+###################################################################################################
+#    - name: SecurityGroupEgressRule
+#      base:
+#        apiVersion: ec2.aws.upbound.io/v1beta1
+#        kind: SecurityGroupEgressRule
+#        metadata:
+#          name: securitygroupegressrule-mathodprotect-dev
+#        spec:
+#          forProvider:
+#            cidrIpv4: 0.0.0.0/0
+#            ipProtocol: "-1"
+#            securityGroupIdRef: 
+#              name: securitygroup-mathodprotect-dev
+#      patches:
+#      - type: PatchSet
+#        patchSetName: region
+#      - type: PatchSet
+#        patchSetName: providerConfigRef
--- a/services/rds/definition.yaml.stop
+++ b/services/rds/definition.yaml.stop
@@ -0,0 +1,49 @@
+apiVersion: apiextensions.crossplane.io/v1
+kind: CompositeResourceDefinition
+metadata:
+  name: xrdss.crossplane.evina
+spec:
+  group: crossplane.evina
+  names:
+    kind: XRDS
+    plural: xrdss
+  claimNames:
+    kind: RDS
+    plural: rdss
+  defaultCompositionRef:
+    name: rds-composition
+  versions:
+  - name: v1alpha1
+    served: true
+    referenceable: true
+    schema:
+      openAPIV3Schema:
+        type: object
+        properties:
+          spec:
+            type: object
+            properties:
+              parameters:
+                type: object
+                properties:
+                  region:
+                    description: AWS Region where the provider will operate
+                    type: string
+                  app:
+                    description:
+                    type: string
+                  environment:
+                    description:
+                    type: string
+                  engineVersion:
+                    description:
+                    type: string
+                  providerConfigRef:
+                    description: Name of the Kubernetes provider config
+                    type: string
+                required:
+                  - region
+                  - app
+                  - environment
+#                  - engineVersion
+                  - providerConfigRef
--- a/services/rds/managedResources.yaml.stop
+++ b/services/rds/managedResources.yaml.stop
@@ -0,0 +1,221 @@
+apiVersion: iam.aws.upbound.io/v1beta1
+kind: Role
+metadata:
+  name: role-mathodprotect-dev
+  labels: 
+    resource: Role
+spec:
+  forProvider:
+    assumeRolePolicy: |
+      {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Action": "sts:AssumeRole",
+            "Effect": "Allow",
+            "Principal": {
+              "Service": "rds.amazonaws.com"
+            }
+          }
+        ]
+      }
+    tags:
+      region: eu-west-1
+      app: mathodprotect
+      environment: dev
+      account: "169590266381"
+      composition: rds
+      managedResources: role
+  providerConfigRef:
+    name: dev
+---
+apiVersion: rds.aws.upbound.io/v1beta1
+kind: SubnetGroup
+metadata:
+  name: subnetgroup-mathodprotect-dev
+  labels:
+    resource: SubnetGroup
+spec:
+  forProvider:
+    region: eu-west-1
+    subnetIds: # Replace to use subnetIdRefs
+      - subnet-0c0a38354f2a028c8
+      - subnet-06dc47da5b4eae974
+      - subnet-0f3ee2a757ce85ad1
+#    subnetIdRefs:
+    tags:
+      region: eu-west-1
+      project: mathodprotect
+      environment: dev
+      account: "169590266381"
+      composition: rds
+      managedResources: subnetgroup
+  providerConfigRef:
+    name: dev
+---
+apiVersion: rds.aws.upbound.io/v1beta1
+kind: Cluster
+metadata:
+  name: cluster-mathodprotect-dev
+  labels:
+    resources: Cluster
+spec:
+  forProvider:
+    region: eu-west-1
+    availabilityZones:
+      - eu-west-1a
+      - eu-west-1b
+      - eu-west-1c
+    engine: aurora-mysql
+    engineMode: provisioned
+    engineVersion: 5.7.mysql_aurora.2.11.2
+    databaseName: mathodProtect
+    autoGeneratePassword: true
+    masterPasswordSecretRef:
+      key: tropsecure
+      name: cluster-mathodprotect-dev-password
+      namespace: crossplane-system
+    port: 3306
+    dbClusterParameterGroupName: clusterparametergroup-mathodprotect-dev
+#    iamRoles:
+#    - arn:aws:iam::453702081005:role/IAM-Role-Aurora
+#    vpcSecurityGroupIds: 
+#      - sg-0292740ac642cbce9
+    vpcSecurityGroupIdRefs:
+      - name: securitygroup-mathodprotect-dev
+    masterUsername: mathod
+    copyTagsToSnapshot: true
+    finalSnapshotIdentifier: test-final
+    dbSubnetGroupName: subnetgroup-mathodprotect-dev
+#    dbSubnetGroupNameRef: 
+    backupRetentionPeriod: 1
+    preferredBackupWindow: 23:48-00:18
+    preferredMaintenanceWindow: tue:22:51-tue:23:21
+    tags:
+      region: eu-west-1
+      project: mathodprotect
+      environment: dev
+      account: "169590266381"
+      composition: rds
+      managedResources: cluster
+  writeConnectionSecretToRef:
+    name: rds-mathod-protect-password
+    namespace: crossplane-system
+  providerConfigRef:
+    name: dev
+---
+apiVersion: rds.aws.upbound.io/v1beta1
+kind: ClusterInstance
+metadata:
+  name: clusterinstance-mathodprotect-dev
+  labels:
+    resources: ClusterInstance
+spec:
+  forProvider:
+    region: eu-west-1
+#    clusterIdentifier: cluster-mathodprotect-dev
+#    id: backoffice-staging-eu-west-1-aurora-cluster-instance-0
+    clusterIdentifierRef:
+      name: cluster-mathodprotect-dev
+    engine: aurora-mysql
+    instanceClass: db.t3.medium
+    publiclyAccessible: false
+    caCertIdentifier: rds-ca-2019
+#    dbParameterGroupName:
+    dbParameterGroupNameRef:
+      name: parametergroup-mathodprotect-dev
+#    dbSubnetGroupName:
+    dbSubnetGroupNameRef:
+      name: subnetgroup-mathodprotect-dev
+  providerConfigRef:
+    name: dev
+---
+apiVersion: rds.aws.upbound.io/v1beta1
+kind: ClusterParameterGroup
+metadata:
+  name: clusterparametergroup-mathodprotect-dev
+  labels:
+    resources: ClusterParameterGroup
+spec:
+  forProvider:
+    region: eu-west-1
+    family: aurora-mysql5.7
+    parameter:
+    - applyMethod: immediate
+      name: aurora_load_from_s3_role
+      value: arn:aws:iam::169590266381:role/role-mathodprotect-dev
+    - applyMethod: immediate
+      name: aurora_select_into_s3_role
+      value: arn:aws:iam::169590266381:role/role-mathodprotect-dev
+    - applyMethod: immediate
+      name: aws_default_s3_role
+      value: arn:aws:iam::169590266381:role/role-mathodprotect-dev
+    - applyMethod: immediate
+      name: innodb_online_alter_log_max_size
+      value: "21474836480"
+    - applyMethod: immediate
+      name: slow_query_log
+      value: "1"
+    tags:
+      region: eu-west-1
+      app: mathodprotect
+      environment: dev
+      account: "169590266381"
+      composition: rds
+      managedResources: clusterparametergroup
+  providerConfigRef:
+    name: dev
+---
+apiVersion: rds.aws.upbound.io/v1beta1
+kind: ParameterGroup
+metadata:
+  name: parametergroup-mathodprotect-dev
+  labels: 
+    resources: ParameterGroup
+spec:
+  forProvider:
+    region: eu-west-1
+    family: aurora-mysql5.7
+    tags:
+      region: eu-west-1
+      app: mathodprotect
+      environment: dev
+      account: "169590266381"
+      composition: rds
+      managedResources: parametergroup
+  providerConfigRef:
+    name: dev
+---
+apiVersion: ec2.aws.upbound.io/v1beta1
+kind: SecurityGroup
+metadata:
+  name: securitygroup-mathodprotect-dev
+spec:
+  forProvider:
+    region: eu-west-1
+    name: securitygroup-mathodprotect-dev
+    vpcId: vpc-029aa16a171ccb018
+#    vpcIdRef:
+    tags:
+      region: eu-west-1
+      app: mathodprotect
+      environment: dev
+      account: "169590266381"
+      composition: rds
+      managedResources: securitygroup
+  providerConfigRef:
+    name: dev
+---
+apiVersion: ec2.aws.upbound.io/v1beta1
+kind: SecurityGroupEgressRule
+metadata:
+  name: securitygroupegressrule-mathodprotect-dev
+spec:
+  forProvider:
+    region: eu-west-1
+    cidrIpv4: 0.0.0.0/0
+    ipProtocol: "-1"
+    securityGroupIdRef: 
+      name: securitygroup-mathodprotect-dev
+  providerConfigRef:
+    name: dev