From 2c3dd22e63739c042d37731ce683069bc291dcc7 Mon Sep 17 00:00:00 2001 From: "Benjamin Valiente (Contractor)" Date: Wed, 16 Sep 2026 19:04:52 -0600 Subject: [PATCH 1/3] feat: upgrade the helm charts compatibility to kubernetes 1.36 --- charts.json | 8 ++++---- platform/modules/cert-manager/chart.json | 2 +- platform/modules/istio-base/chart.json | 2 +- platform/modules/istio-ingress/chart.json | 2 +- platform/modules/istiod/chart.json | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/charts.json b/charts.json index a0a36c0d..e3666c68 100644 --- a/charts.json +++ b/charts.json @@ -7,7 +7,7 @@ "cert-manager": { "chart": "cert-manager", "repository": "https://charts.jetstack.io", - "version": "v1.19.1" + "version": "v1.21.2" }, "cluster-autoscaler": { "chart": "cluster-autoscaler", @@ -27,17 +27,17 @@ "istio-base": { "chart": "base", "repository": "https://istio-release.storage.googleapis.com/charts", - "version": "1.28.0" + "version": "1.30.4" }, "istiod": { "chart": "istiod", "repository": "https://istio-release.storage.googleapis.com/charts", - "version": "1.28.0" + "version": "1.30.4" }, "istio-ingress": { "chart": "gateway", "repository": "https://istio-release.storage.googleapis.com/charts", - "version": "1.28.0" + "version": "1.30.4" }, "load-balancer-controller": { "chart": "aws-load-balancer-controller", diff --git a/platform/modules/cert-manager/chart.json b/platform/modules/cert-manager/chart.json index 60933a66..f7be68cd 100644 --- a/platform/modules/cert-manager/chart.json +++ b/platform/modules/cert-manager/chart.json @@ -1,5 +1,5 @@ { "chart": "cert-manager", "repository": "https://charts.jetstack.io", - "version": "v1.19.1" + "version": "v1.21.2" } diff --git a/platform/modules/istio-base/chart.json b/platform/modules/istio-base/chart.json index 2c20bef4..330a5596 100644 --- a/platform/modules/istio-base/chart.json +++ b/platform/modules/istio-base/chart.json @@ -1,5 +1,5 @@ { "chart": "base", "repository": "https://istio-release.storage.googleapis.com/charts", - "version": "1.28.0" + "version": "1.30.4" } diff --git a/platform/modules/istio-ingress/chart.json b/platform/modules/istio-ingress/chart.json index dc46b330..2d9dbf2a 100644 --- a/platform/modules/istio-ingress/chart.json +++ b/platform/modules/istio-ingress/chart.json @@ -1,5 +1,5 @@ { "chart": "gateway", "repository": "https://istio-release.storage.googleapis.com/charts", - "version": "1.28.0" + "version": "1.30.4" } diff --git a/platform/modules/istiod/chart.json b/platform/modules/istiod/chart.json index 1ae236c7..bd14c5b4 100644 --- a/platform/modules/istiod/chart.json +++ b/platform/modules/istiod/chart.json @@ -1,5 +1,5 @@ { "chart": "istiod", "repository": "https://istio-release.storage.googleapis.com/charts", - "version": "1.28.0" + "version": "1.30.4" } From 9357940b444b23acff39c8993a8297ab17513d16 Mon Sep 17 00:00:00 2001 From: Benjamin Valiente <79182724+benjaminvaliente@users.noreply.github.com> Date: Wed, 16 Sep 2026 21:37:19 -0600 Subject: [PATCH 2/3] fix: flatten vpc-endpoints module and revert SUBMODULES glob change (#275) * fix: flatten vpc-endpoints module and revert SUBMODULES glob change * terraform-docs: automated action --------- Co-authored-by: Benjamin Valiente (Contractor) Co-authored-by: github-actions[bot] --- aws/network/README.md | 2 +- aws/network/main.tf | 2 +- aws/network/modules/vpc-endpoints/README.md | 41 +++++++++++++++++++ .../{s3-vpc-endpoint => }/main.tf | 0 .../{s3-vpc-endpoint => }/makefile | 0 .../{s3-vpc-endpoint => }/outputs.tf | 0 .../vpc-endpoints/s3-vpc-endpoint/README.md | 41 ------------------- .../{s3-vpc-endpoint => }/variables.tf | 0 .../{s3-vpc-endpoint => }/versions.tf | 0 makefile | 15 +++---- 10 files changed, 48 insertions(+), 53 deletions(-) rename aws/network/modules/vpc-endpoints/{s3-vpc-endpoint => }/main.tf (100%) rename aws/network/modules/vpc-endpoints/{s3-vpc-endpoint => }/makefile (100%) rename aws/network/modules/vpc-endpoints/{s3-vpc-endpoint => }/outputs.tf (100%) delete mode 100644 aws/network/modules/vpc-endpoints/s3-vpc-endpoint/README.md rename aws/network/modules/vpc-endpoints/{s3-vpc-endpoint => }/variables.tf (100%) rename aws/network/modules/vpc-endpoints/{s3-vpc-endpoint => }/versions.tf (100%) diff --git a/aws/network/README.md b/aws/network/README.md index e44a4edb..7a8f8904 100644 --- a/aws/network/README.md +++ b/aws/network/README.md @@ -71,7 +71,7 @@ module "network" { | [private\_subnets](#module\_private\_subnets) | ./modules/private-subnets | n/a | | [public\_subnet\_routes](#module\_public\_subnet\_routes) | ./modules/public-subnet-routes | n/a | | [public\_subnets](#module\_public\_subnets) | ./modules/public-subnets | n/a | -| [s3\_endpoint](#module\_s3\_endpoint) | ./modules/vpc-endpoints/s3-vpc-endpoint | n/a | +| [s3\_endpoint](#module\_s3\_endpoint) | ./modules/vpc-endpoints | n/a | | [vpc](#module\_vpc) | ./modules/vpc | n/a | ## Resources diff --git a/aws/network/main.tf b/aws/network/main.tf index 53101f1c..179ef407 100644 --- a/aws/network/main.tf +++ b/aws/network/main.tf @@ -89,7 +89,7 @@ module "public_subnet_routes" { module "s3_endpoint" { count = var.create_s3_endpoint ? 1 : 0 - source = "./modules/vpc-endpoints/s3-vpc-endpoint" + source = "./modules/vpc-endpoints" name = var.name namespace = var.namespace diff --git a/aws/network/modules/vpc-endpoints/README.md b/aws/network/modules/vpc-endpoints/README.md index e69de29b..06514f55 100644 --- a/aws/network/modules/vpc-endpoints/README.md +++ b/aws/network/modules/vpc-endpoints/README.md @@ -0,0 +1,41 @@ +# AWS S3 VPC Endpoint + +Module for creating a S3 VPC Endpoint in AWS. + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.6.2 | +| [aws](#requirement\_aws) | ~> 6.0 | + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | ~> 6.0 | + +## Resources + +| Name | Type | +|------|------| +| [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource | +| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [name](#input\_name) | Name for this network (used in the endpoint's Name tag) | `string` | n/a | yes | +| [namespace](#input\_namespace) | Prefix to be applied to created resources | `list(string)` | `[]` | no | +| [route\_table\_ids](#input\_route\_table\_ids) | List of route table IDs to associate with the S3 Gateway endpoint | `list(string)` | n/a | yes | +| [tags](#input\_tags) | Tags to be applied to the endpoint | `map(string)` | `{}` | no | +| [vpc](#input\_vpc) | The VPC object in which to create the S3 endpoint | 
object({
    id = string
  })
| n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| [endpoint\_id](#output\_endpoint\_id) | ID of the S3 Gateway VPC endpoint | +| [prefix\_list\_id](#output\_prefix\_list\_id) | Prefix list ID of the S3 endpoint (useful for security group egress rules) | + \ No newline at end of file diff --git a/aws/network/modules/vpc-endpoints/s3-vpc-endpoint/main.tf b/aws/network/modules/vpc-endpoints/main.tf similarity index 100% rename from aws/network/modules/vpc-endpoints/s3-vpc-endpoint/main.tf rename to aws/network/modules/vpc-endpoints/main.tf diff --git a/aws/network/modules/vpc-endpoints/s3-vpc-endpoint/makefile b/aws/network/modules/vpc-endpoints/makefile similarity index 100% rename from aws/network/modules/vpc-endpoints/s3-vpc-endpoint/makefile rename to aws/network/modules/vpc-endpoints/makefile diff --git a/aws/network/modules/vpc-endpoints/s3-vpc-endpoint/outputs.tf b/aws/network/modules/vpc-endpoints/outputs.tf similarity index 100% rename from aws/network/modules/vpc-endpoints/s3-vpc-endpoint/outputs.tf rename to aws/network/modules/vpc-endpoints/outputs.tf diff --git a/aws/network/modules/vpc-endpoints/s3-vpc-endpoint/README.md b/aws/network/modules/vpc-endpoints/s3-vpc-endpoint/README.md deleted file mode 100644 index 06514f55..00000000 --- a/aws/network/modules/vpc-endpoints/s3-vpc-endpoint/README.md +++ /dev/null @@ -1,41 +0,0 @@ -# AWS S3 VPC Endpoint - -Module for creating a S3 VPC Endpoint in AWS. - -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.6.2 | -| [aws](#requirement\_aws) | ~> 6.0 | - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | ~> 6.0 | - -## Resources - -| Name | Type | -|------|------| -| [aws_vpc_endpoint.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_endpoint) | resource | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [name](#input\_name) | Name for this network (used in the endpoint's Name tag) | `string` | n/a | yes | -| [namespace](#input\_namespace) | Prefix to be applied to created resources | `list(string)` | `[]` | no | -| [route\_table\_ids](#input\_route\_table\_ids) | List of route table IDs to associate with the S3 Gateway endpoint | `list(string)` | n/a | yes | -| [tags](#input\_tags) | Tags to be applied to the endpoint | `map(string)` | `{}` | no | -| [vpc](#input\_vpc) | The VPC object in which to create the S3 endpoint | 
object({
    id = string
  })
| n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [endpoint\_id](#output\_endpoint\_id) | ID of the S3 Gateway VPC endpoint | -| [prefix\_list\_id](#output\_prefix\_list\_id) | Prefix list ID of the S3 endpoint (useful for security group egress rules) | - \ No newline at end of file diff --git a/aws/network/modules/vpc-endpoints/s3-vpc-endpoint/variables.tf b/aws/network/modules/vpc-endpoints/variables.tf similarity index 100% rename from aws/network/modules/vpc-endpoints/s3-vpc-endpoint/variables.tf rename to aws/network/modules/vpc-endpoints/variables.tf diff --git a/aws/network/modules/vpc-endpoints/s3-vpc-endpoint/versions.tf b/aws/network/modules/vpc-endpoints/versions.tf similarity index 100% rename from aws/network/modules/vpc-endpoints/s3-vpc-endpoint/versions.tf rename to aws/network/modules/vpc-endpoints/versions.tf diff --git a/makefile b/makefile index 08445f24..98378280 100644 --- a/makefile +++ b/makefile @@ -6,16 +6,11 @@ export TFDOCSRC := $(CURDIR)/.terraform-docs.yml SUBMODULES := $(filter-out \ %.md,\ - $(foreach dir,\ - $(wildcard \ - platform/modules/* \ - platform \ - aws/*/modules/* \ - aws/* \ - platform/modules/*/* \ - aws/*/modules/*/* \ - ),\ - $(if $(wildcard $(dir)/*.tf),$(dir),)\ + $(wildcard \ + platform/modules/* \ + platform \ + aws/*/modules/*\ + aws/* \ )\ ) SUBMODULEMAKEFILES := $(foreach module,$(SUBMODULES),$(module)/makefile) From 2d6ed051806b7218b6bf455d41bb2643d542e5fa Mon Sep 17 00:00:00 2001 From: Benjamin Valiente <79182724+benjaminvaliente@users.noreply.github.com> Date: Mon, 21 Sep 2026 23:45:54 -0600 Subject: [PATCH 3/3] fix: upgrade aws provider for ingress and waf modules (#276) * fix: upgrade aws provider for ingress and waf modules * terraform-docs: automated action --------- Co-authored-by: Benjamin Valiente (Contractor) Co-authored-by: github-actions[bot] --- aws/ingress/README.md | 4 ++-- aws/ingress/main.tf | 48 +++++++++++++++++++++-------------------- aws/ingress/versions.tf | 2 +- aws/waf/README.md | 4 ++-- aws/waf/versions.tf | 2 +- 5 files changed, 31 insertions(+), 29 deletions(-) diff --git a/aws/ingress/README.md b/aws/ingress/README.md index 2a333c15..f01f9a17 100644 --- a/aws/ingress/README.md +++ b/aws/ingress/README.md @@ -95,13 +95,13 @@ module "ingress" { | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 0.14.8 | -| [aws](#requirement\_aws) | ~> 5.0 | +| [aws](#requirement\_aws) | ~> 6.0 | ## Modules | Name | Source | Version | |------|--------|---------| -| [alb](#module\_alb) | github.com/thoughtbot/terraform-alb-ingress | v0.5.2 | +| [alb](#module\_alb) | github.com/thoughtbot/terraform-alb-ingress | v0.8.0 | | [cluster\_name](#module\_cluster\_name) | ../cluster-name | n/a | | [network](#module\_network) | ../network-data | n/a | | [waf](#module\_waf) | ../waf | n/a | diff --git a/aws/ingress/main.tf b/aws/ingress/main.tf index 26e22c12..b05a2d88 100644 --- a/aws/ingress/main.tf +++ b/aws/ingress/main.tf @@ -1,28 +1,25 @@ module "alb" { - # TODO: update ref when merged into main - providers = { aws.cluster = aws.cluster, aws.route53 = aws.route53 } - source = "github.com/thoughtbot/terraform-alb-ingress?ref=v0.5.2" + providers = { aws.alb = aws.cluster, aws.route53 = aws.route53 } + source = "github.com/thoughtbot/terraform-alb-ingress?ref=v0.8.0" - alarm_actions = var.alarm_actions - alarm_evaluation_minutes = var.alarm_evaluation_minutes - alternative_domain_names = var.alternative_domain_names - certificate_domain_name = var.certificate_domain_name - create_aliases = var.create_aliases - description = "Flightdeck cluster load balancer" - failure_threshold = var.failure_threshold - hosted_zone_name = var.hosted_zone_name - issue_certificates = var.issue_certificates - legacy_target_group_names = var.legacy_target_group_names - name = var.name - namespace = var.namespace - primary_domain_name = var.primary_domain_name - slow_response_threshold = var.slow_response_threshold - subnet_ids = module.network.public_subnet_ids - tags = var.tags - target_groups = local.target_groups - target_group_weights = var.target_group_weights - validate_certificates = var.validate_certificates - vpc_id = module.network.vpc.id + alarm_actions = var.alarm_actions + alarm_evaluation_minutes = var.alarm_evaluation_minutes + create_domain_aliases = var.create_aliases ? local.domain_names : [] + description = "Flightdeck cluster load balancer" + failure_threshold = var.failure_threshold + hosted_zone_name = var.hosted_zone_name + issue_certificate_domains = var.issue_certificates ? local.domain_names : [] + legacy_target_group_names = var.legacy_target_group_names + name = join("-", concat(var.namespace, [var.name])) + primary_certificate_domain = coalesce(var.certificate_domain_name, var.primary_domain_name) + security_group_name = join("-", concat(var.namespace, [var.name])) + slow_response_threshold = var.slow_response_threshold + subnet_ids = module.network.public_subnet_ids + tags = var.tags + target_groups = local.target_groups + target_group_weights = var.target_group_weights + validate_certificates = var.validate_certificates + vpc_id = module.network.vpc.id depends_on = [module.network] } @@ -45,6 +42,11 @@ locals { values(module.cluster_name).*.shared_tags... ) + # terraform-alb-ingress v0.8.0 replaced the old create_aliases/issue_certificates + # booleans with explicit domain lists; this reconstructs the same "primary + + # alternatives" bundling the old boolean-driven behavior used. + domain_names = concat([var.primary_domain_name], var.alternative_domain_names) + target_groups = zipmap( var.cluster_names, [ diff --git a/aws/ingress/versions.tf b/aws/ingress/versions.tf index 523eeb2b..5d26dd1e 100644 --- a/aws/ingress/versions.tf +++ b/aws/ingress/versions.tf @@ -4,7 +4,7 @@ terraform { aws = { configuration_aliases = [aws.cluster, aws.route53] source = "hashicorp/aws" - version = "~> 5.0" + version = "~> 6.0" } } } diff --git a/aws/waf/README.md b/aws/waf/README.md index dad2c1a9..23cfa63a 100644 --- a/aws/waf/README.md +++ b/aws/waf/README.md @@ -55,13 +55,13 @@ Note: For each rule, if you are providing a country list, you can only specify e | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.4.0 | -| [aws](#requirement\_aws) | ~> 5.0 | +| [aws](#requirement\_aws) | ~> 6.0 | ## Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | ~> 5.0 | +| [aws](#provider\_aws) | ~> 6.0 | ## Modules diff --git a/aws/waf/versions.tf b/aws/waf/versions.tf index bc532bba..b7e1095e 100644 --- a/aws/waf/versions.tf +++ b/aws/waf/versions.tf @@ -3,7 +3,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = "~> 5.0" + version = "~> 6.0" } } } \ No newline at end of file