From 4fdfe91cb6014ed4b80cbb77d755e04c1f2f595b Mon Sep 17 00:00:00 2001
From: christofwe <christofweigl@gmail.com>
Date: Tue, 20 Mar 2018 14:24:15 +0100
Subject: [PATCH] Add common tagging of aws resources (#7)

* added tags to AWS resources where supported

* update readme for common tagging

* fixed conflict - variable additional_certificates

* refactored tagging

* added tags to new S3 object for optional certificate
---
 README.md             |  48 ++++++++-------
 autoscaling_master.tf |  43 +++++---------
 autoscaling_nodes.tf  |  29 +++------
 certificate.tf        |   2 +
 iam.tf                |  27 +++++----
 input.tf              |  18 +++---
 locals.tf             | 133 ++++++++++++++++++++++++++++++++++++++++++
 main.tf               |   3 -
 output.tf             |   5 +-
 s3.tf                 |  21 ++++++-
 10 files changed, 227 insertions(+), 102 deletions(-)
 create mode 100644 locals.tf

diff --git a/README.md b/README.md
index 4033f8c..b9de2a2 100644
--- a/README.md
+++ b/README.md
@@ -16,40 +16,44 @@ resource "aws_key_pair" "ssh" {
 }
 
 module "kubernetes" {
-    source = "github.com/Jnig/terraform-kubernetes-aws?ref=v0.6"
-    name = "devops-dev-cluster"
+  source = "github.com/Jnig/terraform-kubernetes-aws?ref=v0.6"
+  name = "devops-dev-cluster"
 
-    ssh_key = "${aws_key_pair.ssh.key_name}"
+  ssh_key = "${aws_key_pair.ssh.key_name}"
 
-    master_instance_type = "t2.medium"
+  master_instance_type = "t2.medium"
 
-    node_instance_type = "t2.large"
-    node_asg_min = 1
-    node_asg_max = 2
-    node_asg_desired = 2
+  node_instance_type = "t2.large"
+  node_asg_min = 1
+  node_asg_max = 2
+  node_asg_desired = 2
 
-    #aws ec2 describe-vpcs
-    vpc = "<vpc>"
+  #aws ec2 describe-vpcs
+  vpc = "<vpc>"
 
-    # aws ec2 describe-subnets --filters Name=vpc-id,Values=<vpc>
-    # tag all subnets with the name of the cluster: kubernetes.io/cluster/<name>
-    subnets = ["subnet1", "subnet2", "subnet3"]
+  # aws ec2 describe-subnets --filters Name=vpc-id,Values=<vpc>
+  # tag all subnets with the name of the cluster: kubernetes.io/cluster/<name>
+  subnets = ["subnet1", "subnet2", "subnet3"]
 
-    proxy_servers = "<proxy with port>"
-    
-    # optional add addtional certificates to the nodes
-    # useful if you have private docker repositories
-    additional_certificates = <<EOF
+  proxy_servers = "<proxy with port>"
+  
+  # optional add additional certificates to the nodes
+  # useful if you have private docker repositories
+  additional_certificates = <<EOF
 -----BEGIN CERTIFICATE-----
-.... 
+....
 -----END CERTIFICATE-----    
 EOF
-    
-    
+
+  # optional add common tags, e.g. for corporate billing
+  additional_tags = {
+    Application = ""
+    Billing_ID = ""
+    Owner = ""
+  }
 }
 ```
 
 Known limitations
 ------------
 * backups are missing
-
diff --git a/autoscaling_master.tf b/autoscaling_master.tf
index 636923b..63e88bf 100644
--- a/autoscaling_master.tf
+++ b/autoscaling_master.tf
@@ -24,9 +24,7 @@ resource "aws_ebs_volume" "master" {
     size = 40
     encrypted = true
     type = "gp2"
-    tags {
-        Name = "${var.name}-master"
-    }
+    tags = "${merge(var.additional_tags, map("Name", "${var.name}-master"))}"
 }
 
 resource "aws_security_group" "master" {
@@ -48,9 +46,6 @@ resource "aws_security_group" "master" {
     cidr_blocks = ["0.0.0.0/0"]
   }
 
-
-
-
   ingress {
     from_port   = 0
     to_port     = 0
@@ -72,7 +67,10 @@ resource "aws_security_group" "master" {
     protocol        = "-1"
     cidr_blocks     = ["0.0.0.0/0"]
   }
+
+tags = "${var.additional_tags}"
 }
+
 resource "aws_launch_configuration" "master" {
   name_prefix      = "${var.name}-master-"
   image_id         = "${data.aws_ami.ubuntu.id}"
@@ -105,43 +103,28 @@ resource "aws_autoscaling_group" "master" {
 
   target_group_arns         = ["${aws_lb_target_group.master_443.arn}"]
 
-  tags = [
-    {
-      key                 = "Name"
-      value               = "${var.name}-master"
-      propagate_at_launch = true
-    },
-    {
-      key                 = "KubernetesCluster"
-      value               = "${var.name}"
-      propagate_at_launch = true
-    },
-    {
-      key                 = "k8s.io/role/master"
-      value               = 1 
-      propagate_at_launch = true
-    },
-  ]
+  tags = ["${concat(
+      list(map("key", "Name", "value", "${var.name}-master", "propagate_at_launch", true),
+        map("key", "KubernetesCluster", "value", "${var.name}", "propagate_at_launch", true),
+        map("key", "k8s.io/role/master", "value", 1, "propagate_at_launch", true),
+      ),
+      local.tags_asg_format
+   )}"]
 
   lifecycle {
     create_before_destroy = true
   }
 }
 
-
 resource "aws_lb" "master" {
   name = "${var.name}-master"
   internal        = true
   subnets         = ["${data.aws_subnet.region_1a.id}"]
   load_balancer_type = "network"
-
-  tags = {
-    Name = "${var.name}-master"
-  }
-
+  
+  tags = "${merge(var.additional_tags, map("Name", "${var.name}-master"))}"
 }
 
-
 resource "aws_lb_listener" "master" {
   load_balancer_arn = "${aws_lb.master.arn}"
   port              = "443"
diff --git a/autoscaling_nodes.tf b/autoscaling_nodes.tf
index b292ec5..ef5f7df 100644
--- a/autoscaling_nodes.tf
+++ b/autoscaling_nodes.tf
@@ -18,15 +18,13 @@ data "template_file" "nodes" {
 
     load_balancer_dns = "${aws_lb.master.dns_name}"
   }
-
 }
 
-
 resource "aws_security_group" "nodes" {
   name        = "${var.name}-nodes"
   description = "${var.name}-nodes"
   vpc_id      = "${var.vpc}"
-
+  tags = "${var.additional_tags}"
 }
 
 resource "aws_security_group_rule" "nodes-self" {
@@ -101,23 +99,14 @@ resource "aws_autoscaling_group" "nodes" {
   launch_configuration      = "${aws_launch_configuration.nodes.name}"
   vpc_zone_identifier       = ["${data.aws_subnet.region_1b.id}", "${data.aws_subnet.region_1c.id}"]
 
-  tags = [
-    {
-      key                 = "Name"
-      value               = "${var.name}-node"
-      propagate_at_launch = true
-    },
-    {
-      key                 = "KubernetesCluster"
-      value               = "${var.name}"
-      propagate_at_launch = true
-    },
-    {
-      key                 = "k8s.io/role/node"
-      value               = 1 
-      propagate_at_launch = true
-    },
-  ]
+  tags = ["${concat(
+      list(map("key", "Name", "value", "${var.name}-node", "propagate_at_launch", true),
+        map("key", "KubernetesCluster", "value", "${var.name}", "propagate_at_launch", true),
+        map("key", "k8s.io/role/node", "value", 1, "propagate_at_launch", true),
+      ),
+      local.tags_asg_format
+   )}"]
+
 
   lifecycle {
     create_before_destroy = true
diff --git a/certificate.tf b/certificate.tf
index 19fb0cd..b5c164c 100644
--- a/certificate.tf
+++ b/certificate.tf
@@ -5,4 +5,6 @@ resource "aws_s3_bucket_object" "certificate" {
   key                    = "scripts/installation/additional.crt"
   content                = "${var.additional_certificates}"
   server_side_encryption = "AES256"
+
+  tags = "${var.additional_tags}"
 }
diff --git a/iam.tf b/iam.tf
index 59767ac..ceb8def 100644
--- a/iam.tf
+++ b/iam.tf
@@ -4,23 +4,23 @@ resource "aws_iam_role" "cluster" {
 
   assume_role_policy = <<EOF
 {
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Action": "sts:AssumeRole",
-            "Principal": {
-               "Service": "ec2.amazonaws.com"
-            },
-            "Effect": "Allow",
-            "Sid": ""
-        }
-    ]
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
 }
 EOF
 }
 
 resource "aws_iam_instance_profile" "cluster" {
-  name  = "${var.name}"
+  name = "${var.name}"
   role = "${aws_iam_role.cluster.name}"
 }
 
@@ -39,11 +39,10 @@ resource "aws_iam_role_policy" "policy" {
   policy =  "${data.template_file.role_policy.rendered}"
 }
 
-
 resource "aws_iam_role_policy" "additional" {
   count = "${var.iam_policy == "" ? 0 : 1}"
   name = "additional"
   role = "${aws_iam_role.cluster.id}"
 
-  policy =  "${var.iam_policy}"
+  policy = "${var.iam_policy}"
 }
diff --git a/input.tf b/input.tf
index dad7f88..e29b251 100644
--- a/input.tf
+++ b/input.tf
@@ -2,11 +2,11 @@ variable "name" {}
 variable "ssh_key" {}
 
 variable "master_instance_type" {
-    default = "t2.medium"
-} 
+  default = "t2.medium"
+}
 
 variable "node_instance_type" {
-    default = "t2.large"
+  default = "t2.large"
 }
 
 variable "node_asg_min" {}
@@ -15,11 +15,11 @@ variable "node_asg_desired" {}
 variable "vpc" {}
 
 variable "proxy_servers" {
-    default = ""
+  default = ""
 }
 
 variable "subnets" {
-    default = []
+  default = []
 }
 
 variable "kubernetes_version" {
@@ -31,9 +31,13 @@ variable "kubernetes_dashboard_version" {
 }
 
 variable "iam_policy" {
-   default =   ""
+  default = ""
 }
 
 variable "additional_certificates" {
-   default =   ""
+  default = ""
+}
+
+variable "additional_tags" {
+  default = {}
 }
diff --git a/locals.tf b/locals.tf
new file mode 100644
index 0000000..8a8c391
--- /dev/null
+++ b/locals.tf
@@ -0,0 +1,133 @@
+locals {
+  # This whole block is dedicated to converting an input variable of map (same type as other resources) into asg
+  # compatible format, which is a list of maps with the propagate_at_launch variable set at true.
+  # Split the full_tags variable (map) into 2 lists in same order as the map
+  tag_keys = "${keys(var.additional_tags)}"
+
+  tag_values = "${values(var.additional_tags)}"
+
+  list_blank = "${list()}"
+
+  # Define a structure for the keys of the dicts that the asg block requires.
+  key_list = "${list(
+    "key",
+    "value",
+    "propagate_at_launch")}"
+
+  # 10 lists containing values that will be zipmapped to the above structure later.
+  list0 = "${list(
+      element(concat(local.tag_keys, list("")), 0),
+      element(concat(local.tag_values, list("")), 0),
+      "true"
+    )
+  }"
+
+  list1 = "${list(
+      element(concat(local.tag_keys, list("")), 1),
+      element(concat(local.tag_values, list("")), 1),
+      "true"
+    )
+  }"
+
+  list2 = "${list(
+      element(concat(local.tag_keys, list("")), 2),
+      element(concat(local.tag_values, list("")), 2),
+      "true"
+    )
+  }"
+
+  list3 = "${list(
+      element(concat(local.tag_keys, list("")), 3),
+      element(concat(local.tag_values, list("")), 3),
+      "true"
+    )
+  }"
+
+  list4 = "${list(
+      element(concat(local.tag_keys, list("")), 4),
+      element(concat(local.tag_values, list("")), 4),
+      "true"
+    )
+  }"
+
+  list5 = "${list(
+      element(concat(local.tag_keys, list("")), 5),
+      element(concat(local.tag_values, list("")), 5),
+      "true"
+    )
+  }"
+
+  list6 = "${list(
+      element(concat(local.tag_keys, list("")), 6),
+      element(concat(local.tag_values, list("")), 6),
+      "true"
+    )
+  }"
+
+  list7 = "${list(
+      element(concat(local.tag_keys, list("")), 7),
+      element(concat(local.tag_values, list("")), 7),
+      "true"
+    )
+  }"
+
+  list8 = "${list(
+      element(concat(local.tag_keys, list("")), 8),
+      element(concat(local.tag_values, list("")), 8),
+      "true"
+    )
+  }"
+
+  list9 = "${list(
+      element(concat(local.tag_keys, list("")), 9),
+      element(concat(local.tag_values, list("")), 9),
+      "true"
+    )
+  }"
+
+  # Construct list of dicts in required format by zipmapping the value lists with the standard key list
+  # Slicing to the length of the map of tags so we dont get blank or repeating tags starting from first non-default value
+  tags_asg_format = "${slice(list(
+      zipmap(
+        local.key_list,
+        local.list0
+      ),
+      zipmap(
+        local.key_list,
+        local.list1
+      ),
+      zipmap(
+        local.key_list,
+        local.list2
+      ),
+      zipmap(
+        local.key_list,
+        local.list3
+      ),
+      zipmap(
+        local.key_list,
+        local.list4
+      ),
+      zipmap(
+        local.key_list,
+        local.list5
+      ),
+      zipmap(
+        local.key_list,
+        local.list6
+      ),
+      zipmap(
+        local.key_list,
+        local.list7
+      ),
+      zipmap(
+        local.key_list,
+        local.list8
+      ),
+      zipmap(
+        local.key_list,
+        local.list9
+      )
+    ), 0, min(length(local.tag_keys), 10))
+  }"
+}
diff --git a/main.tf b/main.tf
index 95f8470..6255011 100644
--- a/main.tf
+++ b/main.tf
@@ -1,4 +1,3 @@
-
 data "aws_ami" "ubuntu" {
   most_recent = true
 
@@ -14,5 +13,3 @@ data "aws_ami" "ubuntu" {
 
   owners = ["099720109477"] # Canonical
 }
-
-
diff --git a/output.tf b/output.tf
index 41a304b..ae58cc9 100644
--- a/output.tf
+++ b/output.tf
@@ -1,8 +1,7 @@
 output "security_group_nodes_id" {
-   value = "${aws_security_group.nodes.id}"
+  value = "${aws_security_group.nodes.id}"
 }
 
 output "security_group_master_id" {
-   value = "${aws_security_group.master.id}"
+  value = "${aws_security_group.master.id}"
 }
-
diff --git a/s3.tf b/s3.tf
index af2bfab..6798bca 100644
--- a/s3.tf
+++ b/s3.tf
@@ -7,6 +7,8 @@ resource "aws_s3_bucket" "cluster" {
   versioning {
     enabled = true
   }
+
+  tags = "${var.additional_tags}"
 }
 
 data "template_file" "prepare" {
@@ -26,13 +28,13 @@ data "template_file" "prepare2" {
   }
 }
 
-
-
 resource "aws_s3_bucket_object" "prepare" {
   bucket = "${aws_s3_bucket.cluster.id}"
   key    = "scripts/installation/1_prepare.sh"
   content = "${data.template_file.prepare.rendered}"
   server_side_encryption = "AES256"
+
+  tags = "${var.additional_tags}"
 }
 
 resource "aws_s3_bucket_object" "prepare2" {
@@ -40,14 +42,17 @@ resource "aws_s3_bucket_object" "prepare2" {
   key    = "scripts/installation/2_setup_kubernetes.sh"
   content = "${data.template_file.prepare2.rendered}"
   server_side_encryption = "AES256"
-}
 
+  tags = "${var.additional_tags}"
+}
 
 resource "aws_s3_bucket_object" "maint1" {
   bucket = "${aws_s3_bucket.cluster.id}"
   key    = "scripts/maintenance/9_verify_network.sh"
   content = "${file("${path.module}/scripts/9_verify_network.sh")}"
   server_side_encryption = "AES256"
+
+  tags = "${var.additional_tags}"
 }
 
 resource "aws_s3_bucket_object" "createnamespace" {
@@ -55,6 +60,8 @@ resource "aws_s3_bucket_object" "createnamespace" {
   key    = "scripts/maintenance/create_namespace_for_customer.sh"
   content = "${file("${path.module}/scripts/create_namespace_for_customer.sh")}"
   server_side_encryption = "AES256"
+
+  tags = "${var.additional_tags}"
 }
 
 resource "aws_s3_bucket_object" "kill" {
@@ -62,6 +69,8 @@ resource "aws_s3_bucket_object" "kill" {
   key    = "scripts/maintenance/10_kill.sh"
   content = "${file("${path.module}/scripts/10_kill.sh")}"
   server_side_encryption = "AES256"
+
+  tags = "${var.additional_tags}"
 }
 
 resource "aws_s3_bucket_object" "check_proxy" {
@@ -69,6 +78,8 @@ resource "aws_s3_bucket_object" "check_proxy" {
   key    = "scripts/maintenance/proxy_healthcheck.sh"
   content = "${file("${path.module}/scripts/proxy_healthcheck.sh")}"
   server_side_encryption = "AES256"
+
+  tags = "${var.additional_tags}"
 }
 
 resource "aws_s3_bucket_object" "example_nginx" {
@@ -76,6 +87,8 @@ resource "aws_s3_bucket_object" "example_nginx" {
   key    = "scripts/examples/nginx.yaml"
   content = "${file("${path.module}/scripts/examples/nginx.yaml")}"
   server_side_encryption = "AES256"
+
+  tags = "${var.additional_tags}"
 }
 
 data "template_file" "addons" {
@@ -93,4 +106,6 @@ resource "aws_s3_bucket_object" "addons" {
   key    = "scripts/installation/3_addons.sh"
   content = "${data.template_file.addons.rendered}"
   server_side_encryption = "AES256"
+
+  tags = "${var.additional_tags}"
 }