env_variables_aws.yaml

# Reusable variables here to avoid recursions issues
cidr_block: "10.15.0.0/16"

root:
  # Flag the decides if the terraform files are generated using the playbook
  prepare: false
  # Decides if the terraform generated resources are going to be created.
  write: true
  terraform:
    location: ../terraform_templates
    aws_version: 4.0
    prefix: bsa-auto-infra
    modules:
      vpc: "../terraform_templates/modules/vpc"
  outputs:
    location: /app/infra-provision-outputs

resources:
  tags:
    OWNER: AUTOMATION_TEAM
    PURPOSE: AUTOMATION
  vpc:
    enabled: true
    # Only if enabled is set to "false", then all the "pre_existing" parameters must be set
    pre_existing:
      vpc_id: "vpc-01234567"
    # Full options for further implementation https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc
    # This is only required when the resource is going to be created
    options:
      name: "vpc"
      cidr_block: "{{ cidr_block }}"
      instance_tenancy: "default"
      enable_dns_support: "true"
      enable_dns_hostnames: "false"
  subnet:
    enabled: true
    pre_existing:
      subnet_id: "subnet-01234567"
    # Full options for further implementation https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/subnet
    # This is only required when the resource is going to be created
    options:
      name: "sbt"
      cidr_block:
        public: 10.15.1.0/24
        private: 10.15.2.0/24
      availability_zone: ""
  security_group:
    enabled: true
    pre_existing:
      security_group_id: "sg-01234567"
    # Full options for further implementation https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc
    # This is only required when the resource is going to be created
    options:
      name: "sg"
      description: "Security Group of team for Development Automation"
      rules:
        ingress:
          # Add or delete more elements to the array to generate more rules
          - name: Allow all traffic in VPC
            protocol: all
            portRange:
              start: 0
              end: 65535
            # IMPORTANT: To enable this rule, ensure that matches the resources.vpc.options.cidr_block
            source: "{{ cidr_block }}"

          - name: Allow SSH Traffic for my target IP
            protocol: TCP
            portRange:
              start: 22
              end: 22
            # This is a sample public IP
            source: 45.85.127.50/32
        egress:
          - name: Allow all traffic to same VPC
            # This indicates all the protocols ("-1" also works as an equivalent)
            protocol: all
            # For only one port use the same por for start and finish
            # The full range is 0-65535
            portRange:
              start: 0
              end: 65535
            # IMPORTANT: To enable this rule, ensure that matches the resources.vpc.options.cidr_block
            # TODO: Create automation so it "Self VPC" inputs the VPC id either pre-existing or generated instead of having to have the exact value.
            destination: "{{ cidr_block }}"

          - name: Allow Common internet 80
            protocol: TCP
            portRange:
              start: 80
              end: 80
            destination: 0.0.0.0/0

          - name: Allow Common internet 8080
            protocol: TCP
            portRange:
              start: 8080
              end: 8080
            destination: 0.0.0.0/0

          - name: Allow Common internet 443
            protocol: TCP
            portRange:
              start: 443
              end: 443
            destination: 0.0.0.0/0

          - name: Allow DNS Queries
            protocol: TCP
            portRange:
              start: 53
              end: 53
            destination: 0.0.0.0/0

          - name: Allow DNS Queries UDP
            protocol: UDP
            portRange:
              start: 53
              end: 53
            destination: 0.0.0.0/0
  key:
    algorithm: RSA
    bits: 4096
  role:
    enabled: true
  instance:
    enabled: true
    count: 3
    options:
      name: "ubuntu"
      ami:
        eu-south-2: "ami-0ee19dcf57f09e938"
        eu-west-1: "ami-0c1c30571d2dae5c9"
        eu-west-2: "ami-0b9932f4918a00c4f"
        eu-west-3: "ami-00c71bd4d220aa22a"
        eu-central-1: "ami-023adaba598e661ac"
      instance_type: "t3.large"
      volumes:
        size: 100
        delete_on_termination: true
        encrypted: true
  internet_gateway:
    enabled: true
    options:
      name: "ig"
  # IMPORTANT-IG-ID: In case of using an existing internet gateway, remember to include the id in the routes for internet access resources.route_table.options.routes[0].target
  nat_gateway:
    enabled: true
    options:
      name: "nat"
      elastic_ip: true
  route_table:
    enabled: true
    options:
      name: "rt"
      public:
        routes:
          # For any additional routes, it only needs to be set as another element of the list with the details of name, type, destination and target.
          - name: to internet gateway
            type: gateway_id
            destination: 0.0.0.0/0
            # If internet gateway creation is enabled and target is "playbook", it will use the id of the current generated internet gateway id.
            # Otherwise an internet gateway id must be specified here (Check # IMPORTANT-IG-ID).
            target: playbook
      private:
        routes:
          # For any additional routes, it only needs to be set as another element of the list with the details of name, type, destination and target.
          - name: to nat gateway
            type: gateway_id
            destination: 0.0.0.0/0
            # If nat gateway creation is enabled and target is "playbook", it will use the id of the current generated nat gateway id.
            # Otherwise an internet gateway id must be specified here (Check # IMPORTANT-IG-ID).
            target: playbook
  dns_resolver:
    enabled: true
    options:
      dns_servers:
        - "10.15.1.35"
        - "10.15.2.35"
  vpn:
    enabled: true
    domain: example.com
    organization: Example
    cidr: 10.0.0.0/16


# Instances utils configuration
target: ubuntu_22_04
utils:
  python:
    enabled: false
    version: "3.12"
  crio:
    enabled: true
    version: "1.27"
    os: "xUbuntu_22.04"
  aws:
    enabled: false
  azure:
    enabled: false
  gcloud:
    enabled: false
  docker:
    enabled: false
    version: "20.10.11"
  kubernetes:
    version: "1.27.0"
    enabled: false
    kubectl: false
    kubeadm: false
    kubelet: false
  jq_yq:
    enabled: false
  helm:
    enabled: false

addOns:
  createNamespaces: true
  namespaces:
    - apps
    - datastorage
    - monitoring
  cni:
    calico:
      enabled: true
      version: "v3.27.3"
      cidr: "192.168.0.0/16"
  storageClass:
    enabled: false
    name: gp2
    provisioner: kubernetes.io/aws-ebs
    # Only accept valid parameters
    # It will variate depending on the target cloud.
    # This configuration is for aws
    # If no parameters desired, an empty dict should be passed {}
    parameters:
      fsType: ext4
      # Double Quotes MUST be used in booleans
      entrypted: "true"
      type: gp2