Merge remote-tracking branch 'upstream'

governance/steering.md

@@ -24,7 +24,7 @@ The working groups are led by chairs (6 month terms) and maintainers (6 month te
 | Infrastructure   | [Niall Thomson](https://github.com/niallthomson)   |                                                                                                                                                 |
 | Fundamentals     | [Sai Vennam](https://github.com/svennam92)         | [Bijith Nair](https://github.com/bijithnair), [Tolu Okuboyejo](https://github.com/oktab1), [Hemanth AVS](https://github.com/hemanth-avs)        |
 | Autoscaling      | [Sanjeev Ganjihal](https://github.com/sanjeevrg89) |                                                                                                                                                 |
-| Automation       | [Carlos Santana](https://github.com/csantanapr)    | [Tsahi Duek](https://github.com/tsahiduek), [Christina Andonov](https://github.com/candonov), [Sébastien Allamand](https://github.com/allamand) |
+| Automation       | [Carlos Santana](https://github.com/csantanapr)    | [Tsahi Duek](https://github.com/tsahiduek), [Sébastien Allamand](https://github.com/allamand), [Yuriy Bezsonov](https://github.com/ybezsonov)   |
 | Machine Learning | [Masatoshi Hayashi](https://github.com/literalice) | [Benjamin Gardiner](https://github.com/bkgardiner)                                                                                              |
 | Networking       | [Sheetal Joshi](https://github.com/sheetaljoshi)   | [Umair Ishaq](https://github.com/umairishaq)                                                                                                    |
 | Observability    | [Nirmal Mehta](https://github.com/normalfaults)    | [Steven David](https://github.com/StevenDavid)                                                                                                  |

helm/src/requirements.txt

@@ -1,7 +1,7 @@
 certifi==2023.7.22
-charset-normalizer==3.1.0
+charset-normalizer==3.3.0
 idna==3.4
-PyYAML==6.0
+PyYAML==6.0.1
 requests==2.31.0
 semantic-version==2.10.0
-urllib3==2.0.3
+urllib3==2.0.6

lab/bin/use-cluster

@@ -35,4 +35,10 @@ EKS_IP_FAMILY=ipv4
 set +a
 EOT
 
-aws eks update-kubeconfig --name $cluster_name > /dev/null
+aws eks update-kubeconfig --name $cluster_name > /dev/null 2>&1
+
+if [[ -v C9_USER ]]; then
+  echo "Granting C9_USER access to the cluster via the AWS Console ${C9_USER}"
+  eksctl create iamidentitymapping --cluster $cluster_name --arn arn:aws:iam::${AWS_ACCOUNT_ID}:user/${C9_USER} --username console-iam-user --group system:masters > /dev/null
+  eksctl create iamidentitymapping --cluster $cluster_name --arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${C9_USER} --username console-iam-role --group system:masters > /dev/null
+fi

manifests/modules/fundamentals/storage/fsxn/.workshop/terraform/addon.tf

@@ -0,0 +1,96 @@
+module "fsxn_driver" {
+  source = "github.com/NetApp/terraform-aws-netapp-fsxn-eks-addon.git?ref=v1.0"
+}
+
+data "aws_vpc" "selected_vpc_fsx" {
+  tags = {
+    created-by = "eks-workshop-v2"
+    env        = local.addon_context.eks_cluster_id
+  }
+}
+
+data "aws_subnets" "private_subnets_fsx" {
+  tags = {
+    created-by = "eks-workshop-v2"
+    env        = local.addon_context.eks_cluster_id
+  }
+
+  filter {
+    name   = "tag:Name"
+    values = ["*Private*"]
+  }
+}
+
+resource "random_string" "fsx_password" {
+  length  = 10
+  special = false
+}
+
+data "aws_route_table" "private" {
+  count = length(data.aws_subnets.private_subnets_fsx.ids)
+
+  vpc_id    = data.aws_vpc.selected_vpc_fsx.id
+  subnet_id = data.aws_subnets.private_subnets_fsx.ids[count.index]
+}
+
+resource "aws_fsx_ontap_file_system" "fsxnassets" {
+  storage_capacity    = 2048
+  subnet_ids          = slice(data.aws_subnets.private_subnets_fsx.ids, 0, 2)
+  deployment_type     = "MULTI_AZ_1"
+  throughput_capacity = 512
+  preferred_subnet_id = data.aws_subnets.private_subnets_fsx.ids[0]
+  security_group_ids  = [aws_security_group.fsxn.id]
+  fsx_admin_password  = random_string.fsx_password.result
+  route_table_ids     = data.aws_route_table.private.*.id
+
+  tags = merge(
+    local.tags,
+    {
+      Name = "${local.addon_context.eks_cluster_id}-fsxn-assets"
+    }
+  )
+}
+
+resource "aws_fsx_ontap_storage_virtual_machine" "fsxnsvm" {
+  file_system_id = aws_fsx_ontap_file_system.fsxnassets.id
+  name           = "fsxnsvm"
+}
+
+resource "aws_security_group" "fsxn" {
+  name_prefix = "security group for fsx access"
+  vpc_id      = data.aws_vpc.selected_vpc_fsx.id
+  tags = merge(
+    local.tags,
+    {
+      Name = "${local.addon_context.eks_cluster_id}-fsxnsecuritygroup"
+    }
+  )
+}
+
+resource "aws_security_group_rule" "fsxn_inbound" {
+  description       = "allow inbound traffic to eks"
+  from_port         = 0
+  protocol          = "-1"
+  to_port           = 0
+  security_group_id = aws_security_group.fsxn.id
+  type              = "ingress"
+  cidr_blocks       = [data.aws_vpc.selected_vpc_fsx.cidr_block]
+}
+
+resource "aws_security_group_rule" "fsxn_outbound" {
+  description       = "allow outbound traffic to anywhere"
+  from_port         = 0
+  protocol          = "-1"
+  security_group_id = aws_security_group.fsxn.id
+  to_port           = 0
+  type              = "egress"
+  cidr_blocks       = [data.aws_vpc.selected_vpc_fsx.cidr_block]
+}
+
+output "environment" {
+  value = <<EOF
+export FSXN_ID=${aws_fsx_ontap_file_system.fsxnassets.id}
+export FSXN_ADMIN_PASSWORD=${random_string.fsx_password.result}
+export FSXN_IP="${tolist(aws_fsx_ontap_file_system.fsxnassets.endpoints[0].management[0].ip_addresses)[0]}"
+EOF
+}

manifests/modules/fundamentals/storage/fsxn/backend/config.env

@@ -1 +1,2 @@
-FSXN_IP
+FSXN_IP
+FSXN_ADMIN_PASSWORD

manifests/modules/fundamentals/storage/fsxn/backend/env-var-transformer.yaml

@@ -1,3 +1,5 @@
 varReference:
   - kind: TridentBackendConfig
-    path: spec/managementLIF
+    path: spec/managementLIF
+  - kind: Secret
+    path: stringData/password

manifests/modules/fundamentals/storage/fsxn/backend/fsxn-secret.yaml

@@ -6,4 +6,4 @@ metadata:
 type: Opaque
 stringData:
   username: fsxadmin
-  password: Netapp1!
+  password: $(FSXN_ADMIN_PASSWORD)

manifests/modules/fundamentals/storage/fsxn/backend/kustomization.yaml

@@ -21,5 +21,12 @@ vars:
     apiVersion: v1
   fieldref:
     fieldpath: data.FSXN_IP
+- name: FSXN_ADMIN_PASSWORD
+  objref:
+    kind: ConfigMap
+    name: fsxnconfig
+    apiVersion: v1
+  fieldref:
+    fieldpath: data.FSXN_ADMIN_PASSWORD
 configurations:
   - env-var-transformer.yaml

manifests/modules/fundamentals/storage/fsxn/deployment/deployment.yaml

@@ -8,7 +8,7 @@ spec:
     spec:
       initContainers:
        - name: copy
-         image: "public.ecr.aws/aws-containers/retail-store-sample-assets:latest"
+         image: "public.ecr.aws/aws-containers/retail-store-sample-assets:0.4.0"
          command: ["/bin/sh", "-c", "cp -R /usr/share/nginx/html/assets/* /fsxnvolume"]
          volumeMounts:
          - name: fsxnvolume

manifests/modules/fundamentals/storage/fsxn/deployment/kustomization.yaml

@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 bases:
-- ../../../../../manifests/assets
+- ../../../../../base-application/assets
 resources:
 - fsxnpvclaim.yaml
 patches: