diff --git a/README.md b/README.md index 2163884b..b37ad6a9 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,7 @@ $ cd terraform-provider-sysdig $ make build ``` -If you're a rookie, check [Official Terraform Provider development guides](https://developer.hashicorp.com/terraform/plugin/frameworkO) +If you're a rookie, check [Official Terraform Provider development guides](https://developer.hashicorp.com/terraform/plugin/framework) ### Creating new resource / data sources diff --git a/examples/serverless-agent/fargate/orchestrator/README.md b/examples/serverless-agent/fargate/orchestrator/README.md new file mode 100644 index 00000000..c528b975 --- /dev/null +++ b/examples/serverless-agent/fargate/orchestrator/README.md @@ -0,0 +1,27 @@ +# Serverless Orchestrator Agent + +This example deploys an AWS ECS Fargate cluster to run the Serverless Orchestrator Agent. This Agent acts as a proxy between the Collector and many Serverless Workload Agents. + +## Prerequisites + +The following AWS prerequisites are required to deploy this cluster: +- VPC +- 2 subnets + +## Components + +The cluster will be called `-cluster` and will deploy the following: +- 1 Service (called `OrchestratorAgent`) + - 1 Task (with the latest version of the Serverless Orchestrator Agent) +- Network Load balancer +- Cloudwatch log group +- Security group + +## Layout +| **File** | **Purpose** | +| --- | --- | +| `main.tf` | AWS provider configuration | +| `orchestrator.tf` | Orchestrator cluster definition | +| `output.tf` | Defines the output variables | +| `variables.tf` | AWS and Agent configuration | +| `versions.tf` | Defines TF provider versions | diff --git a/examples/serverless-agent/fargate/orchestrator/orchestrator.tf b/examples/serverless-agent/fargate/orchestrator/orchestrator.tf new file mode 100644 index 00000000..102d9604 --- /dev/null +++ b/examples/serverless-agent/fargate/orchestrator/orchestrator.tf @@ -0,0 +1,36 @@ +module "fargate-orchestrator-agent" { + source = "sysdiglabs/fargate-orchestrator-agent/aws" + version = "0.5.0" + + vpc_id = var.vpc_id + subnets = [var.subnet_1, var.subnet_2] + + access_key = var.access_key + + collector_host = var.collector_host + collector_port = var.collector_port + + name = var.prefix + agent_image = var.agent_orchestrator_image + + # True if the VPC uses an InternetGateway, false otherwise + assign_public_ip = true + + tags = var.tags +} + + +data "aws_ecs_cluster" "fargate-orchestrator" { + depends_on = [ + module.fargate-orchestrator-agent + ] + cluster_name = "${var.prefix}-cluster" +} + +data "aws_ecs_service" "orchestrator-service" { + depends_on = [ + module.fargate-orchestrator-agent + ] + service_name = "OrchestratorAgent" + cluster_arn = data.aws_ecs_cluster.fargate-orchestrator.arn +} diff --git a/examples/serverless-agent/fargate/orchestrator/output.tf b/examples/serverless-agent/fargate/orchestrator/output.tf new file mode 100644 index 00000000..0088749d --- /dev/null +++ b/examples/serverless-agent/fargate/orchestrator/output.tf @@ -0,0 +1,11 @@ +output "orchestrator_cluster_name" { + value = data.aws_ecs_cluster.fargate-orchestrator.cluster_name +} + +output "orchestrator_cluster_arn" { + value = data.aws_ecs_cluster.fargate-orchestrator.arn +} + +output "orchestrator_service_arn" { + value = data.aws_ecs_service.orchestrator-service.arn +} diff --git a/examples/serverless-agent/fargate/orchestrator/providers.tf b/examples/serverless-agent/fargate/orchestrator/providers.tf new file mode 100644 index 00000000..f6f28cca --- /dev/null +++ b/examples/serverless-agent/fargate/orchestrator/providers.tf @@ -0,0 +1,4 @@ +provider "aws" { + region = var.region + profile = var.profile +} diff --git a/examples/serverless-agent/fargate/orchestrator/variables.tf b/examples/serverless-agent/fargate/orchestrator/variables.tf new file mode 100644 index 00000000..92af8fc9 --- /dev/null +++ b/examples/serverless-agent/fargate/orchestrator/variables.tf @@ -0,0 +1,51 @@ +# AWS configuration +variable "prefix" { + description = "All resources created by Terraform have this prefix prepended to them" +} + +variable "profile" { + description = "AWS profile name" + type = string +} + +variable "region" { + description = "AWS Region for deployment" + default = "us-east-1" +} + +variable "subnet_1" { + description = "Subnet-1 Id" +} + +variable "subnet_2" { + description = "Subnet-2 Id" +} + +variable "vpc_id" { + description = "VPC Id" +} + +variable "tags" { + type = map(string) + description = "Tags to assign to resources in module" + default = {} +} + +# Serverless Agent Configuration +variable "access_key" { + description = "Sysdig Agent access key" +} + +variable "agent_orchestrator_image" { + description = "Orchestrator Agent image to use" + default = "quay.io/sysdig/orchestrator-agent:latest" +} + +variable "collector_host" { + description = "Collector host where agent will send the data" +} + +variable "collector_port" { + description = "Collector port where agent will send the data" + default = "6443" +} diff --git a/examples/serverless-agent/fargate/orchestrator/versions.tf b/examples/serverless-agent/fargate/orchestrator/versions.tf new file mode 100644 index 00000000..37120d0a --- /dev/null +++ b/examples/serverless-agent/fargate/orchestrator/versions.tf @@ -0,0 +1,18 @@ +terraform { + required_version = ">=1.7.2" + + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.35.0" + } + local = { + source = "hashicorp/local" + version = "~> 2.4.1" + } + sysdig = { + source = "sysdiglabs/sysdig" + version = "~> 1.24.5" + } + } +} \ No newline at end of file diff --git a/examples/serverless-agent/fargate/workload/README.md b/examples/serverless-agent/fargate/workload/README.md new file mode 100644 index 00000000..f5b79e87 --- /dev/null +++ b/examples/serverless-agent/fargate/workload/README.md @@ -0,0 +1,28 @@ +# Workload with Serverless Workload Agent + +This example deploys a cluster with a workload and the Serverless Workload Agent as a sidecar to secure the workload. + +## Prerequisites + +The following prerequisites are required to deploy this cluster: +- Orchestrator Agent deployed +- VPC +- 2 subnets + +## Components + +The cluster will be called `-instrumented-workload` and will deploy the following: +- 1 Service (called ` **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository. + +## Example Usage + +```terraform +resource "sysdig_ip_filter" "example" { + ip_range = "192.168.100.0/24" + note = "Office IP range" + enabled = true +} + +``` +This example creates a filter for IP range 192.168.100.0/24, with a note indicating it's for an office IP range, and it's enabled. + + +## Argument Reference + +* `ip_range` - (Required) The IP range to allow access to the Sysdig platform. Must be in CIDR notation. +* `enabled` - (Required) Specifies whether the IP range is enabled. +* `note` - (Optional) A note describing the allowed IP range. + +## Attributes Reference + +In addition to all arguments above, the following attributes are exported: +* `id` - The ID of the allowed IP range. + +## Import + +Sysdig IP filter can be imported using the ID, e.g. + +``` +$ terraform import sysdig_ip_filter.example 12345 +``` diff --git a/website/docs/r/ip_filtering_settings.md b/website/docs/r/ip_filtering_settings.md new file mode 100644 index 00000000..c1d9d4a1 --- /dev/null +++ b/website/docs/r/ip_filtering_settings.md @@ -0,0 +1,48 @@ +--- +subcategory: "Sysdig Platform" +layout: "sysdig" +page_title: "Sysdig: sysdig_ip_filtering_settings" +description: |- + Creates a IP filters settings in Sysdig. +--- + +# Resource: sysdig_ip_filtering_settings + +Configures settings for IP filters (`sysdig_ip_filter` resource) which can be used to restrict access to the Sysdig platform. +Currently, there is only one setting available: `ip_filtering_enabled` which enables or disables the IP filtering feature. To enable the feature, at least one IP range must be defined in the `sysdig_ip_filter` resource. + +> **Warning** +> This resource is global and is allowed to have only one instance per customer. +> Please verify that all IP ranges are created before enabling the feature. Failure to include your IP range will block your access to Sysdig until you connect from an approved IP range. + + +The `sysdig_ip_filtering_settings` behaves differently from normal resources, in that Terraform does not destroy this resource. +On resource destruction, Terraform performs no actions in Sysdig. + +-> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository. + +## Example Usage + +```terraform +resource "sysdig_ip_filtering_settings" "example" { + ip_filtering_enabled = true +} + +``` +This example enables the IP filtering feature. + +## Argument Reference + +* `ip_filtering_enabled` - (Required) Specifies whether the IP filtering feature is enabled. + +## Attributes Reference + +No additional attributes are exported. + +## Import + +Sysdig IP filters settings can be imported, e.g. + +``` +$ terraform import sysdig_ip_filtering_settings.example ip_filtering_settings_id +``` diff --git a/website/docs/r/monitor_alert_downtime.md b/website/docs/r/monitor_alert_downtime.md index 9cfaf0a1..4a86ebc7 100644 --- a/website/docs/r/monitor_alert_downtime.md +++ b/website/docs/r/monitor_alert_downtime.md @@ -10,6 +10,8 @@ description: |- Creates a Sysdig Monitor Downtime Alert. Monitor any type of entity - host, container, process, service, etc - and alert when the entity goes down. +~> **Deprecation Notice:** `sysdig_monitor_alert_downtime` has been deprecated and will be removed in future releases, use `sysdig_monitor_alert_v2_downtime` instead. + -> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository. ## Example Usage diff --git a/website/docs/r/monitor_alert_event.md b/website/docs/r/monitor_alert_event.md index c0cc78c5..e9d40203 100644 --- a/website/docs/r/monitor_alert_event.md +++ b/website/docs/r/monitor_alert_event.md @@ -12,6 +12,8 @@ Creates a Sysdig Monitor Event Alert. Monitor occurrences of specific events, an number of occurrences violates a threshold. Useful for alerting on container, orchestration, and service events like restarts and deployments. +~> **Deprecation Notice:** `sysdig_monitor_alert_event` has been deprecated and will be removed in future releases, use `sysdig_monitor_alert_v2_event` instead. + -> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository. ## Example Usage diff --git a/website/docs/r/monitor_alert_metric.md b/website/docs/r/monitor_alert_metric.md index 5732a1c7..5305cb9f 100644 --- a/website/docs/r/monitor_alert_metric.md +++ b/website/docs/r/monitor_alert_metric.md @@ -10,6 +10,8 @@ description: |- Creates a Sysdig Monitor Metric Threshold Alert. Monitor time-series metrics and alert if they violate user-defined thresholds. +~> **Deprecation Notice:** `sysdig_monitor_alert_metric` has been deprecated and will be removed in future releases, use `sysdig_monitor_alert_v2_metric` instead. + -> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository. ## Example Usage diff --git a/website/docs/r/monitor_alert_promql.md b/website/docs/r/monitor_alert_promql.md index f93c9d55..7c845366 100644 --- a/website/docs/r/monitor_alert_promql.md +++ b/website/docs/r/monitor_alert_promql.md @@ -10,6 +10,8 @@ description: |- Creates a Sysdig Monitor Prometheus Alert. Monitor prometheus metrics and alert if they violate user-defined PromQL-based metric expression. +~> **Deprecation Notice:** `sysdig_monitor_alert_promql` has been deprecated and will be removed in future releases, use `sysdig_monitor_alert_v2_prometheus` instead. + -> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository. ## Example Usage diff --git a/website/docs/r/monitor_cloud_account.md b/website/docs/r/monitor_cloud_account.md index 6e266fa8..8e004702 100644 --- a/website/docs/r/monitor_cloud_account.md +++ b/website/docs/r/monitor_cloud_account.md @@ -15,18 +15,39 @@ Creates a Sysdig Monitor Cloud Account for monitoring cloud resources. ## Example Usage ```terraform +// GCP example resource "sysdig_monitor_cloud_account" "sample" { cloud_provider = "GCP" integration_type = "API" account_id = "gcp_project_id" } + +// AWS example with role delegation +resource "sysdig_monitor_cloud_account" "sample" { + cloud_provider = "AWS" + integration_type = "Metrics Streams" + account_id = "123412341234" + role_name = "SysdigTestRole" +} + +// AWS example with secret key +resource "sysdig_monitor_cloud_account" "sample" { + cloud_provider = "AWS" + integration_type = "Metrics Streams" + account_id = "123412341234" + secret_key = "Xxx5XX2xXx/Xxxx+xxXxXXxXxXxxXXxxxXXxXxXx" + access_key_id = "XXXXX33XXXX3XX3XXX7X" +} ``` ## Argument Reference -* `cloud_provider` - (Required) Cloud platform that will be monitored. Only `GCP` is currently supported. -* `integration_type` - (Required) Type of cloud integration. Only `API` is currently supported. -* `account_id` - (Required) The GCP project id for the project that will be monitored. +* `cloud_provider` - (Required) Cloud platform that will be monitored. Only `GCP` and `AWS` are currently supported. +* `integration_type` - (Required) Type of cloud integration. Only `API` and `Metrics Streams` are currently supported (`Metrics Streams` only for `AWS`). +* `account_id` - (Required for GCP) The GCP project id for the project that will be monitored . (Optional For AWS) This identified the target Account ID. If provided, a role_name must be set. +* `role_name` - (Optional) The role name used for delegation over the customer resources towards the Sysdig AWS account. Only for AWS when the authentication mode is role delegation instead of secret key. +* `secret_key` - (Optional) The the secret key for a AWS connection. It must be provided along `access_key_id` when this auth mode is used. +* `access_key_id` - (Optional) The ID for the access key that has the permissions into the Cloud Account. It must be provided along `secret_key` when this auth mode is used. * `additional_options` - (Optional) The private key generated when creating a new GCP service account key. Must be in JSON format and base64 encoded. ## Attributes Reference