diff --git a/terraform/aws/app-infrastructure/linkerd/helm.tf b/terraform/aws/app-infrastructure/linkerd/helm.tf index b516e19..a341770 100644 --- a/terraform/aws/app-infrastructure/linkerd/helm.tf +++ b/terraform/aws/app-infrastructure/linkerd/helm.tf @@ -63,10 +63,10 @@ resource "helm_release" "linkerd_control_plane" { chart = var.linkerd_controlplane_chart #"linkerd-control-plane" version = var.linkerd_helm_version - set = [ + set = [ { name = "identityTrustAnchorsPEM" - value = tls_locally_signed_cert.issuer.ca_cert_pem + value = tls_self_signed_cert.ca.cert_pem }, { name = "identity.issuer.tls.crtPEM" @@ -75,15 +75,37 @@ resource "helm_release" "linkerd_control_plane" { { name = "identity.issuer.tls.keyPEM" value = tls_private_key.issuer.private_key_pem + }, + { + name = "priorityClassName" + value = kubernetes_priority_class.linkerd_critical.metadata[0].name + }, + { + name = "enablePodDisruptionBudget" + value = "true" + }, + { + name = "proxyInjector.priorityClassName" + value = kubernetes_priority_class.linkerd_critical.metadata[0].name + }, + { + name = "destination.priorityClassName" + value = kubernetes_priority_class.linkerd_critical.metadata[0].name + }, + { + name = "identity.priorityClassName" + value = kubernetes_priority_class.linkerd_critical.metadata[0].name } ] depends_on = [ - helm_release.linkerd_crds + helm_release.linkerd_crds, + kubernetes_priority_class.linkerd_critical ] } + # deploy linkerd-viz resource "helm_release" "linkerd_viz" { name = "linkerd-viz" @@ -92,5 +114,18 @@ resource "helm_release" "linkerd_viz" { namespace = var.linkerd_viz_namespace_name create_namespace = true version = var.linkerd_helm_version - depends_on = [helm_release.linkerd_crds, helm_release.linkerd_control_plane] + + set = [ + { + name = "priorityClassName" + value = kubernetes_priority_class.linkerd_critical.metadata[0].name + } + ] + depends_on = [ + helm_release.linkerd_crds, + helm_release.linkerd_control_plane, + kubernetes_priority_class.linkerd_critical + ] + + } diff --git a/terraform/aws/app-infrastructure/linkerd/kubernetes.tf b/terraform/aws/app-infrastructure/linkerd/kubernetes.tf new file mode 100644 index 0000000..2da31bb --- /dev/null +++ b/terraform/aws/app-infrastructure/linkerd/kubernetes.tf @@ -0,0 +1,12 @@ +# Priority class to ensure Linkerd components are scheduled before application pods +# This addresses DEV-27: Linkerd scheduling requirements to prevent service mesh injection issues + +resource "kubernetes_priority_class" "linkerd_critical" { + metadata { + name = "linkerd-critical" + } + + value = 1000000 + description = "Priority class for Linkerd service mesh components to ensure they start before application pods during cluster scale operations" + global_default = false +} \ No newline at end of file diff --git a/terraform/aws/app-infrastructure/linkerd/providers.tf b/terraform/aws/app-infrastructure/linkerd/providers.tf index 687e6d1..7cb944b 100644 --- a/terraform/aws/app-infrastructure/linkerd/providers.tf +++ b/terraform/aws/app-infrastructure/linkerd/providers.tf @@ -2,7 +2,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = ">= 6.21.0, < 7.0.0" + version = ">= 5.0, < 7.0.0" } grafana = { source = "grafana/grafana" @@ -22,19 +22,19 @@ terraform { } } - required_version = ">= 1.13.3" + required_version = ">= 1.3.0" } -provider "helm" { - kubernetes = { - host = var.eks_cluster_endpoint # module.eks.cluster_endpoint - cluster_ca_certificate = base64decode(var.cluster_certificate_authority_data) # base64decode(module.eks.cluster_certificate_authority_data) - token = data.aws_eks_cluster_auth.cluster.token - } -} +# provider "helm" { +# kubernetes = { +# host = var.eks_cluster_endpoint # module.eks.cluster_endpoint +# cluster_ca_certificate = base64decode(var.cluster_certificate_authority_data) # base64decode(module.eks.cluster_certificate_authority_data) +# token = data.aws_eks_cluster_auth.cluster.token +# } +# } -provider "kubernetes" { - host = var.eks_cluster_endpoint - cluster_ca_certificate = base64decode(var.cluster_certificate_authority_data) - token = data.aws_eks_cluster_auth.cluster.token -} \ No newline at end of file +# provider "kubernetes" { +# host = var.eks_cluster_endpoint +# cluster_ca_certificate = base64decode(var.cluster_certificate_authority_data) +# token = data.aws_eks_cluster_auth.cluster.token +# } \ No newline at end of file