Support for Terraforming Fleet Teams #18750

yoderme · 2024-05-03T21:57:37Z

This project adds support for terraforming teams in Fleet. If you have 100+ teams, managing them is is prone to error, mistakes, lost configuration, and general pain. An industry standard tool like terraform can unify this configuration as code.

In order to do this, I wrote a terraform provider that on one end talks to the Fleet api, and on the other end implements an interface for terraform. More information is in the README.

A small sample main.tf file is supplied.

This project adds support for terraforming teams in FleetDM. If you have 100+ teams, managing them is is prone to error, mistakes, lost configuration, and general pain. An industry standard tool like terraform can unify this configuration as code. In order to do this, I wrote a terraform provider that on one end talks to the FleetDM api, and on the other end implements an interface for terraform. More information is in the README. A small sample `main.tf` file is supplied.

tools/terraform/go.mod

@@ -0,0 +1,66 @@
+module terraform-provider-fleetdm


ghernandez345 · 2024-05-06T16:37:04Z

@yoderme thanks for the PR! I'll reach out to some of the devs to get some feedback for you.

edwardsb · 2024-05-08T03:06:18Z

@yoderme thanks for the the contribution, this is really awesome. I had some initial thoughts that I'd like to just lay out here for open discussion.

At first I was wonder why you might opt to redefine a client implementation(rather than pull in a dependency via go.mod) of teams because I think our client already has support for the required APIs (create, read, update, delete), but then I remembered a couple of issues I ran into doing something similar on another project which I will detail below.

Here is the project I was working on https://github.com/edwardsb/fleet-lambda-packager/blob/main/main.go#L60 and the client usage. There were a few hurdles getting to this point.

we don't consistently tag the repository with go mod compliant version strings. Last compliant tag is v4.43.4 where the latest release is v4.49.3. This is fairly easy to remedy, but I thought I'd call it out.
https://github.com/fleetdm/fleet/releases/tag/v4.43.4
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.49.3
go get github.com/fleetdm/fleet/[email protected] doesn't even work (I think this is because the repository is too big and the module proxy refuses to cache it). The last version I could get working is the one in the project above, even after running go mod list -m github.com/fleetdm/fleet/[email protected]:

go get github.com/fleetdm/fleet/[email protected]
go: downloading github.com/fleetdm/fleet/v4 v4.43.4
go: github.com/fleetdm/fleet/[email protected]: verifying module: github.com/fleetdm/fleet/[email protected]: reading https://sum.golang.org/lookup/github.com/fleetdm/fleet/[email protected]: 404 Not Found
        server response: not found:

So after painfully remembering all of this I now better understand why it might have been easier just to re-implement the small API required for teams, but it does give us something to think about. We might want to consider properly pulling the service/client into its own module so it can be properly published and depended on (for cases just like this). However I don't think that should be a blocker for this PR.

The other thing I'd like to bring up was that we were considering pulling the terraform modules into its own repository for a variety of reasons #18191. Which makes me wonder if we should also consider having custom providers live there too? This sounds like another solid +1 for proper go.mod support.

Anyways, this was a long-winded way of saying LGTM!

yoderme · 2024-05-09T18:11:33Z

why you might opt to redefine a client implementation

@edwardsb - The embarrassing answer is that I didn't realize it existed. I saw the API and went from there.

I guess I accidentally avoided the issue you ran into.

I'm actually a big fan of monorepos, IMHO having multiple repositories wandering around leads to fragmentation, chaos, and means that you may have to re-implement repo-wide policies/tooling. But anyway, I would note that there is "terraform for creating a fleetdm server", and there is "terraform of config in that server" and they are entirely different things.

Lastly - what's up with all the failing PR checks, and is there anything I can do to address them?

edwardsb · 2024-05-09T18:27:36Z

@yoderme

I guess I accidentally avoided the issue you ran into.

Ha! Well that works too! I'd like to use the existing client but we aren't in a position to do so, which is why I think the small re-implementation shouldn't be a blocker.

I'm actually a big fan of monorepos, IMHO having multiple repositories wandering around leads to fragmentation, chaos, and means that you may have to re-implement repo-wide policies/tooling. But anyway, I would note that there is "terraform for creating a fleetdm server", and there is "terraform of config in that server" and they are entirely different things.

Generally I am too, but in our case terraform doesn't handle monorepos very well (most of the details are outlined in the issue I linked) but each module we define ends up separately cloning the fleet repo, which turns into dozens of GBs of code in .terraform.

Lastly - what's up with all the failing PR checks, and is there anything I can do to address them?

I think most are due to the fact that the PR is coming from a fork and your fork doesn't have permissions and secrets that are required.

yoderme · 2024-05-10T20:55:42Z

@edwardsb Thanks for all the comments - so what are my next steps here? Thanks a bunch.

edwardsb · 2024-05-11T01:58:27Z

@edwardsb Thanks for all the comments - so what are my next steps here? Thanks a bunch.

Someone from the approved code owners needs to approve. @lukeheath @rfairburn when y'all have a chance to check this out and review the discussion so far.

lukeheath · 2024-05-13T14:58:29Z

@yoderme Thank you for your contribution! We are currently in a merge freeze as we prepare for Fleet v4.50.0, but we'll finish reviewing your PR and merge after the freeze is lifted later this week.

yoderme · 2024-06-11T20:19:36Z

@lukeheath Any news on when this might land?

lukeheath · 2024-06-11T21:50:21Z

@yoderme Apologies for the delay and thank you for following up. We are now out of merge freeze and I will ask for a review from the Go group.

mna

Looks great! Most of my comments refer to the fleet client helper as I'm not familiar with the implementation of a terraform provider (and the provider's code otherwise looked good to me).

tools/terraform/fleetdm_client/fleetdm_client.go

tools/terraform/fleetdm_client/fleetdm_client_test.go

mna · 2024-06-12T12:48:49Z

tools/terraform/go.mod

@@ -0,0 +1,66 @@
+module terraform-provider-fleetdm


Wondering if we should use a more typical github.com/fleetdm/fleet/... module path here? Not totally sure what the implications are, but I found it weird when I saw the unfamiliar import syntax for that package. Might be totally ok, just raising in case others have more info on this.

Happy to change it if you like

I think it's fine, we can always change it later if we see it causes issues.

tools/terraform/provider/provider.go

tools/terraform/provider/provider_test.go

tools/terraform/provider/teams_resource.go

yoderme · 2024-06-13T05:23:04Z

@mna - thanks for the great comments; addressed basically all your feedback.

mna

Thank you! The Go code looks good to me!

mna · 2024-06-17T13:03:51Z

tools/terraform/go.mod

@@ -0,0 +1,66 @@
+module terraform-provider-fleetdm


I think it's fine, we can always change it later if we see it causes issues.

noahtalerman · 2024-06-20T18:51:33Z

Hey @lukeheath do you think we need to bring a story for this through feature fest? Maybe not?

(pulling the ~feature fest label off of this PR)

It's not a change to the product but increases surface area we commit to maintaining (another way to manage Fleet as code along side Fleet's best practice GitOps)

I think up to you.

noahtalerman · 2024-06-20T18:52:24Z

FYI @nonpunctual ^

nonpunctual · 2024-06-20T18:56:03Z

I guess since it's community-sourced maybe our ongoing effort to keep it up-to-date is not as high as a product designed & built by Fleet? It's a good point @noahtalerman & it kind of means making a decision about how to maintain external contributions.

lukeheath · 2024-06-20T19:46:50Z

Our recommended best practice for managing teams at scale is Fleet with GitOps. However, GitOps may not work for everyone, so this is a valuable alternative that allows Terraform users not using GitOps to manage teams programatically.

@yoderme Thank you for your contribution!

yoderme requested a review from a team as a code owner May 3, 2024 21:57

yoderme had a problem deploying to Docker Hub May 3, 2024 21:57 — with GitHub Actions Failure

github-advanced-security bot found potential problems May 3, 2024

View reviewed changes

lukeheath requested a review from a team May 6, 2024 16:05

rfairburn previously approved these changes May 11, 2024

View reviewed changes

nonpunctual added ~csa Issue was created by or deemed important by the Customer Solutions Architect. ~feature fest Will be reviewed at next Feature Fest customer-rocher labels Jun 11, 2024

edwardsb previously approved these changes Jun 11, 2024

View reviewed changes

Merge branch 'main' into myoder/terraform-teams

3c135c7

nonpunctual had a problem deploying to Docker Hub June 12, 2024 02:22 — with GitHub Actions Failure

mna reviewed Jun 12, 2024

View reviewed changes

Thanks for the great review feedback

a183b42

yoderme dismissed stale reviews from rfairburn and edwardsb via a183b42 June 13, 2024 05:21

yoderme had a problem deploying to Docker Hub June 13, 2024 05:21 — with GitHub Actions Failure

mna approved these changes Jun 17, 2024

View reviewed changes

noahtalerman changed the title ~~Support for Terraforming FleetDM Teams~~ Support for Terraforming Fleet Teams Jun 20, 2024

noahtalerman removed the ~feature fest Will be reviewed at next Feature Fest label Jun 20, 2024

lukeheath merged commit c7ea012 into fleetdm:main Jun 20, 2024
11 of 16 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support for Terraforming Fleet Teams #18750

Support for Terraforming Fleet Teams #18750

yoderme commented May 3, 2024 •

edited by noahtalerman

Loading

ghernandez345 commented May 6, 2024

edwardsb commented May 8, 2024

yoderme commented May 9, 2024

edwardsb commented May 9, 2024

yoderme commented May 10, 2024

edwardsb commented May 11, 2024

lukeheath commented May 13, 2024

yoderme commented Jun 11, 2024

lukeheath commented Jun 11, 2024

mna left a comment

mna Jun 12, 2024

yoderme Jun 13, 2024

mna Jun 17, 2024

yoderme commented Jun 13, 2024

mna left a comment

mna Jun 17, 2024

noahtalerman commented Jun 20, 2024 •

edited

Loading

noahtalerman commented Jun 20, 2024

nonpunctual commented Jun 20, 2024 •

edited

Loading

lukeheath commented Jun 20, 2024

Support for Terraforming Fleet Teams #18750

Support for Terraforming Fleet Teams #18750

Conversation

yoderme commented May 3, 2024 • edited by noahtalerman Loading

ghernandez345 commented May 6, 2024

edwardsb commented May 8, 2024

yoderme commented May 9, 2024

edwardsb commented May 9, 2024

yoderme commented May 10, 2024

edwardsb commented May 11, 2024

lukeheath commented May 13, 2024

yoderme commented Jun 11, 2024

lukeheath commented Jun 11, 2024

mna left a comment

Choose a reason for hiding this comment

mna Jun 12, 2024

Choose a reason for hiding this comment

yoderme Jun 13, 2024

Choose a reason for hiding this comment

mna Jun 17, 2024

Choose a reason for hiding this comment

yoderme commented Jun 13, 2024

mna left a comment

Choose a reason for hiding this comment

mna Jun 17, 2024

Choose a reason for hiding this comment

noahtalerman commented Jun 20, 2024 • edited Loading

noahtalerman commented Jun 20, 2024

nonpunctual commented Jun 20, 2024 • edited Loading

lukeheath commented Jun 20, 2024

yoderme commented May 3, 2024 •

edited by noahtalerman

Loading

noahtalerman commented Jun 20, 2024 •

edited

Loading

nonpunctual commented Jun 20, 2024 •

edited

Loading