Terraform module updates

[asteel-gsa]

This PR encapsulates the necessary changes to upgrade our modules from v1.1.0 to v2.1.0 in sandbox. The process is detailed in the new doc docs/infra/terraform-module-upgrade.md

This will require 1-2 members of the team to do a call and walkthrough exactly what is happening behind the scenes. Once we move this into main, we will need to repeat these steps in preview on a call and ensure everything works the same way. Because we have to import the resource, I believe each environment will need changes to the main.tf file, and it is recommended that we proceed carefully.

My hunch at this time, is to perform these steps locally, run the apply locally, and then open a PR to keep things in sync.

For the new network policy for app -> clamav, I believe we will need to add this into the terraform for non-sandbox envs:

data "cloudfoundry_app" "fac-app" {
    name_or_id = "gsa-fac"
    space      = data.cloudfoundry_space.space.id
}

resource "cloudfoundry_network_policy" "app-network-policy" {
  provider = cloudfoundry-community
  policy {
    source_app      = data.cloudfoundy_app.fac-app.id
    destination_app = module.clamav.app_id
    port            = "61443"
    protocol        = "tcp"
  }
}

[github-actions]

Terraform plan for dev

Plan: 1 to add, 1 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.dev.module.cors.null_resource.cors_header must be replaced
-/+ resource "null_resource" "cors_header" {
!~      id       = "*******************" -> (known after apply)
!~      triggers = { # forces replacement
!~          "always_run" = "2025-03-14T14:22:41Z" -> (known after apply)
        }
    }

  # module.dev.module.https-proxy.cloudfoundry_app.egress_app will be updated in-place
!~  resource "cloudfoundry_app" "egress_app" {
        id                              = "a6eb3870-2769-4aa9-a8f2-f1a31939f563"
        name                            = "https-proxy"
!~      source_code_hash                = "5a8b0befc063a4694d176a8e843be43565ed3f15d6d4fe2c19693d6d10568c25" -> "48b2f5eba8d1f35c0fbc2f90c2ec87cab180f5f19e7e34b16b9190fe5c5ca09a"
#        (21 unchanged attributes hidden)

#        (1 unchanged block hidden)
    }

Plan: 1 to add, 1 to change, 1 to destroy.

✅ Plan applied in Deploy to Development and Management Environment #964

[github-actions]

Terraform plan for meta

No changes. Your infrastructure matches the configuration.

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

✅ Plan applied in Deploy to Development and Management Environment #964

[github-actions]

This pull request is not up to date with main. Please merge main into this brach or rebase this branch onto main. This PR should not be approved until all status checks pass. If you see this message, please rerun all status checks before merging.

[github-actions]

This pull request is not up to date with main. Please merge main into this brach or rebase this branch onto main. This PR should not be approved until all status checks pass. If you see this message, please rerun all status checks before merging.

[github-actions]

This pull request is not up to date with main. Please merge main into this brach or rebase this branch onto main. This PR should not be approved until all status checks pass. If you see this message, please rerun all status checks before merging.

[asteel-gsa]

Currently, we are expecting the meta module to have all of these changes listed in the terraform plan, however, this will not actually be the case.

[10:06 AM][asteel][meta]$ aws s3 ls s3://$BUCKET/
2025-02-14 10:06:59      73829 terraform.tfstate.meta
2025-02-14 10:06:49      76320 terraform.tfstate.meta.newprovider

I have made a backup of the terraform plan that is illustrated here under .newprovider, simply as a means to regenerate the provider files for use with the other environments while I begin prepping them for the upgrade.

As part of the operation, we will need to rerun a terraform plan and terraform apply in meta, on my machine to update the .tfstate before merging this, and that will allow subsequent runs to generate the plan successfully. I have not updated the live state, as a means to not cause meta plans to show incorrectly on other PRs.

[jadudm]

We have tested this code against all lower environments, and carried out the manual update to each env (sandbox, preview, dev, staging, and production). This is documented as part of the commit. This is the final step: merging this into main, and then testing a deploy against each environment.

[github-actions]

Package	Line Rate	Branch Rate	Health
.	100%	100%	✔
api	98%	90%	✔
audit	97%	87%	✔
audit.cross_validation	98%	88%	✔
audit.fixtures	84%	50%	❌
audit.intakelib	88%	82%	➖
audit.intakelib.checks	92%	85%	➖
audit.intakelib.common	98%	82%	✔
audit.intakelib.transforms	100%	95%	✔
audit.management.commands	78%	17%	❌
audit.migrations	100%	100%	✔
audit.models	94%	73%	➖
audit.templatetags	100%	100%	✔
audit.views	72%	54%	❌
census_historical_migration	96%	65%	✔
census_historical_migration.migrations	100%	100%	✔
census_historical_migration.sac_general_lib	92%	84%	➖
census_historical_migration.transforms	95%	90%	✔
census_historical_migration.workbooklib	68%	69%	❌
config	77%	37%	❌
curation	100%	100%	✔
curation.curationlib	93%	100%	➖
curation.migrations	100%	100%	✔
dissemination	92%	72%	➖
dissemination.migrations	97%	25%	✔
dissemination.searchlib	76%	66%	❌
dissemination.templatetags	100%	100%	✔
djangooidc	53%	38%	❌
djangooidc.tests	100%	94%	✔
report_submission	93%	88%	➖
report_submission.migrations	100%	100%	✔
report_submission.templatetags	74%	100%	❌
support	91%	66%	➖
support.migrations	100%	100%	✔
support.models	96%	50%	✔
tools	98%	50%	✔
users	95%	92%	➖
users.fixtures	100%	83%	✔
users.management	100%	100%	✔
users.management.commands	100%	100%	✔
users.migrations	100%	100%	✔
Summary	91% (18503 / 20270)	77% (2277 / 2962)	➖