Chore/1333 replace terraform cloud

[joshgamache]

Addresses #1333 - Project link
Adds Terraform scripts and Helm charts to run them. Resource states migrated from Terraform Cloud to a Google Cloud Storage bucket.

Changes 🚧

• Added Terraform module, imported from cas-shelf
• Added Helm templates to handle:
  • Terraform module loading to configMaps
  • OpenShift service account for use by Terraform
  • Terraform apply job

To test 🔬

• The Helm charts are built into the automation around deploys via ShipIt. Once a deploy has been run, you can check the job Terraform-apply in OpenShift to see if the run was successful.

Notes📝

• 🔒 Terraform Cloud state has been locked to enable migration of state to state buckets
• The script has been run and resources have been transitioned from Terraform Cloud to GCP buckets holding state for each namespace (cif-dev, cif-test, cif-prod).
• Resources have been migrated rather than recreated, only the state "owning" the resource changes.
• The resources kubernetes_secret.secret_sa have had Terraform changes, but only the addition of a default value (consistent with our use of them) due to a new provider version.
• The script used for migration (/chart/cas-cif/terraform/tf-migration.sh) is kept here for history. It will be removed by Add directions and script for migration off of Terraform Cloud cas-pipeline#83

[pbastia]

Nice work! A few comments about bash formatting, looks good otherwise.
I'd suggest also:

• moving tf-migration.sh and migration.example.tfvars out of the helm chart, I don't think there is a to have these in there?
• move all the terraform yaml templates to chart/cas-cif/templates/terraform instead of the jobs folder

[joshgamache]

• moving tf-migration.sh and migration.example.tfvars out of the helm chart, I don't think there is a to have these in there?
• move all the terraform yaml templates to chart/cas-cif/templates/terraform instead of the jobs folder

I cleaned up the directories with the suggestions you made. Especially with the service account related file split, it keeps them consistently together.

I removed the migration script entirely, as it is unneeded now that the migrations have been run.

[pbastia]

Slick!

[mikevespi]

Awesome stuff! Leaving it Approved but not merged as per discussion today about merging with eyes on. Aside from that let's make sure we get a tech-debt card to create custom GCP role instead of their generic admin, they over permit.

Great stuff!