feat: Deploy Keys as Optional and GitHub Apps #42
Conversation
WalkthroughAdds .gitignore entry for account-map/. Normalizes README whitespace. Introduces GitHub authentication switch: new github_deploy_keys_enabled variable, updates data source gating, main logic for repo URLs/credentials, Helm values template conditionals, and passes GitHub App IDs. Hardens notifications webhook iteration. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant TF as Terraform Module
participant TPL as Helm Values Template
participant ARGO as Argo CD
participant GH as GitHub
rect rgba(230,240,255,0.4)
note over TF: Input vars: github_deploy_keys_enabled, github_app_id, github_app_installation_id
TF->>TF: Compute locals and repo list
alt github_deploy_keys_enabled == true
TF->>TF: Use SSH clone URLs<br/>Load SSM deploy keys
TF->>TPL: Pass sshPrivateKeySecret per repo
else
TF->>TF: Use HTTPS clone URLs<br/>Use GitHub App IDs/secret
TF->>TPL: Pass githubAppID/InstallationID and private key secret
end
end
TPL-->>TF: Rendered values.yaml
TF-->>ARGO: Install/Upgrade Helm release with values
alt Deploy Keys
ARGO->>GH: Git over SSH using deploy key
else GitHub App
ARGO->>GH: HTTPS with GitHub App token minted from private key
end
note over ARGO,GH: Repos synced per selected auth method
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Important Do not edit the Please update the Could you fix it @milldr? 🙏 |
|
/terratest |
milldr
added
minor
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
src/data.tf (1)
29-41: for_each/name gating mismatch will crash when enabled=false.for_each now ignores local.enabled but name still depends on it, and module.argocd_repo outputs won’t exist when disabled. Gate on both.
-data "aws_ssm_parameter" "github_deploy_key" { - for_each = local.github_deploy_keys_enabled ? var.argocd_repositories : {} +data "aws_ssm_parameter" "github_deploy_key" { + for_each = (local.enabled && local.github_deploy_keys_enabled) ? var.argocd_repositories : {} - name = local.enabled ? format( + name = format( module.argocd_repo[each.key].outputs.deploy_keys_ssm_path_format, format( "${module.this.tenant != null ? "%[1]s/" : ""}%[2]s-%[3]s${length(module.this.attributes) > 0 ? "-%[4]s" : "%[4]s"}", module.this.tenant, module.this.environment, module.this.stage, join("-", module.this.attributes) ) - ) : null + )src/main.tf (1)
18-71: Unify gating for GitHub App private key data source
Thedata.aws_ssm_parameter.github_app_private_keyresource is only created whenlocal.create_github_webhook && var.github_app_enabledis true (provider-github.tf:35), but it’s referenced in main.tf wheneverlocal.github_deploy_keys_enabledis false (main.tf:37), leading to potential index-out-of-range errors. Ensure both creation and usage share the same condition.
🧹 Nitpick comments (2)
src/variables-argocd.tf (1)
219-251: Add validations for GitHub App parameters and mutually exclusive auth.Guard against misconfiguration at plan time.
variable "github_deploy_keys_enabled" { type = bool default = true description = <<-EOT Enable GitHub deploy keys for the repository. These are used for Argo CD application syncing. Alternatively, you can use a GitHub App to access this desired state repository configured with `var.github_app_enabled`, `var.github_app_id`, and `var.github_app_installation_id`. EOT + validation { + condition = var.github_deploy_keys_enabled || var.github_app_enabled + error_message = "Enable at least one auth method: github_deploy_keys_enabled or github_app_enabled." + } } variable "github_app_enabled" { type = bool description = "Whether to use GitHub App authentication for Argo CD repositories both for webhooks and syncing (depending on `var.github_deploy_keys_enabled`)" default = false } variable "github_app_id" { type = string description = "The ID of the GitHub App to use for Argo CD repository authentication" default = null + validation { + condition = !var.github_app_enabled || (try(length(trimspace(var.github_app_id)) > 0, false)) + error_message = "github_app_id must be set when github_app_enabled is true." + } } variable "github_app_installation_id" { type = string description = "The Installation ID of the GitHub App to use for Argo CD repository authentication" default = null + validation { + condition = !var.github_app_enabled || (try(length(trimspace(var.github_app_installation_id)) > 0, false)) + error_message = "github_app_installation_id must be set when github_app_enabled is true." + } } variable "ssm_github_app_private_key" { type = string description = "SSM path to the GitHub App private key for Argo CD repository authentication" default = "/argocd/github/app_private_key" + validation { + condition = !var.github_app_enabled || (try(length(trimspace(var.ssm_github_app_private_key)) > 0, false)) + error_message = "ssm_github_app_private_key must be set when github_app_enabled is true." + } }src/resources/argocd-values.yaml.tpl (1)
31-31: Parameterize ingressClassName.Hardcoding "alb-argocd-ext" reduces reuse. Suggest passing via a variable (defaulting to prior "alb") to avoid breaking existing clusters.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (10)
.gitignore(1 hunks)src/README.md(1 hunks)src/data.tf(1 hunks)src/main.tf(2 hunks)src/notifications.tf(1 hunks)src/provider-github.tf(2 hunks)src/provider-helm.tf(1 hunks)src/remote-state.tf(4 hunks)src/resources/argocd-values.yaml.tpl(3 hunks)src/variables-argocd.tf(1 hunks)
🧰 Additional context used
📓 Path-based instructions (4)
**/*.tf
📄 CodeRabbit inference engine (AGENTS.md)
**/*.tf: Use 2-space indentation for all Terraform files
In Terraform, prefer lower_snake_case for variables and locals; keep resource and data source names descriptive and aligned with Cloud Posse null-label patterns
Run terraform fmt and do not commit formatting violations
Adhere to TFLint rules defined in .tflint.hcl; do not commit lint violations
Files:
src/provider-helm.tfsrc/data.tfsrc/notifications.tfsrc/variables-argocd.tfsrc/remote-state.tfsrc/main.tfsrc/provider-github.tf
src/README.md
📄 CodeRabbit inference engine (AGENTS.md)
Do not manually edit src/README.md; regenerate it via
atmos docs generate readme-simple
Files:
src/README.md
**/*.md
📄 CodeRabbit inference engine (AGENTS.md)
Use 2-space indentation for Markdown files
Files:
src/README.md
src/{main,variables,outputs,providers,versions,context}.tf
📄 CodeRabbit inference engine (AGENTS.md)
Keep Terraform component source of truth under src/ with these files: main.tf, variables.tf, outputs.tf, providers.tf, versions.tf, context.tf
Files:
src/main.tf
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Summary
🔇 Additional comments (11)
src/remote-state.tf (1)
3-3: Downgrade to remote-state 1.5.0 — confirm compatibility and sync docs.Verify no outputs/behaviors used here changed between 1.8.0 → 1.5.0, and regenerate README to reflect versions.
Also applies to: 12-12, 23-23, 35-35
.gitignore (1)
79-80: LGTM — ignore for account-map.Benign and helps avoid committing local scaffolding.
src/resources/argocd-values.yaml.tpl (2)
15-19: Enabling ServiceMonitors requires CRDs.Confirm Prometheus Operator CRDs are present; otherwise Helm apply will fail on unknown resource kinds.
Also applies to: 22-26, 152-156
96-110: Confirmed: field depends on config format — githubAppPrivateKeySecret is valid in argocd-cm; repo Secrets/credentialTemplates use githubAppPrivateKeyVerified: legacy argocd-cm repository entries accept githubAppPrivateKeySecret (object with name/key). The modern/recommended repository Secret / credentialTemplates expect githubAppPrivateKey as a Secret key (together with githubAppID and githubAppInstallationID). Keep your current snippet if you intend the argocd-cm (legacy) format; otherwise switch to repo Secret / credentialTemplates and use githubAppPrivateKey (ensure secret name/key match).
src/main.tf (3)
8-8: LGTM! New GitHub deploy keys toggle added correctly.The local variable properly derives from the enabled state and input variable following established patterns.
176-178: LGTM! GitHub App configuration variables passed to template.The new variables
github_app_id,github_app_installation_id, andgithub_deploy_keys_enabledare correctly passed to the Helm template for ArgoCD configuration.
11-13: Approve: deploy-key gating and conditional clone URL are correct.The aws_ssm_parameter data source github_deploy_key is conditionally created in src/data.tf (lines 28–31) via for_each = local.github_deploy_keys_enabled ? var.argocd_repositories : {}, so the lookup is only instantiated when deploy keys are enabled; the main.tf conditional can remain as-is.
src/provider-github.tf (4)
42-44: LGTM! Provider configuration properly gated by webhook creation.The GitHub provider is now conditionally configured only when webhooks need to be created. The null values when
Based on the web search results, I can see that Terraform assumes an empty default configuration for any provider that is not explicitly configured, and (If the provider has any required configuration arguments, Terraform will raise an error when resources default to the empty configuration.). However, the GitHub provider in this code is being conditionally configured with null values when `local.create_github_webhook` is false, which should work properly as long as no GitHub resources are being created when the provider is "disabled".local.create_github_webhookis false will effectively disable the provider, which is the intended behavior.
46-53: LGTM! GitHub App authentication properly configured.The dynamic
app_authblock correctly configures GitHub App authentication when both webhook creation and GitHub App are enabled. The conditional logic ensures the block is only included when appropriate.
28-28: Approve — gating logic is correct and complementary. The PAT data source is gated withlocal.create_github_webhook && !var.github_app_enabledand the App private key withlocal.create_github_webhook && var.github_app_enabled— consistent; no change required.
21-24: local.create_github_webhook is defined — no action required.
Defined in src/github_webhook.tf:7 (create_github_webhook = local.github_webhook_enabled && var.create_github_webhook); variable declared at src/github_webhook.tf:22.
|
/terratest |
|
/terratest |
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
src/resources/argocd-values.yaml.tpl (2)
131-149: Duplicate rbacConfig.policy.default — later value overrides the variable.Line 148 sets role:readonly and will override policy.default: ${rbac_default_policy}. Remove the duplicate or guard it behind a conditional.
rbacConfig: policy.default: ${rbac_default_policy} @@ -%{ if saml_enabled == true ~} - scopes: '${saml_rbac_scopes}' -%{ endif ~} - - policy.default: role:readonly +%{ if saml_enabled == true ~} + scopes: '${saml_rbac_scopes}' +%{ endif ~}
141-146: Emit only onescopeskey (choose OIDC or SAML).If both flags are true the template renders two
scopeskeys and the latter wins — use anelse/elifor precompute a singlerbac_scopesvariable.File: src/resources/argocd-values.yaml.tpl Lines: 141-146
-%{ if oidc_enabled == true ~} - scopes: '${oidc_rbac_scopes}' -%{ endif ~} -%{ if saml_enabled == true ~} - scopes: '${saml_rbac_scopes}' -%{ endif ~} +%{ if oidc_enabled == true ~} + scopes: '${oidc_rbac_scopes}' +%{ else ~} +%{ if saml_enabled == true ~} + scopes: '${saml_rbac_scopes}' +%{ endif ~} +%{ endif ~}
🧹 Nitpick comments (3)
src/resources/argocd-values.yaml.tpl (3)
15-18: Metrics + ServiceMonitor enabled for controller/server/repoServer — looks good; verify Prometheus setup.Confirm the cluster has the ServiceMonitor CRD installed and that your Prometheus operator is selecting these ServiceMonitors (label selectors/namespace). Optionally expose additional fields (additionalLabels, scrapeInterval) via variables for flexibility.
Also applies to: 22-25, 152-155
96-110: GitHub App vs deploy‑keys switch: align types/fields and secrets; quote IDs.Looks correct. Please:
- Ensure your Argo CD/chart version supports githubAppID/githubAppInstallationID/githubAppPrivateKeySecret in repository entries.
- Quote numeric IDs to avoid YAML/typing surprises.
- Verify repo URLs switch to SSH when deploy keys are enabled and HTTPS otherwise.
- Ensure the secret argocd-repo-creds-${name} exists with key githubAppPrivateKey (and sshPrivateKey for the SSH path).
Suggested tweak:
- githubAppID: ${github_app_id} - githubAppInstallationID: ${github_app_installation_id} + githubAppID: "${github_app_id}" + githubAppInstallationID: "${github_app_installation_id}"
157-159: Consider enabling ApplicationSet metrics/ServiceMonitor for parity.Optional, but keeps metrics consistent across Argo CD components.
applicationSet: replicas: 2 + metrics: + enabled: true + serviceMonitor: + enabled: true
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
src/resources/argocd-values.yaml.tpl(3 hunks)src/variables-argocd.tf(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- src/variables-argocd.tf
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Summary
|
/terratest |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
src/resources/argocd-values.yaml.tpl (1)
89-99: Emit numeric GitHub App IDs; ensure HTTPS URLs and optionally add GHE support
- Change src/resources/argocd-values.yaml.tpl to emit numeric IDs (remove quotes):
- githubAppID: "${github_app_id}" - githubAppInstallationID: "${github_app_installation_id}" + githubAppID: ${github_app_id} + githubAppInstallationID: ${github_app_installation_id} +%{ if github_app_enterprise_base_url != "" ~} + githubAppEnterpriseBaseUrl: ${github_app_enterprise_base_url} +%{ endif ~}
- Verified: src/main.tf selects repository_http_clone_url when github_deploy_keys_enabled == false (so the template should receive an HTTP/HTTPS clone URL). Confirm those HTTP clone URLs are HTTPS (not SSH-style git@ URLs).
- github_app_enterprise_base_url is not present in the repo; add the variable (e.g. src/variables-argocd.tf) and pass it through if you need GitHub Enterprise support.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
src/resources/argocd-values.yaml.tpl(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Summary
🔇 Additional comments (1)
src/resources/argocd-values.yaml.tpl (1)
133-137: Scopes selection logic is OK; confirm desired behavior when both OIDC and SAML are disabled.Current flow emits OIDC scopes if enabled; otherwise emits SAML scopes if enabled; otherwise emits no
scopes. Verify that “no scopes” is acceptable in your environment.
|
/terratest |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
src/resources/argocd-values.yaml.tpl (2)
86-101: Heads‑up: repositories in argocd-cm are legacy; plan migration to Secret-based registration.Argo CD still honors argocd-cm.data.repositories, but it’s deprecated in favor of repository Secrets labeled argocd.argoproj.io/secret-type: repository. Consider a roadmap to migrate. (argo-cd.readthedocs.io)
86-101: Add optional GitHub Enterprise base URL; wiring & URL-scheme verified
- Verified: src/main.tf selects SSH vs HTTPS via local.github_deploy_keys_enabled (uses repository_ssh_clone_url vs repository_http_clone_url). github_app_id and github_app_installation_id are defined as strings (src/provider-github.tf) and passed into the module (src/main.tf). SSM-sourced private key is wired into Argocd credentialTemplates (src/provider-github.tf, src/main.tf).
- Action: Add a string variable github_app_enterprise_base_url (default ""), expose/pass it through in src/main.tf to the ArgoCD module, and apply the suggested template diff to emit githubAppEnterpriseBaseUrl when set.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
src/resources/argocd-values.yaml.tpl(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Summary
🔇 Additional comments (2)
src/resources/argocd-values.yaml.tpl (2)
131-137: Scopes branching reads clean; confirm precedence when both OIDC and SAML are true.This now prioritizes OIDC; SAML scopes render only if OIDC is disabled. If that’s the intended precedence, no change needed.
121-122: Duplicate policy.default resolved — variable-driven default retained.Thanks for removing the hard-coded override noted previously; only ${rbac_default_policy} remains.
|
/terratest |
|
/terratest |
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (5)
src/provider-github.tf (3)
14-18: Mark token override as sensitivePrevents accidental logging of secrets.
Apply:
variable "github_token_override" { type = string description = "Use the value of this variable as the GitHub token instead of reading it from SSM" default = null + sensitive = true }
1-5: Add validation for GitHub Enterprise base_url trailing slashAvoid subtle provider misconfig due to missing “/”.
Apply:
variable "github_base_url" { type = string description = "This is the target GitHub base API endpoint. Providing a value is a requirement when working with GitHub Enterprise. It is optional to provide this value and it can also be sourced from the `GITHUB_BASE_URL` environment variable. The value must end with a slash, for example: `https://terraformtesting-ghe.westus.cloudapp.azure.com/`" default = null + validation { + condition = var.github_base_url == null || can(regex("/$", var.github_base_url)) + error_message = "github_base_url must end with a trailing slash, e.g. https://ghe.example.com/ ." + } }
20-25: Add validation to ensure App fields are provided when enabledFail fast if
github_app_enabledis true but IDs/key are missing.Apply (two validations; adjust if you colocate elsewhere):
variable "github_app_enabled" { type = bool description = "Whether to use GitHub App authentication instead of PAT" default = false } variable "github_app_id" { - type = number + type = string description = "The ID of the GitHub App to use for authentication" default = null } variable "github_app_installation_id" { - type = number + type = string description = "The Installation ID of the GitHub App to use for authentication" default = null } +validation { + condition = !var.github_app_enabled || (var.github_app_id != null && var.github_app_installation_id != null) + error_message = "When github_app_enabled is true, github_app_id and github_app_installation_id must be set." +}Also applies to: 27-37
src/variables-argocd-notifications.tf (2)
7-12: Add validations for notifications App configurationEnsure required fields when
github_notifications_app_enabledis true.Apply:
variable "github_notifications_app_enabled" { type = bool description = "Whether to use GitHub App authentication for notifications instead of PAT" default = false } variable "github_notifications_app_id" { - type = number + type = string description = "The ID of the GitHub App to use for notifications authentication" default = null } variable "github_notifications_app_installation_id" { - type = number + type = string description = "The Installation ID of the GitHub App to use for notifications authentication" default = null } +validation { + condition = !var.github_notifications_app_enabled || (var.github_notifications_app_id != null && var.github_notifications_app_installation_id != null) + error_message = "When github_notifications_app_enabled is true, both github_notifications_app_id and github_notifications_app_installation_id must be set." +}Also applies to: 14-30
104-108: Nit: fix dangling backtick in descriptionMinor doc polish.
Apply:
variable "slack_notifications_enabled" { type = bool default = false - description = "Whether or not to enable Slack notifications. See `var.slack_notifications." + description = "Whether or not to enable Slack notifications. See `var.slack_notifications`." }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
src/provider-github.tf(1 hunks)src/resources/argocd-values.yaml.tpl(2 hunks)src/variables-argocd-notifications.tf(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- src/resources/argocd-values.yaml.tpl
🧰 Additional context used
📓 Path-based instructions (1)
**/*.tf
📄 CodeRabbit inference engine (AGENTS.md)
**/*.tf: Use 2-space indentation for all Terraform files
In Terraform, prefer lower_snake_case for variables and locals; keep resource and data source names descriptive and aligned with Cloud Posse null-label patterns
Run terraform fmt and do not commit formatting violations
Adhere to TFLint rules defined in .tflint.hcl; do not commit lint violations
Files:
src/variables-argocd-notifications.tfsrc/provider-github.tf
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Summary
🔇 Additional comments (1)
src/provider-github.tf (1)
69-76: No change required — app_auth.id and app_auth.installation_id accept strings
The integrations/github provider treats both fields as strings, so keep your variables as string values and don’t apply tonumber() here.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
src/resources/argocd-values.yaml.tpl (1)
89-99: GitHub App vs Deploy Keys — supported, but add a guard & ensure repo secrets exist
- Confirmed: Argo CD supports credential‑template secret refs (sshPrivateKeySecret, githubAppPrivateKeySecret) and GitHub App fields (githubAppID, githubAppInstallationID); secret-vs-secretref naming differences are documented and both patterns are supported.
- Confirmed: application_repos already emits SSH when deploy keys are enabled and HTTPS otherwise (src/main.tf lines ~9–13).
- Missing artifact: I didn't find creation of argocd-repo-creds-${name} Secrets in this repo — ensure those Secrets are created/managed (module.argocd_repo or external) or switch to repository Secrets if preferred.
- Action: add a guard so the template won't call tonumber(null) / render invalid YAML when GitHub App IDs are unset — the suggested diff is still valid:
-%{ else ~} - githubAppID: ${tonumber(github_app_id)} - githubAppInstallationID: ${tonumber(github_app_installation_id)} - githubAppPrivateKeySecret: - name: argocd-repo-creds-${name} - key: githubAppPrivateKey +%{ else ~} +%{ if can(tonumber(github_app_id)) && can(tonumber(github_app_installation_id)) ~} + githubAppID: ${tonumber(github_app_id)} + githubAppInstallationID: ${tonumber(github_app_installation_id)} + githubAppPrivateKeySecret: + name: argocd-repo-creds-${name} + key: githubAppPrivateKey +%{ else ~} + # GitHub App selected but IDs not provided; skipping credentials to avoid bad config +%{ endif ~}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
src/resources/argocd-values.yaml.tpl(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Summary
🔇 Additional comments (2)
src/resources/argocd-values.yaml.tpl (2)
131-137: Mutually exclusive OIDC/SAML scopes — LGTMThis ensures only one scopes key is emitted and avoids conflicting entries.
If both oidc_enabled and saml_enabled can be true in some envs, confirm OIDC precedence is intended. If neither is enabled, omission of scopes is acceptable for your setup.
121-123: Duplicate policy.default removal — resolvedPrevious hard-coded override was removed; the variable-driven value now wins.
|
/terratest |
github-merge-queue
bot
removed this pull request from the merge queue due to no response for status checks
github-merge-queue
bot
removed this pull request from the merge queue due to no response for status checks
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
|
These changes were released in v2.2.0. |
what
why
references
Summary by CodeRabbit