Merge pull request #29 from HideyoshiSolutions/staging
Staging - Implements TLS Configuration
This commit is contained in:
GitHub
@@ -1,9 +1,9 @@
|
|||||||
terraform {
|
terraform {
|
||||||
required_providers {
|
required_providers {
|
||||||
aws = {
|
aws = {
|
||||||
source = "hashicorp/aws"
|
source = "hashicorp/aws"
|
||||||
version = "5.17.0"
|
version = "5.17.0"
|
||||||
configuration_aliases = [ aws.main ]
|
configuration_aliases = [aws.main]
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -12,16 +12,16 @@ terraform {
|
|||||||
# S3 Bucket
|
# S3 Bucket
|
||||||
|
|
||||||
resource "aws_s3_bucket" "default" {
|
resource "aws_s3_bucket" "default" {
|
||||||
bucket = "${var.project_name}-bucket"
|
bucket = "${var.project_name}-bucket"
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_s3_bucket_public_access_block" "bucket_public_disabled" {
|
resource "aws_s3_bucket_public_access_block" "bucket_public_disabled" {
|
||||||
bucket = aws_s3_bucket.default.id
|
bucket = aws_s3_bucket.default.id
|
||||||
|
|
||||||
block_public_acls = false
|
block_public_acls = false
|
||||||
block_public_policy = false
|
block_public_policy = false
|
||||||
ignore_public_acls = false
|
ignore_public_acls = false
|
||||||
restrict_public_buckets = false
|
restrict_public_buckets = false
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_s3_bucket_ownership_controls" "s3_bucket_acl_ownership" {
|
resource "aws_s3_bucket_ownership_controls" "s3_bucket_acl_ownership" {
|
||||||
@@ -33,15 +33,15 @@ resource "aws_s3_bucket_ownership_controls" "s3_bucket_acl_ownership" {
|
|||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_s3_bucket_acl" "default" {
|
resource "aws_s3_bucket_acl" "default" {
|
||||||
bucket = aws_s3_bucket.default.id
|
bucket = aws_s3_bucket.default.id
|
||||||
acl = "private"
|
acl = "private"
|
||||||
depends_on = [aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership]
|
depends_on = [aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership]
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_s3_bucket_policy" "default" {
|
resource "aws_s3_bucket_policy" "default" {
|
||||||
bucket = aws_s3_bucket.default.id
|
bucket = aws_s3_bucket.default.id
|
||||||
depends_on = [aws_s3_bucket_public_access_block.bucket_public_disabled]
|
depends_on = [aws_s3_bucket_public_access_block.bucket_public_disabled]
|
||||||
policy = <<POLICY
|
policy = <<POLICY
|
||||||
{
|
{
|
||||||
"Version": "2012-10-17",
|
"Version": "2012-10-17",
|
||||||
"Statement": [
|
"Statement": [
|
||||||
@@ -69,11 +69,11 @@ POLICY
|
|||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_s3_bucket_cors_configuration" "default" {
|
resource "aws_s3_bucket_cors_configuration" "default" {
|
||||||
bucket = aws_s3_bucket.default.bucket
|
bucket = aws_s3_bucket.default.bucket
|
||||||
|
|
||||||
cors_rule {
|
cors_rule {
|
||||||
allowed_headers = ["*"]
|
allowed_headers = ["*"]
|
||||||
allowed_methods = ["GET", "PUT", "POST", "DELETE", "HEAD"]
|
allowed_methods = ["GET", "PUT", "POST", "DELETE", "HEAD"]
|
||||||
allowed_origins = ["${var.project_domain}"]
|
allowed_origins = ["https://${var.project_domain}"]
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,166 +1,166 @@
|
|||||||
terraform {
|
terraform {
|
||||||
required_providers {
|
required_providers {
|
||||||
aws = {
|
aws = {
|
||||||
source = "hashicorp/aws"
|
source = "hashicorp/aws"
|
||||||
version = "5.17.0"
|
version = "5.17.0"
|
||||||
configuration_aliases = [ aws.main ]
|
configuration_aliases = [aws.main]
|
||||||
}
|
|
||||||
tls = {
|
|
||||||
source = "hashicorp/tls"
|
|
||||||
version = "3.1.0"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
tls = {
|
||||||
|
source = "hashicorp/tls"
|
||||||
|
version = "3.1.0"
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
# TERRAFORM SSH KEYS
|
# TERRAFORM SSH KEYS
|
||||||
|
|
||||||
resource "tls_private_key" "terraform_ssh_key" {
|
resource "tls_private_key" "terraform_ssh_key" {
|
||||||
algorithm = "RSA"
|
algorithm = "RSA"
|
||||||
rsa_bits = 4096
|
rsa_bits = 4096
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
# EC2 Instances
|
# EC2 Instances
|
||||||
|
|
||||||
resource "aws_key_pair" "ssh_key_main" {
|
resource "aws_key_pair" "ssh_key_main" {
|
||||||
key_name = "${var.project_name}_ssh_key_main"
|
key_name = "${var.project_name}_ssh_key_main"
|
||||||
public_key = var.ssh_public_key_main
|
public_key = var.ssh_public_key_main
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_key_pair" "ssh_key_ci_cd" {
|
resource "aws_key_pair" "ssh_key_ci_cd" {
|
||||||
key_name = "${var.project_name}_ssh_key_ci_cd"
|
key_name = "${var.project_name}_ssh_key_ci_cd"
|
||||||
public_key = var.ssh_public_key_ci_cd
|
public_key = var.ssh_public_key_ci_cd
|
||||||
}
|
}
|
||||||
|
|
||||||
locals {
|
locals {
|
||||||
rules_in = [
|
rules_in = [
|
||||||
# { "port": 22, "protocol": "tcp" },
|
# { "port": 22, "protocol": "tcp" },
|
||||||
# { "port": 80, "protocol": "tcp" },
|
# { "port": 80, "protocol": "tcp" },
|
||||||
# { "port": 443, "protocol": "tcp" },
|
# { "port": 443, "protocol": "tcp" },
|
||||||
# { "port": 6080, "protocol": "tcp" },
|
# { "port": 6080, "protocol": "tcp" },
|
||||||
# { "port": 6443, "protocol": "tcp" },
|
# { "port": 6443, "protocol": "tcp" },
|
||||||
# { "port": 10250, "protocol": "tcp" },
|
# { "port": 10250, "protocol": "tcp" },
|
||||||
{ "port": 0, "protocol": "-1" },
|
{ "port" : 0, "protocol" : "-1" },
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_security_group" "project_pool" {
|
resource "aws_security_group" "project_pool" {
|
||||||
name = "${var.project_name}_pool_security_group"
|
name = "${var.project_name}_pool_security_group"
|
||||||
description = "Security group for project pool"
|
description = "Security group for project pool"
|
||||||
|
|
||||||
dynamic "ingress" {
|
dynamic "ingress" {
|
||||||
for_each = toset(local.rules_in)
|
for_each = toset(local.rules_in)
|
||||||
content {
|
content {
|
||||||
from_port = ingress.value["port"]
|
from_port = ingress.value["port"]
|
||||||
to_port = ingress.value["port"]
|
to_port = ingress.value["port"]
|
||||||
protocol = ingress.value["protocol"]
|
protocol = ingress.value["protocol"]
|
||||||
cidr_blocks = ["0.0.0.0/0"]
|
cidr_blocks = ["0.0.0.0/0"]
|
||||||
ipv6_cidr_blocks = ["::/0"]
|
ipv6_cidr_blocks = ["::/0"]
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
egress {
|
egress {
|
||||||
from_port = 0
|
from_port = 0
|
||||||
to_port = 0
|
to_port = 0
|
||||||
protocol = "-1"
|
protocol = "-1"
|
||||||
cidr_blocks = ["0.0.0.0/0"]
|
cidr_blocks = ["0.0.0.0/0"]
|
||||||
ipv6_cidr_blocks = ["::/0"]
|
ipv6_cidr_blocks = ["::/0"]
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_instance" "main" {
|
resource "aws_instance" "main" {
|
||||||
ami = "ami-0af6e9042ea5a4e3e"
|
ami = "ami-0af6e9042ea5a4e3e"
|
||||||
instance_type = "t2.micro"
|
instance_type = "t2.micro"
|
||||||
vpc_security_group_ids = [ aws_security_group.project_pool.id ]
|
vpc_security_group_ids = [aws_security_group.project_pool.id]
|
||||||
|
|
||||||
key_name = aws_key_pair.ssh_key_main.key_name
|
key_name = aws_key_pair.ssh_key_main.key_name
|
||||||
|
|
||||||
user_data = templatefile("${path.module}/scripts/setup_server.sh", {
|
user_data = templatefile("${path.module}/scripts/setup_server.sh", {
|
||||||
extra_key = aws_key_pair.ssh_key_ci_cd.public_key
|
extra_key = aws_key_pair.ssh_key_ci_cd.public_key
|
||||||
terraform_key = tls_private_key.terraform_ssh_key.public_key_openssh
|
terraform_key = tls_private_key.terraform_ssh_key.public_key_openssh
|
||||||
})
|
})
|
||||||
|
|
||||||
provisioner "remote-exec" {
|
provisioner "remote-exec" {
|
||||||
connection {
|
connection {
|
||||||
type = "ssh"
|
type = "ssh"
|
||||||
user = "ubuntu"
|
user = "ubuntu"
|
||||||
agent = false
|
agent = false
|
||||||
private_key = tls_private_key.terraform_ssh_key.private_key_pem
|
private_key = tls_private_key.terraform_ssh_key.private_key_pem
|
||||||
host = self.public_ip
|
host = self.public_ip
|
||||||
}
|
|
||||||
|
|
||||||
inline = [
|
|
||||||
"sudo /bin/dd if=/dev/zero of=/var/swap.1 bs=1M count=1024",
|
|
||||||
"sudo /sbin/mkswap /var/swap.1",
|
|
||||||
"sudo chmod 600 /var/swap.1",
|
|
||||||
"sudo /sbin/swapon /var/swap.1",
|
|
||||||
"echo 'curl -sfL https://get.k3s.io | K3S_TOKEN=\"${var.k3s_token}\" K3S_KUBECONFIG_MODE=644 INSTALL_K3S_EXEC=\"server --disable=traefik\" sh -' >> /home/ubuntu/setup.sh",
|
|
||||||
"echo 'mkdir /home/ubuntu/.kube' >> /home/ubuntu/setup.sh",
|
|
||||||
"echo 'sudo chmod 644 /etc/rancher/k3s/k3s.yaml' >> /home/ubuntu/setup.sh",
|
|
||||||
"echo 'cp /etc/rancher/k3s/k3s.yaml /home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/setup.sh",
|
|
||||||
"echo 'export KUBECONFIG=/home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/.profile",
|
|
||||||
"chmod +x /home/ubuntu/setup.sh",
|
|
||||||
"exec /home/ubuntu/setup.sh | tee logs.txt",
|
|
||||||
]
|
|
||||||
}
|
}
|
||||||
|
|
||||||
tags = {
|
inline = [
|
||||||
Name = "${var.project_name}-main"
|
"sudo /bin/dd if=/dev/zero of=/var/swap.1 bs=1M count=1024",
|
||||||
}
|
"sudo /sbin/mkswap /var/swap.1",
|
||||||
|
"sudo chmod 600 /var/swap.1",
|
||||||
|
"sudo /sbin/swapon /var/swap.1",
|
||||||
|
"echo 'curl -sfL https://get.k3s.io | K3S_TOKEN=\"${var.k3s_token}\" K3S_KUBECONFIG_MODE=644 INSTALL_K3S_EXEC=\"server --disable=traefik --tls-san=${var.project_domain}\" sh -' >> /home/ubuntu/setup.sh",
|
||||||
|
"echo 'mkdir /home/ubuntu/.kube' >> /home/ubuntu/setup.sh",
|
||||||
|
"echo 'sudo chmod 644 /etc/rancher/k3s/k3s.yaml' >> /home/ubuntu/setup.sh",
|
||||||
|
"echo 'cp /etc/rancher/k3s/k3s.yaml /home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/setup.sh",
|
||||||
|
"echo 'export KUBECONFIG=/home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/.profile",
|
||||||
|
"chmod +x /home/ubuntu/setup.sh",
|
||||||
|
"exec /home/ubuntu/setup.sh | tee logs.txt",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
tags = {
|
||||||
|
Name = "${var.project_name}-main"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "aws_instance" "worker" {
|
resource "aws_instance" "worker" {
|
||||||
ami = "ami-0af6e9042ea5a4e3e"
|
ami = "ami-0af6e9042ea5a4e3e"
|
||||||
instance_type = "t2.micro"
|
instance_type = "t2.micro"
|
||||||
vpc_security_group_ids = [ aws_security_group.project_pool.id ]
|
vpc_security_group_ids = [aws_security_group.project_pool.id]
|
||||||
count = var.number_of_workers
|
count = var.number_of_workers
|
||||||
|
|
||||||
key_name = aws_key_pair.ssh_key_main.key_name
|
key_name = aws_key_pair.ssh_key_main.key_name
|
||||||
|
|
||||||
user_data = templatefile("${path.module}/scripts/setup_server.sh", {
|
user_data = templatefile("${path.module}/scripts/setup_server.sh", {
|
||||||
extra_key = aws_key_pair.ssh_key_ci_cd.public_key
|
extra_key = aws_key_pair.ssh_key_ci_cd.public_key
|
||||||
terraform_key = tls_private_key.terraform_ssh_key.public_key_openssh
|
terraform_key = tls_private_key.terraform_ssh_key.public_key_openssh
|
||||||
})
|
})
|
||||||
|
|
||||||
provisioner "remote-exec" {
|
provisioner "remote-exec" {
|
||||||
connection {
|
connection {
|
||||||
type = "ssh"
|
type = "ssh"
|
||||||
user = "ubuntu"
|
user = "ubuntu"
|
||||||
agent = false
|
agent = false
|
||||||
private_key = tls_private_key.terraform_ssh_key.private_key_pem
|
private_key = tls_private_key.terraform_ssh_key.private_key_pem
|
||||||
host = self.public_ip
|
host = self.public_ip
|
||||||
}
|
|
||||||
|
|
||||||
inline = [
|
|
||||||
"sudo /bin/dd if=/dev/zero of=/var/swap.1 bs=1M count=1024",
|
|
||||||
"sudo /sbin/mkswap /var/swap.1",
|
|
||||||
"sudo chmod 600 /var/swap.1",
|
|
||||||
"sudo /sbin/swapon /var/swap.1",
|
|
||||||
"echo 'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC=\"agent\" K3S_TOKEN=\"${var.k3s_token}\" K3S_URL=\"${var.project_domain}:6443\" sh -s -' >> /home/ubuntu/setup.sh",
|
|
||||||
"chmod +x /home/ubuntu/setup.sh",
|
|
||||||
"while ! nc -z ${aws_instance.main.public_ip} 6443; do sleep 0.1; done",
|
|
||||||
"exec /home/ubuntu/setup.sh | tee logs.txt",
|
|
||||||
]
|
|
||||||
}
|
}
|
||||||
|
|
||||||
tags = {
|
inline = [
|
||||||
Name = "${var.project_name}-worker-${count.index+1}"
|
"sudo /bin/dd if=/dev/zero of=/var/swap.1 bs=1M count=1024",
|
||||||
}
|
"sudo /sbin/mkswap /var/swap.1",
|
||||||
|
"sudo chmod 600 /var/swap.1",
|
||||||
|
"sudo /sbin/swapon /var/swap.1",
|
||||||
|
"echo 'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC=\"agent\" K3S_TOKEN=\"${var.k3s_token}\" K3S_URL=\"https://${var.project_domain}:6443\" sh -s -' >> /home/ubuntu/setup.sh",
|
||||||
|
"chmod +x /home/ubuntu/setup.sh",
|
||||||
|
"while ! nc -z ${aws_instance.main.public_ip} 6443; do sleep 0.1; done",
|
||||||
|
"exec /home/ubuntu/setup.sh | tee logs.txt",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
tags = {
|
||||||
|
Name = "${var.project_name}-worker-${count.index + 1}"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
# OUTPUTS
|
# OUTPUTS
|
||||||
|
|
||||||
output "pool_master_public_ip" {
|
output "pool_master_public_ip" {
|
||||||
value = aws_instance.main.public_ip
|
value = aws_instance.main.public_ip
|
||||||
}
|
}
|
||||||
|
|
||||||
output "pool_master_instance" {
|
output "pool_master_instance" {
|
||||||
value = aws_instance.main
|
value = aws_instance.main
|
||||||
}
|
}
|
||||||
|
|
||||||
output "pool_worker_instances" {
|
output "pool_worker_instances" {
|
||||||
value = aws_instance.worker
|
value = aws_instance.worker
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user