From a9eb18c332d38dd6d3a2a5b48ca73c856ec27fa8 Mon Sep 17 00:00:00 2001
From: Vitor Hideyoshi <vitor.h.n.batista@gmail.com>
Date: Sat, 23 Sep 2023 06:46:03 -0300
Subject: [PATCH 1/6] Adds AWS Instances to Output

---
 instances/instance.tf             | 27 +++++++++++++---------
 instances/scripts/setup_main.sh   | 12 ----------
 instances/scripts/setup_server.sh |  8 +++++++
 instances/scripts/setup_worker.sh | 14 ------------
 k3s/k3s.tf                        | 38 -------------------------------
 5 files changed, 24 insertions(+), 75 deletions(-)
 delete mode 100644 instances/scripts/setup_main.sh
 create mode 100644 instances/scripts/setup_server.sh
 delete mode 100644 instances/scripts/setup_worker.sh
 delete mode 100644 k3s/k3s.tf

diff --git a/instances/instance.tf b/instances/instance.tf
index f35a028..3bf0d34 100644
--- a/instances/instance.tf
+++ b/instances/instance.tf
@@ -1,11 +1,11 @@
 terraform {
-  required_providers {
-    aws = {
-      source = "hashicorp/aws"
-      version = "5.17.0"
-      configuration_aliases = [ aws.main ]
+    required_providers {
+        aws = {
+            source = "hashicorp/aws"
+            version = "5.17.0"
+            configuration_aliases = [ aws.main ]
+        }
     }
-  }
 }
 
 
@@ -66,9 +66,8 @@ resource "aws_instance" "main" {
 
     key_name = aws_key_pair.ssh_key_main.key_name
 
-    user_data   = templatefile("${path.module}/scripts/setup_main.sh", {
+    user_data   = templatefile("${path.module}/scripts/setup_server.sh", {
         extra_key = aws_key_pair.ssh_key_ci_cd.public_key
-        k3s_token = var.k3s_token
     })
 
     tags = {
@@ -84,10 +83,8 @@ resource "aws_instance" "worker" {
 
     key_name = aws_key_pair.ssh_key_main.key_name
 
-    user_data   = templatefile("${path.module}/scripts/setup_worker.sh", {
+    user_data   = templatefile("${path.module}/scripts/setup_server.sh", {
         extra_key = aws_key_pair.ssh_key_ci_cd.public_key
-        k3s_token = var.k3s_token
-        k3s_cluster_ip = var.project_domain
     })
 
     tags = {
@@ -100,4 +97,12 @@ resource "aws_instance" "worker" {
 
 output "pool_master_public_ip" {
     value = aws_instance.main.public_ip
+}
+
+output "pool_master_instance" {
+    value = aws_instance.main
+}
+
+output "pool_worker_instances" {
+    value = aws_instance.worker
 }
\ No newline at end of file
diff --git a/instances/scripts/setup_main.sh b/instances/scripts/setup_main.sh
deleted file mode 100644
index d7f89c1..0000000
--- a/instances/scripts/setup_main.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash -xe
-
-
-echo -e "\n${extra_key}" >> /home/ubuntu/.ssh/authorized_keys;
-
-echo -e "export TERM='xterm-256color'" >> /home/ubuntu/.profile;
-
-su ubuntu -i << EOF
-# curl -sfL https://get.k3s.io | \
-#         K3S_TOKEN="${k3s_token}" sh -'
-echo "HERE" >> /home/ubuntu/test.txt
-EOF
\ No newline at end of file
diff --git a/instances/scripts/setup_server.sh b/instances/scripts/setup_server.sh
new file mode 100644
index 0000000..5175cd0
--- /dev/null
+++ b/instances/scripts/setup_server.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+
+echo -e "\n${extra_key}" >> /home/ubuntu/.ssh/authorized_keys;
+
+echo "export TERM='xterm-256color';" > /home/ubuntu/.profile;
+
+exit 0;
\ No newline at end of file
diff --git a/instances/scripts/setup_worker.sh b/instances/scripts/setup_worker.sh
deleted file mode 100644
index 7d5ce57..0000000
--- a/instances/scripts/setup_worker.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/bin/bash -xe
-
-
-echo -e "\n${extra_key}" >> /home/ubuntu/.ssh/authorized_keys;
-
-echo "export TERM='xterm-256color'" > /home/ubuntu/.profile;
-
-su ubuntu -i << EOF
-# curl -sfL https://get.k3s.io | \
-#         INSTALL_K3S_EXEC="agent" \
-#         K3S_TOKEN="${k3s_token}" \
-#         sh -s - --server ${k3s_cluster_ip}
-echo "HERE" >> /home/ubuntu/test.txt
-EOF
\ No newline at end of file
diff --git a/k3s/k3s.tf b/k3s/k3s.tf
deleted file mode 100644
index 411c761..0000000
--- a/k3s/k3s.tf
+++ /dev/null
@@ -1,38 +0,0 @@
-module "k3s" {
-  source  = "xunleii/k3s/module"
-  version = "3.3.0"
-  k3s_version = "v1.21.4+k3s1"
-
-  cluster_domain = "civo_k3s"
-
-  drain_timeout            = "60s"
-  managed_fields           = ["label"]
-  generate_ca_certificates = true
-
-  global_flags = [for instance in civo_instance.node_instances : "--tls-san ${instance.public_ip}"]
-
-  servers = {
-    # The node name will be automatically provided by
-    # the module using the field name... any usage of
-    # --node-name in additional_flags will be ignored
-
-    for instance in civo_instance.node_instances :
-    instance.hostname => {
-      ip = instance.private_ip
-      connection = {
-        timeout  = "60s"
-        type     = "ssh"
-        host     = instance.public_ip
-        password = instance.initial_password
-        user     = "root"
-      }
-
-      labels = { "node.kubernetes.io/type" = "master" }
-    }
-  }
-}
-
-output "kube_config" {
-  value     = module.k3s.kube_config
-  sensitive = true
-}
\ No newline at end of file

From 18d6da38cca92f65d980010d08cd45105d622730 Mon Sep 17 00:00:00 2001
From: Vitor Hideyoshi <vitor.h.n.batista@gmail.com>
Date: Sun, 24 Sep 2023 21:14:26 -0300
Subject: [PATCH 2/6] Implementa K3S-Cluster

---
 instances/instance.tf             | 68 +++++++++++++++++++++++++------
 instances/scripts/setup_server.sh |  3 +-
 2 files changed, 57 insertions(+), 14 deletions(-)

diff --git a/instances/instance.tf b/instances/instance.tf
index 3bf0d34..253d87a 100644
--- a/instances/instance.tf
+++ b/instances/instance.tf
@@ -5,10 +5,22 @@ terraform {
             version = "5.17.0"
             configuration_aliases = [ aws.main ]
         }
+        tls = {
+            source = "hashicorp/tls"
+            version = "3.1.0"
+        }
     }
 }
 
 
+# TERRAFORM SSH KEYS
+
+resource "tls_private_key" "terraform_ssh_key" {
+    algorithm = "RSA"
+    rsa_bits = 4096
+}
+
+
 # EC2 Instances
 
 resource "aws_key_pair" "ssh_key_main" {
@@ -29,25 +41,12 @@ locals {
         6443,
         10250
     ]
-    ports_out = [
-        0,
-    ]
 }
 
 resource "aws_security_group" "project_pool" {
     name = "${var.project_name}_pool_security_group"
     description = "Security group for project pool"
 
-    dynamic "egress" {
-        for_each = toset(local.ports_out)
-        content {
-            from_port = egress.value
-            to_port = egress.value
-            protocol = "tcp"
-            cidr_blocks = ["0.0.0.0/0"]
-        }
-    }
-
     dynamic "ingress" {
         for_each = toset(local.ports_in)
         content {
@@ -57,6 +56,15 @@ resource "aws_security_group" "project_pool" {
             cidr_blocks = ["0.0.0.0/0"]
         }
     }
+
+    egress {
+        from_port        = 0
+        to_port          = 0
+        protocol         = "-1"
+        cidr_blocks      = ["0.0.0.0/0"]
+        ipv6_cidr_blocks = ["::/0"]
+    }
+
 }
 
 resource "aws_instance" "main" {
@@ -68,8 +76,25 @@ resource "aws_instance" "main" {
 
     user_data   = templatefile("${path.module}/scripts/setup_server.sh", {
         extra_key = aws_key_pair.ssh_key_ci_cd.public_key
+        terraform_key = tls_private_key.terraform_ssh_key.public_key_openssh
     })
 
+    provisioner "remote-exec" {
+        connection {
+            type        = "ssh"
+            user        = "ubuntu"
+            agent       = false
+            private_key = tls_private_key.terraform_ssh_key.private_key_pem
+            host        = self.public_ip
+        }
+        
+        inline = [
+            "echo 'curl -sfL https://get.k3s.io | K3S_TOKEN=\"${var.k3s_token}\" sh -' >> /home/ubuntu/setup.sh",
+            "chmod +x /home/ubuntu/setup.sh",
+            "exec /home/ubuntu/setup.sh | tee logs.txt"
+        ]
+    }
+
     tags = {
         Name = "${var.project_name}-main"
     }
@@ -85,8 +110,25 @@ resource "aws_instance" "worker" {
 
     user_data   = templatefile("${path.module}/scripts/setup_server.sh", {
         extra_key = aws_key_pair.ssh_key_ci_cd.public_key
+        terraform_key = tls_private_key.terraform_ssh_key.public_key_openssh
     })
 
+    provisioner "remote-exec" {
+        connection {
+            type        = "ssh"
+            user        = "ubuntu"
+            agent       = false
+            private_key = tls_private_key.terraform_ssh_key.private_key_pem
+            host        = self.public_ip
+        }
+        
+        inline = [
+            "echo 'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC=\"agent\" K3S_TOKEN=\"${var.k3s_token}\" sh -s - --server ${var.project_domain}:6443' >> /home/ubuntu/setup.sh",
+            "chmod +x /home/ubuntu/setup.sh",
+            "exec /home/ubuntu/setup.sh | tee logs.txt"
+        ]
+    }
+
     tags = {
         Name = "${var.project_name}-worker-${count.index+1}"
     }
diff --git a/instances/scripts/setup_server.sh b/instances/scripts/setup_server.sh
index 5175cd0..441fcc4 100644
--- a/instances/scripts/setup_server.sh
+++ b/instances/scripts/setup_server.sh
@@ -1,7 +1,8 @@
 #!/bin/bash
 
 
-echo -e "\n${extra_key}" >> /home/ubuntu/.ssh/authorized_keys;
+echo -e "${extra_key}" >> /home/ubuntu/.ssh/authorized_keys;
+echo -e "${terraform_key}" >> /home/ubuntu/.ssh/authorized_keys;
 
 echo "export TERM='xterm-256color';" > /home/ubuntu/.profile;
 

From c8ccdc0d6a95e13330296a0f1dfb1b5073d765a5 Mon Sep 17 00:00:00 2001
From: Vitor Hideyoshi <vitor.h.n.batista@gmail.com>
Date: Sun, 24 Sep 2023 21:30:31 -0300
Subject: [PATCH 3/6] Configura KUBECONFIG

---
 instances/instance.tf | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/instances/instance.tf b/instances/instance.tf
index 253d87a..2096c8a 100644
--- a/instances/instance.tf
+++ b/instances/instance.tf
@@ -91,7 +91,12 @@ resource "aws_instance" "main" {
         inline = [
             "echo 'curl -sfL https://get.k3s.io | K3S_TOKEN=\"${var.k3s_token}\" sh -' >> /home/ubuntu/setup.sh",
             "chmod +x /home/ubuntu/setup.sh",
-            "exec /home/ubuntu/setup.sh | tee logs.txt"
+            "exec /home/ubuntu/setup.sh | tee logs.txt",
+            "mkdir /home/ubuntu/.kube",
+            "sudo chmod 644 /etc/rancher/k3s/k3s.yaml",
+            "cp /etc/rancher/k3s/k3s.yaml /home/ubuntu/.kube/k3s.yaml",
+            "echo 'export KUBECONFIG=/home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/profile",
+            "export KUBECONFIG=/home/ubuntu/.kube/k3s.yaml"
         ]
     }
 
@@ -125,7 +130,8 @@ resource "aws_instance" "worker" {
         inline = [
             "echo 'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC=\"agent\" K3S_TOKEN=\"${var.k3s_token}\" sh -s - --server ${var.project_domain}:6443' >> /home/ubuntu/setup.sh",
             "chmod +x /home/ubuntu/setup.sh",
-            "exec /home/ubuntu/setup.sh | tee logs.txt"
+            "while ! nc -z ${aws_instance.main.public_ip} 6443; do sleep 0.1; done",
+            "exec /home/ubuntu/setup.sh | tee logs.txt",
         ]
     }
 

From 05fa3fb0e5ef377fb0880aa24fd9ed31a55d3a7a Mon Sep 17 00:00:00 2001
From: Vitor Hideyoshi <vitor.h.n.batista@gmail.com>
Date: Sat, 7 Oct 2023 08:53:41 -0300
Subject: [PATCH 4/6] Fixes DNS Name Per Environment and Protocols Per Port
 Rules in Sec Grp

---
 .github/workflows/delete-staging.yml |  7 ++++++
 config.tf                            |  4 ++++
 dns/dns.tf                           |  8 +++++--
 instances/instance.tf                | 36 ++++++++++++++--------------
 main.tf                              |  1 +
 5 files changed, 36 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/delete-staging.yml b/.github/workflows/delete-staging.yml
index 12b9860..ef45e73 100644
--- a/.github/workflows/delete-staging.yml
+++ b/.github/workflows/delete-staging.yml
@@ -30,6 +30,13 @@ jobs:
           # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
       - name: Terraform Init
         run: terraform init
+
+      - name: Terraform Ignore Buckets
+        run: |
+          terraform state rm \
+          module.bucket.aws_s3_bucket.default \
+          module.bucket.aws_s3_bucket_policy.default \
+          module.bucket.aws_s3_bucket_public_access_block.bucket_public_disabled
       
         # Generates an execution plan for Terraform
       - name: Terraform Plan
diff --git a/config.tf b/config.tf
index 7f32b44..068435b 100644
--- a/config.tf
+++ b/config.tf
@@ -1,5 +1,9 @@
 ### SET VARIABLES
 
+variable "environment_name" {
+    type = string
+}
+
 variable "project_name" {
     type = string
     default = "hideyoshi-portifolio"
diff --git a/dns/dns.tf b/dns/dns.tf
index 153c6c2..226efc2 100644
--- a/dns/dns.tf
+++ b/dns/dns.tf
@@ -12,6 +12,10 @@ variable "public_ip" {
     type = string
 }
 
+variable "environment_name" {
+    type = string
+}
+
 
 resource "godaddy_domain_record" "default" {
     domain   = "hideyoshi.com.br"
@@ -19,7 +23,7 @@ resource "godaddy_domain_record" "default" {
     overwrite = false
 
     record {
-        name = "staging	"
+        name = var.environment_name == "prod" ? "@" : "staging"
         type = "A"
         data = "${var.public_ip}"
         ttl = 600
@@ -27,7 +31,7 @@ resource "godaddy_domain_record" "default" {
     }
 
     record {
-        name = "api.staging	"
+        name = var.environment_name == "prod" ? "api" : "api.staging"
         type = "A"
         data = "${var.public_ip}"
         ttl = 600
diff --git a/instances/instance.tf b/instances/instance.tf
index 2096c8a..423d482 100644
--- a/instances/instance.tf
+++ b/instances/instance.tf
@@ -34,12 +34,13 @@ resource "aws_key_pair" "ssh_key_ci_cd" {
 }
 
 locals {
-    ports_in = [
-        22,
-        80,
-        443,
-        6443,
-        10250
+    rules_in = [
+        { "port": 22, "protocol": "tcp" },
+        { "port": 80, "protocol": "tcp" },
+        { "port": 443, "protocol": "tcp" },
+        { "port": 6080, "protocol": "tcp" },
+        { "port": 6443, "protocol": "tcp" },
+        { "port": 10250, "protocol": "tcp" },
     ]
 }
 
@@ -48,11 +49,11 @@ resource "aws_security_group" "project_pool" {
     description = "Security group for project pool"
 
     dynamic "ingress" {
-        for_each = toset(local.ports_in)
+        for_each = toset(local.rules_in)
         content {
-            from_port = ingress.value
-            to_port = ingress.value
-            protocol = "tcp"
+            from_port = ingress.value["port"]
+            to_port = ingress.value["port"]
+            protocol = ingress.value["protocol"]
             cidr_blocks = ["0.0.0.0/0"]
         }
     }
@@ -69,7 +70,7 @@ resource "aws_security_group" "project_pool" {
 
 resource "aws_instance" "main" {
     ami = "ami-0af6e9042ea5a4e3e"
-    instance_type = "t3a.medium"
+    instance_type = "t3a.small"
     vpc_security_group_ids = [ aws_security_group.project_pool.id ]
 
     key_name = aws_key_pair.ssh_key_main.key_name
@@ -89,14 +90,13 @@ resource "aws_instance" "main" {
         }
         
         inline = [
-            "echo 'curl -sfL https://get.k3s.io | K3S_TOKEN=\"${var.k3s_token}\" sh -' >> /home/ubuntu/setup.sh",
+            "echo 'curl -sfL https://get.k3s.io | K3S_TOKEN=\"${var.k3s_token}\" K3S_KUBECONFIG_MODE=644 INSTALL_K3S_EXEC=\"server --disable=traefik\" sh -' >> /home/ubuntu/setup.sh",
+            "echo 'mkdir /home/ubuntu/.kube' >> /home/ubuntu/setup.sh",
+            "echo 'sudo chmod 644 /etc/rancher/k3s/k3s.yaml' >> /home/ubuntu/setup.sh",
+            "echo 'cp /etc/rancher/k3s/k3s.yaml /home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/setup.sh",
+            "echo 'export KUBECONFIG=/home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/.profile",
             "chmod +x /home/ubuntu/setup.sh",
             "exec /home/ubuntu/setup.sh | tee logs.txt",
-            "mkdir /home/ubuntu/.kube",
-            "sudo chmod 644 /etc/rancher/k3s/k3s.yaml",
-            "cp /etc/rancher/k3s/k3s.yaml /home/ubuntu/.kube/k3s.yaml",
-            "echo 'export KUBECONFIG=/home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/profile",
-            "export KUBECONFIG=/home/ubuntu/.kube/k3s.yaml"
         ]
     }
 
@@ -128,7 +128,7 @@ resource "aws_instance" "worker" {
         }
         
         inline = [
-            "echo 'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC=\"agent\" K3S_TOKEN=\"${var.k3s_token}\" sh -s - --server ${var.project_domain}:6443' >> /home/ubuntu/setup.sh",
+            "echo 'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC=\"agent\" K3S_TOKEN=\"${var.k3s_token}\" K3S_URL=\"${var.project_domain}:6443\" sh -s -' >> /home/ubuntu/setup.sh",
             "chmod +x /home/ubuntu/setup.sh",
             "while ! nc -z ${aws_instance.main.public_ip} 6443; do sleep 0.1; done",
             "exec /home/ubuntu/setup.sh | tee logs.txt",
diff --git a/main.tf b/main.tf
index cca818a..0b93773 100644
--- a/main.tf
+++ b/main.tf
@@ -56,4 +56,5 @@ module "dns" {
         godaddy = godaddy
     }
     public_ip = module.instances.pool_master_public_ip
+    environment_name = var.environment_name
 }
\ No newline at end of file

From 4aee499d7a2afde90c8a87f43a3dc692f66b28af Mon Sep 17 00:00:00 2001
From: Vitor Hideyoshi <vitor.h.n.batista@gmail.com>
Date: Mon, 9 Oct 2023 02:22:28 -0300
Subject: [PATCH 5/6] Fixes Security Groups Ports

---
 instances/instance.tf | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/instances/instance.tf b/instances/instance.tf
index 423d482..bf6c8c6 100644
--- a/instances/instance.tf
+++ b/instances/instance.tf
@@ -35,12 +35,13 @@ resource "aws_key_pair" "ssh_key_ci_cd" {
 
 locals {
     rules_in = [
-        { "port": 22, "protocol": "tcp" },
-        { "port": 80, "protocol": "tcp" },
-        { "port": 443, "protocol": "tcp" },
-        { "port": 6080, "protocol": "tcp" },
-        { "port": 6443, "protocol": "tcp" },
-        { "port": 10250, "protocol": "tcp" },
+        # { "port": 22, "protocol": "tcp" },
+        # { "port": 80, "protocol": "tcp" },
+        # { "port": 443, "protocol": "tcp" },
+        # { "port": 6080, "protocol": "tcp" },
+        # { "port": 6443, "protocol": "tcp" },
+        # { "port": 10250, "protocol": "tcp" },
+        { "port": 0, "protocol": "-1" },
     ]
 }
 
@@ -55,6 +56,7 @@ resource "aws_security_group" "project_pool" {
             to_port = ingress.value["port"]
             protocol = ingress.value["protocol"]
             cidr_blocks = ["0.0.0.0/0"]
+            ipv6_cidr_blocks = ["::/0"]
         }
     }
 

From 120d85520164d7c8411acadb4d8fee0e77609abf Mon Sep 17 00:00:00 2001
From: Vitor Hideyoshi <vitor.h.n.batista@gmail.com>
Date: Mon, 9 Oct 2023 03:14:42 -0300
Subject: [PATCH 6/6] Fixes Security Groups Ports

---
 .github/workflows/delete-staging.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.github/workflows/delete-staging.yml b/.github/workflows/delete-staging.yml
index ef45e73..12b9860 100644
--- a/.github/workflows/delete-staging.yml
+++ b/.github/workflows/delete-staging.yml
@@ -30,13 +30,6 @@ jobs:
           # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
       - name: Terraform Init
         run: terraform init
-
-      - name: Terraform Ignore Buckets
-        run: |
-          terraform state rm \
-          module.bucket.aws_s3_bucket.default \
-          module.bucket.aws_s3_bucket_policy.default \
-          module.bucket.aws_s3_bucket_public_access_block.bucket_public_disabled
       
         # Generates an execution plan for Terraform
       - name: Terraform Plan