Skip to content

Commit c3d600e

Browse files
sekka1sekka1
authored
Revert "Revert (#382)" (#383)
This reverts commit 9c55a36.
1 parent 9c55a36 commit c3d600e

64 files changed

Lines changed: 6754 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎terraform-modules/aws/ec2_instance/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Nodes
2+
This module creates a node based on the param
3+
4+
It will create:
5+
* A an EC2 instance
6+
* attach a security group
7+
* attach IAM policies to the instance role
8+
* AMI used
9+
* subnet it is placed in
10+
* instance type
11+
12+
# Dependencies
13+
14+
`subnet_id` - the subnet to place this instance in
15+
`aws_iam_role_policy_attachment_list` - a list of policy arn to attach to this instance
16+
17+
# instance_config var
18+
This is the main input for the module. This the EC2 instances and it's configuration.
19+
20+
```hcl
21+
instance_config = {
22+
root_installer_device = {
23+
instance_type = "m5.4xlarge"
24+
delete_on_termination = true,
25+
encrypted = true,
26+
iops = "",
27+
kms_key_id = "",
28+
volume_size = 80,
29+
volume_type = "gp2",
30+
}
31+
ebs_block_device = []
32+
user_data_inputs = {
33+
ebs_block_device_1_is_set = "false"
34+
ebs_block_device_1_mount_path = "null"
35+
ebs_block_device_2_is_set = "false"
36+
ebs_block_device_2_mount_path = "null"
37+
}
38+
}
39+
```
40+
41+
# How to run the unit tests
42+
43+
```
44+
cd test
45+
go test ./
46+
```
47+
48+
no cache run
49+
```
50+
go test ./ -v -count=1
51+
```
52+
53+
## How to run the debugger
54+
55+
TBD

‎terraform-modules/aws/ec2_instance/cloud-init/user-data.yaml.tpl‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# #cloud-config
2+
# # Doc: https://cloudinit.readthedocs.io/en/latest/topics/examples.html
3+
4+
# # Add groups to the system
5+
# groups:
6+
# - fspace
7+
8+
# # Add users to the system. Users are added after groups are added.
9+
# users:
10+
# - default
11+
# - name: fsinstaller
12+
# gecos: fsinstaller
13+
# shell: /bin/bash
14+
# primary_group: fspace
15+
# sudo:
16+
# - ALL=(ALL:ALL) NOPASSWD:/usr/bin/rpm
17+
# - ALL=(ALL:ALL) NOPASSWD:/opt/chef/embedded/bin/gem
18+
# - ALL=(ALL:ALL) NOPASSWD:/usr/bin/chef-client
19+
# - ALL=(ALL:ALL) NOPASSWD:/usr/bin/pkill
20+
# - ALL=(ALL:ALL) NOPASSWD:/usr/bin/chef
21+
# - ALL=(ALL:ALL) NOPASSWD:/opt/chefdk/embedded/bin/gem
22+
# lock_passwd: false
23+
# ssh_authorized_keys:
24+
# - ${user_ssh_public_key}
25+
# - name: aric
26+
# gecos: aric
27+
# shell: /bin/bash
28+
# primary_group: fspace
29+
# ssh_authorized_keys:
30+
# - ${user_ssh_public_key}
31+
32+
33+
# # Installs packages
34+
# packages:
35+
# - unzip
36+
37+
# # Sets the GOPATH & downloads the demo payload
38+
# runcmd:
39+
# - echo "ClientAliveInterval 60" | tee -a /etc/ssh/sshd_config
40+
# - echo "ClientAliveCountMax 10" | tee -a /etc/ssh/sshd_config
41+
# - systemctl restart sshd
42+
# - echo "vm.swappiness=1" | tee -a /etc/sysctl.conf
43+
# - sudo sysctl -p
44+
# - curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.0.30.zip" -o "/tmp/awscliv2.zip"
45+
# - unzip /tmp/awscliv2.zip -d /tmp/
46+
# - /tmp/aws/install
47+
# - if [[ "${ebs_block_device_1_is_set}" == "true" ]]; then export EBS_DEVICE=$(lsblk | grep -e "nvme1.*" | awk '{print $1}'); mkfs -t ext4 /dev/"$${EBS_DEVICE}"; mkdir -p "${ebs_block_device_1_mount_path}"; mount /dev/"$${EBS_DEVICE[$i]}" ${ebs_block_device_1_mount_path}; echo -e "UUID=$(lsblk -o +uuid /dev/"$${EBS_DEVICE[$i]}" | grep "$${EBS_DEVICE[$i]}" | awk '{print $8}') \t ${ebs_block_device_1_mount_path} \t ext4 \t defaults \t 0 \t 0" >> /etc/fstab; fi
48+
# - if [[ "${ebs_block_device_2_is_set}" == "true" ]]; then export EBS_DEVICE=$(lsblk | grep -e "nvme2.*" | awk '{print $1}'); mkfs -t ext4 /dev/"$${EBS_DEVICE}"; mkdir -p "${ebs_block_device_2_mount_path}"; mount /dev/"$${EBS_DEVICE[$i]}" ${ebs_block_device_2_mount_path}; echo -e "UUID=$(lsblk -o +uuid /dev/"$${EBS_DEVICE[$i]}" | grep "$${EBS_DEVICE[$i]}" | awk '{print $8}') \t ${ebs_block_device_2_mount_path} \t ext4 \t defaults \t 0 \t 0" >> /etc/fstab; fi
49+
# write_files:
50+
# - encoding: gzip
51+
# content: !!binary |
52+
# ${sudoers}
53+
# path: /etc/sudoers.d/99-custom-sudoers
54+
# permissions: '0440'

‎terraform-modules/aws/ec2_instance/files/99-custom-sudoers‎

Lines changed: 334 additions & 0 deletions
Large diffs are not rendered by default.

‎terraform-modules/aws/ec2_instance/main.tf‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
locals {
2+
sudoers = base64gzip(file("${path.module}/files/99-custom-sudoers"))
3+
4+
# combine user's IAM policy arn list with what is created in this module
5+
complete_aws_iam_role_policy_attachment_list = concat(var.aws_iam_role_policy_attachment_list,
6+
[
7+
"arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM",
8+
aws_iam_policy.node_configs.arn,
9+
])
10+
}
11+
12+
module "ec2_instance" {
13+
source = "terraform-aws-modules/ec2-instance/aws"
14+
version = "~> 2.0"
15+
16+
name = var.instance_name
17+
instance_count = 1
18+
19+
ami = var.ami
20+
instance_type = var.instance_config.root_installer_device.instance_type
21+
key_name = var.key_pair_name != null ? var.key_pair_name: aws_key_pair.this[0].id
22+
monitoring = true
23+
vpc_security_group_ids = var.security_group_list
24+
subnet_id = var.subnet_id
25+
26+
# instance profile created in this module for each individual node
27+
iam_instance_profile = aws_iam_instance_profile.instance_profile.id
28+
29+
tags = var.tags
30+
31+
enable_volume_tags = true
32+
root_block_device = [
33+
{
34+
delete_on_termination = var.instance_config.root_installer_device.delete_on_termination
35+
encrypted = var.instance_config.root_installer_device.encrypted
36+
iops = var.instance_config.root_installer_device.volume_type == "io2" ? var.instance_config.root_installer_device.iops : null
37+
kms_key_id = var.instance_config.root_installer_device.kms_key_id
38+
volume_size = var.instance_config.root_installer_device.volume_size
39+
volume_type = var.instance_config.root_installer_device.volume_type
40+
},
41+
]
42+
43+
ebs_block_device = var.instance_config.ebs_block_device
44+
45+
user_data = templatefile("${path.module}/cloud-init/user-data.yaml.tpl", {
46+
sudoers = local.sudoers
47+
user_ssh_public_key = var.user_ssh_public_key
48+
ebs_block_device_1_is_set = var.instance_config.user_data_inputs.ebs_block_device_1_is_set
49+
ebs_block_device_1_mount_path = var.instance_config.user_data_inputs.ebs_block_device_1_mount_path
50+
ebs_block_device_2_is_set = var.instance_config.user_data_inputs.ebs_block_device_2_is_set
51+
ebs_block_device_2_mount_path = var.instance_config.user_data_inputs.ebs_block_device_2_mount_path
52+
})
53+
54+
depends_on = [
55+
aws_iam_instance_profile.instance_profile,
56+
]
57+
}
58+
59+
resource "aws_key_pair" "this" {
60+
count = var.key_pair_name == null ? 1: 0
61+
key_name = var.instance_name
62+
public_key = var.user_ssh_public_key
63+
}
64+
65+
# Instance profile
66+
resource "aws_iam_instance_profile" "instance_profile" {
67+
name = var.instance_name
68+
role = aws_iam_role.instance_role.name
69+
}
70+
71+
# Instance role
72+
resource "aws_iam_role" "instance_role" {
73+
74+
name = var.instance_name
75+
assume_role_policy = jsonencode({
76+
Version = "2012-10-17"
77+
Statement = [
78+
{
79+
Action = "sts:AssumeRole"
80+
Effect = "Allow"
81+
Sid = ""
82+
Principal = {
83+
Service = "ec2.amazonaws.com"
84+
}
85+
},
86+
]
87+
})
88+
description = "A role for the ${var.instance_name} node"
89+
}
90+
91+
# Attached the list of policies to the instance profile
92+
resource "aws_iam_role_policy_attachment" "attach_policies" {
93+
count = length(concat(local.complete_aws_iam_role_policy_attachment_list))
94+
role = aws_iam_role.instance_role.name
95+
policy_arn = local.complete_aws_iam_role_policy_attachment_list[count.index]
96+
}
97+
98+
# Policy for S3 Bucket - allows the node to get read-only access to s3 buckets for the node_config items
99+
# For the "all" nodes
100+
resource "aws_iam_policy" "node_configs" {
101+
name = "${var.instance_name}-node-configs"
102+
policy = jsonencode({
103+
"Version" : "2012-10-17",
104+
"Statement" : [
105+
{
106+
"Action" : ["s3:GetObject", "s3:ListBucket"],
107+
"Effect" : "Allow",
108+
"Resource" : "arn:aws:s3:::${var.environment_name}-installer/node_configs/*"
109+
}
110+
]
111+
})
112+
}

‎terraform-modules/aws/ec2_instance/outputs.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
output "ec2_id" {
2+
value = module.ec2_instance.id
3+
}

‎terraform-modules/aws/ec2_instance/test/go.mod‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
module github.com/ManagedKube/kubernetes-ops
2+
3+
go 1.15
4+
5+
require (
6+
github.com/gruntwork-io/terratest v0.32.24
7+
github.com/stretchr/testify v1.7.0
8+
)

0 commit comments

Comments
 (0)