rhel-instance.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Template for RHEL machine Launch

Conditions:
  # If EC2Type parameter == MetalMachine, then do not add a secondary volume
  AddSecondaryVolume: !Not [!Equals [!Ref EC2Type, 'MetalMachine']]
  UseCapacityReservation: !Not [!Equals [!Ref CapacityReservationId, '']]
  UseSpecificAZ: !Not [!Equals [!Ref AvailabilityZone, '']]
  UseSpotInstance: !Equals [!Ref UseSpot, 'Yes']

Mappings:
  VolumeSize:
    MetalMachine:
      PrimaryVolumeSize: "300"
      SecondaryVolumeSize: "0"
    VirtualMachine:
      PrimaryVolumeSize: "200"
      SecondaryVolumeSize: "100"

Parameters:
  EC2Type:
    Default: 'VirtualMachine'
    Type: String
  VpcCidr:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-4]))$
    ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-24.
    Default: 10.192.0.0/16
    Description: CIDR block for VPC.
    Type: String
  PublicSubnetCidr:
    Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone
    Type: String
    Default: 10.192.10.0/24
  AmiId:
    Description: Current RHEL AMI to use.
    Type: AWS::EC2::Image::Id
  Machinename:
    MaxLength: 27
    MinLength: 1
    ConstraintDescription: Machinename
    Description: Machinename
    Type: String
    Default: rhel-testbed-ec2-instance
  HostInstanceType:
    Default: t2.medium
    Type: String
  PublicKeyString:
    Type: String
    Description: The public key used to connect to the EC2 instance
  CapacityReservationId:
    Type: String
    Description: EC2 Capacity Reservation ID (optional)
    Default: ""
  AvailabilityZone:
    Type: String
    Description: Specific AZ for instance placement (optional)
    Default: ""
  UseSpot:
    Type: String
    Description: Whether to use spot instances (Yes/No)
    Default: "No"
    AllowedValues:
      - "Yes"
      - "No"

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Host Information"
        Parameters:
          - HostInstanceType
      - Label:
          default: "Network Configuration"
        Parameters:
          - PublicSubnet
    ParameterLabels:
      PublicSubnet:
        default: "Worker Subnet"
      HostInstanceType:
        default: "Worker Instance Type"

Resources:
  # VPC Creation
  RHELVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      Tags:
        - Key: Name
          Value: RHELVPC

  # Internet Gateway
  RHELInternetGateway:
    Type: AWS::EC2::InternetGateway
    DeletionPolicy: Delete
    Properties:
      Tags:
        - Key: Name
          Value: RHELInternetGateway

  RHELGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    DeletionPolicy: Delete
    Properties:
      VpcId: !Ref RHELVPC
      InternetGatewayId: !Ref RHELInternetGateway

  RHELPublicSubnet:
    Type: AWS::EC2::Subnet
    DeletionPolicy: Delete
    Properties:
      VpcId: !Ref RHELVPC
      CidrBlock: !Ref PublicSubnetCidr
      MapPublicIpOnLaunch: true
      AvailabilityZone: !If [UseSpecificAZ, !Ref AvailabilityZone, !Ref 'AWS::NoValue']
      Tags:
        - Key: Name
          Value: RHELPublicSubnet

  RHELNatGatewayEIP:
    Type: AWS::EC2::EIP
    DeletionPolicy: Delete
    DependsOn: RHELGatewayAttachment
    Properties:
      Domain: vpc

  RHELNatGateway:
    Type: AWS::EC2::NatGateway
    DeletionPolicy: Delete
    DependsOn: RHELNatGatewayEIP
    Properties:
      AllocationId: !GetAtt RHELNatGatewayEIP.AllocationId
      SubnetId: !Ref RHELPublicSubnet

  RHELRouteTable:
    Type: AWS::EC2::RouteTable
    DeletionPolicy: Delete
    Properties:
      VpcId: !Ref RHELVPC
      Tags:
        - Key: Name
          Value: RHELRouteTable

  RHELPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: RHELGatewayAttachment
    Properties:
      RouteTableId: !Ref RHELRouteTable
      DestinationCidrBlock: "0.0.0.0/0"
      GatewayId: !Ref RHELInternetGateway

  RHELPublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn: RHELRouteTable
    Properties:
      RouteTableId: !Ref RHELRouteTable
      SubnetId: !Ref RHELPublicSubnet

  # IAM Roles and Instance Profile
  RHELIamRole:
    Type: AWS::IAM::Role
    DeletionPolicy: Delete
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "ec2.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"

  RHELInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - !Ref RHELIamRole

  # Security Group
  RHELSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: RHEL Host Security Group
      SecurityGroupIngress:
        - IpProtocol: icmp
          FromPort: -1
          ToPort: -1
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 5678
          ToPort: 5678
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 9090
          ToPort: 9090
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 5353
          ToPort: 5353
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 6443
          ToPort: 6443
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 8213
          ToPort: 8213
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 30000
          ToPort: 32767
          CidrIp: 0.0.0.0/0
        - IpProtocol: udp
          FromPort: 30000
          ToPort: 32767
          CidrIp: 0.0.0.0/0
      VpcId: !Ref RHELVPC

  # Launch Template for Capacity Reservation (only created when capacity reservation is used)
  RHELLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Condition: UseCapacityReservation
    Properties:
      LaunchTemplateData:
        CapacityReservationSpecification:
          CapacityReservationTarget:
            CapacityReservationId: !Ref CapacityReservationId

  # Launch Template for Spot Instances (only created when spot is used)
  RHELSpotLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Condition: UseSpotInstance
    Properties:
      LaunchTemplateData:
        InstanceMarketOptions:
          MarketType: spot
          SpotOptions:
            SpotInstanceType: persistent
            InstanceInterruptionBehavior: stop

  # EC2 Instance
  RHELInstance:
    Type: AWS::EC2::Instance
    DeletionPolicy: Delete
    DependsOn:
      - RHELPublicSubnet
      - RHELGatewayAttachment
      - RHELInstanceProfile
    Properties:
      ImageId: !Ref AmiId
      IamInstanceProfile: !Ref RHELInstanceProfile
      InstanceType: !Ref HostInstanceType
      LaunchTemplate: !If
        - UseSpotInstance
        - LaunchTemplateId: !Ref RHELSpotLaunchTemplate
          Version: !GetAtt RHELSpotLaunchTemplate.LatestVersionNumber
        - !If
          - UseCapacityReservation
          - LaunchTemplateId: !Ref RHELLaunchTemplate
            Version: !GetAtt RHELLaunchTemplate.LatestVersionNumber
          - !Ref AWS::NoValue
      NetworkInterfaces:
        - AssociatePublicIpAddress: "False"
          DeviceIndex: "0"
          GroupSet:
            - !GetAtt RHELSecurityGroup.GroupId
          SubnetId: !Ref RHELPublicSubnet
      Tags:
        - Key: Name
          Value: !Join ["", [!Ref Machinename]]
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeSize: !FindInMap [VolumeSize, !Ref EC2Type, PrimaryVolumeSize]
            VolumeType: gp3
            Iops: 16000
        - !If
          - AddSecondaryVolume
          - DeviceName: /dev/sdc
            Ebs:
              VolumeSize: !FindInMap [VolumeSize, !Ref EC2Type, SecondaryVolumeSize]
              VolumeType: gp3
              Iops: 16000
          - !Ref AWS::NoValue
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe

          log_output_file=/tmp/init_output.txt

          echo "====== Authorizing public key ======" | tee -a "$log_output_file"
          echo "${PublicKeyString}" >> /home/ec2-user/.ssh/authorized_keys

          sudo dnf install -y git make cockpit lvm2 jq |& tee -a "$log_output_file"
          sudo systemctl enable --now cockpit.socket |& tee -a "$log_output_file"

          echo "====== Getting Disk Path ======" | tee -a "$log_output_file"
          pv_location=$(sudo lsblk -Jd | jq -r '.blockdevices[] | select(.size == "200G") | "/dev/\(.name)"')
          echo "discovered pv location of ($pv_location)" | tee -a "$log_output_file"

          # NOTE: wrapping script vars with {} since CloudFormation will see
          # them as CloudFormation vars instead.
          echo "====== Creating PV ======" | tee -a "$log_output_file"
          sudo pvcreate "$pv_location" |& tee -a "$log_output_file"

          echo "====== Creating VG ======" | tee -a "$log_output_file"
          sudo vgcreate rhel "$pv_location" |& tee -a "$log_output_file"

  # Elastic IP
  RHELElasticIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: !Ref Machinename

  RHELEIPAssociation:
    Type: AWS::EC2::EIPAssociation
    Properties:
      InstanceId: !Ref RHELInstance
      AllocationId: !GetAtt RHELElasticIP.AllocationId

Outputs:
  InstanceId:
    Description: RHEL Host Instance ID
    Value: !Ref RHELInstance
  PrivateIp:
    Description: The bastion host Private DNS, will be used for cluster install pulling release image
    Value: !GetAtt RHELInstance.PrivateIp
  PublicIp:
    Description: The bastion host Public IP, will be used for registering minIO server DNS
    Value: !GetAtt RHELInstance.PublicIp