Skip to content

Commit 61c1f53

Browse files
author
Alok G Singh
committed
tui behind LB
1 parent da8a0eb commit 61c1f53

File tree

6 files changed

+207
-43
lines changed

6 files changed

+207
-43
lines changed

‎infra/cd.tf‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,14 +75,16 @@ resource "aws_iam_role" "ter" {
7575
name = "ter"
7676
path = "/cd/"
7777

78-
inline_policy {
79-
name = "extra-ter"
80-
policy = data.aws_iam_policy_document.extra.json
81-
}
8278
assume_role_policy = data.aws_iam_policy_document.ecs_assume_role_policy.json
8379
#managed_policy_arns = ["arn:aws:iam::aws:policy/aws-service-role/AmazonECSServiceRolePolicy"]
8480
}
8581

82+
resource "aws_iam_role_policy" "extra" {
83+
name = "extra-ter"
84+
role = aws_iam_role.ter.id
85+
policy = data.aws_iam_policy_document.extra.json
86+
}
87+
8688
# ecr_rw_tyk is created in base but ter is created here. We need to
8789
# know ter so that we can give ecr_rw_tyk the minimum permission
8890
# boundary
@@ -145,7 +147,7 @@ resource "aws_ssm_parameter" "ter" {
145147
value = aws_iam_role.ter.arn
146148
}
147149

148-
resource "aws_s3_bucket_policy" "deptrack_lb_logs" {
150+
resource "aws_s3_bucket_policy" "lb_logs" {
149151
bucket = data.terraform_remote_state.base.outputs.assets
150152
policy = <<-EOF
151153
{
@@ -158,6 +160,14 @@ resource "aws_s3_bucket_policy" "deptrack_lb_logs" {
158160
},
159161
"Action": "s3:PutObject",
160162
"Resource": "arn:aws:s3:::${data.terraform_remote_state.base.outputs.assets}/deptrack-lb/AWSLogs/754489498669/*"
163+
},
164+
{
165+
"Effect": "Allow",
166+
"Principal": {
167+
"AWS": "arn:aws:iam::054676820928:root"
168+
},
169+
"Action": "s3:PutObject",
170+
"Resource": "arn:aws:s3:::${data.terraform_remote_state.base.outputs.assets}/tui-lb/AWSLogs/754489498669/*"
161171
}
162172
]
163173
}

‎infra/gromit.tf‎

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -28,35 +28,6 @@ resource "aws_ssm_parameter" "tui_credentials" {
2828
value = data.sops_file.secrets.data["tui_credentials"]
2929
}
3030

31-
# API server for test UI
32-
module "tui" {
33-
source = "./modules/fg-service"
34-
35-
cluster = aws_ecs_cluster.internal.arn
36-
cdt = "templates/cd-awsvpc.tpl"
37-
# Container definition
38-
cd = {
39-
name = "tui",
40-
port = 80,
41-
log_group = "internal",
42-
image = var.gromit_image,
43-
command = ["--textlogs=false", "policy", "serve", "--save=/shared", "--port=:80"],
44-
mounts = [
45-
{ src = "shared", dest = "/shared", readonly = false },
46-
],
47-
env = [],
48-
secrets = [
49-
{ name = "CREDENTIALS", valueFrom = aws_ssm_parameter.tui_credentials.arn }
50-
],
51-
region = data.aws_region.current.name
52-
}
53-
trarn = aws_iam_role.ter.arn
54-
tearn = aws_iam_role.ter.arn
55-
vpc = data.terraform_remote_state.base.outputs.vpc.id
56-
subnets = data.terraform_remote_state.base.outputs.vpc.public_subnets
57-
volume_map = { shared = { fs_id = data.terraform_remote_state.base.outputs.shared_efs, root = "/tui" } }
58-
}
59-
6031
# Refresh dash license
6132
module "licenser" {
6233
source = "./modules/fg-sched-task"

‎infra/modules/fg-service/main.tf‎

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,9 @@ resource "aws_ecs_task_definition" "td" {
2828

2929
resource "aws_security_group" "sg" {
3030
name = var.cd.name
31-
description = "One TCP port from anywhere, full outbound access"
31+
description = format("For service %s", var.cd.name)
3232
vpc_id = var.vpc
3333

34-
ingress {
35-
from_port = var.cd.port
36-
to_port = var.cd.port
37-
protocol = "tcp"
38-
cidr_blocks = ["0.0.0.0/0"]
39-
}
40-
4134
egress {
4235
from_port = 0
4336
to_port = 0
@@ -46,6 +39,26 @@ resource "aws_security_group" "sg" {
4639
}
4740
}
4841

42+
resource "aws_vpc_security_group_ingress_rule" "ing_port" {
43+
security_group_id = aws_security_group.sg.id
44+
cidr_ipv4 = "0.0.0.0/0"
45+
from_port = var.cd.port
46+
to_port = var.cd.port
47+
ip_protocol = "tcp"
48+
}
49+
50+
data "aws_vpc" "vpc" {
51+
id = var.vpc
52+
}
53+
54+
resource "aws_vpc_security_group_ingress_rule" "efs" {
55+
security_group_id = aws_security_group.sg.id
56+
cidr_ipv4 = data.aws_vpc.vpc.cidr_block
57+
from_port = 2049
58+
to_port = 2049
59+
ip_protocol = "tcp"
60+
}
61+
4962
resource "aws_ecs_service" "service" {
5063
name = var.cd.name
5164
cluster = var.cluster
@@ -56,6 +69,6 @@ resource "aws_ecs_service" "service" {
5669
network_configuration {
5770
subnets = var.subnets
5871
security_groups = [aws_security_group.sg.id]
59-
assign_public_ip = true
72+
assign_public_ip = var.public_ip
6073
}
6174
}

‎infra/modules/fg-service/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "sg_id" {
2+
value = aws_security_group.sg.id
3+
description = "security group id for the task, use in LB"
4+
}

‎infra/modules/fg-service/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,9 @@ variable "volume_map" {
5050
description = "map of volume name to EFS id"
5151
type = map(object({ fs_id = string, root = string }))
5252
}
53+
54+
variable "public_ip" {
55+
description = "assign public IP"
56+
type = bool
57+
default = false
58+
}

‎infra/tui.tf‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
# tui.dev
2+
3+
module "tui" {
4+
source = "terraform-aws-modules/ecs/aws//modules/service"
5+
6+
name = "tui"
7+
cluster_arn = aws_ecs_cluster.internal.arn
8+
assign_public_ip = false
9+
launch_type = "FARGATE"
10+
11+
volume = {
12+
tui_shared = {
13+
efs_volume_configuration = {
14+
file_system_id = data.terraform_remote_state.base.outputs.shared_efs
15+
root_directory = "/tui"
16+
}
17+
18+
}
19+
}
20+
21+
cpu = 256 # 0.25 vCPU
22+
memory = 512
23+
desired_count = 1
24+
container_definitions = {
25+
tui = {
26+
cpu = 256
27+
memory = 512
28+
image = var.gromit_image
29+
command = ["--textlogs=false", "policy", "serve", "--save=/shared", "--port=:80"]
30+
31+
environment = []
32+
secrets = [
33+
{ name = "CREDENTIALS", valueFrom = aws_ssm_parameter.tui_credentials.arn }
34+
]
35+
port_mappings = [
36+
{
37+
name = "tui"
38+
containerPort = 80
39+
hostPort = 80
40+
protocol = "tcp"
41+
}
42+
]
43+
mount_points = [
44+
{
45+
sourceVolume = "tui_shared"
46+
containerPath = "/shared"
47+
}
48+
]
49+
health_check = {
50+
command = ["CMD-SHELL", "curl -f http://localhost/ping || exit 1"]
51+
interval = 300
52+
timeout = 5
53+
retries = 3
54+
startPeriod = 30
55+
}
56+
log_configuration = {
57+
logDriver = "awslogs"
58+
options = {
59+
awslogs-group = "internal"
60+
awslogs-region = "eu-central-1"
61+
awslogs-stream-prefix = "tui"
62+
}
63+
}
64+
}
65+
}
66+
subnet_ids = data.terraform_remote_state.base.outputs.vpc.public_subnets
67+
load_balancer = {
68+
service = {
69+
target_group_arn = aws_lb_target_group.tui.arn
70+
container_name = "tui"
71+
container_port = 80
72+
}
73+
}
74+
75+
create_task_exec_iam_role = false
76+
create_task_exec_policy = false
77+
task_exec_iam_role_arn = aws_iam_role.ter.arn
78+
create_security_group = false
79+
security_group_ids = [aws_security_group.tui.id]
80+
}
81+
82+
resource "aws_security_group" "tui" {
83+
name = "tui"
84+
description = "EFS, http"
85+
vpc_id = data.terraform_remote_state.base.outputs.vpc.id
86+
87+
egress {
88+
from_port = 0
89+
to_port = 0
90+
protocol = "-1"
91+
cidr_blocks = ["0.0.0.0/0"]
92+
}
93+
}
94+
95+
resource "aws_vpc_security_group_ingress_rule" "http" {
96+
security_group_id = aws_security_group.tui.id
97+
cidr_ipv4 = "0.0.0.0/0"
98+
from_port = 80
99+
to_port = 80
100+
ip_protocol = "tcp"
101+
}
102+
103+
resource "aws_vpc_security_group_ingress_rule" "efs_tui" {
104+
security_group_id = aws_security_group.tui.id
105+
cidr_ipv4 = data.terraform_remote_state.base.outputs.vpc.cidr
106+
from_port = 2049
107+
to_port = 2049
108+
ip_protocol = "tcp"
109+
}
110+
111+
resource "aws_lb_target_group" "tui" {
112+
name = "tui"
113+
port = 80
114+
protocol = "HTTP"
115+
target_type = "ip"
116+
vpc_id = data.terraform_remote_state.base.outputs.vpc.id
117+
}
118+
119+
resource "aws_lb" "tui" {
120+
name = "tui"
121+
internal = false
122+
load_balancer_type = "application"
123+
security_groups = [aws_security_group.tui.id]
124+
subnets = data.terraform_remote_state.base.outputs.vpc.public_subnets
125+
126+
# FIXME: enable before making public
127+
enable_deletion_protection = false
128+
129+
access_logs {
130+
bucket = data.terraform_remote_state.base.outputs.assets
131+
prefix = "tui-lb"
132+
enabled = true
133+
}
134+
135+
connection_logs {
136+
bucket = data.terraform_remote_state.base.outputs.assets
137+
prefix = "tui-lb"
138+
enabled = true
139+
}
140+
}
141+
142+
resource "aws_lb_listener" "tui" {
143+
load_balancer_arn = aws_lb.tui.arn
144+
port = "80"
145+
protocol = "HTTP"
146+
default_action {
147+
type = "forward"
148+
target_group_arn = aws_lb_target_group.tui.arn
149+
}
150+
}
151+
152+
resource "aws_route53_record" "tui" {
153+
zone_id = data.terraform_remote_state.base.outputs.dns.zone_id
154+
155+
name = "tui.internal"
156+
type = "CNAME"
157+
ttl = "300"
158+
159+
records = [aws_lb.tui.dns_name]
160+
}

0 commit comments

Comments
 (0)