Skip to content

Commit d39304a

Browse files
Volatusbeyhan
Volatus
authored and
beyhan
committed
feat: Add AWS NLB load balancer type
* Adds NLB variants of existing classic load balancers * Adds dualstack support on the NLBs * CF TCP LB is now limited to 50 ports, instead of 100 Signed-off-by: Ismayil Mirzali <[email protected]>
1 parent c9a3ffc commit d39304a

File tree

6 files changed

+551
-253
lines changed

6 files changed

+551
-253
lines changed

‎terraform/aws/template_generator.go

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,10 @@ type templates struct {
1313
iam string
1414
lbSubnet string
1515
cfLB string
16+
cfNLB string
1617
cfDNS string
1718
concourseLB string
19+
cfCommon string
1820
sslCertificate string
1921
isoSeg string
2022
vpc string
@@ -43,7 +45,13 @@ func (tg TemplateGenerator) Generate(state storage.State) string {
4345
case "concourse":
4446
template = strings.Join([]string{template, tmpls.lbSubnet, tmpls.concourseLB}, "\n")
4547
case "cf":
46-
template = strings.Join([]string{template, tmpls.lbSubnet, tmpls.cfLB, tmpls.sslCertificate, tmpls.isoSeg}, "\n")
48+
template = strings.Join([]string{template, tmpls.lbSubnet, tmpls.cfLB, tmpls.cfCommon, tmpls.sslCertificate, tmpls.isoSeg}, "\n")
49+
50+
if state.LB.Domain != "" {
51+
template = strings.Join([]string{template, tmpls.cfDNS}, "\n")
52+
}
53+
case "nlb":
54+
template = strings.Join([]string{template, tmpls.lbSubnet, tmpls.cfNLB, tmpls.cfCommon, tmpls.sslCertificate, tmpls.isoSeg}, "\n")
4755

4856
if state.LB.Domain != "" {
4957
template = strings.Join([]string{template, tmpls.cfDNS}, "\n")
@@ -60,6 +68,8 @@ func (t TemplateGenerator) readTemplates() templates {
6068
"lb_subnet.tf": "",
6169
"cf_lb.tf": "",
6270
"cf_dns.tf": "",
71+
"cf_lb_common.tf": "",
72+
"cf_nlb.tf": "",
6373
"concourse_lb.tf": "",
6474
"ssl_certificate.tf": "",
6575
"iso_segments.tf": "",
@@ -94,8 +104,10 @@ func (t TemplateGenerator) readTemplates() templates {
94104
base: listings["base.tf"],
95105
iam: listings["iam.tf"],
96106
lbSubnet: listings["lb_subnet.tf"],
107+
cfCommon: listings["cf_lb_common.tf"],
97108
cfLB: listings["cf_lb.tf"],
98109
cfDNS: listings["cf_dns.tf"],
110+
cfNLB: listings["cf_nlb.tf"],
99111
concourseLB: listings["concourse_lb.tf"],
100112
sslCertificate: listings["ssl_certificate.tf"],
101113
isoSeg: listings["iso_segments.tf"],

‎terraform/aws/templates/cf_dns.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ resource "aws_route53_record" "wildcard_dns" {
3939
type = "CNAME"
4040
ttl = 300
4141

42-
records = ["${aws_elb.cf_router_lb.dns_name}"]
42+
records = var.dualstack ? [aws_lb.cf_router_lb.dns_name] : ["${aws_elb.cf_router_lb.dns_name}"]
4343
}
4444

4545
resource "aws_route53_record" "ssh" {
@@ -48,7 +48,7 @@ resource "aws_route53_record" "ssh" {
4848
type = "CNAME"
4949
ttl = 300
5050

51-
records = ["${aws_elb.cf_ssh_lb.dns_name}"]
51+
records = var.dualstack ? [aws_lb.cf_ssh_lb.dns_name] : ["${aws_elb.cf_ssh_lb.dns_name}"]
5252
}
5353

5454
resource "aws_route53_record" "bosh" {
@@ -66,7 +66,7 @@ resource "aws_route53_record" "tcp" {
6666
type = "CNAME"
6767
ttl = 300
6868

69-
records = ["${aws_elb.cf_tcp_lb.dns_name}"]
69+
records = var.dualstack ? [aws_lb.cf_tcp_lb.dns_name] : ["${aws_elb.cf_tcp_lb.dns_name}"]
7070
}
7171

7272
resource "aws_route53_record" "iso" {

‎terraform/aws/templates/cf_lb.tf

Lines changed: 0 additions & 243 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1,3 @@
1-
variable "elb_idle_timeout" {
2-
type = number
3-
default = 60
4-
}
5-
6-
resource "aws_security_group" "cf_ssh_lb_security_group" {
7-
name = "${var.env_id}-cf-ssh-lb-security-group"
8-
description = "CF SSH"
9-
vpc_id = local.vpc_id
10-
11-
ingress {
12-
cidr_blocks = ["0.0.0.0/0"]
13-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
14-
protocol = "tcp"
15-
from_port = 2222
16-
to_port = 2222
17-
}
18-
19-
egress {
20-
from_port = 0
21-
to_port = 0
22-
protocol = "-1"
23-
cidr_blocks = ["0.0.0.0/0"]
24-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
25-
}
26-
27-
tags = {
28-
Name = "${var.env_id}-cf-ssh-lb-security-group"
29-
}
30-
31-
lifecycle {
32-
ignore_changes = [name]
33-
}
34-
}
35-
36-
output "cf_ssh_lb_security_group" {
37-
value = aws_security_group.cf_ssh_lb_security_group.id
38-
}
39-
40-
resource "aws_security_group" "cf_ssh_lb_internal_security_group" {
41-
name = "${var.env_id}-cf-ssh-lb-internal-security-group"
42-
description = "CF SSH Internal"
43-
vpc_id = local.vpc_id
44-
45-
ingress {
46-
security_groups = ["${aws_security_group.cf_ssh_lb_security_group.id}"]
47-
protocol = "tcp"
48-
from_port = 2222
49-
to_port = 2222
50-
}
51-
52-
egress {
53-
from_port = 0
54-
to_port = 0
55-
protocol = "-1"
56-
cidr_blocks = ["0.0.0.0/0"]
57-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
58-
}
59-
60-
tags = {
61-
Name = "${var.env_id}-cf-ssh-lb-internal-security-group"
62-
}
63-
64-
lifecycle {
65-
ignore_changes = [name]
66-
}
67-
}
68-
69-
output "cf_ssh_lb_internal_security_group" {
70-
value = aws_security_group.cf_ssh_lb_internal_security_group.id
71-
}
72-
731
resource "aws_elb" "cf_ssh_lb" {
742
name = "${var.short_env_id}-cf-ssh-lb"
753
cross_zone_load_balancing = true
@@ -107,88 +35,6 @@ output "cf_ssh_lb_url" {
10735
value = aws_elb.cf_ssh_lb.dns_name
10836
}
10937

110-
resource "aws_security_group" "cf_router_lb_security_group" {
111-
name = "${var.env_id}-cf-router-lb-security-group"
112-
description = "CF Router"
113-
vpc_id = local.vpc_id
114-
115-
ingress {
116-
cidr_blocks = ["0.0.0.0/0"]
117-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
118-
protocol = "tcp"
119-
from_port = 80
120-
to_port = 80
121-
}
122-
123-
ingress {
124-
cidr_blocks = ["0.0.0.0/0"]
125-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
126-
protocol = "tcp"
127-
from_port = 443
128-
to_port = 443
129-
}
130-
131-
ingress {
132-
cidr_blocks = ["0.0.0.0/0"]
133-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
134-
protocol = "tcp"
135-
from_port = 4443
136-
to_port = 4443
137-
}
138-
139-
egress {
140-
from_port = 0
141-
to_port = 0
142-
protocol = "-1"
143-
cidr_blocks = ["0.0.0.0/0"]
144-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
145-
}
146-
147-
tags = {
148-
Name = "${var.env_id}-cf-router-lb-security-group"
149-
}
150-
151-
lifecycle {
152-
ignore_changes = [name]
153-
}
154-
}
155-
156-
output "cf_router_lb_security_group" {
157-
value = aws_security_group.cf_router_lb_security_group.id
158-
}
159-
160-
resource "aws_security_group" "cf_router_lb_internal_security_group" {
161-
name = "${var.env_id}-cf-router-lb-internal-security-group"
162-
description = "CF Router Internal"
163-
vpc_id = local.vpc_id
164-
165-
ingress {
166-
security_groups = ["${aws_security_group.cf_router_lb_security_group.id}"]
167-
protocol = "tcp"
168-
from_port = 80
169-
to_port = 80
170-
}
171-
172-
egress {
173-
from_port = 0
174-
to_port = 0
175-
protocol = "-1"
176-
cidr_blocks = ["0.0.0.0/0"]
177-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
178-
}
179-
180-
tags = {
181-
Name = "${var.env_id}-cf-router-lb-internal-security-group"
182-
}
183-
184-
lifecycle {
185-
ignore_changes = [name]
186-
}
187-
}
188-
189-
output "cf_router_lb_internal_security_group" {
190-
value = aws_security_group.cf_router_lb_internal_security_group.id
191-
}
19238

19339
resource "aws_elb" "cf_router_lb" {
19440
name = "${var.short_env_id}-cf-router-lb"
@@ -235,21 +81,6 @@ resource "aws_elb" "cf_router_lb" {
23581
}
23682
}
23783

238-
resource "aws_lb_target_group" "cf_router_4443" {
239-
name = "${var.short_env_id}-routertg-4443"
240-
port = 4443
241-
protocol = "TCP"
242-
vpc_id = local.vpc_id
243-
244-
health_check {
245-
protocol = "TCP"
246-
}
247-
248-
tags = {
249-
Name = "${var.env_id}"
250-
}
251-
}
252-
25384
output "cf_router_lb_name" {
25485
value = aws_elb.cf_router_lb.name
25586
}
@@ -258,80 +89,6 @@ output "cf_router_lb_url" {
25889
value = aws_elb.cf_router_lb.dns_name
25990
}
26091

261-
resource "aws_security_group" "cf_tcp_lb_security_group" {
262-
name = "${var.env_id}-cf-tcp-lb-security-group"
263-
description = "CF TCP"
264-
vpc_id = local.vpc_id
265-
266-
ingress {
267-
cidr_blocks = ["0.0.0.0/0"]
268-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
269-
protocol = "tcp"
270-
from_port = 1024
271-
to_port = 1123
272-
}
273-
274-
egress {
275-
from_port = 0
276-
to_port = 0
277-
protocol = "-1"
278-
cidr_blocks = ["0.0.0.0/0"]
279-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
280-
}
281-
282-
tags = {
283-
Name = "${var.env_id}-cf-tcp-lb-security-group"
284-
}
285-
286-
lifecycle {
287-
ignore_changes = [name]
288-
}
289-
}
290-
291-
output "cf_tcp_lb_security_group" {
292-
value = aws_security_group.cf_tcp_lb_security_group.id
293-
}
294-
295-
resource "aws_security_group" "cf_tcp_lb_internal_security_group" {
296-
name = "${var.env_id}-cf-tcp-lb-internal-security-group"
297-
description = "CF TCP Internal"
298-
vpc_id = local.vpc_id
299-
300-
ingress {
301-
security_groups = ["${aws_security_group.cf_tcp_lb_security_group.id}"]
302-
protocol = "tcp"
303-
from_port = 1024
304-
to_port = 1123
305-
}
306-
307-
ingress {
308-
security_groups = ["${aws_security_group.cf_tcp_lb_security_group.id}"]
309-
protocol = "tcp"
310-
from_port = 80
311-
to_port = 80
312-
}
313-
314-
egress {
315-
from_port = 0
316-
to_port = 0
317-
protocol = "-1"
318-
cidr_blocks = ["0.0.0.0/0"]
319-
ipv6_cidr_blocks = var.dualstack ? ["::/0"] : null
320-
}
321-
322-
tags = {
323-
Name = "${var.env_id}-cf-tcp-lb-security-group"
324-
}
325-
326-
lifecycle {
327-
ignore_changes = [name]
328-
}
329-
}
330-
331-
output "cf_tcp_lb_internal_security_group" {
332-
value = aws_security_group.cf_tcp_lb_internal_security_group.id
333-
}
334-
33592
resource "aws_elb" "cf_tcp_lb" {
33693
name = "${var.short_env_id}-cf-tcp-lb"
33794
cross_zone_load_balancing = true

0 commit comments

Comments
 (0)