Skip to content
This repository is currently being migrated. It's locked while the migration is in progress.

Commit 3912cf5

Browse files
singhalsshughes-uk
singhals
and
shughes-uk
authored
Time to parameterize (#3)
* Start modularizing cube cluster creation * Setup secrets, env vars and container health checks * Add resource config params * move module to a module folder * Migrate to parameterized * Update repo location * Temp update branch * Update cluster name * Install curl * Add cubestore script * Add port for refresh worker and remove health check for cubestore * desired count for cubestore * Move back to main * Update docker/cube/Dockerfile Co-authored-by: Samantha Hughes <[email protected]> --------- Co-authored-by: Samantha Hughes <[email protected]>
1 parent 29f0f35 commit 3912cf5

File tree

18 files changed

+646
-425
lines changed

18 files changed

+646
-425
lines changed

‎.github/workflows/deploy.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,13 @@ jobs:
2626
with:
2727
mask-password: "false"
2828

29-
- name: Build, tag, and push docker image to Amazon ECR
29+
- name: Build, tag, and push cube api docker image to Amazon ECR
3030
env:
3131
REGISTRY: ${{ steps.login-ecr.outputs.registry }}
32-
REPOSITORY: sync-svc-cube
32+
REPOSITORY: prod-sync-cube-ecr
3333
IMAGE_TAG: "${{ github.sha }}"
3434
run: |
35-
docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG .
35+
docker build -t $REGISTRY/$REPOSITORY:$IMAGE_TAG -f docker/cube/Dockerfile .
3636
docker push $REGISTRY/$REPOSITORY:$IMAGE_TAG
3737
3838
- name: Update cube-api Task Definition with latest image
@@ -41,28 +41,28 @@ jobs:
4141
with:
4242
task-definition-family: cube_api
4343
container-name: cube-api
44-
image: ${{ steps.login-ecr.outputs.registry }}/sync-svc-cube:${{ github.sha }}
44+
image: ${{ steps.login-ecr.outputs.registry }}/prod-sync-cube-ecr:${{ github.sha }}
4545

4646
- name: Update cube-refresh-worker Task Definition with latest image
4747
id: cube-refresh-worker-task-def
4848
uses: aws-actions/[email protected]
4949
with:
5050
task-definition-family: cube_refresh_worker
5151
container-name: cube-refresh-worker
52-
image: ${{ steps.login-ecr.outputs.registry }}/sync-svc-cube:${{ github.sha }}
52+
image: ${{ steps.login-ecr.outputs.registry }}/prod-sync-cube-ecr:${{ github.sha }}
5353

5454
- name: Deploy cube-api task definition
5555
uses: aws-actions/[email protected]
5656
with:
5757
task-definition: ${{ steps.cube-api-task-def.outputs.task-definition }}
5858
service: cube_api
59-
cluster: production
59+
cluster: prod-sync_cluster
6060
wait-for-service-stability: true
6161

6262
- name: Deploy cube-refresh-worker task definition
6363
uses: aws-actions/[email protected]
6464
with:
6565
task-definition: ${{ steps.cube-refresh-worker-task-def.outputs.task-definition }}
6666
service: cube_refresh_worker
67-
cluster: production
67+
cluster: prod-sync_cluster
6868
wait-for-service-stability: true

‎Dockerfile‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎deploy_cubestore.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
AWS_REGION="us-east-1"
6+
ECR_REPOSITORY="prod-sync-cubestore-ecr"
7+
8+
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query "Account" --output text)
9+
REGISTRY="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
10+
IMAGE_TAG=$(git rev-parse --short HEAD 2>/dev/null || date +%s)
11+
12+
aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $REGISTRY
13+
14+
docker build --platform linux/amd64 -t $REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f docker/cubestore/Dockerfile .
15+
docker push $REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
16+
17+
echo "New cubestore image pushed to ECR: $REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG. Please update terraform cubestore services task definitions accordingly."

‎docker/cube/Dockerfile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
FROM cubejs/cube:v1.1.9
2+
3+
RUN apt-get update \
4+
&& apt-get install -y --no-install-recommends curl \
5+
&& apt-get clean \
6+
&& rm -rf /var/lib/apt/lists/*
7+
8+
COPY cube.js cube.js
9+
COPY fetch.js fetch.js
10+
RUN mkdir model
11+
COPY model/ model/

‎docker/cubestore/Dockerfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM cubejs/cubestore:latest
2+
3+
RUN apt-get update && apt-get install -y curl

‎terraform/.terraform.lock.hcl‎

Lines changed: 19 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎terraform/ecr.tf‎

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎terraform/main.tf‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,120 @@ provider "aws" {
77
}
88
}
99
}
10+
11+
module "vpc" {
12+
source = "terraform-aws-modules/vpc/aws"
13+
version = ">=5.7.1"
14+
15+
name = "production-vpc"
16+
cidr = "10.0.0.0/16"
17+
18+
azs = ["us-east-1a", "us-east-1b", "us-east-1d", "us-east-1c"]
19+
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24", "10.0.4.0/24"]
20+
public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24", "10.0.104.0/24"]
21+
enable_dns_hostnames = true
22+
enable_dns_support = true
23+
enable_nat_gateway = true
24+
create_igw = true
25+
}
26+
27+
module "production_cube_cluster" {
28+
source = "./modules/cube-cluster"
29+
30+
cluster_prefix = "prod-sync"
31+
vpc = module.vpc
32+
cube_api_domain_name = "cube-api.synccomputing.com"
33+
cube_shared_env = [
34+
{
35+
name = "CUBEJS_DB_SSL"
36+
value = "true"
37+
},
38+
{
39+
name = "CUBEJS_DB_TYPE"
40+
value = "postgres"
41+
},
42+
{
43+
name = "CUBEJS_DB_HOST"
44+
value = "ec2-3-221-59-105.compute-1.amazonaws.com"
45+
},
46+
{
47+
name = "CUBEJS_DB_PORT"
48+
value = "5432"
49+
},
50+
{
51+
name = "CUBEJS_DB_USER"
52+
value = "cube"
53+
},
54+
{
55+
name = "CUBEJS_DB_NAME"
56+
value = "d20nhfliefb6aa"
57+
},
58+
{
59+
name = "CUBEJS_SCHEMA_PATH"
60+
value = "model"
61+
},
62+
{
63+
name = "CUBEJS_DEV_MODE"
64+
value = "false"
65+
},
66+
{
67+
name = "NODE_ENV",
68+
value = "production"
69+
},
70+
{
71+
name = "CUBEJS_JWK_URL"
72+
value = "https://sync-prod.us.auth0.com/.well-known/jwks.json"
73+
},
74+
{
75+
name = "CUBEJS_JWT_AUDIENCE"
76+
value = "https://api.synccomputing.com"
77+
},
78+
{
79+
name = "CUBEJS_JWT_ISSUER"
80+
value = "https://login.app.synccomputing.com/"
81+
},
82+
{
83+
name = "CUBEJS_JWT_ALGS"
84+
value = "RS256"
85+
},
86+
{
87+
name = "CUBEJS_JWT_CLAIMS_NAMESPACE"
88+
value = "https://synccomputing.com/"
89+
}
90+
]
91+
cube_shared_secrets = [
92+
{ name = "CUBEJS_DB_PASS", valueFrom = aws_secretsmanager_secret.postgres_cube_user_pw.arn },
93+
{ name = "CUBEJS_JWT_KEY", valueFrom = aws_secretsmanager_secret.auth0_jwt_key.arn },
94+
]
95+
}
96+
97+
resource "aws_secretsmanager_secret" "postgres_cube_user_pw" {
98+
name = "production/postgres-cube-user-pw"
99+
}
100+
101+
resource "aws_secretsmanager_secret" "auth0_jwt_key" {
102+
name = "production/auth0-jwt-key"
103+
}
104+
105+
resource "aws_iam_openid_connect_provider" "github_openid" {
106+
url = "https://token.actions.githubusercontent.com"
107+
108+
client_id_list = [
109+
"sts.amazonaws.com",
110+
]
111+
112+
thumbprint_list = ["cf23df2207d99a74fbe169e3eba035e633b65d94"]
113+
}
114+
115+
module "iam_github_oidc_role" {
116+
source = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-role"
117+
name = "github_actions_role"
118+
path = "/system/"
119+
description = "GitHub IAM role for GitHub actions"
120+
121+
subjects = ["synccomputingcode/sync-svc-cube-v2:*"]
122+
123+
policies = {
124+
GitHubActionsPolicy = module.production_cube_cluster.cube_repo_ecr_policy.arn
125+
}
126+
}

‎terraform/cloudfront.tf‎ renamed to ‎terraform/modules/cube-cluster/cloudfront.tf‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ data "aws_cloudfront_origin_request_policy" "all_viewers" {
1414
name = "Managed-AllViewer"
1515
}
1616

17-
resource "aws_cloudfront_distribution" "sync_svc_cube_cdn" {
18-
aliases = [local.domain_name, "www.${local.domain_name}"]
17+
resource "aws_cloudfront_distribution" "cube_cdn" {
18+
aliases = [var.cube_api_domain_name]
1919
comment = "Cloudfront distribution for cube.dev api"
2020
price_class = "PriceClass_100"
2121
is_ipv6_enabled = true
@@ -25,12 +25,6 @@ resource "aws_cloudfront_distribution" "sync_svc_cube_cdn" {
2525
domain_name = local.api_domain_name
2626
origin_id = local.api_domain_name
2727

28-
# vpc_origin_config {
29-
# vpc_origin_id = aws_cloudfront_vpc_origin.alb.id
30-
# origin_keepalive_timeout = 5
31-
# origin_read_timeout = 30
32-
# }
33-
3428
custom_origin_config {
3529
http_port = 80
3630
https_port = 443
@@ -64,4 +58,4 @@ resource "aws_cloudfront_distribution" "sync_svc_cube_cdn" {
6458
locations = []
6559
}
6660
}
67-
}
61+
}

‎terraform/cloudwatch.tf‎ renamed to ‎terraform/modules/cube-cluster/cloudwatch.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
resource "aws_cloudwatch_log_group" "main" {
2-
name = "/ecs/sync-svc-cube/production"
2+
name = "/ecs/${var.cluster_prefix}-cube-logs"
33
retention_in_days = 14
44
}

0 commit comments

Comments
 (0)