Skip to content

Commit d16f73a

Browse files
rsandorrsandor
committed
SAN-4262; Terraform (#470)
* First steps with terraform. * Basic working VPC setup with public subnet, bastion, and nat. * Tag formatting. * Nearly working, just need outbound from private through nat. * Fully working vpc base. * Added basic readme to describe usage and scope. * Use route resources over embedded. * Fixed typo in docs. * Conform to tag standards. * Removed depends_on * Removed nat instance options.
1 parent 5feded7 commit d16f73a

16 files changed

Lines changed: 455 additions & 1 deletion

File tree

‎.gitignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,6 @@ ca.srl
1111
ansible/roles/hipache/templates/runnable*
1212
ansible/certs/*
1313
*.retry
14-
14+
*.tfstate*
15+
terraform/credentials.tfvars
16+
terraform/.build

‎ssh/config‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ Host epsilon*
1616
StrictHostKeyChecking no
1717
Identityfile ~/.ssh/epsilon.pem
1818

19+
Host zeta*
20+
User ubuntu
21+
ForwardAgent yes
22+
StrictHostKeyChecking no
23+
Identityfile ~/.ssh/zeta.pem
24+
1925
################################################################################
2026
# utility
2127
################################################################################
@@ -274,3 +280,10 @@ Host 127.0.0.1
274280
UserKnownHostsFile /dev/null
275281
User core
276282
LogLevel QUIET
283+
284+
################################################################################
285+
# Zeta Environment (Terraform Infrastructure Migration)
286+
################################################################################
287+
Host zeta-bastion
288+
HostName 52.24.4.209
289+
Port 22

‎terraform/Makefile‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
.DEFAULT_GOAL := help
2+
.PHONY: help plan apply deps
3+
4+
TF_SOURCE := sandbox
5+
BUILD_DIR := .build
6+
BUILD_TARGET := sandbox.tf
7+
CREDENTIALS_FILE := credentials.tfvars
8+
9+
help:
10+
@echo "Builds Runnable AWS infrastructures with Terraform"
11+
@echo ""
12+
@echo "Environment Variables:"
13+
@echo " TERRAFORM_ENVIRONMENT - Name of the environment for which to apply changes"
14+
@echo ""
15+
@echo "Targets:"
16+
@echo " apply Commits the plan and builds the infrastructure"
17+
@echo " deps Ensures system requirements are met to run Terraform"
18+
@echo " env Display the working environment (TERRAFORM_ENVIRONMENT)"
19+
@echo " help Displays this message"
20+
@echo " plan Builds a new Terraform plan"
21+
@echo ""
22+
@echo "For an indepth guide see: https://github.com/codenow/devops-scripts README"
23+
24+
env:
25+
@echo "Working environment: ${TERRAFORM_ENVIRONMENT}"
26+
27+
deps:
28+
@hash terraform > /dev/null 2>&1 || \
29+
(echo "Terraform not installed (try: brew install terraform)"; exit 1)
30+
@test -n "$(TERRAFORM_ENVIRONMENT)" || \
31+
(echo "Variable TERRAFORM_ENVIRONMENT is missing"; exit 1)
32+
@test -e "${CREDENTIALS_FILE}" || \
33+
(echo "Cannot find credentials variables, ask someone for '${CREDENTIALS_FILE}'")
34+
35+
compile:
36+
@echo "Compiling .tf files from sandbox/"
37+
@mkdir -p .build
38+
@find ${TF_SOURCE} \
39+
| grep -E '${TF_SOURCE}/.*[.]tf' \
40+
| xargs cat > ${BUILD_DIR}/${BUILD_TARGET}
41+
42+
apply: compile deps
43+
terraform apply \
44+
-var-file="${CREDENTIALS_FILE}" \
45+
-var-file="environment/${TERRAFORM_ENVIRONMENT}.tfvars" \
46+
${BUILD_DIR}/
47+
48+
destroy: compile deps
49+
terraform destroy \
50+
-var-file="${CREDENTIALS_FILE}" \
51+
-var-file="environment/${TERRAFORM_ENVIRONMENT}.tfvars" \
52+
${BUILD_DIR}/
53+
54+
plan: compile deps
55+
terraform plan \
56+
-var-file="${CREDENTIALS_FILE}" \
57+
-var-file="environment/${TERRAFORM_ENVIRONMENT}.tfvars" \
58+
${BUILD_DIR}/

‎terraform/README.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# devops-scripts/terraform
2+
3+
## Overview
4+
The `terraform/` directory in `devops-scripts` defines our sandboxes infrastructure
5+
as code via [Hashicorp's Terraform Tool](https://terraform.io). To begin let's look
6+
at the overall directory structure:
7+
8+
- `Makefile` - Makefile used to build, destroy, and mutate the sandboxes AWS infrastructure.
9+
- `environment/` - Holds variable definitions for each of the environments we maintain.
10+
- `sandbox/` - Contains the Terraform files (`*.tf`) that describe the sandboxes infrastructure.
11+
12+
Take a moment to familiarize yourself with the layout of the files listed above.
13+
14+
## How to develop
15+
16+
1. Set the `TERRAFORM_ENVIRONMENT` environment variable to `zeta` in your shell.
17+
2. Get a copy of the `credentials.tfvars` file from @rsandor.
18+
3. Make changes to the `*.tf` files that describe your infrastructure change.
19+
4. Run `make plan` from the `terraform/` directory
20+
5. Once satisfied with the resulting diff, run `make apply` to apply changes.
21+
22+
**Note:** currently only members of the devops team are allowed to have credentials
23+
that can mutate the entire infrastructure. For the foreseeable future no execeptions
24+
will be made.

‎terraform/environment/zeta.tfvars‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/**
2+
* Variable definitions for the Runnable sandboxes `zeta` environment. This
3+
* environment will be used to migrate from our old "by hand" infrastructure to
4+
* management by terraform.
5+
*/
6+
7+
environment = "zeta"
8+
key_name = "zeta"
9+
provider.region = "us-west-2"
10+
11+
/**
12+
* VPC resource configuration.
13+
*/
14+
vpc.cidr_block = "10.248.0.0/16"
15+
16+
/**
17+
* Subnet configuration.
18+
*/
19+
public-subnet.cidr_block_a = "10.248.0.0/24"
20+
public-subnet.cidr_block_b = "10.248.1.0/24"
21+
public-subnet.cidr_block_c = "10.248.2.0/24"
22+
public-subnet.cidr_block_reserved = "10.248.3.0/24"
23+
24+
private-subnet.cidr_block_a = "10.248.4.0/24"
25+
private-subnet.cidr_block_b = "10.248.5.0/24"
26+
private-subnet.cidr_block_c = "10.248.6.0/24"
27+
private-subnet.cidr_block_reserved = "10.248.7.0/24"
28+
29+
/**
30+
* Instance level configuration.
31+
*/
32+
bastion.ssh_port = "22"

‎terraform/sandbox/instance/bastion.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Bastion server for the VPC. The bastion server allows those with credentials
3+
* (e.g. a signed pem file) to SSH through it and into the private subnet.
4+
*/
5+
resource "aws_instance" "bastion" {
6+
tags {
7+
Name = "bastion"
8+
Environment = "${var.environment}"
9+
}
10+
11+
ami = "${var.bastion.ami}"
12+
associate_public_ip_address = true
13+
instance_type = "${var.bastion.instance_type}"
14+
key_name = "${var.key_name}"
15+
security_groups = [
16+
"${aws_security_group.bastion.id}"
17+
]
18+
subnet_id = "${aws_subnet.public-a.id}"
19+
}

‎terraform/sandbox/instance/private-example.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Private example server. This is to test whether or not bastion is working
3+
* correctly in the vpc.
4+
*/
5+
resource "aws_instance" "private-example" {
6+
tags {
7+
Name = "private-example"
8+
Environment = "${var.environment}"
9+
}
10+
11+
ami = "ami-9abea4fb"
12+
associate_public_ip_address = false
13+
instance_type = "t2.micro"
14+
key_name = "${var.key_name}"
15+
security_groups = [
16+
"${aws_security_group.private-example.id}"
17+
]
18+
subnet_id = "${aws_subnet.private-a.id}"
19+
}

‎terraform/sandbox/provider.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
/*
2+
* Default provider for all Runnable AWS resources.
3+
* @see https://www.terraform.io/docs/providers/aws/index.html
4+
* @author Ryan Sandor Richards
5+
*/
6+
provider "aws" {
7+
region = "us-west-2"
8+
access_key = "${var.provider.access_key}"
9+
secret_key = "${var.provider.secret_key}"
10+
}

‎terraform/sandbox/security_group/bastion.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* Bastion security group. This allows trusted external sources to talk to
3+
* machines within the packer VPCs private subnet.
4+
*/
5+
resource "aws_security_group" "bastion" {
6+
tags {
7+
Name = "bastion"
8+
Environment = "${var.environment}"
9+
}
10+
11+
vpc_id = "${aws_vpc.sandbox.id}"
12+
name = "bastion"
13+
description = "Ingress/Egress rules for the VPC bastion server"
14+
}
15+
16+
/**
17+
* Allows inbound SSH connections from the internet to the bastion server.
18+
*/
19+
resource "aws_security_group_rule" "bastion-ingress-ssh" {
20+
type = "ingress"
21+
security_group_id = "${aws_security_group.bastion.id}"
22+
from_port = "${var.bastion.ssh_port}"
23+
to_port = "${var.bastion.ssh_port}"
24+
protocol = "tcp"
25+
cidr_blocks = ["0.0.0.0/0"]
26+
}
27+
28+
/**
29+
* Allows all outbound traffic from the bastion server.
30+
*/
31+
resource "aws_security_group_rule" "bastion-egress-all" {
32+
type = "egress"
33+
security_group_id = "${aws_security_group.bastion.id}"
34+
from_port = 0
35+
to_port = 0
36+
protocol = "-1"
37+
cidr_blocks = ["0.0.0.0/0"]
38+
}

‎terraform/sandbox/security_group/private-example.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* Security group for the private-example server.
3+
*/
4+
resource "aws_security_group" "private-example" {
5+
tags {
6+
Name = "private-example"
7+
Environment = "${var.environment}"
8+
}
9+
10+
vpc_id = "${aws_vpc.sandbox.id}"
11+
name = "private-example"
12+
description = "Example private subnet security group"
13+
}
14+
15+
/**
16+
* Allows SSH (port 22) traffic inbound to private-example security group via
17+
* the bastion security group.
18+
*/
19+
resource "aws_security_group_rule" "private-example-inbound-bastion" {
20+
type = "ingress"
21+
security_group_id = "${aws_security_group.private-example.id}"
22+
source_security_group_id = "${aws_security_group.bastion.id}"
23+
from_port = 22
24+
to_port = 22
25+
protocol = "tcp"
26+
}
27+
28+
/**
29+
* Allows all outbound on the private-example security group.
30+
*/
31+
resource "aws_security_group_rule" "private-example-outbound-all" {
32+
type = "egress"
33+
security_group_id = "${aws_security_group.private-example.id}"
34+
from_port = 0
35+
to_port = 0
36+
protocol = "-1"
37+
cidr_blocks = ["0.0.0.0/0"]
38+
}

0 commit comments

Comments
 (0)