diff --git a/terraform/.gitignore b/terraform/.gitignore index 6dafb3a..9b0f74f 100644 --- a/terraform/.gitignore +++ b/terraform/.gitignore @@ -3,3 +3,6 @@ terraform.state terraform.state.backup id_mesosphere id_mesosphere.pub +*.tfplan +*.tfstate +*.tfstate.backup diff --git a/terraform/README.md b/terraform/README.md index 48c06e6..e0b0ba1 100644 --- a/terraform/README.md +++ b/terraform/README.md @@ -15,7 +15,7 @@ Additional `aws_tags` can be specified on apply to play nicely with `cloud-cleaner`: ```bash - terraform apply -var 'aws_tags={"owner":"my_name","expiration"="10h"}' ag.tfplan + terraform apply -var 'aws_tags={"owner"="my_name","expiration"="10h"}' ag.tfplan ``` ## Setup @@ -34,11 +34,12 @@ then downloads a set of packages from them to cache. It then creates a local repo from those cached packages and serves the out to the private subnet. A docker registry is also configured on the `jumpbox`. + In the `private` subnet, the `bootstrap` node is launched as well as an ELB to sit infront of the `bootstrap`. On all the `bootstrap` instance a `user_data` script is created that disables all existing yum repos, and installs a single repo that points to -the jumpbox. This allows dependancies of the bundled packages in `konvoy` to +the jumpbox. This allows dependencies of the bundled packages in `konvoy` to be resolved automatically, but it also requires that the `jumpbox` and the cluster nodes use the same version of centos. @@ -53,21 +54,55 @@ The docker registry running on the `jumpbox` will need to be manually seeded with the required images. ## Initialize terraform + ```bash docker run -i -t -v $(pwd):/tf --workdir=/tf hashicorp/terraform:light init ``` ## Generate plan + +You can run build the simple plan: + ```bash docker run -i -t -v $(pwd):/tf --workdir=/tf hashicorp/terraform:light plan -out=ag.tfplan ``` +-or- + +Add some extra vars. + +```bash +docker run -i -t -v $(pwd):/tf --workdir=/tf hashicorp/terraform:light plan -var 'aws_tags={"owner"="my_name","expiration"="10h"}' -var 'cluster_name="air_gap_test"' -out=ag.tfplan +``` + +Note: This will ask for your ~/.aws/credential sets if you don't have them in you ENV. +The environment variables must be in the format `TF_VAR_name` and this will be checked last for a value + +You could also modify the `main.tf` with an explicit aws shared credentials file. + +```json +provider "aws" { + shared_credentials_file = "~/.aws/credentials" + profile = "customprofile" +} +``` + ## Apply plan + ```bash docker run -i -t -v $(pwd):/tf --workdir=/tf hashicorp/terraform:light apply ag.tfplan ``` +## Connect to the AirGap Machine + +* `54.185.129.50` is the External IP of the Public Node +* `10.0.0.233` is the Internal IP of the Private(AirGap) Node + +Example: +`ssh -o 'ProxyCommand ssh -W %h:%p -i id_mesosphere centos@54.185.129.50' -i id_mesosphere centos@10.0.0.233` + ## Destroy cluster + ```bash docker run -i -t -v $(pwd):/tf --workdir=/tf hashicorp/terraform:light destroy --force ``` diff --git a/terraform/main.tf b/terraform/main.tf index 8cbf953..a59abcd 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -3,11 +3,11 @@ variable "aws_secret_key" {} variable "aws_session_token" {} provider "aws" { - version = "~> 2.4" - region = "${var.aws_region}" + version = "~> 2.4" + region = "${var.aws_region}" access_key = "${var.aws_access_key_id}" secret_key = "${var.aws_secret_key}" - token = "${var.aws_session_token}" + token = "${var.aws_session_token}" } provider "random" { @@ -21,8 +21,8 @@ resource "random_id" "id" { locals { cluster_name = "${var.cluster_name_random_string ? format("%s-%s", var.cluster_name, random_id.id.hex) : var.cluster_name}" - jumpbox_keypair_name = "${local.cluster_name}-jumpbox" - instance_jumpbox_name = "${local.cluster_name}-jumpbox" + jumpbox_keypair_name = "${local.cluster_name}-jumpbox" + instance_jumpbox_name = "${local.cluster_name}-jumpbox" instance_bootstrap_name = "${local.cluster_name}-bootstrap" repo_port = 80 @@ -101,7 +101,7 @@ data "template_file" "cluster_userdata" { } resource "aws_instance" "bootstrap" { - ami = "${var.cluster_ami_id}" + ami = "${var.cluster_ami_id}" instance_type = "${var.bootstrap_instance_type}" key_name = "${aws_key_pair.jumpbox.key_name}" @@ -117,11 +117,12 @@ resource "aws_instance" "bootstrap" { tags = "${merge( var.aws_tags, - map( - "Name", "${local.instance_bootstrap_name}", - ) - )}" + map( + "Name", "${local.instance_bootstrap_name}", + ) + )}" } + output "jumpbox_public_ip" { value = "${aws_instance.jumpbox.public_ip}" } diff --git a/terraform/network.tf b/terraform/network.tf index 0e5b457..24a3aca 100644 --- a/terraform/network.tf +++ b/terraform/network.tf @@ -5,7 +5,7 @@ locals { public_name = "${local.vpc_name}-public" private_name = "${local.vpc_name}-public" sg_cluster_name = "${local.cluster_name}-cluster" - sg_jumpbox_name = "${local.instance_jumpbox_name}" + sg_jumpbox_name = "${local.cluster_name}-jump" public_route_name = "${local.vpc_name}-public-route" } @@ -157,4 +157,3 @@ resource "aws_security_group" "cluster" { cidr_blocks = ["${aws_subnet.private.cidr_block}"] } } - diff --git a/terraform/variables.tf b/terraform/variables.tf index 7e4c986..dc43705 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -14,13 +14,13 @@ variable "cluster_name_random_string" { } variable "admin_cidr_blocks" { - type = "list" + type = list(string) description = "Admin CIDR blocks that can access the cluster from outside" default = ["0.0.0.0/0"] } variable "bootstrap_ips" { - type = "list" + type = list(string) description = "Control plane ip addresses" default = ["10.1.0.20"] } @@ -42,7 +42,7 @@ variable "ssh_user" { variable "aws_tags" { description = "Add custom tags to all resources" - type = "map" + type = map(string) default = {} } @@ -93,7 +93,7 @@ variable "cluster_ami_id" { variable "cache_packages" { description = "Packages to cache in the jumpbox repo" - type = "list" + type = list(string) default = [] }