-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
2a7dc6e
commit c378fba
Showing
12 changed files
with
581 additions
and
132 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -124,6 +124,7 @@ module "bastion" { | |
| } | ||
|
|
||
| data "aws_ami" "al2023" { | ||
|
|
||
| most_recent = true | ||
| owners = ["amazon"] | ||
| filter { | ||
|
|
||
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| Keeping windmill in its own state to minimise its blast radius. It has access to the base state outputs. | ||
|
|
||
| The database provisioning is manual. The reasons it was not maintained as IaC are: | ||
| - the terraform provider [requires the instance to available](https://github.com/cyrilgdn/terraform-provider-postgresql/issues/81) where the manifests are being processed | ||
| - remote_exec requires management of ssh access to the bastion. | ||
|
|
||
| So, if you have deleted the windmill db or role, you will have to create it _before_ running this manifest. The role password is expected in the SSM parameter `/windmill/db_pass`. | ||
|
|
||
| ## Creating DB objects | ||
| The RDS instance is not accessible from the internet. Use bastion.dev.tyk.technology which has psql installed. Add your key to the [cloudinit template](https://github.com/TykTechnologies/tyk-ci/blob/master/infra/bastion-cloudinit.yaml.tftpl#L19) or use the devacc key. | ||
|
|
||
| Obtain the DB host from the the AWS console or from `tf output` in `../base`. The master password is in SSM Parameter Store as `/base-prod/rds/master`. | ||
|
|
||
| ```shellsession | ||
| $ psql -h postgres15.c1po6t6zkr9a.eu-central-1.rds.amazonaws.com -U master -W -d postgres | ||
| postgres=> create role windmill with nocreatedb nocreaterole login password 'supersekret'; | ||
| CREATE ROLE | ||
| postgres=> create database windmill with owner windmill encoding 'UTF8'; | ||
| ERROR: must be member of role "windmill" | ||
| postgres=> grant windmill to master; | ||
| GRANT ROLE | ||
| postgres=> create database windmill with owner windmill encoding 'UTF8'; | ||
| CREATE DATABASE | ||
| postgres=> CREATE ROLE windmill_user; | ||
| CREATE ROLE | ||
| postgres=> GRANT ALL PRIVILEGES ON DATABASE windmill TO windmill_user; | ||
| GRANT | ||
| postgres=> CREATE ROLE windmill_admin WITH BYPASSRLS; | ||
| CREATE ROLE | ||
| postgres=> GRANT windmill_user TO windmill_admin; | ||
| GRANT ROLE | ||
| postgres=> grant windmill_admin to windmill; | ||
| GRANT ROLE | ||
| postgres=> grant windmill_user to windmill; | ||
| GRANT ROLE | ||
| ``` | ||
|
|
||
| `windmill` is the user used to connect to the database.` windmill_user` and `windmill_admin` and users internal to windmill. The documentation requires giving windmill an RDS instance to itself. By creating these users externally, the shared RDS instance in <../base> can be used. | ||
|
|
||
| Construct the URL to access the DB in SSM as a SecureString with name `/windmill/db_url`. | ||
|
|
||
| ## Applying manifests | ||
| To apply the manifests from scratch, login to AWS on your CLI. You will need at least PowerUser access to the devacc (754489498669) sub-account. Then use the the usual incantation: | ||
|
|
||
| ``` | ||
| terraform init && terraform plan && terraform apply | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| #!/bin/bash | ||
|
|
||
| cat <<'EOF' >> /etc/ecs/ecs.config | ||
| ECS_CLUSTER=${name} | ||
| #ECS_LOGLEVEL=debug | ||
| ECS_ENABLE_TASK_IAM_ROLE=true | ||
| ECS_ENABLE_SPOT_INSTANCE_DRAINING=true | ||
| EOF |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| data "aws_iam_policy_document" "ecs_assume_role_policy" { | ||
| statement { | ||
| actions = ["sts:AssumeRole"] | ||
|
|
||
| principals { | ||
| type = "Service" | ||
| identifiers = ["ecs-tasks.amazonaws.com"] | ||
| } | ||
| } | ||
| } | ||
|
|
||
| # to decrypt secrets in SSM | ||
| data "aws_iam_policy_document" "ssm_decrypt" { | ||
| statement { | ||
| sid = "kms" | ||
| actions = [ | ||
| "kms:Decrypt" | ||
| ] | ||
|
|
||
| resources = [data.terraform_remote_state.base.outputs.kms] | ||
| } | ||
|
|
||
| statement { | ||
| sid = "ssm" | ||
| actions = [ | ||
| "ssm:GetParameters" | ||
| ] | ||
|
|
||
| resources = [data.aws_ssm_parameter.windmill_db_url.arn] | ||
| } | ||
|
|
||
| statement { | ||
| sid = "logs" | ||
| actions = [ | ||
| "logs:CreateLogStream", | ||
| "logs:PutLogEvents" | ||
| ] | ||
|
|
||
| resources = ["*"] | ||
| } | ||
| } | ||
|
|
||
| resource "aws_iam_role" "windmill" { | ||
| name = "windmill" | ||
| path = "/infra/windmill/" | ||
|
|
||
| inline_policy { | ||
| name = "ssm-decrypt" | ||
| policy = data.aws_iam_policy_document.ssm_decrypt.json | ||
| } | ||
| assume_role_policy = data.aws_iam_policy_document.ecs_assume_role_policy.json | ||
| } | ||
|
|
Oops, something went wrong.