Skip to content

Commit 34bdf5b

Browse files
dungpham91dungpham91
authored
chore: create Dev environment (#1)
* feat: add tf modules and dev environment * chore: update AMI ID for dev environment * ci: add flow to create backend s3 bucket * ci: fix syntax * ci(fix): update IAM credentials to environment * chore: rebase main branch
1 parent 68d777a commit 34bdf5b

30 files changed

+1944
-0
lines changed

‎env/dev/backend.tf

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
version = "5.83.1"
6+
}
7+
8+
tls = {
9+
source = "hashicorp/tls"
10+
version = "4.0.6"
11+
}
12+
}
13+
14+
backend "s3" {
15+
bucket = "devopslite-tf-state"
16+
key = "dev/terraform.tfstate"
17+
region = "us-east-1"
18+
encrypt = true
19+
dynamodb_table = "devopslite-tf-state"
20+
}
21+
}

‎env/dev/main.tf

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
provider "aws" {
2+
region = var.aws_region
3+
}
4+
5+
module "vpc" {
6+
source = "../../modules/vpc"
7+
aws_region = var.aws_region
8+
default_tags = var.default_tags
9+
project = var.project
10+
environment = var.environment
11+
private_subnets_cidr = var.private_subnets_cidr
12+
public_subnets_cidr = var.public_subnets_cidr
13+
vpc_cidr = var.vpc_cidr
14+
}
15+
16+
module "vpc_endpoint" {
17+
source = "../../modules/vpc-endpoint"
18+
aws_region = var.aws_region
19+
default_tags = var.default_tags
20+
project = var.project
21+
environment = var.environment
22+
private_subnets = module.vpc.aws_subnets_private
23+
route_table_ids = [module.vpc.private_route_table]
24+
vpc_cidr = [module.vpc.cidr_block]
25+
vpc_id = module.vpc.vpc_id
26+
27+
depends_on = [module.vpc]
28+
}
29+
30+
module "kms" {
31+
source = "../../modules/kms"
32+
default_tags = var.default_tags
33+
project = var.project
34+
environment = var.environment
35+
}
36+
37+
module "ssm" {
38+
source = "../../modules/ssm"
39+
project = var.project
40+
environment = var.environment
41+
}
42+
43+
module "bastion" {
44+
source = "../../modules/bastion"
45+
default_tags = var.default_tags
46+
project = var.project
47+
environment = var.environment
48+
ami_id = var.bastion_ami_id
49+
bastion_instance_profile_name = module.ssm.ssm_instance_profile_name
50+
instance_type = var.bation_instance_type
51+
private_subnet_id = module.vpc.aws_subnets_private[0]
52+
vpc_cidr = [module.vpc.cidr_block]
53+
vpc_id = module.vpc.vpc_id
54+
55+
depends_on = [
56+
module.vpc,
57+
module.ssm
58+
]
59+
}
60+
61+
module "ecr_fe" {
62+
source = "../../modules/ecr"
63+
default_tags = var.default_tags
64+
project = var.project
65+
environment = var.environment
66+
kms_key_arn = module.kms.kms_arn
67+
repository_name = "devopslite-fe"
68+
69+
depends_on = [module.kms]
70+
}
71+
72+
module "ecr_be" {
73+
source = "../../modules/ecr"
74+
default_tags = var.default_tags
75+
project = var.project
76+
environment = var.environment
77+
kms_key_arn = module.kms.kms_arn
78+
repository_name = "devopslite-be"
79+
80+
depends_on = [module.kms]
81+
}
82+
83+
module "eks" {
84+
source = "../../modules/eks"
85+
default_tags = var.default_tags
86+
project = var.project
87+
environment = var.environment
88+
bastion_sg_id = module.bastion.bastion_sg_id
89+
vpc_id = module.vpc.vpc_id
90+
vpc_cidr = [module.vpc.cidr_block]
91+
private_subnets = module.vpc.aws_subnets_private
92+
eks_cluster_version = var.eks_cluster_version
93+
kms_key_arn = module.kms.kms_arn
94+
custom_ami_id = var.custom_ami_id
95+
node_group_name = var.node_group_name
96+
node_capacity_type = var.node_capacity_type
97+
node_instance_type = var.node_instance_type
98+
node_group_desired_capacity = var.node_group_desired_capacity
99+
node_group_min_size = var.node_group_min_size
100+
node_group_max_size = var.node_group_max_size
101+
102+
depends_on = [
103+
module.vpc,
104+
module.kms,
105+
module.bastion
106+
]
107+
}
108+
109+
module "eks_access" {
110+
source = "../../modules/eks-access"
111+
project = var.project
112+
environment = var.environment
113+
access_entry_type = var.access_entry_type
114+
access_scope_type = var.access_scope_type
115+
kubernetes_groups = var.kubernetes_groups
116+
policy_arn = var.policy_arn
117+
principal_arn = var.principal_arn
118+
119+
depends_on = [module.eks]
120+
}

‎env/dev/outputs.tf

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
output "eks_cluster_endpoint" {
2+
description = "The endpoint for the EKS cluster."
3+
value = module.eks.eks_cluster_endpoint
4+
}
5+
6+
output "eks_cluster_id" {
7+
description = "The ID of the EKS cluster."
8+
value = module.eks.eks_cluster_id
9+
}
10+
11+
output "eks_cluster_oidc_issuer_url" {
12+
description = "The OIDC issuer URL for the EKS cluster."
13+
value = module.eks.eks_cluster_oidc_issuer_url
14+
}
15+
16+
output "eks_cluster_security_group_id" {
17+
description = "The security group ID for the EKS cluster."
18+
value = module.eks.eks_cluster_security_group_id
19+
}
20+
21+
output "eks_cluster_serviceaccount_role_arn" {
22+
description = "The ARN of the IAM role used by service accounts in the EKS cluster."
23+
value = module.eks.eks_cluster_serviceaccount_role_arn
24+
}
25+
26+
output "eks_node_group_arn" {
27+
description = "The ARN of the EKS node group."
28+
value = module.eks.eks_node_group_arn
29+
}
30+
31+
output "eks_node_group_role_arn" {
32+
description = "The ARN of the IAM role used by the EKS node group."
33+
value = module.eks.eks_node_group_role_arn
34+
}

‎env/dev/variables.tf

+131
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
variable "access_entry_type" {
2+
description = "Type of access entry (STANDARD, EC2, EC2_LINUX, EC2_WINDOWS, FARGATE_LINUX)"
3+
type = string
4+
default = "STANDARD"
5+
}
6+
7+
variable "access_scope_type" {
8+
description = "Type of access scope (namespace or cluster)"
9+
type = string
10+
default = "cluster"
11+
}
12+
13+
variable "aws_region" {
14+
type = string
15+
default = "us-east-1"
16+
}
17+
18+
variable "bastion_ami_id" {
19+
description = "AMI ID for Bastion Host"
20+
type = string
21+
default = "ami-05576a079321f21f8" # Amazon Linux 2023 AMI
22+
}
23+
24+
variable "bation_instance_type" {
25+
description = "Instance type for bastion host"
26+
type = string
27+
default = "t3.micro"
28+
}
29+
30+
variable "custom_ami_id" {
31+
description = "Custom AMI ID for EKS nodes"
32+
type = string
33+
default = "ami-0e28a3d4672edb444" # Get ID after Packer builds AMI
34+
}
35+
36+
variable "default_tags" {
37+
type = map(string)
38+
default = {
39+
Environment = "dev"
40+
Provisioner = "terraform"
41+
Project = "devopslite"
42+
}
43+
}
44+
45+
variable "eks_cluster_version" {
46+
description = "Kubernetes version for the EKS cluster"
47+
type = string
48+
default = "1.31"
49+
}
50+
51+
variable "environment" {
52+
type = string
53+
default = "dev"
54+
}
55+
56+
variable "kubernetes_groups" {
57+
description = "List of Kubernetes groups to grant access to the EKS cluster"
58+
type = list(string)
59+
default = ["admin"]
60+
}
61+
62+
variable "node_capacity_type" {
63+
description = "Capacity type for the EKS node group (ON_DEMAND or SPOT)"
64+
type = string
65+
default = "ON_DEMAND"
66+
}
67+
68+
variable "node_group_desired_capacity" {
69+
description = "Desired number of nodes in the EKS node group"
70+
type = number
71+
default = 2
72+
}
73+
74+
variable "node_group_max_size" {
75+
description = "Maximum number of nodes in the EKS node group"
76+
type = number
77+
default = 3
78+
}
79+
80+
variable "node_group_min_size" {
81+
description = "Minimum number of nodes in the EKS node group"
82+
type = number
83+
default = 1
84+
}
85+
86+
variable "node_group_name" {
87+
description = "Name of the EKS node group"
88+
type = string
89+
default = "ng"
90+
}
91+
92+
variable "node_instance_type" {
93+
description = "Instance type for the EKS nodes"
94+
type = string
95+
default = "t3.small"
96+
}
97+
98+
variable "policy_arn" {
99+
description = "ARN of the IAM policy to associate with the principal"
100+
type = string
101+
default = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
102+
}
103+
104+
variable "principal_arn" {
105+
description = "ARN of the principal to grant access to the EKS cluster"
106+
type = string
107+
default = null
108+
}
109+
110+
variable "private_subnets_cidr" {
111+
description = "CIDR blocks for the private subnets"
112+
type = list(string)
113+
default = ["172.16.10.0/24", "172.16.20.0/24", "172.16.30.0/24"]
114+
}
115+
116+
variable "project" {
117+
type = string
118+
default = "devopslite"
119+
}
120+
121+
variable "public_subnets_cidr" {
122+
description = "CIDR blocks for the public subnets"
123+
type = list(string)
124+
default = ["172.16.1.0/24", "172.16.2.0/24", "172.16.3.0/24"]
125+
}
126+
127+
variable "vpc_cidr" {
128+
description = "CIDR block for the VPC"
129+
type = string
130+
default = "172.16.0.0/16"
131+
}

‎modules/bastion/main.tf

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
data "aws_region" "current" {}
2+
3+
resource "aws_security_group" "bastion_sg" {
4+
name = "${var.project}-${var.environment}-bastion-sg"
5+
vpc_id = var.vpc_id
6+
description = "Security group for bastion host"
7+
ingress {
8+
description = "Allow SSH from VPC CIDR"
9+
from_port = 22
10+
to_port = 22
11+
protocol = "tcp"
12+
cidr_blocks = var.vpc_cidr
13+
}
14+
egress {
15+
description = "Allow all traffic to all destinations"
16+
from_port = 0
17+
to_port = 0
18+
protocol = -1
19+
cidr_blocks = ["0.0.0.0/0"]
20+
}
21+
tags = merge(
22+
var.default_tags,
23+
{
24+
Name = "${var.project}-${var.environment}-bastion-sg"
25+
}
26+
)
27+
}
28+
29+
resource "aws_instance" "bastion_host" {
30+
# checkov:skip=CKV_AWS_126: "Ensure that detailed monitoring is enabled for EC2 instances"
31+
ami = var.ami_id
32+
instance_type = var.instance_type
33+
subnet_id = var.private_subnet_id
34+
vpc_security_group_ids = [aws_security_group.bastion_sg.id]
35+
iam_instance_profile = var.bastion_instance_profile_name
36+
ebs_optimized = true
37+
38+
metadata_options {
39+
http_endpoint = "enabled"
40+
http_tokens = "required"
41+
}
42+
43+
root_block_device {
44+
encrypted = true
45+
}
46+
47+
tags = merge(
48+
var.default_tags,
49+
{
50+
Name = "${var.project}-${var.environment}-bastion-host"
51+
}
52+
)
53+
user_data = base64encode(<<-EOF
54+
#!/bin/bash
55+
yum install -y https://s3.${data.aws_region.current.name}.amazonaws.com/amazon-ssm-${data.aws_region.current.name}/latest/linux_amd64/amazon-ssm-agent.rpm
56+
systemctl enable amazon-ssm-agent
57+
systemctl start amazon-ssm-agent
58+
EOF
59+
)
60+
}

‎modules/bastion/outputs.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "bastion_instance_id" {
2+
value = aws_instance.bastion_host.id
3+
description = "The ID of bastion ec2 instance"
4+
}
5+
6+
output "bastion_sg_id" {
7+
value = aws_security_group.bastion_sg.id
8+
description = "The ID of bastion security group"
9+
}

0 commit comments

Comments
 (0)