Skip to content

Commit d8c39ec

Browse files
jasonwalshjasonwalsh
authoredOct 27, 2020
feat: add worker module (#2)
* feat: add worker module The worker module is responsible for creating an Auto Scaling Group of Boundary workers. The `worker` module is dependent on the `controller` module. In order to allow the workers to connect to the controller hosts, the `worker` module requires the `ip_addresses` variable. The value of the `ip_addresses` variable is a list of strings, where each value is the private IP address of each controller EC2 instance instance in the Auto Scaling Group. When the `controller` module initializes the PostgreSQL database, it writes the credentials for the `admin` user to stdout. The `boundary` module will grep the contents of the `/var/log/cloud-init-output.log` file and if it contains the text "Initial auth information", then it writes the contents to an S3 bucket. Writing the contents to an S3 bucket ensures that the admin credentials are always available to the user, even if the Auto Scaling Group is re-created. * docs: update module documentation * docs: update README
·
v1.3.0v1.0.0
1 parent db80ec2 commit d8c39ec

17 files changed

+602
-40
lines changed
 

‎README.md

+89
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,86 @@
1+
## Contents
2+
3+
- [Usage](#usage)
4+
- [Life cycle](#life-cycle)
5+
- [Contributing](#contributing)
6+
- [Inputs](#inputs)
7+
- [Outputs](#outputs)
8+
- [License](#license)
9+
10+
**Note:** Like HashiCorp Boundary, this module is relatively new and may contain some issues. If you do experience an issue, please create a [new issue](https://github.com/jasonwalsh/terraform-aws-boundary/issues) in the repository. Pull requests are also welcome!
11+
12+
## Usage
13+
14+
This module uses Terraform to install [HashiCorp Boundary](https://www.boundaryproject.io/) in an Amazon Web Services (AWS) account.
15+
16+
This module uses the [official documentation](https://www.boundaryproject.io/docs/installing/high-availability) to install a highly available service.
17+
18+
![high-availability-service](https://www.boundaryproject.io/img/production.png)
19+
20+
This module creates the following resources:
21+
22+
- A virtual private cloud with all associated networking resources (e.g., public and private subnets, route tables, internet gateways, NAT gateways, etc)
23+
- A PostgreSQL RDS instance used by the [Boundary controllers](https://www.boundaryproject.io/docs/installing/postgres)
24+
- Two [AWS KMS](https://www.boundaryproject.io/docs/configuration/kms/awskms) keys, one for `root` and the other for `worker-auth`
25+
- An application load balancer (ALB) that serves as a gateway to the Boundary UI/API
26+
- Two auto scaling groups, one for controller instances and the other for worker instances
27+
28+
For more information on Boundary, please visit the [official documentation](https://www.boundaryproject.io/docs) or the [tutorials](https://learn.hashicorp.com/boundary) on HashiCorp Learn.
29+
30+
To use this module, the following environment variables are required:
31+
32+
| Name |
33+
|------|
34+
| `AWS_ACCESS_KEY_ID` |
35+
| `AWS_SECRET_ACCESS_KEY` |
36+
| `AWS_DEFAULT_REGION` |
37+
38+
After exporting the environment variables, simply run the following command:
39+
40+
```
41+
$ terraform apply
42+
```
43+
44+
## Life cycle
45+
46+
This module creates the controller instances *before* the worker instances. This implicit dependency ensures that the controller and worker instances share the same `worker-auth` KMS key.
47+
48+
The [controller](modules/controller) module also initializes the PostgreSQL database using the following command:
49+
50+
```
51+
$ boundary database init -config /etc/boundary/configuration.hcl
52+
```
53+
54+
After initializing the database, Boundary outputs information required to authenticate as defined [here](https://learn.hashicorp.com/tutorials/boundary/getting-started-dev?in=boundary/getting-started). Notably, the Auth Method ID, Login Name, and Password are generated.
55+
56+
Since initializing the database is a one-time operation, this module writes the output of the command to an S3 bucket so that the user always has access to this information.
57+
58+
In order to retrieve the information, you can invoke the following command:
59+
60+
```
61+
$ $(terraform output s3command)
62+
```
63+
64+
**Note:** The `$` before the `(` is required to run this command.
65+
66+
The result of running the command displays the contents of the [`cloud-init-output.log`](https://cloudinit.readthedocs.io/en/latest/topics/logging.html), which contains the output of the `boundary database init` command.
67+
68+
After you run this command, you can visit the Boundary UI using the `dns_name` output.
69+
70+
To authenticate to Boundary, you can reference [this](https://learn.hashicorp.com/tutorials/boundary/getting-started-connect?in=boundary/getting-started) guide.
71+
72+
**Note:** If you attempt to run the `authenticate` command and are met with this error `Error trying to perform authentication: dial tcp 127.0.0.1:9200: connect: connection refused`, you can export the `BOUNDARY_ADDR` environment variable to the value of the DNS name of the ALB. For example:
73+
74+
```
75+
export BOUNDARY_ADDR="http://$(terraform output dns_name)"
76+
```
77+
78+
## Contributing
79+
80+
As mentioned in the beginning of the README, this module is relatively new and may have issues. If you do discover an issue, please create a [new issue](https://github.com/jasonwalsh/terraform-aws-boundary/issues) or a [pull request](https://github.com/jasonwalsh/terraform-aws-boundary/pulls).
81+
82+
As always, thanks for using this module!
83+
184
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
285
## Requirements
386

@@ -10,6 +93,7 @@
1093
| Name | Version |
1194
|------|---------|
1295
| aws | n/a |
96+
| random | n/a |
1397

1498
## Inputs
1599

@@ -35,5 +119,10 @@
35119
| Name | Description |
36120
|------|-------------|
37121
| dns\_name | The public DNS name of the controller load balancer |
122+
| s3command | The S3 cp command used to display the contents of the cloud-init-output.log |
38123

39124
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
125+
126+
## License
127+
128+
[MIT License](LICENSE)

‎main.tf

+38
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,30 @@ data "aws_ami" "boundary" {
2525
owners = ["aws-marketplace"]
2626
}
2727

28+
data "aws_s3_bucket_objects" "cloudinit" {
29+
bucket = aws_s3_bucket.boundary.id
30+
31+
depends_on = [module.controllers]
32+
}
33+
34+
resource "random_string" "boundary" {
35+
length = 16
36+
special = false
37+
upper = false
38+
}
39+
40+
resource "aws_s3_bucket" "boundary" {
41+
acl = "private"
42+
bucket = "boundary-${random_string.boundary.result}"
43+
force_destroy = true
44+
tags = local.tags
45+
}
46+
2847
module "controllers" {
2948
source = "./modules/controller"
3049

3150
boundary_release = var.boundary_release
51+
bucket_name = aws_s3_bucket.boundary.id
3252
desired_capacity = var.controller_desired_capacity
3353
image_id = local.image_id
3454
instance_type = var.controller_instance_type
@@ -40,6 +60,24 @@ module "controllers" {
4060
vpc_id = local.vpc_id
4161
}
4262

63+
module "workers" {
64+
source = "./modules/worker"
65+
66+
boundary_release = var.boundary_release
67+
bucket_name = aws_s3_bucket.boundary.id
68+
desired_capacity = var.worker_desired_capacity
69+
image_id = local.image_id
70+
instance_type = var.worker_instance_type
71+
ip_addresses = module.controllers.ip_addresses
72+
kms_key_id = module.controllers.kms_key_id
73+
max_size = var.worker_max_size
74+
min_size = var.worker_min_size
75+
public_subnets = local.public_subnets
76+
security_group_id = module.controllers.security_group_id
77+
tags = local.tags
78+
vpc_id = local.vpc_id
79+
}
80+
4381
module "vpc" {
4482
source = "terraform-aws-modules/vpc/aws"
4583

‎modules/boundary/README.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
2+
## Requirements
3+
4+
No requirements.
5+
6+
## Providers
7+
8+
No provider.
9+
10+
## Inputs
11+
12+
| Name | Description | Type | Default | Required |
13+
|------|-------------|------|---------|:--------:|
14+
| auto\_scaling\_group\_name | The name of the Auto Scaling group | `string` | n/a | yes |
15+
| boundary\_release | The version of Boundary to install | `string` | n/a | yes |
16+
| bucket\_name | The name of the bucket to upload the contents of the<br>cloud-init-output.log file | `string` | n/a | yes |
17+
| desired\_capacity | The desired capacity is the initial capacity of the Auto Scaling group<br>at the time of its creation and the capacity it attempts to maintain. | `number` | `0` | no |
18+
| iam\_instance\_profile | The name or the Amazon Resource Name (ARN) of the instance profile associated<br>with the IAM role for the instance | `string` | `""` | no |
19+
| image\_id | The ID of the Amazon Machine Image (AMI) that was assigned during registration | `string` | n/a | yes |
20+
| instance\_type | Specifies the instance type of the EC2 instance | `string` | n/a | yes |
21+
| key\_name | The name of the key pair | `string` | `""` | no |
22+
| max\_size | The maximum size of the group | `number` | n/a | yes |
23+
| min\_size | The minimum size of the group | `number` | n/a | yes |
24+
| runcmd | Run arbitrary commands at a rc.local like level with output to the<br>console. Each item can be either a list or a string. | `list(string)` | `[]` | no |
25+
| security\_groups | A list that contains the security groups to assign to the instances in the Auto<br>Scaling group | `list(string)` | `[]` | no |
26+
| tags | One or more tags. You can tag your Auto Scaling group and propagate the tags to<br>the Amazon EC2 instances it launches. | `map(string)` | `{}` | no |
27+
| target\_group\_arns | The Amazon Resource Names (ARN) of the target groups to associate with the Auto<br>Scaling group | `list(string)` | `[]` | no |
28+
| vpc\_zone\_identifier | A comma-separated list of subnet IDs for your virtual private cloud | `list(string)` | n/a | yes |
29+
| write\_files | Write out arbitrary content to files, optionally setting permissions | <pre>list(object({<br> content = string<br> owner = string<br> path = string<br> permissions = string<br> }))</pre> | `[]` | no |
30+
31+
## Outputs
32+
33+
| Name | Description |
34+
|------|-------------|
35+
| auto\_scaling\_group\_name | The name of the controller Auto Scaling group |
36+
37+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/boundary/main.tf

+6-1
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,17 @@ locals {
1313

1414
runcmd = concat(
1515
[
16+
"curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip",
17+
"unzip awscliv2.zip",
18+
"./aws/install",
1619
"wget -O boundary.zip ${local.download_url}",
1720
"unzip boundary.zip -d /usr/local/bin"
1821
],
1922
var.runcmd,
2023
[
2124
"systemctl enable boundary",
22-
"systemctl start boundary"
25+
"systemctl start boundary",
26+
"grep 'Initial auth information' /var/log/cloud-init-output.log && aws s3 cp /var/log/cloud-init-output.log s3://${var.bucket_name}/{{v1.local_hostname}}/cloud-init-output.log || true"
2327
]
2428
)
2529

@@ -56,6 +60,7 @@ module "autoscaling" {
5660
target_group_arns = var.target_group_arns
5761

5862
user_data = <<EOF
63+
## template: jinja
5964
#cloud-config
6065
${yamlencode(local.user_data)}
6166
EOF

‎modules/boundary/outputs.tf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "auto_scaling_group_name" {
2+
description = "The name of the controller Auto Scaling group"
3+
value = module.autoscaling.this_autoscaling_group_name
4+
}

‎modules/boundary/variables.tf

+9-1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,15 @@ variable "boundary_release" {
88
type = string
99
}
1010

11+
variable "bucket_name" {
12+
description = <<EOF
13+
The name of the bucket to upload the contents of the
14+
cloud-init-output.log file
15+
EOF
16+
17+
type = string
18+
}
19+
1120
variable "desired_capacity" {
1221
default = 0
1322

@@ -116,7 +125,6 @@ variable "write_files" {
116125

117126
type = list(object({
118127
content = string
119-
encoding = string
120128
owner = string
121129
path = string
122130
permissions = string

‎modules/controller/README.md

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
2+
## Requirements
3+
4+
No requirements.
5+
6+
## Providers
7+
8+
| Name | Version |
9+
|------|---------|
10+
| aws | n/a |
11+
| random | n/a |
12+
13+
## Inputs
14+
15+
| Name | Description | Type | Default | Required |
16+
|------|-------------|------|---------|:--------:|
17+
| boundary\_release | The version of Boundary to install | `string` | `"0.1.0"` | no |
18+
| bucket\_name | The name of the bucket to upload the contents of the<br>cloud-init-output.log file | `string` | n/a | yes |
19+
| desired\_capacity | The desired capacity is the initial capacity of the Auto Scaling group<br>at the time of its creation and the capacity it attempts to maintain. | `number` | `3` | no |
20+
| image\_id | The ID of the Amazon Machine Image (AMI) that was assigned during registration | `string` | n/a | yes |
21+
| instance\_type | Specifies the instance type of the EC2 instance | `string` | `"t3.small"` | no |
22+
| key\_name | The name of the key pair | `string` | `""` | no |
23+
| max\_size | The maximum size of the group | `number` | `3` | no |
24+
| min\_size | The minimum size of the group | `number` | `3` | no |
25+
| private\_subnets | List of private subnets | `list(string)` | n/a | yes |
26+
| public\_subnets | List of public subnets | `list(string)` | n/a | yes |
27+
| tags | One or more tags. You can tag your Auto Scaling group and propagate the tags to<br>the Amazon EC2 instances it launches. | `map(string)` | `{}` | no |
28+
| vpc\_id | The ID of the VPC | `string` | n/a | yes |
29+
30+
## Outputs
31+
32+
| Name | Description |
33+
|------|-------------|
34+
| dns\_name | The public DNS name of the load balancer |
35+
| ip\_addresses | One or more private IPv4 addresses associated with the controllers |
36+
| kms\_key\_id | The unique identifier for the worker-auth key |
37+
| security\_group\_id | The ID of the controller security group |
38+
39+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

0 commit comments

Comments
 (0)
Please sign in to comment.