Skip to content

Commit 3646ecc

Browse files
nandajavarmanandajavarma
committed
addressing the review comments
1 parent 05cc5ed commit 3646ecc

File tree

10 files changed

+131
-70
lines changed

10 files changed

+131
-70
lines changed

‎install/infra/modules/eks/database.tf

+5-12
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,23 @@
11
resource "random_password" "password" {
2-
count = var.enable_external_database ? 1 : 0
2+
count = var.create_external_database ? 1 : 0
33

44
length = 16
55
special = true
66
override_special = "!#$%&*()-_=+[]{}<>:?"
77
}
88

99
resource "aws_db_subnet_group" "gitpod_subnets" {
10-
count = var.enable_external_database ? 1 : 0
10+
count = var.create_external_database ? 1 : 0
1111

1212
name = "db-sg-${var.cluster_name}"
1313
subnet_ids = [module.vpc.public_subnets[2], module.vpc.public_subnets[3]]
1414
}
1515

1616
resource "aws_security_group" "rdssg" {
17-
count = var.enable_external_database ? 1 : 0
17+
count = var.create_external_database ? 1 : 0
1818

1919
name = "dh-sg-${var.cluster_name}"
2020
vpc_id = module.vpc.vpc_id
21-
22-
egress {
23-
from_port = 0
24-
to_port = 0
25-
protocol = "-1"
26-
cidr_blocks = ["0.0.0.0/0"]
27-
}
2821
}
2922

3023
resource "aws_security_group_rule" "db-ingress-nodes" {
@@ -38,7 +31,7 @@ resource "aws_security_group_rule" "db-ingress-nodes" {
3831
}
3932

4033
resource "aws_db_instance" "gitpod" {
41-
count = var.enable_external_database ? 1 : 0
34+
count = var.create_external_database ? 1 : 0
4235

4336
allocated_storage = 20
4437
max_allocated_storage = 120
@@ -53,5 +46,5 @@ resource "aws_db_instance" "gitpod" {
5346
parameter_group_name = "default.mysql5.7"
5447
db_subnet_group_name = aws_db_subnet_group.gitpod_subnets[0].name
5548
skip_final_snapshot = true
56-
publicly_accessible = true
49+
publicly_accessible = false
5750
}

‎install/infra/modules/eks/kubernetes.tf

-7
Original file line numberDiff line numberDiff line change
@@ -56,13 +56,6 @@ resource "aws_security_group" "nodes" {
5656
name = "nodes-sg-${var.cluster_name}"
5757
vpc_id = module.vpc.vpc_id
5858

59-
ingress {
60-
from_port = 0
61-
to_port = 6443
62-
protocol = "tcp"
63-
cidr_blocks = ["0.0.0.0/0"]
64-
}
65-
6659
egress {
6760
from_port = 0
6861
to_port = 0

‎install/infra/modules/eks/output.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ output "registry_backend" {
7777
region = aws_s3_bucket.gitpod-registry-backend[0].region
7878
endpoint = "s3.${aws_s3_bucket.gitpod-registry-backend[0].region}.amazonaws.com"
7979
bucket_name = aws_s3_bucket.gitpod-registry-backend[0].id
80-
access_key_id = aws_iam_access_key.bucket_storage_user[0].id
81-
secret_access_key = aws_iam_access_key.bucket_storage_user[0].secret
80+
access_key_id = aws_iam_access_key.bucket_registry_user[0].id
81+
secret_access_key = aws_iam_access_key.bucket_registry_user[0].secret
8282
}, "No s3 bucket created for registry backend.")
8383
}

‎install/infra/modules/eks/registry.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "aws_ecr_repository" "gitpod" {
2-
count = var.enable_external_registry ? 1 : 0
2+
count = var.create_external_registry ? 1 : 0
33

44
name = "registry-${var.cluster_name}"
55
image_tag_mutability = "MUTABLE"
@@ -10,6 +10,6 @@ resource "aws_ecr_repository" "gitpod" {
1010
}
1111

1212
data "aws_ecr_authorization_token" "gitpod" {
13-
count = var.enable_external_registry ? 1 : 0
13+
count = var.create_external_registry ? 1 : 0
1414
registry_id = aws_ecr_repository.gitpod[0].registry_id
1515
}

‎install/infra/modules/eks/storage.tf

+99-24
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,141 @@
11
resource "aws_s3_bucket" "gitpod-storage" {
2-
count = var.enable_external_storage ? 1 : 0
2+
count = var.create_external_storage ? 1 : 0
33

44
force_destroy = true
55
bucket = "bucket-${var.cluster_name}"
6-
acl = "private"
76
}
87

9-
resource "aws_s3_bucket" "gitpod-registry-backend" {
10-
count = var.enable_external_storage_for_registry_backend ? 1 : 0
8+
resource "aws_s3_bucket_acl" "gitpod-storage" {
9+
count = var.create_external_storage ? 1 : 0
1110

12-
force_destroy = true
13-
bucket = "reg-bucket-${var.cluster_name}"
14-
acl = "private"
11+
bucket = aws_s3_bucket.gitpod-storage[count.index].id
12+
acl = "private"
1513
}
1614

1715
resource "aws_s3_bucket_versioning" "storage" {
18-
count = var.enable_external_storage ? 1 : 0
16+
count = var.create_external_storage ? 1 : 0
1917

2018
bucket = aws_s3_bucket.gitpod-storage[0].id
2119
versioning_configuration {
2220
status = "Enabled"
2321
}
2422
}
2523

26-
resource "aws_s3_bucket_versioning" "registry" {
27-
count = var.enable_external_storage_for_registry_backend ? 1 : 0
28-
29-
bucket = aws_s3_bucket.gitpod-registry-backend[0].id
30-
versioning_configuration {
31-
status = "Enabled"
32-
}
33-
}
34-
3524
data "aws_iam_policy_document" "s3_policy" {
36-
count = var.enable_external_storage ? 1 : 0
25+
count = var.create_external_storage ? 1 : 0
3726
statement {
38-
actions = ["s3:*"]
39-
resources = ["*"]
27+
actions = [
28+
"s3:PutObject",
29+
"s3:ListMultipartUploadParts",
30+
"s3:GetObject",
31+
"s3:DeleteObject",
32+
"s3:AbortMultipartUpload"
33+
]
34+
resources = [
35+
"arn:aws:s3:::${aws_s3_bucket.gitpod-storage[count.index].id}",
36+
]
4037
effect = "Allow"
4138
}
4239
}
4340

4441
resource "aws_iam_policy" "policy" {
45-
count = var.enable_external_storage ? 1 : 0
42+
count = var.create_external_storage ? 1 : 0
4643
name = "spolicy-${var.cluster_name}"
4744
description = "Gitpod ${var.cluster_name} object storage bucket policy"
4845
policy = data.aws_iam_policy_document.s3_policy[0].json
4946
}
5047

5148
resource "aws_iam_user" "bucket_storage" {
52-
count = var.enable_external_storage ? 1 : 0
49+
count = var.create_external_storage ? 1 : 0
5350
name = "suser-${var.cluster_name}"
5451

5552
}
5653

5754
resource "aws_iam_user_policy_attachment" "attachment" {
58-
count = var.enable_external_storage ? 1 : 0
55+
count = var.create_external_storage ? 1 : 0
5956
user = aws_iam_user.bucket_storage[0].name
6057
policy_arn = aws_iam_policy.policy[0].arn
6158
}
6259

60+
resource "aws_iam_user_policy_attachment" "full_access_attachment" {
61+
count = var.create_external_storage ? 1 : 0
62+
user = aws_iam_user.bucket_storage[0].name
63+
policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
64+
}
65+
6366
resource "aws_iam_access_key" "bucket_storage_user" {
64-
count = var.enable_external_storage ? 1 : 0
67+
count = var.create_external_storage ? 1 : 0
6568
user = aws_iam_user.bucket_storage[0].name
6669
}
70+
71+
// s3 bucket for registry backend
72+
73+
resource "aws_s3_bucket" "gitpod-registry-backend" {
74+
count = var.create_external_storage_for_registry_backend ? 1 : 0
75+
76+
force_destroy = true
77+
bucket = "reg-bucket-${var.cluster_name}"
78+
}
79+
80+
resource "aws_s3_bucket_acl" "gitpod-registry-storage" {
81+
count = var.create_external_storage_for_registry_backend ? 1 : 0
82+
83+
bucket = aws_s3_bucket.gitpod-registry-backend[count.index].id
84+
acl = "private"
85+
}
86+
87+
resource "aws_s3_bucket_versioning" "registry" {
88+
count = var.create_external_storage_for_registry_backend ? 1 : 0
89+
90+
bucket = aws_s3_bucket.gitpod-registry-backend[0].id
91+
versioning_configuration {
92+
status = "Enabled"
93+
}
94+
}
95+
96+
data "aws_iam_policy_document" "s3_policy_registry" {
97+
count = var.create_external_storage_for_registry_backend ? 1 : 0
98+
statement {
99+
actions = [
100+
"s3:PutObject",
101+
"s3:ListMultipartUploadParts",
102+
"s3:GetObject",
103+
"s3:DeleteObject",
104+
"s3:AbortMultipartUpload"
105+
]
106+
resources = [
107+
"arn:aws:s3:::${aws_s3_bucket.gitpod-registry-backend[count.index].id}",
108+
]
109+
effect = "Allow"
110+
}
111+
}
112+
113+
resource "aws_iam_policy" "policy_registry" {
114+
count = var.create_external_storage_for_registry_backend ? 1 : 0
115+
name = "registry-policy-${var.cluster_name}"
116+
description = "Gitpod ${var.cluster_name} registry backend storage bucket policy"
117+
policy = data.aws_iam_policy_document.s3_policy_registry[count.index].json
118+
}
119+
120+
resource "aws_iam_user" "bucket_registry" {
121+
count = var.create_external_storage_for_registry_backend ? 1 : 0
122+
name = "registry-user-${var.cluster_name}"
123+
124+
}
125+
126+
resource "aws_iam_user_policy_attachment" "registry_attachment" {
127+
count = var.create_external_storage_for_registry_backend ? 1 : 0
128+
user = aws_iam_user.bucket_registry[count.index].name
129+
policy_arn = aws_iam_policy.policy_registry[count.index].arn
130+
}
131+
132+
resource "aws_iam_user_policy_attachment" "full_access_registry_attachment" {
133+
count = var.create_external_storage_for_registry_backend ? 1 : 0
134+
user = aws_iam_user.bucket_registry[count.index].name
135+
policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
136+
}
137+
138+
resource "aws_iam_access_key" "bucket_registry_user" {
139+
count = var.create_external_storage_for_registry_backend ? 1 : 0
140+
user = aws_iam_user.bucket_registry[count.index].name
141+
}

‎install/infra/modules/eks/variables.tf

+8-8
Original file line numberDiff line numberDiff line change
@@ -51,22 +51,22 @@ variable "vpc_cidr" {
5151
default = "10.100.0.0/16"
5252
}
5353

54-
variable "enable_external_database" {
54+
variable "create_external_database" {
5555
default = true
56-
description = "Set this to false to avoid creating an RDS database to use with Gitpod instead of inclsuter mysql"
56+
description = "Create a mysql RDS database"
5757
}
5858

59-
variable "enable_external_storage" {
59+
variable "create_external_storage" {
6060
default = true
61-
description = "Set this to false to avoid creating an s3 storage to use with Gitpod instead of incluster minio"
61+
description = "Create an S3 bucket"
6262
}
6363

64-
variable "enable_external_storage_for_registry_backend" {
64+
variable "create_external_storage_for_registry_backend" {
6565
default = false
66-
description = "Set this to true to create a separate s3 storage to use with Gitpod as registry backend"
66+
description = "Create an S3 bucket for registry backend"
6767
}
6868

69-
variable "enable_external_registry" {
69+
variable "create_external_registry" {
7070
default = false
71-
description = "Set this to true to create an AWS ECR registry to use with Gitpod(Not officially supported)"
71+
description = "Create an EKS registry(Not officially supported)"
7272
}

‎install/infra/single-cluster/aws/cluster.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ module "eks" {
88
image_id = var.image_id
99
cluster_version = var.cluster_version
1010
kubeconfig = var.kubeconfig
11-
enable_external_database = var.enable_external_database
12-
enable_external_storage = var.enable_external_storage
11+
create_external_database = var.create_external_database
12+
create_external_storage = var.create_external_storage
1313
service_machine_type = "m6i.xlarge"
1414
workspace_machine_type = "m6i.2xlarge"
1515

16-
enable_external_storage_for_registry_backend = var.enable_external_storage_for_registry_backend
16+
create_external_storage_for_registry_backend = var.create_external_storage_for_registry_backend
1717
}

‎install/infra/single-cluster/aws/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
terraform {
22
backend "s3" {
3-
bucket = "gitpod-tf"
3+
bucket = "nan-tf-bucket"
44
key = "aws/terraform.state"
55
}
66
}

‎install/infra/single-cluster/aws/terraform.tfvars

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11

22
# the cluster_name should be of length less than 16 characters
3-
cluster_name = "nan-cluster"
3+
cluster_name = "nan"
44

55
# a route53 zone and certificate request will be created for this domain
6-
domain_name = "nan-cluster.gitpod-self-hosted.com"
6+
domain_name = "nan-cluster.doptig.com"
77

88
region = "eu-west-1"
99

@@ -18,9 +18,9 @@ vpc_availability_zones = ["eu-west-1c", "eu-west-1b"]
1818
cluster_version = "1.22"
1919
image_id = "ami-0793b4124359a6ad7"
2020

21-
enable_external_database = true
22-
enable_external_storage = true
21+
create_external_database = true
22+
create_external_storage = true
2323

2424
# if you want to create a separate s3 bucket to use as registry backend,
2525
# set the following to true. You can re-use the above bucket or incluster registry otherwise.
26-
enable_external_storage_for_registry_backend = false
26+
create_external_storage_for_registry_backend = false

‎install/infra/single-cluster/aws/variables.tf

+6-6
Original file line numberDiff line numberDiff line change
@@ -37,19 +37,19 @@ variable "domain_name" {
3737
description = "Domain name to associate with the Gitpod installation"
3838
}
3939

40-
variable "enable_external_database" {
40+
variable "create_external_database" {
4141
default = true
42-
description = "Set this to false to avoid creating an RDS database to use with Gitpod instead of inclsuter mysql"
42+
description = "Create a mysql RDS database"
4343
}
4444

45-
variable "enable_external_storage" {
45+
variable "create_external_storage" {
4646
default = true
47-
description = "Set this to false to avoid creating an s3 storage to use with Gitpod instead of incluster minio"
47+
description = "Create an S3 bucket"
4848
}
4949

50-
variable "enable_external_storage_for_registry_backend" {
50+
variable "create_external_storage_for_registry_backend" {
5151
default = false
52-
description = "Set this to true to create a separate S3 bucket to use as registry backend(if not, you can use the same bucket as above or the incluster registry)"
52+
description = "Create an S3 bucket for registry backend"
5353
}
5454

5555
variable "cluster_version" {

0 commit comments

Comments
 (0)