Skip to content

Commit 76ad4d7

Browse files
sandrampetersandrampeter
committed
more update
1 parent 6ee02a7 commit 76ad4d7

File tree

14 files changed

+359
-18
lines changed

14 files changed

+359
-18
lines changed

‎examples/standalone-redis/README.md

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Example: Standalone with mTLS Redis
2+
3+
## About this example
4+
5+
This example for Terraform Enterprise creates a TFE installation with the
6+
following traits:
7+
8+
- External mode
9+
- a small VM machine type (m5.xlarge)
10+
- Ubuntu as the VM image
11+
- a publicly accessible HTTP load balancer with TLS termination
12+
- an access key for accessing S3
13+
- Redis VM
14+
15+
## Pre-requisites
16+
17+
This test assumes the following resources already exist:
18+
19+
- Valid DNS Zone managed in Route53
20+
- Valid AWS ACM certificate
21+
- a TFE license on a filepath accessible by tests
22+
- Valid TLS certs for Redis
23+
24+
## How to Use This Module
25+
26+
### Deployment
27+
28+
1. Read the entire [README.md](../../README.md) of the root module.
29+
2. Ensure account meets module prerequisites from above.
30+
3. Clone repository.
31+
4. Change directory into desired example folder.
32+
5. Create a local `terraform.auto.tfvars` file and instantiate the required inputs as required in the respective `./examples/standalone-redis/variables.tf` including the path to the license under the `license_file` variable value.
33+
6. Authenticate against the AWS provider. See [instructions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration).
34+
7. Initialize terraform and apply the module configurations using the commands below:
35+
36+
NOTE: `terraform plan` will print out the execution plan which describes the actions Terraform will take in order to build your infrastructure to match the module configuration. If anything in the plan seems incorrect or dangerous, it is safe to abort here and not proceed to `terraform apply`.
37+
38+
```
39+
terraform init
40+
terraform plan
41+
terraform apply
42+
```
43+
44+
## Post-deployment Tasks
45+
46+
The build should take approximately 10-15 minutes to deploy. Once the module has completed, give the platform another 10 minutes or so prior to attempting to interact with it in order for all containers to start up.
47+
48+
Unless amended, this example will not create an initial admin user using the IACT, but it does output the URL for your convenience. Follow the advice in this document to create the initial admin user, and log into the system using this user in order to configure it for use.
49+
50+
### Connecting to the TFE Application
51+
52+
1. Navigate to the URL supplied via the `login_url` Terraform output. (It may take several minutes for this to be available after initial deployment. You may monitor the progress of cloud init if desired on one of the instances)
53+
2. Enter a `username`, `email`, and `password` for the initial user.
54+
3. Click `Create an account`.
55+
4. After the initial user is created you may access the TFE Application normally using the URL supplied via `login_url` Terraform output.

‎examples/standalone-redis/data.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Copyright (c) HashiCorp, Inc.
2+
# SPDX-License-Identifier: MPL-2.0
3+
4+
data "aws_ami" "ubuntu" {
5+
most_recent = true
6+
7+
filter {
8+
name = "name"
9+
values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
10+
}
11+
12+
filter {
13+
name = "virtualization-type"
14+
values = ["hvm"]
15+
}
16+
17+
owners = ["099720109477"] # Canonical
18+
}

‎examples/standalone-redis/locals.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Copyright (c) HashiCorp, Inc.
2+
# SPDX-License-Identifier: MPL-2.0
3+
4+
locals {
5+
friendly_name_prefix = random_string.friendly_name.id
6+
network_private_subnet_cidrs = ["10.0.32.0/20", "10.0.48.0/20", "10.0.112.0/20"]
7+
}

‎examples/standalone-redis/main.tf

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Copyright (c) HashiCorp, Inc.
2+
# SPDX-License-Identifier: MPL-2.0
3+
4+
# Random string to prepend resources
5+
# ----------------------------------
6+
resource "random_string" "friendly_name" {
7+
length = 4
8+
upper = false # Some AWS resources do not accept uppercase characters.
9+
numeric = false
10+
special = false
11+
}
12+
13+
# Store TFE License as secret
14+
# ---------------------------
15+
module "secrets" {
16+
source = "../../fixtures/secrets"
17+
tfe_license = {
18+
name = "${local.friendly_name_prefix}-tfe-license"
19+
path = var.license_file
20+
}
21+
}
22+
23+
# Key Management Service
24+
# ----------------------
25+
module "kms" {
26+
source = "../../fixtures/kms"
27+
key_alias = "${local.friendly_name_prefix}-key"
28+
}
29+
30+
# Standalone with redis mTLS
31+
# --------------------------
32+
module "standalone_redis" {
33+
source = "../../"
34+
35+
acm_certificate_arn = var.acm_certificate_arn
36+
domain_name = var.domain_name
37+
distribution = "ubuntu"
38+
friendly_name_prefix = local.friendly_name_prefix
39+
tfe_license_secret_id = module.secrets.tfe_license_secret_id
40+
41+
ami_id = data.aws_ami.ubuntu.id
42+
bypass_preflight_checks = true
43+
health_check_grace_period = 3000
44+
iact_subnet_list = ["0.0.0.0/0"]
45+
iam_role_policy_arns = ["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"]
46+
instance_type = "m5.4xlarge"
47+
kms_key_arn = module.kms.key
48+
load_balancing_scheme = "PUBLIC"
49+
network_private_subnet_cidrs = local.network_private_subnet_cidrs
50+
node_count = 1
51+
operational_mode = "external"
52+
enable_redis_mtls = true
53+
tfe_subdomain = local.friendly_name_prefix
54+
vm_certificate_secret_id = var.certificate_pem_secret_id
55+
vm_key_secret_id = var.private_key_pem_secret_id
56+
redis_client_key = var.redis_client_key
57+
redis_client_cert = var.redis_client_cert
58+
redis_client_ca = var.redis_client_ca
59+
redis_client_key_path = var.redis_client_key_path
60+
redis_client_cert_path = var.redis_client_cert_path
61+
redis_client_ca_path = var.redis_ca_cert_path
62+
}

‎examples/standalone-redis/outputs.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Copyright (c) HashiCorp, Inc.
2+
# SPDX-License-Identifier: MPL-2.0
3+

‎examples/standalone-redis/terraform.tfvars.example

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
acm_certificate_arn = "arn:aws:acm:<region>:<account_id>:certificate/<certificate_name>"
2+
certificate_pem_secret_id = "arn:aws:secretsmanager:<region>:<account_id>:secret:<secret_name>"
3+
private_key_pem_secret_id = "arn:aws:secretsmanager:<region>:<account_id>:secret:<secret_name>"
4+
domain_name = "my.domain.com"
5+
license_file = "/files/license.rli"
6+
aurora_cluster_instance_enable_single = "true"
7+
aurora_cluster_instance_replica_count = 0
8+
aurora_db_username = "hashicorp"
9+
aurora_db_password = "xxxxxxxxx"

‎examples/standalone-redis/variables.tf

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Copyright (c) HashiCorp, Inc.
2+
# SPDX-License-Identifier: MPL-2.0
3+
4+
variable "acm_certificate_arn" {
5+
type = string
6+
description = "The ARN of an existing ACM certificate."
7+
}
8+
9+
variable "domain_name" {
10+
type = string
11+
description = "Domain for creating the Terraform Enterprise subdomain on."
12+
}
13+
14+
variable "license_file" {
15+
type = string
16+
description = "The local path to the Terraform Enterprise license."
17+
}
18+
19+
20+
variable "redis_ca_cert_path" {
21+
type = string
22+
description = "The secrets manager secret ID of the Base64 & PEM encoded TLS certificate for tfe."
23+
}
24+
25+
variable "redis_client_cert_path" {
26+
type = string
27+
description = "The secrets manager secret ID of the Base64 & PEM encoded TLS certificate for tfe."
28+
}
29+
30+
variable "redis_client_key_path" {
31+
type = string
32+
description = "The secrets manager secret ID of the Base64 & PEM encoded TLS certificate for tfe."
33+
}
34+
variable "redis_client_ca" {
35+
type = string
36+
description = "The secrets manager secret ID of the Base64 & PEM encoded TLS certificate for tfe."
37+
}
38+
variable "redis_client_cert" {
39+
type = string
40+
description = "The secrets manager secret ID of the Base64 & PEM encoded TLS certificate for tfe."
41+
}
42+
variable "redis_client_key" {
43+
type = string
44+
description = "The secrets manager secret ID of the Base64 & PEM encoded TLS certificate for tfe."
45+
}
46+
47+
variable private_key_pem_secret_id {
48+
type = string
49+
description = "The secrets manager secret ID of the Base64 & PEM encoded private key for tfe."
50+
}
51+
variable "certificate_pem_secret_id" {
52+
type = string
53+
description = "The secrets manager secret ID of the Base64 & PEM encoded certificate for tfe."
54+
}
55+
56+
variable redis_private_key_pem_secret_id {
57+
type = string
58+
description = "The secrets manager secret ID of the Base64 & PEM encoded private key for tfe."
59+
}
60+
61+
variable "redis_certificate_pem_secret_id" {
62+
type = string
63+
description = "The secrets manager secret ID of the Base64 & PEM encoded certificate for tfe."
64+
}
65+
66+
variable "redis_ca_certificate_pem_secret_id" {
67+
type = string
68+
description = "The secrets manager secret ID of the Base64 & PEM encoded certificate for tfe."
69+
}
70+

‎examples/standalone-redis/versions.tf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Copyright (c) HashiCorp, Inc.
2+
# SPDX-License-Identifier: MPL-2.0
3+
4+
terraform {
5+
required_version = ">= 0.14"
6+
required_providers {
7+
aws = {
8+
source = "hashicorp/aws"
9+
version = "~> 5.0"
10+
}
11+
random = {
12+
source = "hashicorp/random"
13+
version = "~> 3.1"
14+
}
15+
}
16+
}

‎locals.tf

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,24 @@ locals {
6565
aws_elasticache_subnet_group_name = null
6666
aws_security_group_redis = null
6767
}
68-
) : try(
68+
) : var.enable_redis_mtls ? try(
69+
module.redis_mtls[0],
70+
{
71+
hostname = null
72+
password = null
73+
username = null
74+
redis_port = null
75+
use_password_auth = null
76+
use_tls = null
77+
sentinel_enabled = var.enable_redis_sentinel
78+
sentinel_hosts = []
79+
sentinel_leader = null
80+
sentinel_username = null
81+
sentinel_password = null
82+
aws_elasticache_subnet_group_name = null
83+
aws_security_group_redis = null
84+
}
85+
) : try(
6986
module.redis[0],
7087
{
7188
hostname = null

‎main.tf

Lines changed: 40 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,33 @@ module "redis_sentinel" {
115115
network_private_subnet_cidrs = local.network_private_subnet_cidrs
116116
}
117117

118+
# -----------------------------------------------------------------------------
119+
# Redis Sentinel
120+
# -----------------------------------------------------------------------------
121+
122+
module "redis_mtls" {
123+
count = var.enable_redis_mtls ? 1 : 0
124+
source = "./modules/redis-standalone-mtls"
125+
# This module is used to deploy a Redis instance with mTLS enabled.
126+
127+
domain_name = var.domain_name
128+
ca_cert = var.redis_client_ca
129+
fullchain = var.redis_client_cert
130+
privkey = var.redis_client_key
131+
redis_authentication_mode = "NONE" # mTLS does not use password authentication
132+
aws_iam_instance_profile = module.service_accounts.iam_instance_profile.name
133+
asg_tags = var.asg_tags
134+
ec2_launch_template_tag_specifications = var.ec2_launch_template_tag_specifications
135+
friendly_name_prefix = var.friendly_name_prefix
136+
health_check_grace_period = var.health_check_grace_period
137+
health_check_type = var.health_check_type
138+
instance_type = var.instance_type
139+
key_name = var.key_name
140+
network_id = local.network_id
141+
network_subnets_private = local.network_private_subnets
142+
network_private_subnet_cidrs = local.network_private_subnet_cidrs
143+
}
144+
118145
# -----------------------------------------------------------------------------
119146
# AWS PostreSQL Database
120147
# -----------------------------------------------------------------------------
@@ -170,7 +197,7 @@ module "aurora_database" {
170197
# Docker Compose File Config for TFE on instance(s) using Flexible Deployment Options
171198
# ------------------------------------------------------------------------------------
172199
module "runtime_container_engine_config" {
173-
source = "git::https://github.com/hashicorp/terraform-random-tfe-utility//modules/runtime_container_engine_config?ref=main"
200+
source = "git::https://github.com/hashicorp/terraform-random-tfe-utility//modules/runtime_container_engine_config?ref=redis-standalone"
174201
count = var.is_replicated_deployment ? 0 : 1
175202

176203
tfe_license = var.hc_license
@@ -228,6 +255,11 @@ module "runtime_container_engine_config" {
228255
redis_sentinel_leader_name = local.redis.sentinel_leader
229256
redis_sentinel_user = local.redis.sentinel_username
230257
redis_sentinel_password = local.redis.sentinel_password
258+
redis_use_mtls = var.enable_redis_mtls
259+
redis_ca_cert_path = "/etc/ssl/private/terraform-enterprise/redis/ca_cert.pem"
260+
redis_client_cert_path = "/etc/ssl/private/terraform-enterprise/redis/cert.pem"
261+
redis_client_key_path = "/etc/ssl/private/terraform-enterprise/redis/key.pem"
262+
231263

232264
trusted_proxies = local.trusted_proxies
233265

@@ -243,7 +275,7 @@ module "runtime_container_engine_config" {
243275
# AWS cloud init used to install and configure TFE on instance(s) using Flexible Deployment Options
244276
# --------------------------------------------------------------------------------------------------
245277
module "tfe_init_fdo" {
246-
source = "git::https://github.com/hashicorp/terraform-random-tfe-utility//modules/tfe_init?ref=main"
278+
source = "git::https://github.com/hashicorp/terraform-random-tfe-utility//modules/tfe_init?ref=redis-standalone"
247279
count = var.is_replicated_deployment ? 0 : 1
248280

249281
cloud = "aws"
@@ -258,6 +290,11 @@ module "tfe_init_fdo" {
258290
ca_certificate_secret_id = var.ca_certificate_secret_id == null ? null : var.ca_certificate_secret_id
259291
certificate_secret_id = var.vm_certificate_secret_id == null ? null : var.vm_certificate_secret_id
260292
key_secret_id = var.vm_key_secret_id == null ? null : var.vm_key_secret_id
293+
294+
# redis_use_mtls = var.enable_redis_mtls
295+
# redis_ca_certificate_secret_id = var.redis_ca_certificate_secret_id == null ? null : var.redis_ca_certificate_secret_id
296+
# redis_certificate_secret_id = var.redis_vm_certificate_secret_id == null ? null : var.redis_vm_certificate_secret_id
297+
# redis_key_secret_id = var.redis_vm_key_secret_id == null ? null : var.redis_vm_key_secret_id
261298

262299
proxy_ip = var.proxy_ip != null ? var.proxy_ip : null
263300
proxy_port = var.proxy_ip != null ? var.proxy_port : null
@@ -277,7 +314,7 @@ module "tfe_init_fdo" {
277314
# TFE and Replicated settings to pass to the tfe_init_replicated module for replicated deployment
278315
# --------------------------------------------------------------------------------------------
279316
module "settings" {
280-
source = "git::https://github.com/hashicorp/terraform-random-tfe-utility//modules/settings?ref=main"
317+
source = "git::https://github.com/hashicorp/terraform-random-tfe-utility//modules/settings?ref=redis-standalone"
281318
count = var.is_replicated_deployment ? 1 : 0
282319

283320
# TFE Base Configuration

‎modules/redis-standalone-mtls/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ resource "aws_autoscaling_group" "redis" {
6969
vpc_zone_identifier = var.network_subnets_private
7070
target_group_arns = concat(
7171
[for tg in aws_lb_target_group.redis_tg : tg.arn],
72-
[for tg in aws_lb_target_group.redis_tg_redis : tg.arn]
72+
[for tg in aws_lb_target_group.redis_tg : tg.arn]
7373
)
7474

7575
# Increases grace period for any AMI that is not the default Ubuntu

0 commit comments

Comments
 (0)