Skip to content

Commit ca03c73

Browse files
kosyfranceskosyfrances
authored
Add configuration for the new Admin API HTTPS port (#357)
1 parent 2af9efd commit ca03c73

File tree

10 files changed

+144
-29
lines changed

10 files changed

+144
-29
lines changed

‎main.tf

Lines changed: 33 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,7 @@ module "runtime_container_engine_config" {
179179
hostname = local.fqdn
180180
http_port = var.http_port
181181
https_port = var.https_port
182+
admin_api_https_port = var.admin_api_https_port
182183
http_proxy = var.proxy_ip != null ? "${var.proxy_ip}:${var.proxy_port}" : null
183184
https_proxy = var.proxy_ip != null ? "${var.proxy_ip}:${var.proxy_port}" : null
184185
no_proxy = var.proxy_ip != null ? local.no_proxy : null
@@ -368,6 +369,7 @@ module "load_balancer" {
368369

369370
active_active = var.operational_mode == "active-active"
370371
admin_dashboard_ingress_ranges = var.admin_dashboard_ingress_ranges
372+
admin_api_https_port = var.admin_api_https_port
371373
certificate_arn = var.acm_certificate_arn
372374
domain_name = var.domain_name
373375
friendly_name_prefix = var.friendly_name_prefix
@@ -384,6 +386,7 @@ module "private_tcp_load_balancer" {
384386
source = "./modules/network_load_balancer"
385387

386388
active_active = var.operational_mode == "active-active"
389+
admin_api_https_port = var.admin_api_https_port
387390
certificate_arn = var.acm_certificate_arn
388391
domain_name = var.domain_name
389392
friendly_name_prefix = var.friendly_name_prefix
@@ -396,32 +399,34 @@ module "private_tcp_load_balancer" {
396399
module "vm" {
397400
source = "./modules/vm"
398401

399-
active_active = var.operational_mode == "active-active"
400-
aws_iam_instance_profile = module.service_accounts.iam_instance_profile.name
401-
ami_id = local.ami_id
402-
aws_lb = var.load_balancing_scheme == "PRIVATE_TCP" ? null : module.load_balancer[0].aws_lb_security_group
403-
aws_lb_target_group_tfe_tg_443_arn = var.load_balancing_scheme == "PRIVATE_TCP" ? module.private_tcp_load_balancer[0].aws_lb_target_group_tfe_tg_443_arn : module.load_balancer[0].aws_lb_target_group_tfe_tg_443_arn
404-
aws_lb_target_group_tfe_tg_8800_arn = var.load_balancing_scheme == "PRIVATE_TCP" ? module.private_tcp_load_balancer[0].aws_lb_target_group_tfe_tg_8800_arn : module.load_balancer[0].aws_lb_target_group_tfe_tg_8800_arn
405-
asg_tags = var.asg_tags
406-
ec2_launch_template_tag_specifications = var.ec2_launch_template_tag_specifications
407-
default_ami_id = local.default_ami_id
408-
enable_disk = local.enable_disk
409-
enable_ssh = var.enable_ssh
410-
ebs_device_name = var.ebs_device_name
411-
ebs_volume_size = var.ebs_volume_size
412-
ebs_volume_type = var.ebs_volume_type
413-
ebs_iops = var.ebs_iops
414-
ebs_delete_on_termination = var.ebs_delete_on_termination
415-
ebs_snapshot_id = var.ebs_snapshot_id
416-
friendly_name_prefix = var.friendly_name_prefix
417-
health_check_grace_period = var.health_check_grace_period
418-
health_check_type = var.health_check_type
419-
instance_type = var.instance_type
420-
is_replicated_deployment = var.is_replicated_deployment
421-
key_name = var.key_name
422-
network_id = local.network_id
423-
network_subnets_private = local.network_private_subnets
424-
network_private_subnet_cidrs = local.network_private_subnet_cidrs
425-
node_count = var.node_count
426-
user_data_base64 = var.is_replicated_deployment ? module.tfe_init_replicated[0].tfe_userdata_base64_encoded : module.tfe_init_fdo[0].tfe_userdata_base64_encoded
402+
active_active = var.operational_mode == "active-active"
403+
aws_iam_instance_profile = module.service_accounts.iam_instance_profile.name
404+
ami_id = local.ami_id
405+
aws_lb = var.load_balancing_scheme == "PRIVATE_TCP" ? null : module.load_balancer[0].aws_lb_security_group
406+
aws_lb_target_group_tfe_tg_443_arn = var.load_balancing_scheme == "PRIVATE_TCP" ? module.private_tcp_load_balancer[0].aws_lb_target_group_tfe_tg_443_arn : module.load_balancer[0].aws_lb_target_group_tfe_tg_443_arn
407+
aws_lb_target_group_tfe_tg_8800_arn = var.load_balancing_scheme == "PRIVATE_TCP" ? module.private_tcp_load_balancer[0].aws_lb_target_group_tfe_tg_8800_arn : module.load_balancer[0].aws_lb_target_group_tfe_tg_8800_arn
408+
aws_lb_target_group_tfe_tg_admin_api_arn = var.load_balancing_scheme == "PRIVATE_TCP" ? module.private_tcp_load_balancer[0].aws_lb_target_group_tfe_tg_admin_api_arn : module.load_balancer[0].aws_lb_target_group_tfe_tg_admin_api_arn
409+
admin_api_https_port = var.admin_api_https_port
410+
asg_tags = var.asg_tags
411+
ec2_launch_template_tag_specifications = var.ec2_launch_template_tag_specifications
412+
default_ami_id = local.default_ami_id
413+
enable_disk = local.enable_disk
414+
enable_ssh = var.enable_ssh
415+
ebs_device_name = var.ebs_device_name
416+
ebs_volume_size = var.ebs_volume_size
417+
ebs_volume_type = var.ebs_volume_type
418+
ebs_iops = var.ebs_iops
419+
ebs_delete_on_termination = var.ebs_delete_on_termination
420+
ebs_snapshot_id = var.ebs_snapshot_id
421+
friendly_name_prefix = var.friendly_name_prefix
422+
health_check_grace_period = var.health_check_grace_period
423+
health_check_type = var.health_check_type
424+
instance_type = var.instance_type
425+
is_replicated_deployment = var.is_replicated_deployment
426+
key_name = var.key_name
427+
network_id = local.network_id
428+
network_subnets_private = local.network_private_subnets
429+
network_private_subnet_cidrs = local.network_private_subnet_cidrs
430+
node_count = var.node_count
431+
user_data_base64 = var.is_replicated_deployment ? module.tfe_init_replicated[0].tfe_userdata_base64_encoded : module.tfe_init_fdo[0].tfe_userdata_base64_encoded
427432
}

‎modules/application_load_balancer/main.tf

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,16 @@ resource "aws_security_group_rule" "tfe_lb_allow_inbound_dashboard" {
3737
security_group_id = aws_security_group.tfe_lb_allow.id
3838
}
3939

40+
resource "aws_security_group_rule" "tfe_lb_allow_inbound_admin_api" {
41+
type = "ingress"
42+
from_port = var.admin_api_https_port
43+
to_port = var.admin_api_https_port
44+
protocol = "tcp"
45+
cidr_blocks = ["0.0.0.0/0"]
46+
description = "Allow Admin API HTTPS traffic inbound to TFE LB"
47+
security_group_id = aws_security_group.tfe_lb_allow.id
48+
}
49+
4050
resource "aws_security_group" "tfe_outbound_allow" {
4151
name = "${var.friendly_name_prefix}-tfe-outbound-allow"
4252
vpc_id = var.network_id
@@ -136,6 +146,32 @@ resource "aws_lb_target_group" "tfe_tg_8800" {
136146
}
137147
}
138148

149+
resource "aws_lb_listener" "tfe_listener_admin_api" {
150+
load_balancer_arn = aws_lb.tfe_lb.arn
151+
port = var.admin_api_https_port
152+
protocol = "HTTPS"
153+
ssl_policy = var.ssl_policy
154+
certificate_arn = var.certificate_arn
155+
156+
default_action {
157+
type = "forward"
158+
target_group_arn = aws_lb_target_group.tfe_tg_admin_api.arn
159+
}
160+
}
161+
162+
resource "aws_lb_target_group" "tfe_tg_admin_api" {
163+
name = "${var.friendly_name_prefix}-tfe-alb-tg-${var.admin_api_https_port}"
164+
port = var.admin_api_https_port
165+
protocol = "HTTPS"
166+
vpc_id = var.network_id
167+
168+
health_check {
169+
path = "/api/v1/ping"
170+
protocol = "HTTPS"
171+
matcher = "200-399,400,401,403"
172+
}
173+
}
174+
139175
data "aws_route53_zone" "tfe" {
140176
name = var.domain_name
141177
private_zone = false

‎modules/application_load_balancer/outputs.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,12 @@ output "aws_lb_target_group_tfe_tg_8800_arn" {
1919
description = "The Amazon Resource Name of the load balancer target group for traffic on port 8800."
2020
}
2121

22+
output "aws_lb_target_group_tfe_tg_admin_api_arn" {
23+
value = aws_lb_target_group.tfe_tg_admin_api.arn
24+
25+
description = "The Amazon Resource Name of the load balancer target group for traffic on the Admin API HTTPS port."
26+
}
27+
2228
output "load_balancer_address" {
2329
value = aws_lb.tfe_lb.dns_name
2430

‎modules/application_load_balancer/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,8 @@ variable "friendly_name_prefix" {
6060
type = string
6161
description = "(Required) Friendly name prefix used for tagging and naming AWS resources."
6262
}
63+
64+
variable "admin_api_https_port" {
65+
type = number
66+
description = "Port application listens on for Admin API HTTPS."
67+
}

‎modules/network_load_balancer/main.tf

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,28 @@ resource "aws_lb_target_group" "tfe_tg_8800" {
5858
}
5959
}
6060

61+
resource "aws_lb_listener" "tfe_listener_admin_api" {
62+
load_balancer_arn = aws_lb.tfe_lb.arn
63+
port = var.admin_api_https_port
64+
protocol = "TCP"
65+
66+
default_action {
67+
type = "forward"
68+
target_group_arn = aws_lb_target_group.tfe_tg_admin_api.arn
69+
}
70+
}
71+
72+
resource "aws_lb_target_group" "tfe_tg_admin_api" {
73+
name = "${var.friendly_name_prefix}-tfe-nlb-tg-${var.admin_api_https_port}"
74+
port = var.admin_api_https_port
75+
protocol = "TCP"
76+
vpc_id = var.network_id
77+
78+
health_check {
79+
protocol = "TCP"
80+
}
81+
}
82+
6183
data "aws_route53_zone" "tfe" {
6284
name = var.domain_name
6385
private_zone = false

‎modules/network_load_balancer/outputs.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,9 @@ output "load_balancer_address" {
1818

1919
description = "The DNS name of the load balancer."
2020
}
21+
22+
output "aws_lb_target_group_tfe_tg_admin_api_arn" {
23+
value = aws_lb_target_group.tfe_tg_admin_api.arn
24+
25+
description = "The Amazon Resource Name of the load balancer target group for traffic on the Admin API HTTPS port."
26+
}

‎modules/network_load_balancer/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,8 @@ variable "friendly_name_prefix" {
4040
type = string
4141
description = "(Required) Friendly name prefix used for tagging and naming AWS resources."
4242
}
43+
44+
variable "admin_api_https_port" {
45+
type = number
46+
description = "Port application listens on for Admin API HTTPS."
47+
}

‎modules/vm/main.tf

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,16 @@ resource "aws_security_group_rule" "tfe_dashboard" {
7272
cidr_blocks = var.aws_lb == null ? var.network_private_subnet_cidrs : null
7373
}
7474

75+
resource "aws_security_group_rule" "tfe_admin_api" {
76+
security_group_id = aws_security_group.tfe_instance.id
77+
type = "ingress"
78+
from_port = var.admin_api_https_port
79+
to_port = var.admin_api_https_port
80+
protocol = "tcp"
81+
source_security_group_id = var.aws_lb
82+
cidr_blocks = var.aws_lb == null ? var.network_private_subnet_cidrs : null
83+
}
84+
7585
resource "aws_launch_template" "tfe" {
7686
name_prefix = "${var.friendly_name_prefix}-tfe-ec2-asg-launch-template-"
7787
image_id = var.ami_id
@@ -136,9 +146,13 @@ resource "aws_autoscaling_group" "tfe_asg" {
136146
max_size = var.node_count
137147
desired_capacity = var.node_count
138148
vpc_zone_identifier = var.network_subnets_private
139-
target_group_arns = var.active_active || !var.is_replicated_deployment ? [var.aws_lb_target_group_tfe_tg_443_arn] : [
149+
target_group_arns = var.active_active || !var.is_replicated_deployment ? [
150+
var.aws_lb_target_group_tfe_tg_443_arn,
151+
var.aws_lb_target_group_tfe_tg_admin_api_arn,
152+
] : [
140153
var.aws_lb_target_group_tfe_tg_8800_arn,
141154
var.aws_lb_target_group_tfe_tg_443_arn,
155+
var.aws_lb_target_group_tfe_tg_admin_api_arn,
142156
]
143157
# Increases grace period for any AMI that is not the default Ubuntu
144158
# since RHEL has longer startup time

‎modules/vm/variables.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,16 @@ variable "aws_lb_target_group_tfe_tg_8800_arn" {
2626
type = string
2727
}
2828

29+
variable "aws_lb_target_group_tfe_tg_admin_api_arn" {
30+
description = "The Amazon Resource Name of the load balancer target group for traffic on the Admin API HTTPS port which will be backed by the TFE EC2 autoscaling group."
31+
type = string
32+
}
33+
34+
variable "admin_api_https_port" {
35+
type = number
36+
description = "Port application listens on for Admin API HTTPS."
37+
}
38+
2939
variable "aws_iam_instance_profile" {
3040
description = "The name of the IAM instance profile to be associated with the TFE EC2 instance(s)."
3141
type = string

‎variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -344,6 +344,12 @@ variable "https_port" {
344344
description = "(Optional if is_replicated_deployment is false) Port application listens on for HTTPS. Default is 443."
345345
}
346346

347+
variable "admin_api_https_port" {
348+
default = 8446
349+
type = number
350+
description = "(Optional if is_replicated_deployment is false) Port application listens on for Admin API HTTPS. Default is 8443."
351+
}
352+
347353
variable "iact_subnet_list" {
348354
default = []
349355
description = "A list of CIDR masks that configure the ability to retrieve the IACT from outside the host."

0 commit comments

Comments
 (0)