-
Notifications
You must be signed in to change notification settings - Fork 336
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore(*) split ingress to a separate template
Signed-off-by: Nikolay Nikolaev <[email protected]>
- Loading branch information
Nikolay Nikolaev
committed
Jan 20, 2021
1 parent
7579123
commit e9e5ff3
Showing
3 changed files
with
207 additions
and
111 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,184 @@ | ||
| AWSTemplateFormatVersion: "2010-09-09" | ||
| Description: Kuma Control Plane on ECS | ||
| Parameters: | ||
| VPCStackName: | ||
| Type: String | ||
| Default: kuma-vpc | ||
| Description: The name of the parent Fargate networking stack that you created. Necessary | ||
| to locate and reference resources created by that stack. | ||
| Image: | ||
| Type: String | ||
| Default: "kong-docker-kuma-docker.bintray.io/kuma-dp:1.0.5" | ||
| Description: The name of the kuma-dp docker image | ||
| IngressPort: | ||
| Type: String | ||
| Default: 10001 | ||
| DesiredCount: | ||
| Type: String | ||
| Default: 1 | ||
| Description: The desired replica count of the workload | ||
| CPAddress: | ||
| Type: String | ||
| Default: "https://zone-1-controlplane.kuma.io:5678" | ||
| Description: The kuma-cp address | ||
| DPTemplate: | ||
| Type: String | ||
| Default: | | ||
| --- | ||
| type: Dataplane | ||
| name: dp-ingress | ||
| mesh: default | ||
| networking: | ||
| address: "{{ address }}" | ||
| ingress: | ||
| publicAddress: "{{ publicAddress }}" | ||
| publicPort: "{{ publicPort }}" | ||
| inbound: | ||
| - port: {{ port }} | ||
| tags: | ||
| kuma.io/service: ingress | ||
| kuma.io/protocol: tcp | ||
| DPMesh: | ||
| Type: String | ||
| Default: "default" | ||
| Description: The Mesh of the dataplane | ||
| DPToken: | ||
| # generated with "wget --header='Content-Type: application/json' --post-data='{\"mesh\": \"default\", \"type\": \"ingress\"}' -qO- http://localhost:5681/tokens" | ||
| Type: String | ||
| Default: "" | ||
| Description: The dataplane token generated from kuma-cp | ||
| AllowedCidr: | ||
| Type: String | ||
| Default: '10.0.0.0/8' | ||
| Description: The CIDR used to restrict the kuma-cp ports access | ||
| Resources: | ||
|
|
||
| ################################### | ||
| # Service Discovery configuration # | ||
| ################################### | ||
|
|
||
| IngressTaskExecutionRole: | ||
| Type: AWS::IAM::Role | ||
| Properties: | ||
| AssumeRolePolicyDocument: | ||
| Statement: | ||
| - Effect: Allow | ||
| Principal: | ||
| Service: [ ecs-tasks.amazonaws.com ] | ||
| Action: [ 'sts:AssumeRole' ] | ||
| Path: / | ||
| ManagedPolicyArns: | ||
| - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly | ||
| - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess | ||
|
|
||
| IngressTaskIamRole: | ||
| Type: AWS::IAM::Role | ||
| Properties: | ||
| Path: / | ||
| AssumeRolePolicyDocument: | | ||
| { | ||
| "Statement": [{ | ||
| "Effect": "Allow", | ||
| "Principal": { "Service": [ "ecs-tasks.amazonaws.com" ]}, | ||
| "Action": [ "sts:AssumeRole" ] | ||
| }] | ||
| } | ||
| ManagedPolicyArns: | ||
| - arn:aws:iam::aws:policy/CloudWatchFullAccess | ||
| - arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess | ||
| - arn:aws:iam::aws:policy/AWSAppMeshEnvoyAccess | ||
|
|
||
|
|
||
| LogGroup: | ||
| Type: AWS::Logs::LogGroup | ||
| Properties: | ||
| LogGroupName: !Ref AWS::StackName | ||
| RetentionInDays: 7 # days | ||
|
|
||
| ############################ | ||
| # Ingress DP configuration # | ||
| ############################ | ||
|
|
||
| IngressDPSecurityGroup: | ||
| Type: AWS::EC2::SecurityGroup | ||
| Properties: | ||
| GroupDescription: Access to Kuma Ingress DP | ||
| VpcId: | ||
| Fn::ImportValue: | ||
| !Join [ ':', [ !Ref 'VPCStackName', 'VPCId' ] ] | ||
|
|
||
| IngressDPTcp: | ||
| Type: AWS::EC2::SecurityGroupIngress | ||
| Properties: | ||
| Description: For Ingress DP | ||
| GroupId: !Ref IngressDPSecurityGroup | ||
| IpProtocol: tcp | ||
| CidrIp: 0.0.0.0/0 | ||
| FromPort: !Ref IngressPort | ||
| ToPort: !Ref IngressPort | ||
|
|
||
| ServiceIngressDP: | ||
| Type: AWS::ECS::Service | ||
| Properties: | ||
| LaunchType: FARGATE | ||
| Cluster: | ||
| Fn::ImportValue: | ||
| !Join [ ':', [ !Ref 'VPCStackName', 'ClusterName' ] ] | ||
| DesiredCount: 1 | ||
| TaskDefinition: !Ref 'TaskDefinitionIngressDP' | ||
| NetworkConfiguration: | ||
| AwsvpcConfiguration: | ||
| AssignPublicIp: ENABLED | ||
| Subnets: | ||
| - Fn::ImportValue: | ||
| !Join [ ':', [ !Ref 'VPCStackName', 'PublicSubnet' ] ] | ||
| SecurityGroups: [ !Ref 'IngressDPSecurityGroup' ] | ||
|
|
||
| TaskDefinitionIngressDP: | ||
| Type: AWS::ECS::TaskDefinition | ||
| Properties: | ||
| Family: kuma-dp-ingress | ||
| NetworkMode: awsvpc | ||
| RequiresCompatibilities: | ||
| - FARGATE | ||
| TaskRoleArn: !Ref IngressTaskIamRole | ||
| ExecutionRoleArn: !Ref 'IngressTaskExecutionRole' | ||
| Cpu: 256 | ||
| Memory: 512 | ||
| ContainerDefinitions: | ||
| - Name: kuma-dp | ||
| Image: !Ref Image | ||
| PortMappings: | ||
| - ContainerPort: !Ref IngressPort | ||
| Protocol: tcp | ||
| Essential: true | ||
| User: '5678' | ||
| Environment: | ||
| - Name: KUMA_DATAPLANE_RUNTIME_TOKEN | ||
| Value: !Ref DPToken | ||
| - Name: KUMA_DATAPLANE_RUNTIME_RESOURCE | ||
| Value: !Ref DPTemplate | ||
| EntryPoint: [ "sh", "-c" ] | ||
| Command: | ||
| - !Join | ||
| - " " | ||
| - - "kuma-dp" | ||
| - "run" | ||
| - "--cp-address" | ||
| - !Ref CPAddress | ||
| - "--dataplane-var" | ||
| - "dpname=`hostname -s`" | ||
| - "--dataplane-var" | ||
| - "address=`hostname -i`" | ||
| - "--dataplane-var" | ||
| - !Join [ "=", [ "port", !Ref IngressPort ] ] | ||
| - "--dataplane-var" | ||
| - "publicAddress=`hostname -i`" # this might be an LB public IP | ||
| - "--dataplane-var" | ||
| - !Join [ "=", [ "publicPort", !Ref IngressPort ] ] | ||
| LogConfiguration: | ||
| LogDriver: awslogs | ||
| Options: | ||
| awslogs-group: !Ref AWS::StackName | ||
| awslogs-region: !Ref AWS::Region | ||
| awslogs-stream-prefix: kuma-dp |