Merge pull request #19 from portefaix/feat/ack-infra

AWS Infrastructure using ACK
portefaix · Aug 19, 2022 · abfd91e · abfd91e
2 parents fc481a6 + b0b0d0b
commit abfd91e
Show file tree

Hide file tree

Showing 16 changed files with 547 additions and 1 deletion.
diff --git a/krm/ack/ec2-values.yaml b/krm/ack/ec2-values.yaml
@@ -0,0 +1,45 @@
+# Copyright (C) Nicolas Lamirault <nicolas.lamirault@gmail.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+metrics:
+  service:
+    create: true
+
+resources:
+  requests:
+    memory: "64Mi"
+    cpu: "50m"
+  limits:
+    memory: "128Mi"
+    cpu: "100m"
+
+aws:
+  region: "us-west-2"
+  credentials:
+    # If specified, Secret with shared credentials file to use.
+    secretName: "ack-aws-credentials"
+    # Secret stringData key that contains the credentials
+    secretKey: "credentials"
+    # Profile used for AWS credentials
+    # profile: "default"  
+
+resourceTags:
+  # Configures the ACK service controller to always set key/value pairs tags on
+  # resources that it manages.
+  - services.k8s.aws/controller-version=%CONTROLLER_SERVICE%-%CONTROLLER_VERSION%
+  - services.k8s.aws/namespace=%K8S_NAMESPACE%
+  - service=krm
+  - environment=local
+  - made-by=ack
diff --git a/krm/ack/ecr-values.yaml b/krm/ack/ecr-values.yaml
@@ -34,3 +34,12 @@ aws:
     secretKey: "credentials"
     # Profile used for AWS credentials
     # profile: "default"  
+
+resourceTags:
+  # Configures the ACK service controller to always set key/value pairs tags on
+  # resources that it manages.
+  - services.k8s.aws/controller-version=%CONTROLLER_SERVICE%-%CONTROLLER_VERSION%
+  - services.k8s.aws/namespace=%K8S_NAMESPACE%
+  - service=krm
+  - environment=local
+  - made-by=ack
diff --git a/krm/ack/eks-values.yaml b/krm/ack/eks-values.yaml
@@ -33,4 +33,13 @@ aws:
     # Secret stringData key that contains the credentials
     secretKey: "credentials"
     # Profile used for AWS credentials
-    # profile: "default"  
+    # profile: "default"
+
+resourceTags:
+  # Configures the ACK service controller to always set key/value pairs tags on
+  # resources that it manages.
+  - services.k8s.aws/controller-version=%CONTROLLER_SERVICE%-%CONTROLLER_VERSION%
+  - services.k8s.aws/namespace=%K8S_NAMESPACE%
+  - service=krm
+  - environment=local
+  - made-by=ack
diff --git a/krm/ack/iam-values.yaml b/krm/ack/iam-values.yaml
@@ -34,3 +34,12 @@ aws:
     secretKey: "credentials"
     # Profile used for AWS credentials
     # profile: "default"  
+
+resourceTags:
+  # Configures the ACK service controller to always set key/value pairs tags on
+  # resources that it manages.
+  - services.k8s.aws/controller-version=%CONTROLLER_SERVICE%-%CONTROLLER_VERSION%
+  - services.k8s.aws/namespace=%K8S_NAMESPACE%
+  - service=krm
+  - environment=local
+  - made-by=ack
diff --git a/krm/ack/infra/ecr.yaml b/krm/ack/infra/ecr.yaml
@@ -0,0 +1,25 @@
+# Copyright (C) Nicolas Lamirault <nicolas.lamirault@gmail.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+apiVersion: ecr.services.k8s.aws/v1alpha1
+kind: Repository
+metadata:
+  name: portefaix-krm-ack
+spec:
+  name: portefaix-krm-ack
+  imageTagMutability: IMMUTABLE
+  imageScanningConfiguration:
+    scanOnPush: true
+  lifecyclePolicy: '{"rules":[{"rulePriority":1,"description":"Expire images older than 14 days","selection":{"tagStatus":"untagged","countType":"sinceImagePushed","countUnit":"days","countNumber":14},"action":{"type":"expire"}}]}'
diff --git a/krm/ack/infra/eip.yaml b/krm/ack/infra/eip.yaml
@@ -0,0 +1,21 @@
+# Copyright (C) Nicolas Lamirault <nicolas.lamirault@gmail.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+apiVersion: ec2.services.k8s.aws/v1alpha1
+kind: ElasticIPAddress
+metadata:
+  name: portefaix-krm-ack
+spec:
+  domain: vpc
diff --git a/krm/ack/infra/eks.yaml b/krm/ack/infra/eks.yaml
@@ -0,0 +1,109 @@
+# Copyright (C) Nicolas Lamirault <nicolas.lamirault@gmail.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+apiVersion: eks.services.k8s.aws/v1alpha1
+kind: Cluster
+metadata:
+  name: portefaix-krm-ack
+spec:
+  name: portefaix-krm-ack-eks-cluster
+  roleRef:
+    from:
+      name: portefaix-krm-ack-eks-cluster
+  resourcesVPCConfig:
+    endpointPrivateAccess: true
+    endpointPublicAccess: false
+    # securityGroupRefs:
+    #   from:
+    #     name: XXXX
+    subnetRefs:
+      - from:
+          name: portefaix-krm-ack-public
+  version: 1.23
+---
+apiVersion: eks.services.k8s.aws/v1alpha1
+kind: Nodegroup
+metadata:
+  name: portefaix-krm-ack-core
+spec:
+  name: portefaix-krm-ack-core
+  clusterName: portefaix-krm-ack-eks-cluster
+  roleRef:
+    from:
+      name: portefaix-krm-ack-eks-node
+  amiType: AL2_x86_64
+  diskSize: 50
+  instanceTypes:
+  - "t3.large"
+  subnetRefs:
+    - from:
+        name: portefaix-krm-ack-private
+  scalingConfig:
+    minSize: 1
+    maxSize: 3
+    desiredSize: 1
+  updateConfig: 
+    maxUnavailable: 1
+    maxUnavailablePercentage: 50 
+---
+apiVersion: eks.services.k8s.aws/v1alpha1
+kind: Nodegroup
+metadata:
+  name: portefaix-krm-ack-ops
+spec:
+  name: portefaix-krm-ack-ops
+  clusterName: portefaix-krm-ack-eks-cluster
+  nodeRoleRef:
+    from:
+      name: portefaix-krm-ack-eks-node
+  amiType: AL2_x86_64
+  diskSize: 50
+  instanceTypes:
+  - "t3.large"
+  capacityTypes:
+  - "SPOT"
+  subnetRefs:
+      - name: portefaix-krm-ack-private
+  scalingConfig:
+    minSize: 1
+    maxSize: 3
+    desiredSize: 1
+  updateConfig: 
+    maxUnavailable: 1 
+    maxUnavailablePercentage: 50 
+---
+apiVersion: eks.services.k8s.aws/v1alpha1
+kind: FargateProfile
+metadata:
+  name: portefaix-krm-ack
+spec:
+  name: portefaix-krm-ack
+  clusterName: portefaix-krm-ack-eks-cluster
+  # podExecutionRoleARN: $FARGATE_POD_ROLE 
+  subnetRefs:
+      - name: portefaix-krm-ack-private
+  selectors:
+    labels: {}
+    namespace: portefaix-system
+---
+# apiVersion: eks.services.k8s.aws/v1alpha1
+# kind: Addon
+# metadata:
+#   name: $ADDON_NAME
+# spec:
+#   name: $ADDON_NAME
+#   addonVersion: $ADDON_VERSION
+#   #https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeAddonVersions.html
+#   clusterName: $CLUSTER_NAME
diff --git a/krm/ack/infra/gateways.yaml b/krm/ack/infra/gateways.yaml
@@ -0,0 +1,54 @@
+# Copyright (C) Nicolas Lamirault <nicolas.lamirault@gmail.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+apiVersion: ec2.services.k8s.aws/v1alpha1
+kind: InternetGateway
+metadata:
+  name: portefaix-krm-ack
+spec:
+  vpcRef:
+    from:
+      name: portefaix-krm-ack
+---
+apiVersion: ec2.services.k8s.aws/v1alpha1
+kind: NATGateway
+metadata:
+  name: portefaix-krm-ack
+spec:
+  allocationRef: # Elastic IP Address
+    from:
+      name: portefaix-krm-ack
+  subnetRef:
+    from:
+      name: portefaix-krm-ack-private
+  connectivityType: "public"
+---
+apiVersion: ec2.services.k8s.aws/v1alpha1
+kind: RouteTable
+metadata:
+  name: portefaix-krm-ack
+spec:
+  routes:
+    - destinationCIDRBlock: 10.10.1.0/24
+      gatewayRef:
+        from:
+          name: portefaix-krm-ack
+    - destinationCIDRBlock: 10.10.2.0/24
+      natGatewayRef:
+        from:
+          name: portefaix-krm-ack
+  vpcRef:
+    from:
+      name: portefaix-krm-ack
diff --git a/krm/ack/infra/iam.yaml b/krm/ack/infra/iam.yaml
@@ -0,0 +1,71 @@
+# Copyright (C) Nicolas Lamirault <nicolas.lamirault@gmail.com>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+apiVersion: iam.services.k8s.aws/v1alpha1
+kind: Role
+metadata:
+  name: portefaix-krm-ack-eks-cluster
+spec:
+  name: portefaix-krm-ack-eks-cluster
+  description: Portefaix EKS cluster
+  maxSessionDuration: $MAX_SESSION_DURATION 
+  policies:
+  - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
+  - arn:aws:iam::aws:policy/AmazonEKSServicePolicy
+  assumeRolePolicyDocument: >
+    {
+      "Version":"2012-10-17",
+      "Statement": [{
+        "Effect":"Allow",
+        "Principal": {
+          "Service": [
+            "ec2.amazonaws.com",
+            "eks.amazonaws.com",
+            "eks-fargate-pods.amazonaws.com",
+            "lambda.amazonaws.com"
+          ]
+        },
+        "Action": ["sts:AssumeRole"]
+      }]
+    }
+---
+apiVersion: iam.services.k8s.aws/v1alpha1
+kind: Role
+metadata:
+  name: portefaix-krm-ack-eks-node
+spec:
+  name: portefaix-krm-ack-eks-node
+  description: Portefaix EKS node
+  maxSessionDuration: $MAX_SESSION_DURATION 
+  policies:
+  - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
+  - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
+  - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
+  assumeRolePolicyDocument: >
+    {
+      "Version":"2012-10-17",
+      "Statement": [{
+        "Effect":"Allow",
+        "Principal": {
+          "Service": [
+            "ec2.amazonaws.com",
+            "eks.amazonaws.com",
+            "eks-fargate-pods.amazonaws.com",
+            "lambda.amazonaws.com"
+          ]
+        },
+        "Action": ["sts:AssumeRole"]
+      }]
+    }