diff --git a/assets/packer/perforce/helix-core/p4_configure.sh b/assets/packer/perforce/helix-core/p4_configure.sh index f5bb3f9c..90113fd3 100644 --- a/assets/packer/perforce/helix-core/p4_configure.sh +++ b/assets/packer/perforce/helix-core/p4_configure.sh @@ -1,8 +1,5 @@ #!/bin/bash - -#Currently this needs proper EBS volume locations from /dev with proper nvme names $1 is a hxlogs $2 hxmetadata $3 hxdepots $4 perforce server type p4d_master/ p4d_replica - # Log file location LOG_FILE="/var/log/p4_configure.log" @@ -80,7 +77,6 @@ setup_helix_auth() { >> $LOG_FILE 2>> $LOG_FILE } - # Function to create and mount XFS on EBS prepare_ebs_volume() { local ebs_volume=$1 @@ -99,7 +95,6 @@ prepare_ebs_volume() { } # Function to copy SiteTags template and update with AWS regions -> This file will be updated by Ansible with replica AWS regions. - prepare_site_tags() { log_message "Setting up SiteTags for installation" local source="/hxdepots/sdp/Server/Unix/p4/common/config/SiteTags.cfg.sample" @@ -131,21 +126,98 @@ prepare_site_tags() { # Starting the script log_message "Starting the p4 configure script." -# Check if the script received 7 arguments -if [[ "$#" < 6 || "$#" > 7 ]]; then - log_message "Incorrect usage. Expected 6 or 7 arguments, got $#." - log_message "Usage: $0 " +# Function to print help +print_help() { + echo "Usage: $0 [OPTIONS]" + echo "Options:" + echo " --p4d_type Specify the type of Helix Core server (p4d_master, p4d_replica, p4d_edge)" + echo " --username AWS Secrets Manager secret ID for the Helix Core admin username" + echo " --password AWS Secrets Manager secret ID for the Helix Core admin password" + echo " --auth Helix Authentication Service URL" + echo " --fqdn Fully Qualified Domain Name for the Helix Core server" + echo " --hx_logs Path for Helix Core logs" + echo " --hx_metadata Path for Helix Core metadata" + echo " --hx_depots Path for Helix Core depots" + echo " --help Display this help and exit" +} + +# Parse command-line options +OPTS=$(getopt -o '' --long p4d_type:,username:,password:,auth:,fqdn:,hx_logs:,hx_metadata:,hx_depots:,help -n 'parse-options' -- "$@") + +if [ $? != 0 ]; then + log_message "Failed to parse options" exit 1 fi -# Assigning arguments to variables -EBS_LOGS=$1 -EBS_METADATA=$2 -EBS_DEPOTS=$3 -P4D_TYPE=$4 -[[ "$P4D_TYPE" == "p4d_commit" ]] && P4D_TYPE="p4d_master" || P4D_TYPE="$4" -P4D_ADMIN_USERNAME_SECRET_ID=$5 -P4D_ADMIN_PASS_SECRET_ID=$6 +eval set -- "$OPTS" + +while true; do + case "$1" in + --p4d_type) + P4D_TYPE=$([ "$2" = "p4d_commit" ] && echo "p4d_master" || echo "$2") + case "$P4D_TYPE" in + p4d_master|p4d_replica|p4d_edge) + shift 2 + ;; + *) + log_message "Invalid value for --p4d_type: $2" + print_help + exit 1 + ;; + esac + ;; + --username) + P4D_ADMIN_USERNAME_SECRET_ID="$2" + shift 2 + ;; + --password) + P4D_ADMIN_PASS_SECRET_ID="$2" + shift 2 + ;; + --auth) + HELIX_AUTH_SERVICE_URL="$2" + shift 2 + ;; + --fqdn) + FQDN="$2" + shift 2 + ;; + --hx_logs) + EBS_LOGS="$2" + log_message "EBS_LOGS: $EBS_LOGS" + shift 2 + ;; + --hx_metadata) + EBS_METADATA="$2" + log_message "EBS_METADATA: $EBS_METADATA" + shift 2 + ;; + --hx_depots) + EBS_DEPOTS="$2" + log_message "EBS_DEPOTS: $EBS_DEPOTS" + shift 2 + ;; + --help) + print_help + exit 0 + ;; + --) + shift + break + ;; + *) + log_message "Invalid option: $1" + print_help + exit 1 + ;; + esac +done + +# Validate P4D_TYPE +if [[ "$P4D_TYPE" != "p4d_master" && "$P4D_TYPE" != "p4d_replica" && "$P4D_TYPE" != "p4d_edge" ]]; then + log_message "Invalid P4D_TYPE: $P4D_TYPE. Valid options are p4d_master, p4d_replica, or p4d_edge." + exit 1 +fi # Fetch credentials for admin user from secrets manager P4D_ADMIN_USERNAME=$(resolve_aws_secret $P4D_ADMIN_USERNAME_SECRET_ID) @@ -211,15 +283,35 @@ perform_operations() { log_message "Operation completed successfully." } -# Check if EBS volumes or FSx mount points are provided for all required paths -if ( [ -e "$EBS_LOGS" ] || is_fsx_mount "$EBS_LOGS" ) && \ - ( [ -e "$EBS_METADATA" ] || is_fsx_mount "$EBS_METADATA" ) && \ - ( [ -e "$EBS_DEPOTS" ] || is_fsx_mount "$EBS_DEPOTS" ); then - perform_operations -else - log_message "One or more required paths are not valid EBS volumes or FSx mount points. No operations performed. Will continue with single disk setup" + +# Maximum number of attempts (added due to terraform not mounting EBS fast enough at instance boot) +MAX_ATTEMPTS=3 + +# Counter for attempts +attempt=1 + +# Flag to track if the condition is met +condition_met=false + +while [ $attempt -le $MAX_ATTEMPTS ] && [ "$condition_met" = false ]; do + # Check if EBS volumes or FSx mount points are provided for all required paths + if ( [ -e "$EBS_LOGS" ] || is_fsx_mount "$EBS_LOGS" ) && \ + ( [ -e "$EBS_METADATA" ] || is_fsx_mount "$EBS_METADATA" ) && \ + ( [ -e "$EBS_DEPOTS" ] || is_fsx_mount "$EBS_DEPOTS" ); then + condition_met=true + perform_operations + else + log_message "Attempt $attempt: One or more required paths are not valid EBS volumes or FSx mount points." + sleep 5 # Wait for 1 second before the next attempt + ((attempt++)) + fi +done + +if [ "$condition_met" = false ]; then + log_message "All attempts failed. No operations performed. Will continue with single disk setup." fi + log_message "$0" "$@" log_message "Starting the configuration part after mounting was done later will configure the commit or replica depending on configuration." @@ -278,12 +370,12 @@ fi FILE_PATH="/p4/ssl/config.txt" # Retrieve the EC2 instance DNS name -if [ -z $7 ]; then +if [ -z $FQDN ]; then log_message "FQDN was not provided. Retrieving from EC2 metadata." EC2_DNS_NAME=$(curl -s http://169.254.169.254/latest/meta-data/public-hostname --header "X-aws-ec2-metadata-token: $TOKEN") else - log_message "FQDN was provided: $7" - EC2_DNS_NAME=$7 + log_message "FQDN was provided: $FQDN" + EC2_DNS_NAME=$FQDN fi # Check if the DNS name was successfully retrieved @@ -382,11 +474,10 @@ else fi # Check if the HELIX_AUTH_SERVICE_URL is empty. if not, configure Helix Authentication Extension -if [-z $8]; then +if [-z $HELIX_AUTH_SERVICE_URL ]; then log_message "Helix Authentication Service URL was not provided. Skipping configuration." else - log_message "Configuring Helix Authentication Extension against $8" - HELIX_AUTH_SERVICE_URL=$8 + log_message "Configuring Helix Authentication Extension against $HELIX_AUTH_SERVICE_URL" setup_helix_auth "$P4PORT" "$P4D_ADMIN_USERNAME" "$P4D_ADMIN_PASS" "$HELIX_AUTH_SERVICE_URL" "oidc" "email" "email" fi diff --git a/assets/packer/perforce/helix-core/perforce_arm64.pkr.hcl b/assets/packer/perforce/helix-core/perforce_arm64.pkr.hcl new file mode 100644 index 00000000..7096649f --- /dev/null +++ b/assets/packer/perforce/helix-core/perforce_arm64.pkr.hcl @@ -0,0 +1,98 @@ +packer { + required_plugins { + amazon = { + version = ">= 0.0.2" + source = "github.com/hashicorp/amazon" + } + } +} + +locals { + timestamp = regex_replace(timestamp(), "[- TZ:]", "") + ami_prefix = "p4_al2023" +} + +variable "region" { + type = string + default = "us-west-2" +} + +variable "vpc_id" { + type = string + default = null +} + +variable "subnet_id" { + type = string + default = null +} + +variable "associate_public_ip_address" { + type = bool + default = true +} + +variable "ssh_interface" { + type = string + default = "public_ip" +} + +source "amazon-ebs" "al2023" { + region = var.region + ami_name = "${local.ami_prefix}-${local.timestamp}" + instance_type = "t4g.medium" + + vpc_id = var.vpc_id + subnet_id = var.subnet_id + + associate_public_ip_address = var.associate_public_ip_address + ssh_interface = var.ssh_interface + + source_ami_filter { + filters = { + name = "al2023-ami-2023.5.*" + architecture = "arm64" + root-device-type = "ebs" + virtualization-type = "hvm" + } + most_recent = true + owners = ["amazon"] + } + + ssh_username = "ec2-user" +} + +build { + name = "P4_SDP_AWS" + sources = [ + "source.amazon-ebs.al2023" + ] + + provisioner "shell" { + inline = [ + "cloud-init status --wait", + "sudo dnf install -y git sendmail nfs-utils s-nail unzip cronie" + ] + } + + provisioner "shell" { + script = "${path.root}/p4_setup.sh" + execute_command = "sudo sh {{.Path}}" + } + + provisioner "file" { + source = "${path.root}/p4_configure.sh" + destination = "/tmp/p4_configure.sh" + } + + provisioner "shell" { + inline = ["mkdir -p /home/ec2-user/gpic_scripts", + "sudo mv /tmp/p4_configure.sh /home/ec2-user/gpic_scripts" + ] + } + + provisioner "shell" { + inline = ["sudo chmod +x /home/ec2-user/gpic_scripts/p4_configure.sh"] + } + +} diff --git a/assets/packer/perforce/helix-core/perforce.pkr.hcl b/assets/packer/perforce/helix-core/perforce_x86.pkr.hcl similarity index 100% rename from assets/packer/perforce/helix-core/perforce.pkr.hcl rename to assets/packer/perforce/helix-core/perforce_x86.pkr.hcl diff --git a/modules/perforce/helix-core/data.tf b/modules/perforce/helix-core/data.tf index 1816611c..d39bc874 100644 --- a/modules/perforce/helix-core/data.tf +++ b/modules/perforce/helix-core/data.tf @@ -22,4 +22,8 @@ data "aws_ami" "helix_core_ami" { name = "virtualization-type" values = ["hvm"] } + filter { + name = "architecture" + values = [var.instance_architecture] + } } diff --git a/modules/perforce/helix-core/main.tf b/modules/perforce/helix-core/main.tf index bfee77b7..82035cc7 100644 --- a/modules/perforce/helix-core/main.tf +++ b/modules/perforce/helix-core/main.tf @@ -35,14 +35,15 @@ resource "aws_instance" "helix_core_instance" { user_data = <<-EOT #!/bin/bash - /home/ec2-user/gpic_scripts/p4_configure.sh /dev/sdf /dev/sdg /dev/sdh \ - ${var.server_type} \ - ${var.helix_core_super_user_username_secret_arn == null ? awscc_secretsmanager_secret.helix_core_super_user_username[0].secret_id : var.helix_core_super_user_username_secret_arn} \ - ${var.helix_core_super_user_password_secret_arn == null ? awscc_secretsmanager_secret.helix_core_super_user_password[0].secret_id : var.helix_core_super_user_password_secret_arn} \ - ${var.FQDN == null ? "" : var.FQDN} \ - ${var.helix_authentication_service_url == null ? "" : var.helix_authentication_service_url} + /home/ec2-user/gpic_scripts/p4_configure.sh --hx_logs /dev/sdf --hx_metadata /dev/sdg --hx_depots /dev/sdh \ + --p4d_type ${var.server_type} \ + --username ${var.helix_core_super_user_username_secret_arn == null ? awscc_secretsmanager_secret.helix_core_super_user_username[0].secret_id : var.helix_core_super_user_username_secret_arn} \ + --password ${var.helix_core_super_user_password_secret_arn == null ? awscc_secretsmanager_secret.helix_core_super_user_password[0].secret_id : var.helix_core_super_user_password_secret_arn} \ + --fqdn ${var.FQDN == null ? "" : var.FQDN} \ + --auth ${var.helix_authentication_service_url == null ? "" : var.helix_authentication_service_url} EOT + vpc_security_group_ids = concat(var.existing_security_groups, [aws_security_group.helix_core_security_group[0].id]) metadata_options { diff --git a/modules/perforce/helix-core/plan b/modules/perforce/helix-core/plan new file mode 100644 index 00000000..dd02cb10 Binary files /dev/null and b/modules/perforce/helix-core/plan differ diff --git a/modules/perforce/helix-core/pln b/modules/perforce/helix-core/pln new file mode 100644 index 00000000..0d04ff2e Binary files /dev/null and b/modules/perforce/helix-core/pln differ diff --git a/modules/perforce/helix-core/variables.tf b/modules/perforce/helix-core/variables.tf index 6728bf2a..7799e29e 100644 --- a/modules/perforce/helix-core/variables.tf +++ b/modules/perforce/helix-core/variables.tf @@ -35,6 +35,16 @@ variable "tags" { description = "Tags to apply to resources." } +variable "instance_architecture" { + type = string + description = "The architecture of the Helix Core instance. Allowed values are 'arm64' or 'x86_64'." + default = "x86_64" + validation { + condition = var.instance_architecture == "arm64" || var.instance_architecture == "x86_64" + error_message = "The instance_architecture variable must be either 'arm64' or 'x86_64'." + } +} + ######################################## # Networking and Security ######################################## diff --git a/modules/perforce/helix-swarm/README.md b/modules/perforce/helix-swarm/README.md index f9fa3c56..bc17e481 100644 --- a/modules/perforce/helix-swarm/README.md +++ b/modules/perforce/helix-swarm/README.md @@ -6,7 +6,7 @@ | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.0 | -| [aws](#requirement\_aws) | 5.59.0 | +| [aws](#requirement\_aws) | 5.66.0 | | [random](#requirement\_random) | 3.6.2 | ## Providers @@ -24,46 +24,46 @@ No modules. | Name | Type | |------|------| -| [aws_cloudwatch_log_group.helix_swarm_redis_service_log_group](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/cloudwatch_log_group) | resource | -| [aws_cloudwatch_log_group.helix_swarm_service_log_group](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/cloudwatch_log_group) | resource | -| [aws_ecs_cluster.helix_swarm_cluster](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/ecs_cluster) | resource | -| [aws_ecs_cluster_capacity_providers.helix_swarm_cluster_fargate_providers](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/ecs_cluster_capacity_providers) | resource | -| [aws_ecs_service.helix_swarm_service](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/ecs_service) | resource | -| [aws_ecs_task_definition.helix_swarm_task_definition](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/ecs_task_definition) | resource | -| [aws_efs_access_point.helix_swarm_efs_access_point](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/efs_access_point) | resource | -| [aws_efs_access_point.redis_efs_access_point](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/efs_access_point) | resource | -| [aws_efs_file_system.helix_swarm_efs_file_system](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/efs_file_system) | resource | -| [aws_efs_mount_target.helix_swarm_efs_mount_target](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/efs_mount_target) | resource | -| [aws_iam_policy.helix_swarm_default_policy](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/iam_policy) | resource | -| [aws_iam_policy.helix_swarm_efs_policy](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/iam_policy) | resource | -| [aws_iam_policy.helix_swarm_ssm_policy](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/iam_policy) | resource | -| [aws_iam_role.helix_swarm_default_role](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/iam_role) | resource | -| [aws_iam_role.helix_swarm_task_execution_role](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/iam_role) | resource | -| [aws_lb.helix_swarm_alb](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/lb) | resource | -| [aws_lb_listener.swarm_alb_https_listener](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/lb_listener) | resource | -| [aws_lb_target_group.helix_swarm_alb_target_group](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/lb_target_group) | resource | -| [aws_s3_bucket.helix_swarm_alb_access_logs_bucket](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/s3_bucket) | resource | -| [aws_s3_bucket_lifecycle_configuration.access_logs_bucket_lifecycle_configuration](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/s3_bucket_lifecycle_configuration) | resource | -| [aws_s3_bucket_policy.alb_access_logs_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/s3_bucket_policy) | resource | -| [aws_s3_bucket_public_access_block.access_logs_bucket_public_block](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/s3_bucket_public_access_block) | resource | -| [aws_security_group.helix_swarm_alb_sg](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/security_group) | resource | -| [aws_security_group.helix_swarm_efs_security_group](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/security_group) | resource | -| [aws_security_group.helix_swarm_service_sg](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/security_group) | resource | -| [aws_vpc_security_group_egress_rule.helix_swarm_alb_outbound_service](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_egress_rule) | resource | -| [aws_vpc_security_group_egress_rule.helix_swarm_service_outbound_ipv4](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_egress_rule) | resource | -| [aws_vpc_security_group_egress_rule.helix_swarm_service_outbound_ipv6](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_egress_rule) | resource | -| [aws_vpc_security_group_ingress_rule.helix_swarm_efs_inbound_service](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | -| [aws_vpc_security_group_ingress_rule.helix_swarm_service_inbound_alb](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_cloudwatch_log_group.helix_swarm_redis_service_log_group](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/cloudwatch_log_group) | resource | +| [aws_cloudwatch_log_group.helix_swarm_service_log_group](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/cloudwatch_log_group) | resource | +| [aws_ecs_cluster.helix_swarm_cluster](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/ecs_cluster) | resource | +| [aws_ecs_cluster_capacity_providers.helix_swarm_cluster_fargate_providers](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/ecs_cluster_capacity_providers) | resource | +| [aws_ecs_service.helix_swarm_service](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/ecs_service) | resource | +| [aws_ecs_task_definition.helix_swarm_task_definition](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/ecs_task_definition) | resource | +| [aws_efs_access_point.helix_swarm_efs_access_point](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/efs_access_point) | resource | +| [aws_efs_access_point.redis_efs_access_point](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/efs_access_point) | resource | +| [aws_efs_file_system.helix_swarm_efs_file_system](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/efs_file_system) | resource | +| [aws_efs_mount_target.helix_swarm_efs_mount_target](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/efs_mount_target) | resource | +| [aws_iam_policy.helix_swarm_default_policy](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/iam_policy) | resource | +| [aws_iam_policy.helix_swarm_efs_policy](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/iam_policy) | resource | +| [aws_iam_policy.helix_swarm_ssm_policy](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/iam_policy) | resource | +| [aws_iam_role.helix_swarm_default_role](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/iam_role) | resource | +| [aws_iam_role.helix_swarm_task_execution_role](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/iam_role) | resource | +| [aws_lb.helix_swarm_alb](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/lb) | resource | +| [aws_lb_listener.swarm_alb_https_listener](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/lb_listener) | resource | +| [aws_lb_target_group.helix_swarm_alb_target_group](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/lb_target_group) | resource | +| [aws_s3_bucket.helix_swarm_alb_access_logs_bucket](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket_lifecycle_configuration.access_logs_bucket_lifecycle_configuration](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/s3_bucket_lifecycle_configuration) | resource | +| [aws_s3_bucket_policy.alb_access_logs_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/s3_bucket_policy) | resource | +| [aws_s3_bucket_public_access_block.access_logs_bucket_public_block](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/s3_bucket_public_access_block) | resource | +| [aws_security_group.helix_swarm_alb_sg](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/security_group) | resource | +| [aws_security_group.helix_swarm_efs_security_group](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/security_group) | resource | +| [aws_security_group.helix_swarm_service_sg](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/security_group) | resource | +| [aws_vpc_security_group_egress_rule.helix_swarm_alb_outbound_service](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_egress_rule) | resource | +| [aws_vpc_security_group_egress_rule.helix_swarm_service_outbound_ipv4](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_egress_rule) | resource | +| [aws_vpc_security_group_egress_rule.helix_swarm_service_outbound_ipv6](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_egress_rule) | resource | +| [aws_vpc_security_group_ingress_rule.helix_swarm_efs_inbound_service](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_vpc_security_group_ingress_rule.helix_swarm_service_inbound_alb](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | | [random_string.helix_swarm](https://registry.terraform.io/providers/hashicorp/random/3.6.2/docs/resources/string) | resource | | [random_string.helix_swarm_alb_access_logs_bucket_suffix](https://registry.terraform.io/providers/hashicorp/random/3.6.2/docs/resources/string) | resource | -| [aws_ecs_cluster.helix_swarm_cluster](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/ecs_cluster) | data source | -| [aws_elb_service_account.main](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/elb_service_account) | data source | -| [aws_iam_policy_document.access_logs_bucket_alb_write](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.ecs_tasks_trust_relationship](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.helix_swarm_default_policy](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.helix_swarm_efs_policy](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.helix_swarm_ssm_policy](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/region) | data source | +| [aws_ecs_cluster.helix_swarm_cluster](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/ecs_cluster) | data source | +| [aws_elb_service_account.main](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/elb_service_account) | data source | +| [aws_iam_policy_document.access_logs_bucket_alb_write](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.ecs_tasks_trust_relationship](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.helix_swarm_default_policy](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.helix_swarm_efs_policy](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.helix_swarm_ssm_policy](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/iam_policy_document) | data source | +| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/region) | data source | ## Inputs diff --git a/modules/perforce/helix-swarm/efs.tf b/modules/perforce/helix-swarm/efs.tf index 82cc8222..cd1aa183 100644 --- a/modules/perforce/helix-swarm/efs.tf +++ b/modules/perforce/helix-swarm/efs.tf @@ -20,7 +20,7 @@ resource "aws_efs_file_system" "helix_swarm_efs_file_system" { lifecycle_policy { transition_to_primary_storage_class = "AFTER_1_ACCESS" } - + #checkov:skip=CKV_AWS_184: CMK encryption not supported currently tags = merge(local.tags, { Name = "${local.name_prefix}-efs-file-system" }) diff --git a/samples/simple-build-pipeline/README.md b/samples/simple-build-pipeline/README.md index 3b9c499b..7abf0abe 100644 --- a/samples/simple-build-pipeline/README.md +++ b/samples/simple-build-pipeline/README.md @@ -4,13 +4,13 @@ | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.0 | -| [aws](#requirement\_aws) | 5.59.0 | +| [aws](#requirement\_aws) | 5.66.0 | ## Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | 5.59.0 | +| [aws](#provider\_aws) | 5.66.0 | ## Modules @@ -25,45 +25,47 @@ | Name | Type | |------|------| -| [aws_acm_certificate.helix](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/acm_certificate) | resource | -| [aws_acm_certificate.jenkins](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/acm_certificate) | resource | -| [aws_acm_certificate_validation.helix](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/acm_certificate_validation) | resource | -| [aws_acm_certificate_validation.jenkins](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/acm_certificate_validation) | resource | -| [aws_default_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/default_security_group) | resource | -| [aws_ecs_cluster.build_pipeline_cluster](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/ecs_cluster) | resource | -| [aws_ecs_cluster_capacity_providers.providers](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/ecs_cluster_capacity_providers) | resource | -| [aws_eip.nat_gateway_eip](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/eip) | resource | -| [aws_internet_gateway.igw](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/internet_gateway) | resource | -| [aws_nat_gateway.nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/nat_gateway) | resource | -| [aws_route53_record.helix_authentication_service](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route53_record) | resource | -| [aws_route53_record.helix_cert](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route53_record) | resource | -| [aws_route53_record.helix_swarm](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route53_record) | resource | -| [aws_route53_record.jenkins](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route53_record) | resource | -| [aws_route53_record.jenkins_cert](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route53_record) | resource | -| [aws_route53_record.perforce_helix_core](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route53_record) | resource | -| [aws_route53_record.perforce_helix_core_pvt](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route53_record) | resource | -| [aws_route53_zone.helix_private_zone](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route53_zone) | resource | -| [aws_route_table.private_rt](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route_table) | resource | -| [aws_route_table.public_rt](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route_table) | resource | -| [aws_route_table_association.private_rt_asso](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route_table_association) | resource | -| [aws_route_table_association.public_rt_asso](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/route_table_association) | resource | -| [aws_subnet.private_subnets](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/subnet) | resource | -| [aws_subnet.public_subnets](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/subnet) | resource | -| [aws_vpc.build_pipeline_vpc](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc) | resource | -| [aws_vpc_security_group_ingress_rule.helix_auth_access](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | -| [aws_vpc_security_group_ingress_rule.helix_auth_inbound_core](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | -| [aws_vpc_security_group_ingress_rule.helix_core_access](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | -| [aws_vpc_security_group_ingress_rule.helix_core_inbound_build_farm](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | -| [aws_vpc_security_group_ingress_rule.helix_core_inbound_swarm](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | -| [aws_vpc_security_group_ingress_rule.helix_swarm_access](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | -| [aws_vpc_security_group_ingress_rule.helix_swarm_inbound_core](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | -| [aws_vpc_security_group_ingress_rule.jenkins_access](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/resources/vpc_security_group_ingress_rule) | resource | -| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/availability_zones) | data source | -| [aws_route53_zone.root](https://registry.terraform.io/providers/hashicorp/aws/5.59.0/docs/data-sources/route53_zone) | data source | +| [aws_acm_certificate.helix](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/acm_certificate) | resource | +| [aws_acm_certificate.jenkins](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/acm_certificate) | resource | +| [aws_acm_certificate_validation.helix](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/acm_certificate_validation) | resource | +| [aws_acm_certificate_validation.jenkins](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/acm_certificate_validation) | resource | +| [aws_default_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/default_security_group) | resource | +| [aws_ecs_cluster.build_pipeline_cluster](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/ecs_cluster) | resource | +| [aws_ecs_cluster_capacity_providers.providers](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/ecs_cluster_capacity_providers) | resource | +| [aws_eip.nat_gateway_eip](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/eip) | resource | +| [aws_internet_gateway.igw](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/internet_gateway) | resource | +| [aws_nat_gateway.nat_gateway](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/nat_gateway) | resource | +| [aws_route53_record.helix_authentication_service](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route53_record) | resource | +| [aws_route53_record.helix_cert](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route53_record) | resource | +| [aws_route53_record.helix_swarm](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route53_record) | resource | +| [aws_route53_record.jenkins](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route53_record) | resource | +| [aws_route53_record.jenkins_cert](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route53_record) | resource | +| [aws_route53_record.perforce_helix_core](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route53_record) | resource | +| [aws_route53_record.perforce_helix_core_pvt](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route53_record) | resource | +| [aws_route53_zone.helix_private_zone](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route53_zone) | resource | +| [aws_route_table.private_rt](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route_table) | resource | +| [aws_route_table.public_rt](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route_table) | resource | +| [aws_route_table_association.private_rt_asso](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route_table_association) | resource | +| [aws_route_table_association.public_rt_asso](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/route_table_association) | resource | +| [aws_subnet.private_subnets](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/subnet) | resource | +| [aws_subnet.public_subnets](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/subnet) | resource | +| [aws_vpc.build_pipeline_vpc](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc) | resource | +| [aws_vpc_security_group_ingress_rule.helix_auth_access](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_vpc_security_group_ingress_rule.helix_auth_inbound_core](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_vpc_security_group_ingress_rule.helix_core_access](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_vpc_security_group_ingress_rule.helix_core_inbound_build_farm](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_vpc_security_group_ingress_rule.helix_core_inbound_swarm](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_vpc_security_group_ingress_rule.helix_swarm_access](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_vpc_security_group_ingress_rule.helix_swarm_inbound_core](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_vpc_security_group_ingress_rule.jenkins_access](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/resources/vpc_security_group_ingress_rule) | resource | +| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/availability_zones) | data source | +| [aws_route53_zone.root](https://registry.terraform.io/providers/hashicorp/aws/5.66.0/docs/data-sources/route53_zone) | data source | ## Inputs -No inputs. +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [root\_domain\_name](#input\_root\_domain\_name) | The fully qualified domain name of your existing Route53 Hosted Zone. | `string` | n/a | yes | ## Outputs diff --git a/samples/simple-build-pipeline/dns.tf b/samples/simple-build-pipeline/dns.tf index 677e09eb..a4ae3487 100644 --- a/samples/simple-build-pipeline/dns.tf +++ b/samples/simple-build-pipeline/dns.tf @@ -3,16 +3,10 @@ # Route53 Hosted Zone for FQDN ########################################## data "aws_route53_zone" "root" { - name = local.fully_qualified_domain_name + name = var.root_domain_name private_zone = false } -# resource "aws_route53_zone" "root" { -# name = local.fully_qualified_domain_name -# #checkov:skip=CKV2_AWS_38: DNSSEC signing disabled by design -# #checkov:skip=CKV2_AWS_39: Query logging disabled by design -# } - resource "aws_route53_record" "jenkins" { zone_id = data.aws_route53_zone.root.id name = data.aws_route53_zone.root.name @@ -82,7 +76,7 @@ resource "aws_route53_record" "perforce_helix_core_pvt" { ########################################## resource "aws_acm_certificate" "jenkins" { - domain_name = "jenkins.${local.fully_qualified_domain_name}" + domain_name = "jenkins.${var.root_domain_name}" validation_method = "DNS" tags = { @@ -123,8 +117,8 @@ resource "aws_acm_certificate_validation" "jenkins" { ########################################## resource "aws_acm_certificate" "helix" { - domain_name = "helix.${local.fully_qualified_domain_name}" - subject_alternative_names = ["*.helix.${local.fully_qualified_domain_name}"] + domain_name = "helix.${var.root_domain_name}" + subject_alternative_names = ["*.helix.${var.root_domain_name}"] validation_method = "DNS" diff --git a/samples/simple-build-pipeline/local.tf b/samples/simple-build-pipeline/local.tf index 3d6c3b8e..fa389239 100644 --- a/samples/simple-build-pipeline/local.tf +++ b/samples/simple-build-pipeline/local.tf @@ -2,7 +2,6 @@ data "aws_availability_zones" "available" {} locals { # Simple Build Pipeline Configuration - fully_qualified_domain_name = "PLACEHOLDER" # update this to the root domain name you own # IPV4 CIDR blocks that need Jenkins access. For example: # "/32" diff --git a/samples/simple-build-pipeline/main.tf b/samples/simple-build-pipeline/main.tf index 71c23621..8dbd36d3 100644 --- a/samples/simple-build-pipeline/main.tf +++ b/samples/simple-build-pipeline/main.tf @@ -28,18 +28,19 @@ resource "aws_ecs_cluster_capacity_providers" "providers" { ########################################## module "perforce_helix_core" { - source = "../../modules/perforce/helix-core" - vpc_id = aws_vpc.build_pipeline_vpc.id - server_type = "p4d_commit" - instance_subnet_id = aws_subnet.public_subnets[0].id - instance_type = "c6in.large" + source = "../../modules/perforce/helix-core" + vpc_id = aws_vpc.build_pipeline_vpc.id + server_type = "p4d_commit" + instance_subnet_id = aws_subnet.public_subnets[0].id + instance_type = "c6g.large" + instance_architecture = "arm64" storage_type = "EBS" depot_volume_size = 64 metadata_volume_size = 32 logs_volume_size = 32 - FQDN = "core.helix.perforce.${local.fully_qualified_domain_name}" + FQDN = "core.helix.perforce.${var.root_domain_name}" helix_authentication_service_url = "https://${aws_route53_record.helix_authentication_service.name}" } @@ -57,7 +58,7 @@ module "perforce_helix_authentication_service" { certificate_arn = aws_acm_certificate.helix.arn enable_web_based_administration = true - fqdn = "https://auth.helix.${local.fully_qualified_domain_name}" + fqdn = "https://auth.helix.${var.root_domain_name}" depends_on = [aws_ecs_cluster.build_pipeline_cluster, aws_acm_certificate_validation.helix] } @@ -80,7 +81,7 @@ module "perforce_helix_swarm" { p4d_swarm_user_arn = module.perforce_helix_core.helix_core_super_user_username_secret_arn p4d_swarm_password_arn = module.perforce_helix_core.helix_core_super_user_password_secret_arn - fqdn = "swarm.helix.${local.fully_qualified_domain_name}" + fqdn = "swarm.helix.${var.root_domain_name}" depends_on = [aws_ecs_cluster.build_pipeline_cluster, aws_acm_certificate_validation.helix] } diff --git a/samples/simple-build-pipeline/variables.tf b/samples/simple-build-pipeline/variables.tf new file mode 100644 index 00000000..7099b5ad --- /dev/null +++ b/samples/simple-build-pipeline/variables.tf @@ -0,0 +1,4 @@ +variable "root_domain_name" { + type = string + description = "The fully qualified domain name of your existing Route53 Hosted Zone." +}