Skeleton of the d4s-pre-cloud project.

This commit is contained in:
Andrea Dell'Amico 2023-11-03 17:12:11 +01:00
parent eccfb0b2a8
commit da199a5be2
Signed by: andrea.dellamico
GPG Key ID: 147ABE6CEB9E20FF
27 changed files with 553 additions and 41 deletions

View File

@ -1,9 +1,17 @@
resource "openstack_dns_zone_v2" "primary_project_dns_zone" {
name = var.dns_zone.zone_name
email = var.dns_zone.email
description = var.dns_zone.description
ttl = var.dns_zone.ttl
type = "PRIMARY"
}
resource "openstack_networking_network_v2" "main-private-network" {
name = var.main_private_network["name"]
name = var.main_private_network.name
admin_state_up = "true"
external = "false"
description = var.main_private_network.description
dns_domain = var.dns-zone
dns_domain = var.dns_zone.zone_name
mtu = var.mtu_size
port_security_enabled = true
shared = false

View File

View File

View File

View File

View File

@ -0,0 +1,395 @@
# This is the security group that should be added to every instance
resource "openstack_networking_secgroup_v2" "default" {
name = "default_for_all"
delete_default_rules = "true"
description = "Default security group with rules for ssh access via jump proxy, prometheus scraping"
}
resource "openstack_networking_secgroup_rule_v2" "egress-ipv4" {
security_group_id = openstack_networking_secgroup_v2.default.id
direction = "egress"
ethertype = "IPv4"
}
resource "openstack_networking_secgroup_rule_v2" "ingress-icmp" {
security_group_id = openstack_networking_secgroup_v2.default.id
description = "Allow ICMP from remote"
direction = "ingress"
ethertype = "IPv4"
remote_ip_prefix = "0.0.0.0/0"
protocol = "icmp"
}
resource "openstack_networking_secgroup_rule_v2" "ssh-jump-proxy" {
security_group_id = openstack_networking_secgroup_v2.default.id
description = "SSH traffic from the jump proxy"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
}
resource "openstack_networking_secgroup_rule_v2" "prometheus-node" {
security_group_id = openstack_networking_secgroup_v2.default.id
description = "Prometheus access to the node exporter"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 9100
port_range_max = 9100
remote_ip_prefix = var.basic_services_ip.prometheus_cidr
}
# SSH access to the jump proxy
resource "openstack_networking_secgroup_v2" "access_to_the_jump_proxy" {
name = "ssh_access_to_the_jump_node"
delete_default_rules = "true"
description = "Security group that allows SSH access to the jump node from a limited set of sources"
}
resource "openstack_networking_secgroup_rule_v2" "ssh-s2i2s-vpn-1" {
security_group_id = openstack_networking_secgroup_v2.access_to_the_jump_proxy.id
description = "SSH traffic from S2I2S VPN 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-s2i2s-vpn-2" {
security_group_id = openstack_networking_secgroup_v2.access_to_the_jump_proxy.id
description = "SSH traffic from S2I2S VPN 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-1" {
security_group_id = openstack_networking_secgroup_v2.access_to_the_jump_proxy.id
description = "SSH traffic from D4Science VPN 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = var.ssh_sources.d4s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-2" {
security_group_id = openstack_networking_secgroup_v2.access_to_the_jump_proxy.id
description = "SSH traffic from D4Science VPN 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = var.ssh_sources.d4s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-shell-d4s" {
security_group_id = openstack_networking_secgroup_v2.access_to_the_jump_proxy.id
description = "SSH traffic from shell.d4science.org"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = var.ssh_sources.shell_d4s_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-infrascience-net" {
security_group_id = openstack_networking_secgroup_v2.access_to_the_jump_proxy.id
description = "SSH traffic from the InfraScience network"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = var.ssh_sources.infrascience_net_cidr
}
# Debug via tunnel from the jump proxy node
resource "openstack_networking_secgroup_v2" "debugging" {
name = "debugging_from_jump_node"
delete_default_rules = "true"
description = "Security group that allows web app debugging via tunnel from the ssh jump node"
}
resource "openstack_networking_secgroup_rule_v2" "shell_8100" {
security_group_id = openstack_networking_secgroup_v2.debugging.id
description = "Tomcat debug on port 8100 from the shell jump proxy"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 8100
port_range_max = 8100
remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
}
resource "openstack_networking_secgroup_rule_v2" "shell_80" {
security_group_id = openstack_networking_secgroup_v2.debugging.id
description = "http debug port 80 from the shell jump proxy"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
}
resource "openstack_networking_secgroup_rule_v2" "shell_443" {
security_group_id = openstack_networking_secgroup_v2.debugging.id
description = "https debug port 443 from the shell jump proxy"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
}
# Traffic from the main HAPROXY load balancers
resource "openstack_networking_secgroup_v2" "traffic_from_main_haproxy" {
name = "traffic_from_the_main_load_balancers"
delete_default_rules = "true"
description = "Allow traffic from the main L7 HAPROXY load balancers"
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-80" {
security_group_id = openstack_networking_secgroup_v2.traffic_from_main_haproxy.id
description = "HTTP traffic from HAPROXY L7 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-80" {
security_group_id = openstack_networking_secgroup_v2.traffic_from_main_haproxy.id
description = "HTTP traffic from HAPROXY L7 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-443" {
security_group_id = openstack_networking_secgroup_v2.traffic_from_main_haproxy.id
description = "HTTPS traffic from HAPROXY L7 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-443" {
security_group_id = openstack_networking_secgroup_v2.traffic_from_main_haproxy.id
description = "HTTPS traffic from HAPROXY L7 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8080" {
security_group_id = openstack_networking_secgroup_v2.traffic_from_main_haproxy.id
description = "HTTP traffic from HAPROXY L7 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 8080
port_range_max = 8080
remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8080" {
security_group_id = openstack_networking_secgroup_v2.traffic_from_main_haproxy.id
description = "HTTP traffic from HAPROXY L7 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 8080
port_range_max = 8080
remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8888" {
security_group_id = openstack_networking_secgroup_v2.traffic_from_main_haproxy.id
description = "HTTP traffic from HAPROXY L7 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 8888
port_range_max = 8888
remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8888" {
security_group_id = openstack_networking_secgroup_v2.traffic_from_main_haproxy.id
description = "HTTP traffic from HAPROXY L7 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 8888
port_range_max = 8888
remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
}
resource "openstack_networking_secgroup_v2" "public_web" {
name = "public_web_service"
delete_default_rules = "true"
description = "Security group that allows HTTPS and HTTP from everywhere, for the services that are not behind any load balancer"
}
resource "openstack_networking_secgroup_rule_v2" "public_http" {
security_group_id = openstack_networking_secgroup_v2.public_web.id
description = "Allow HTTP from everywhere"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = "0.0.0.0/0"
}
resource "openstack_networking_secgroup_rule_v2" "public_https" {
security_group_id = openstack_networking_secgroup_v2.public_web.id
description = "Allow HTTPS from everywhere"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = "0.0.0.0/0"
}
resource "openstack_networking_secgroup_v2" "restricted_web" {
name = "restricted_web_service"
delete_default_rules = "true"
description = "Security group that restricts HTTP and HTTPS sources to the VPN nodes and shell.d4science.org"
}
resource "openstack_networking_secgroup_rule_v2" "http_from_d4s_vpn_1" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTP from D4Science VPN 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = var.ssh_sources.d4s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "http_from_d4s_vpn_2" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTP from D4Science VPN 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = var.ssh_sources.d4s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "https_from_d4s_vpn_1" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTPS from D4Science VPN 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = var.ssh_sources.d4s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "https_from_d4s_vpn_2" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTPS from D4Science VPN 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = var.ssh_sources.d4s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "http_from_s2i2s_vpn_1" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTP from S2I2S VPN 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "http_from_s2i2s_vpn_2" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTP from S2I2S VPN 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_1" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTPS from S2I2S VPN 1"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_2" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTPS from S2I2S VPN 2"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "http_from_shell_d4s" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTP from shell.d4science.org"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = var.ssh_sources.shell_d4s_cidr
}
resource "openstack_networking_secgroup_rule_v2" "https_from_shell_d4s" {
security_group_id = openstack_networking_secgroup_v2.restricted_web.id
description = "Allow HTTPS from shell.d4science.org"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = var.ssh_sources.shell_d4s_cidr
}

View File

@ -12,6 +12,13 @@ variable "external_network" {
}
}
variable "floating_ip_pools" {
type = map(string)
default = {
main_public_ip_pool = "external-network"
}
}
variable "resolvers_ip" {
type = list(string)
default = ["146.48.29.97", "146.48.29.98", "146.48.29.99"]

View File

@ -0,0 +1,19 @@
variable "ssh_key_file" {
default = "~/.ssh/id_rsa_cloud_key"
}
variable "smartgears_legacy_os_image" {
default = "Ubuntu-Bionic-18.04"
}
variable "smartgears_4_os_image" {
default = "Ubuntu-Jammy-22.04"
}
variable "ubuntu-2204" {
default = "Ubuntu-Jammy-22.04"
}
variable "almalinux-9" {
default = "AlmaLinux-9.0-20220718"
}

View File

@ -0,0 +1,24 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/terraform-provider-openstack/openstack" {
version = "1.53.0"
constraints = "~> 1.53.0"
hashes = [
"h1:ZSJPqrlaHQ3sj7wyJuPSG+NblFZbAA6Y0d3GjSJf3o8=",
"zh:09da7ca98ffd3de7b9ce36c4c13446212a6e763ba1162be71b50f95d453cb68e",
"zh:14041bcbb87312411d88612056ed185650bfd01284b8ea0761ce8105a331708e",
"zh:35bf4c788fdbc17c8e40ebc7b33c7de4b45a2fa2efaa657b10f0e3bd37c9627f",
"zh:46ede8ef4cfa12d654c538afc1e1ec34a1f3e8eb4e986ee23dceae398b7176a6",
"zh:59675734990dab1e8d87997853ea75e8104bba730b3f5a7146ac735540c9d6bf",
"zh:6de52428849806498670e827b54810be7510a2a79449602c1aede4235a0ec036",
"zh:78b2a20601272afceffac8f8ca78a6b647b84196c0dd8dc710fae297f6be15a4",
"zh:7c41ed3a4fac09677e676ecf9f9edd1e38eef449e656cb01a848d2c799c6de8f",
"zh:852800228f4118a4aa6cfaa4468b851247cbed6f037fd204f08de69eb1edc149",
"zh:86d618e7f9a07d978b8bc4b190be350a00de64ec535f9c8f5dfe133542a55483",
"zh:963a9e72b66d8bcf43de9b14a674ae3ca3719ce2f829217f7a65b66fc3773397",
"zh:a8e72ab67795071bda61f99a6de3d2d40122fb51971768fd75e1324abe874ced",
"zh:ce1890cf3af17d569af3bc7673cec0a8f78e6f5d701767593f3d29c551f44848",
"zh:e6f1b96eb684f527a47f71923f268c86a36d7894751b31ee9e726d7502a639cd",
]
}

View File

@ -0,0 +1 @@
../variables/00-variables.tf

View File

@ -0,0 +1,13 @@
# Main services
* Load balancer as a service (openstack), L4. Three instances of it:
> * Main HAPROXY load balancer
> * HAPROXY used as ingress of the swarm cluster
* Two VMs as HAPROXY L7 instances for the main services. The dataminers will be also served by this load balancer.
* A shell server, with floating IP address, that will be used as a proxy to reach all the other VMs.
* A internal CA service.
* A Prometheus instance.
* A Docker Swarm cluster, with a NFS server in a dedicated network
* A PostgreSQL server instance, with a dedicated network

View File

@ -0,0 +1 @@
../../common_setups/docker-swarm.tf

View File

@ -0,0 +1 @@
../../common_variables/external-network-and-resolvers.tf

View File

@ -0,0 +1 @@
../../common_setups/haproxy.tf

View File

@ -0,0 +1 @@
../../common_setups/internal-ca.tf

View File

@ -0,0 +1 @@
../../common_setups/octavia.tf

View File

@ -0,0 +1 @@
../../common_setups/postgresql.tf

View File

@ -0,0 +1 @@
../../common_variables/projects-and-users-vars.tf

View File

@ -0,0 +1 @@
../../common_setups/prometheus.tf

View File

@ -0,0 +1 @@
../../common_setups/security-groups.tf

View File

@ -0,0 +1 @@
../../common_setups/ssh-jump-proxy.tf

View File

@ -0,0 +1 @@
../../common_variables/terraform-provider.tf

View File

@ -1,39 +0,0 @@
# Configure the OpenStack Provider
provider "openstack" {
cloud = "d4s-pre"
}
variable "dns-zone" {
type = string
default = "cloud-pre.d4science.org."
}
variable "main_private_network" {
type = map(string)
default = {
name = "d4s-pre-cloud-main"
description = "D4Science Preprod private network (use this as the main network)"
}
}
variable "main_private_subnet" {
type = map(string)
default = {
name = "d4s-pre-cloud-main-subnet"
description = "D4Science Preprod main private subnet"
cidr = "10.1.32.0/22"
gateway_ip = "10.1.32.1"
allocation_start = "10.1.32.100"
allocation_end = "10.1.35.254"
}
}
variable "external_router" {
type = map(string)
default = {
name = "d4s-pre-cloud-external-router"
description = "D4Science Preprod main router"
id = "cc26064a-bb08-4c0b-929f-d0cb39f934a3"
}
}

View File

@ -0,0 +1 @@
../variables/00-variables.tf

View File

@ -0,0 +1,72 @@
# Configure the OpenStack Provider
provider "openstack" {
cloud = "d4s-pre"
}
variable "dns_zone" {
type = map(string)
default = {
zone_name = "cloud-pre.d4science.org."
email = "postmaster@isti.cnr.it"
description = "DNS primary zone for the d4s-pre-cloud project"
ttl = 8600
}
}
variable "main_private_network" {
type = map(string)
default = {
name = "d4s-pre-cloud-main"
description = "D4Science Preprod private network (use this as the main network)"
}
}
variable "main_private_subnet" {
type = map(string)
default = {
name = "d4s-pre-cloud-main-subnet"
description = "D4Science Preprod main private subnet"
cidr = "10.1.32.0/22"
gateway_ip = "10.1.32.1"
allocation_start = "10.1.32.100"
allocation_end = "10.1.35.254"
}
}
variable "external_router" {
type = map(string)
default = {
name = "d4s-pre-cloud-external-router"
description = "D4Science Preprod main router"
id = "cc26064a-bb08-4c0b-929f-d0cb39f934a3"
}
}
variable "basic_services_ip" {
type = map(string)
default = {
haproxy_l7_1 = "10.1.32.11"
haproxy_l7_1_cidr = "10.1.32.11/32"
haproxy_l7_2 = "10.1.32.12"
haproxy_l7_2_cidr = "10.1.32.12/32"
ssh_jump = "10.1.32.5"
ssh_jump_cidr = "10.1.32.5/32"
prometheus = "10.1.32.10"
prometheus_cidr = "10.1.32.10/32"
ca = "10.1.32.4"
ca_cidr = "10.1.32.4/32"
}
}
variable "ssh_sources" {
type = map(string)
default = {
s2i2s_vpn_1_cidr = "146.48.28.10/32"
s2i2s_vpn_2_cidr = "146.48.28.11/32"
d4s_vpn_1_cidr = "146.48.122.27/32"
d4s_vpn_2_cidr = "146.48.122.49/32"
shell_d4s_cidr = "146.48.122.95/32"
infrascience_net_cidr = "146.48.122.0/23"
}
}