rancher-server-asg-ha.tf

variable "name" {
}

variable "ami_id" {
}

variable "instance_type" {
}

variable "key_name" {
}

variable "rancher_ssl_cert" {
}

variable "rancher_ssl_key" {
}

# variable "rancher_ssl_chain"  {}
variable "database_port" {
}

variable "database_name" {
}

variable "database_username" {
}

variable "database_password" {
}

variable "database_encrypted_password" {
}

variable "ha_encryption_key" {
}

variable "scale_min_size" {
}

variable "scale_max_size" {
}

variable "scale_desired_size" {
}

variable "ha_registration_url" {
}

variable "region" {
}

variable "vpc_id" {
}

variable "az1" {
}

variable "az2" {
}

variable "zone_id" {
}

variable "fqdn" {
}

variable "database_instance_class" {
}

variable "rancher_version" {
}

#Create Security group for access to RDS instance
resource "aws_security_group" "rancher_ha_allow_db" {
  name        = "rancher_ha_allow_db"
  description = "Allow Connection from internal"
  vpc_id      = var.vpc_id
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = var.database_port
    to_port     = var.database_port
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

#Create RDS database
resource "aws_db_instance" "rancherdb" {
  allocated_storage      = 55
  engine                 = "mysql"
  instance_class         = var.database_instance_class #This is smaller than the recommended size and should be increased according to environment
  name                   = var.database_name
  username               = var.database_username
  password               = var.database_password
  vpc_security_group_ids = [aws_security_group.rancher_ha_allow_db.id]
  skip_final_snapshot    = true
}

resource "aws_iam_server_certificate" "rancher_ha" {
  name             = "rancher-ha-cert-ae"
  certificate_body = file(var.rancher_ssl_cert)
  private_key      = file(var.rancher_ssl_key)

  #  certificate_chain = "${file("${var.rancher_ssl_chain}")}"

  lifecycle {
    create_before_destroy = true
  }
  #  provisioner "local-exec" {
  #    command = <<EOF
  #      echo "Sleep 10 secends so that the cert is propagated by aws iam service"
  #      echo "See https://github.com/hashicorp/terraform/issues/2499 (terraform ~v0.6.1)"
  #      sleep 10
  #EOF
  #  }
}

# Into ELB from upstream
resource "aws_security_group" "rancher_ha_web_elb" {
  name        = "rancher_ha_web_elb"
  description = "Allow ports rancher "
  vpc_id      = var.vpc_id
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

#Into servers
resource "aws_security_group" "rancher_ha_allow_elb" {
  name        = "rancher_ha_allow_elb"
  description = "Allow Connection from elb"
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.rancher_ha_web_elb.id]
  }
  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.rancher_ha_web_elb.id]
  }
}

#Direct into Rancher HA instances
resource "aws_security_group" "rancher_ha_allow_internal" {
  name        = "rancher_ha_allow_internal"
  description = "Allow Connection from internal"
  vpc_id      = var.vpc_id
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 9345
    to_port     = 9345
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group_rule" "ingress_all_rancher_ha" {
  security_group_id        = aws_security_group.rancher_ha_allow_internal.id
  type                     = "ingress"
  from_port                = 0
  to_port                  = "0"
  protocol                 = "-1"
  source_security_group_id = aws_security_group.rancher_ha_allow_internal.id
}

resource "aws_security_group_rule" "egress_all_rancher_ha" {
  security_group_id        = aws_security_group.rancher_ha_allow_internal.id
  type                     = "egress"
  from_port                = 0
  to_port                  = 0
  protocol                 = "-1"
  source_security_group_id = aws_security_group.rancher_ha_allow_internal.id
}

# User-data template
#resource "aws_instance" "user_data" {
#
#     = "${file("${path.module}/files/userdata.template")}"
#
#    vars {
#
#        # Database
#        database_address  = "${aws_db_instance.rancherdb.address}"
#        database_port     = "${var.database_port}"
#        database_name     = "${var.database_name}"
#        database_username = "${var.database_username}"
#        database_password = "${var.database_password}"
#        #ha_registration_url = "${var.ha_registration_url}"
#        rancher_version = "${var.rancher_version}"
#    }
#    lifecycle {
#        create_before_destroy = true
#    }
#
#
#}

provider "aws" {
  version = "~> 2.0"
  region  = var.region
}

# Elastic Load Balancer
resource "aws_elb" "rancher_ha" {
  name                      = "rancher-ha-ae"
  availability_zones        = [var.az1, var.az2]
  cross_zone_load_balancing = true
  internal                  = false
  security_groups           = [aws_security_group.rancher_ha_web_elb.id]
  listener {
    instance_port      = 8080
    instance_protocol  = "tcp"
    lb_port            = 443
    lb_protocol        = "ssl"
    ssl_certificate_id = aws_iam_server_certificate.rancher_ha.arn
  }
  health_check {
    healthy_threshold   = 2
    unhealthy_threshold = 4
    timeout             = 5
    target              = "TCP:22"

    #target = "HTTP:8080/ping"
    interval = 7
  }
}

resource "aws_proxy_protocol_policy" "rancher_ha" {
  load_balancer  = aws_elb.rancher_ha.name
  instance_ports = ["8080"]
}

# rancher resource
resource "aws_launch_configuration" "rancher_ha" {
  name_prefix = "Launch-Config-rancher-server-ha"
  image_id    = var.ami_id
  security_groups = [
    aws_security_group.rancher_ha_allow_elb.id,
    aws_security_group.rancher_ha_web_elb.id,
    aws_security_group.rancher_ha_allow_internal.id,
  ]
  instance_type = var.instance_type
  key_name      = var.key_name

  #    user_data     = "${template_file.user_data.rendered}"
  associate_public_ip_address = false
  ebs_optimized               = false

  #####
  user_data = file("${path.module}/files/userdata.template")
}

resource "aws_autoscaling_group" "rancher_ha" {
  name                      = "${var.name}-asg-ae"
  min_size                  = var.scale_min_size
  max_size                  = var.scale_max_size
  desired_capacity          = var.scale_desired_size
  health_check_grace_period = 900
  health_check_type         = "ELB"
  force_delete              = false
  launch_configuration      = aws_launch_configuration.rancher_ha.name
  load_balancers            = [aws_elb.rancher_ha.name]
  availability_zones        = [var.az1, var.az2]
  tag {
    key                 = "Name"
    value               = var.name
    propagate_at_launch = true
  }
}

output "elb_dns" {
  value = aws_elb.rancher_ha.dns_name
}

# FIXME map dns to elb
#resource "aws_route53_record" "www" {
#  zone_id = "${var.zone_id}"
#  name = "var.fqdn"
#  type = "A"

#  alias {
#    name = "var.fqdn"
#    zone_id = "${var.zone_id}"
#    evaluate_target_health = true
#  }
#}

# works
resource "aws_route53_record" "www" {
  zone_id = var.zone_id
  name    = var.fqdn
  type    = "CNAME"
  ttl     = "300"
  records = [aws_elb.rancher_ha.dns_name]
}