Skip to content

Commit 138eb18

Browse files
edwinavalosedwinavalos
committed
More README.md about securing load balancers
1 parent 92c96f9 commit 138eb18

21 files changed

+1929
-5
lines changed

‎LICENSE

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
1+
MIT No Attribution
22

33
Permission is hereby granted, free of charge, to any person obtaining a copy of this
44
software and associated documentation files (the "Software"), to deal in the Software

‎NOTICE

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Spinnaker Halyard Deployment on AWS
2+
Copyright 2018-2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.

‎README.md

Lines changed: 71 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,74 @@
1-
## AWS EKS deployment with Spinnaker
1+
# Halyard deploy
22

3-
AWS CloudFormation templates and scripting around launching an EKS cluster to run Spinnaker. The Spinnaker installation will allow for EC2 and EKS deployments.
3+
This repo is intended to:
44

5-
## License Summary
5+
1. Create an EKS cluster for Spinnaker to be deployed to
6+
1. Deploy Spinnaker using halyard
67

7-
This sample code is made available under a modified MIT license. See the LICENSE file.
8+
This is mostly for demo environment purposes, and there are some overly permissive IAM roles in places. If you wish to run this in production, you should modify the permissive roles to be more restrictive. This is intended to run as-is in a brand new AWS account.
9+
10+
# Pre-requisites
11+
12+
This repository assumes you have a new AWS account and wish to test Spinnaker out, you will need:
13+
14+
1. AWS CLI credentials setup for a user with at least Administrator access to create resources
15+
1. Access to create EC2 security groups
16+
17+
# Quick Start
18+
19+
1. Fork this repository on GitHub (or CodeCommit)
20+
2. Run the following from a terminal with aws cli access to your account (change GITHUB to CODECOMMIT if code is uploaded there)
21+
22+
```
23+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
24+
aws cloudformation create-stack --stack-name codebuild-projects \
25+
--template-body "$(cat resources/cloudformation/codebuild-projects.yaml)" \
26+
--parameters ParameterKey=CodeBuildArtifactsBucketName,ParameterValue=codebuild-artifacts-${ACCOUNT_ID} \
27+
ParameterKey=SourceLocation,ParameterValue=https://github.com/aws-samples/aws-deploy-spinnaker-halyard \
28+
ParameterKey=SourceType,ParameterValue=GITHUB \
29+
--capabilities CAPABILITY_NAMED_IAM
30+
aws ec2 create-key-pair --key-name spinnaker-eks-keypair
31+
```
32+
3. Navigate to CodeBuild
33+
4. Start the create-eks CodeBuild project
34+
5. Create a security group in the EKS-VPC to lock-down the Spinnaker load balancers take note of the security group id.
35+
6. Start the deploy-spinnaker CodeBuild project, fill in the environment variable "SECURITY_GROUP_ID" with the security group id from the previous step
36+
37+
Spinnaker will be available at the UI/Deck address emitted at the end of the deploy-spinnaker CodeBuild job.
38+
39+
# Cleaning up
40+
41+
The CodeBuild project "cleanup-infrastructure" will delete all objects associated with all the cloudformation stacks in this project except the CodeBuild projects stack. For the stack to delete *everything* you must specify the FORCE_DELETE parameter to true, this will empty the Spinnaker infra bucket of data before deleting the CloudFormation stack that defines the Spinnaker data bucket. This at the moment is a best effort there might be resources created by Spinnaker or other processes that will need to be manually deleted before the Spinnaker CloudFormation can be deleted.
42+
43+
# Accessing EKS
44+
45+
You will need to add your user ARN to the EKS-Admin role, once this done you can download the EKS kubeconfig with the following command
46+
47+
```$bash
48+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
49+
aws s3 cp s3://codebuild-artifacts-${ACCOUNT_ID}/create-eks/files/resources/kubernetes/kubeconfig.yaml /tmp/kube/config
50+
export KUBECONFIG=/tmp/kube/config
51+
kubectl get pods -n spinnaker
52+
```
53+
54+
Once it is downloaded you can run kubectl commands as normal to read and output logs and see pod status.
55+
56+
# Exposing Services
57+
58+
See the [buildspec section](#modifying-buildspec-for-authentication-and-security-groups) for some supplemental information.
59+
60+
The code in this repository will create two load balancers using the EKS and EC2 integrations, these services are created in the deploy_spinnaker.sh. When created these load balancers are open to the world, so there are few flags in the deploy_spinnaker.sh to give you options on locking down the security groups, the flags in this example will apply the security group specified in the deploy_spinnaker.sh script to the load balancers to lock down load balancers.
61+
62+
# Modifying the Spinnaker installation
63+
64+
If you need to tweak the halyard settings that are applied to the Spinnaker installation this can be accomplished by modifying the `deploy_spinnaker.sh` script. Once modified you can upload your changes to the source control, and then rerun the deploy-spinnaker CodeBuild job to apply the changes.
65+
66+
# Feedback
67+
68+
This repository is meant to be an easy method of deploying Spinnaker to a brand new AWS account for demo purposes. Not all use cases are meant to be covered, but if new use cases can be added without making the repository difficult to use, then they are more than welcome. You can submit changes or fixes to this repository by submitting a pull request on this repository. We will review and provide feedback, we might need further follow up from pull request authors to make changes.
69+
70+
71+
72+
73+
74+

‎buildspec-cleanup.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
## Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: MIT-0
3+
version: 0.2
4+
5+
phases:
6+
build:
7+
commands:
8+
- apk add --no-cache curl bash
9+
- curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.11.0/bin/linux/amd64/kubectl
10+
- chmod +x kubectl
11+
- mv kubectl /usr/local/bin
12+
- curl -LO https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/bin/linux/amd64/aws-iam-authenticator
13+
- chmod +x aws-iam-authenticator
14+
- mv aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
15+
- ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
16+
- aws s3 cp s3://codebuild-artifacts-${ACCOUNT_ID}/create-eks/files/resources/kubernetes/kubeconfig-no-role.yaml /root/.kube/config
17+
- ./scripts/cleanup.sh -f ${SECURITY_GROUP_ID} -d ${FORCE_DELETE}

‎buildspec-deploy.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: MIT-0
3+
version: 0.2
4+
5+
phases:
6+
build:
7+
commands:
8+
- curl -LO https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/bin/linux/amd64/kubectl
9+
- chmod +x kubectl
10+
- mv kubectl /usr/local/bin
11+
- curl -LO https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/bin/linux/amd64/aws-iam-authenticator
12+
- chmod +x aws-iam-authenticator
13+
- mv aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
14+
- curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip"
15+
- unzip awscli-bundle.zip
16+
- ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws
17+
- ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
18+
- aws s3 cp s3://codebuild-artifacts-${ACCOUNT_ID}/create-eks/files/resources/kubernetes/kubeconfig-no-role.yaml /home/spinnaker/.kube/config
19+
- su spinnaker -c "./scripts/deploy_spinnaker.sh -f ${SECURITY_GROUP_ID}"

‎buildspec-infra.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
## Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: MIT-0
3+
version: 0.2
4+
5+
phases:
6+
build:
7+
commands:
8+
- apk add --no-cache curl bash
9+
- curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.11.0/bin/linux/amd64/kubectl
10+
- chmod +x kubectl
11+
- mv kubectl /usr/local/bin
12+
- curl -LO https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/bin/linux/amd64/aws-iam-authenticator
13+
- chmod +x aws-iam-authenticator
14+
- mv aws-iam-authenticator /usr/local/bin/heptio-authenticator-aws
15+
- ./scripts/create_eks_cluster.sh -k ${K8S_NAME} -s ${K8S_KEYPAIR} -b ${BUCKET_NAME}
16+
17+
artifacts:
18+
files:
19+
- resources/kubernetes/kubeconfig.yaml
20+
- resources/kubernetes/kubeconfig-no-role.yaml

‎resources/cloudformation/codebuild-projects.yaml

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
## Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: MIT-0
3+
4+
---
5+
AWSTemplateFormatVersion: '2010-09-09'
6+
Description: 'CodeBuild Projects for EKS+Spinnaker'
7+
8+
Parameters:
9+
10+
CodeBuildArtifactsBucketName:
11+
Type: String
12+
Default: codebuild-artifacts
13+
Description: Name for the bucket where CodeBuild will save output artifacts
14+
15+
SourceLocation:
16+
Type: String
17+
Default: https://git-codecommit.us-west-2.amazonaws.com/v1/repos/myrepowithcode
18+
Description: Location of source code for the create-eks and deploy spinnaker codebuild projects
19+
20+
SourceType:
21+
Type: String
22+
Default: GITHUB
23+
AllowedValues:
24+
- GITHUB
25+
- CODECOMMIT
26+
27+
Resources:
28+
29+
CreateEKSSpinnakerRole:
30+
Type: AWS::IAM::Role
31+
Properties:
32+
RoleName: create-eks-spinnaker
33+
AssumeRolePolicyDocument:
34+
Statement:
35+
- Action:
36+
- sts:AssumeRole
37+
Effect: Allow
38+
Principal:
39+
Service: codebuild.amazonaws.com
40+
Version: '2012-10-17'
41+
ManagedPolicyArns:
42+
- arn:aws:iam::aws:policy/PowerUserAccess
43+
- arn:aws:iam::aws:policy/IAMFullAccess
44+
45+
CodeBuildArtifactsBucket:
46+
Type: "AWS::S3::Bucket"
47+
Properties:
48+
BucketName: !Ref CodeBuildArtifactsBucketName
49+
Tags:
50+
-
51+
Key: cloudformation-stack
52+
Value: !Ref AWS::StackId
53+
54+
CreateEKSProject:
55+
Type: AWS::CodeBuild::Project
56+
Properties:
57+
Artifacts:
58+
Name: files
59+
Location: !Ref CodeBuildArtifactsBucket
60+
OverrideArtifactName: true
61+
NamespaceType: NONE
62+
Packaging: NONE
63+
Path: create-eks
64+
Type: S3
65+
BadgeEnabled: true
66+
Cache:
67+
Type: NO_CACHE
68+
Description: Creates and EKS cluster and supporting infrastructure/roles/policies for managing a Spinnaker instance
69+
EncryptionKey:
70+
Fn::Join: [ "", [ "arn:aws:kms:", { Ref: "AWS::Region" }, ":", { Ref: "AWS::AccountId" }, ":alias/aws/s3"]]
71+
Environment:
72+
ComputeType: BUILD_GENERAL1_SMALL
73+
Image: infrastructureascode/aws-cli
74+
PrivilegedMode: false
75+
Type: LINUX_CONTAINER
76+
EnvironmentVariables:
77+
-
78+
Name: K8S_NAME
79+
Type: PLAINTEXT
80+
Value: "spinnaker-infra"
81+
-
82+
Name: K8S_KEYPAIR
83+
Type: PLAINTEXT
84+
Value: "spinnaker-eks-keypair"
85+
-
86+
Name: BUCKET_NAME
87+
Type: PLAINTEXT
88+
Value: "spinnaker-infra"
89+
Name: create-eks
90+
ServiceRole: !Ref CreateEKSSpinnakerRole
91+
Source:
92+
BuildSpec: buildspec-infra.yaml
93+
GitCloneDepth: 1
94+
InsecureSsl: false
95+
Location: !Ref SourceLocation
96+
Type: !Ref SourceType
97+
Tags:
98+
-
99+
Key: cloudformation-stack
100+
Value: !Ref AWS::StackId
101+
TimeoutInMinutes: 45
102+
103+
DeploySpinnakerProject:
104+
Type: AWS::CodeBuild::Project
105+
Properties:
106+
Artifacts:
107+
Type: NO_ARTIFACTS
108+
BadgeEnabled: true
109+
Cache:
110+
Type: NO_CACHE
111+
Description: Deploys Spinnaker via Halyard
112+
EncryptionKey:
113+
Fn::Join: [ "", [ "arn:aws:kms:", { Ref: "AWS::Region" }, ":", { Ref: "AWS::AccountId" }, ":alias/aws/s3"]]
114+
Environment:
115+
ComputeType: BUILD_GENERAL1_SMALL
116+
Image: gcr.io/spinnaker-marketplace/halyard:stable
117+
PrivilegedMode: false
118+
Type: LINUX_CONTAINER
119+
EnvironmentVariables:
120+
-
121+
Name: SECURITY_GROUP_ID
122+
Type: PLAINTEXT
123+
Value: ""
124+
Name: deploy-spinnaker
125+
ServiceRole: !Ref CreateEKSSpinnakerRole
126+
Source:
127+
BuildSpec: buildspec-deploy.yaml
128+
GitCloneDepth: 1
129+
InsecureSsl: false
130+
Location: !Ref SourceLocation
131+
Type: !Ref SourceType
132+
Tags:
133+
-
134+
Key: cloudformation-stack
135+
Value: !Ref AWS::StackId
136+
TimeoutInMinutes: 45
137+
138+
CleanUpProject:
139+
Type: AWS::CodeBuild::Project
140+
Properties:
141+
Artifacts:
142+
Type: NO_ARTIFACTS
143+
BadgeEnabled: true
144+
Cache:
145+
Type: NO_CACHE
146+
Description: Deploys Spinnaker via Halyard
147+
EncryptionKey:
148+
Fn::Join: [ "", [ "arn:aws:kms:", { Ref: "AWS::Region" }, ":", { Ref: "AWS::AccountId" }, ":alias/aws/s3"]]
149+
Environment:
150+
ComputeType: BUILD_GENERAL1_SMALL
151+
Image: infrastructureascode/aws-cli
152+
PrivilegedMode: false
153+
Type: LINUX_CONTAINER
154+
EnvironmentVariables:
155+
-
156+
Name: SECURITY_GROUP_ID
157+
Type: PLAINTEXT
158+
Value: ""
159+
-
160+
Name: FORCE_DELETE
161+
Type: PLAINTEXT
162+
Value: "false"
163+
Name: cleanup-infrastructure
164+
ServiceRole: !Ref CreateEKSSpinnakerRole
165+
Source:
166+
BuildSpec: buildspec-cleanup.yaml
167+
GitCloneDepth: 1
168+
InsecureSsl: false
169+
Location: !Ref SourceLocation
170+
Type: !Ref SourceType
171+
Tags:
172+
-
173+
Key: cloudformation-stack
174+
Value: !Ref AWS::StackId
175+
TimeoutInMinutes: 45
176+
177+
Outputs:
178+
179+
CodeBuildArtifactsBucket:
180+
Description: Bucket where codebuild artifacts are placed
181+
Value: !Ref CodeBuildArtifactsBucket
182+
183+
CreateEKSSpinnakerRole:
184+
Description: Role that the codebuild projects use for EKS and Spinnaker deployments
185+
Value: !Ref CreateEKSSpinnakerRole

0 commit comments

Comments
 (0)