Skip to content

Commit 1bc6c80

Browse files
irvingpopirvingpop
authored
Port python services (backend, resources_api & pybot) to ECS (#180)
* initial working version of python_backend on ECS spot instances Signed-off-by: Irving Popovetsky <[email protected]> * terraform fmt and make cpu/mem/count different for staging Signed-off-by: Irving Popovetsky <[email protected]> * Implement resources_api largely copy-pasta from python_backend Signed-off-by: Irving Popovetsky <[email protected]> * Update image tags to match values from k8s, and solve a mystery about why backend was being weird Signed-off-by: Irving Popovetsky <[email protected]> * use the Terraform orb Signed-off-by: Irving Popovetsky <[email protected]> * Is it even looking in the right place? Signed-off-by: Irving Popovetsky <[email protected]> * Add pybot configs Signed-off-by: Irving Popovetsky <[email protected]> * Scale up the environment a bit Signed-off-by: Irving Popovetsky <[email protected]> * Updating TF to reflect shutdown of Resources API and departure of Pybot Signed-off-by: Irving Popovetsky <[email protected]> * save a few pennies and get faster disks Signed-off-by: Irving Popovetsky <[email protected]> * We dont need no fancy dynamic scaling its just trying to cost us money Signed-off-by: Irving Popovetsky <[email protected]> Signed-off-by: Irving Popovetsky <[email protected]>
1 parent f08f854 commit 1bc6c80

File tree

17 files changed

+1001
-74
lines changed

17 files changed

+1001
-74
lines changed

‎.circleci/config.yml

+13-74
Original file line numberDiff line numberDiff line change
@@ -1,77 +1,16 @@
1-
version: 2
2-
jobs:
3-
validate:
4-
docker:
5-
- image: hashicorp/terraform:0.11.14
6-
7-
steps:
8-
- checkout
9-
10-
- run:
11-
command: |
12-
mkdir bin
13-
curl -sSL https://github.com/gruntwork-io/terragrunt/releases/download/v0.18.3/terragrunt_linux_amd64 -o bin/terragrunt
14-
chmod +x bin/terragrunt
15-
16-
- run:
17-
command: |
18-
cd dns/operationcode.net/
19-
/root/project/bin/terragrunt validate
20-
21-
- save_cache:
22-
key: terragrunt
23-
paths:
24-
- bin/terragrunt
25-
26-
plan:
27-
docker:
28-
- image: hashicorp/terraform:0.11.14
29-
steps:
30-
- checkout
31-
32-
- restore_cache:
33-
key: terragrunt
34-
paths:
35-
- bin/terragrunt
36-
37-
- run:
38-
name: terraform plan
39-
command: |
40-
/root/project/bin/terragrunt plan-all
41-
42-
- save_cache:
43-
key: terragrunt
44-
paths:
45-
- bin/terragrunt
46-
47-
apply:
48-
docker:
49-
- image: hashicorp/terraform:0.11.14
50-
steps:
51-
- checkout
52-
53-
- restore_cache:
54-
key: terragrunt
55-
paths:
56-
- bin/terragrunt
57-
58-
- run:
59-
name: terraform apply
60-
command: |
61-
/root/project/bin/terragrunt apply-all --terragrunt-non-interactive
62-
1+
version: '2.1'
2+
orbs:
3+
terraform: circleci/[email protected]
634
workflows:
64-
version: 2
65-
terraform:
5+
deploy_infrastructure:
666
jobs:
67-
- validate
68-
- plan:
7+
- terraform/fmt:
8+
checkout: true
9+
context: terraform
10+
path: terraform
11+
- terraform/validate:
12+
checkout: true
13+
context: terraform
14+
path: terraform
6915
requires:
70-
- validate
71-
- apply:
72-
requires:
73-
- validate
74-
- plan
75-
filters:
76-
branches:
77-
only: main
16+
- terraform/fmt

‎terraform/.terraform.lock.hcl

+25
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎terraform/alb.tf

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# load balancer ARN arn:aws:acm:us-east-2:633607774026:certificate/8de9fd02-191c-485f-b952-e5ba32e90acb
2+
################################################################################
3+
resource "aws_security_group" "lb_security_group" {
4+
name_prefix = "ecs"
5+
vpc_id = data.aws_vpc.use2.id
6+
7+
# allow incoming traffic
8+
ingress {
9+
from_port = 443
10+
to_port = 443
11+
protocol = "tcp"
12+
cidr_blocks = ["0.0.0.0/0"]
13+
}
14+
ingress {
15+
from_port = 80
16+
to_port = 80
17+
protocol = "tcp"
18+
cidr_blocks = ["0.0.0.0/0"]
19+
}
20+
21+
# allow all outgoing traffic
22+
egress {
23+
from_port = 0
24+
to_port = 0
25+
protocol = "-1"
26+
cidr_blocks = [data.aws_vpc.use2.cidr_block]
27+
}
28+
29+
lifecycle {
30+
create_before_destroy = true
31+
}
32+
}
33+
34+
resource "aws_lb" "ecs" {
35+
name_prefix = "oc"
36+
security_groups = [aws_security_group.lb_security_group.id]
37+
38+
load_balancer_type = "application"
39+
internal = false
40+
41+
subnets = data.aws_subnets.use2.ids
42+
43+
# idle_timeout = 60
44+
}
45+
46+
47+
resource "aws_lb_listener" "default_http" {
48+
depends_on = [aws_lb.ecs]
49+
50+
load_balancer_arn = aws_lb.ecs.arn
51+
protocol = "HTTP"
52+
port = 80
53+
54+
default_action {
55+
type = "redirect"
56+
57+
redirect {
58+
port = "443"
59+
protocol = "HTTPS"
60+
status_code = "HTTP_301"
61+
}
62+
}
63+
}
64+
65+
66+
resource "aws_lb_listener" "default_https" {
67+
depends_on = [aws_lb.ecs]
68+
69+
load_balancer_arn = aws_lb.ecs.arn
70+
protocol = "HTTPS"
71+
port = 443
72+
certificate_arn = "arn:aws:acm:us-east-2:633607774026:certificate/8de9fd02-191c-485f-b952-e5ba32e90acb"
73+
ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01"
74+
75+
default_action {
76+
type = "fixed-response"
77+
78+
fixed_response {
79+
content_type = "text/plain"
80+
message_body = "Not Found"
81+
status_code = "404"
82+
}
83+
}
84+
}

‎terraform/apps.tf

+191
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
resource "aws_cloudwatch_log_group" "ecslogs" {
2+
name_prefix = "ecs-"
3+
retention_in_days = 7
4+
}
5+
6+
# Secrets access stuff
7+
################################################################################
8+
data "aws_iam_role" "ecs_task_execution_role" {
9+
name = "ecsTaskExecutionRole"
10+
}
11+
12+
# attach aws secrets manager policy to ecs task execution role
13+
resource "aws_iam_role_policy_attachment" "ecs_task_execution_role_attach" {
14+
role = data.aws_iam_role.ecs_task_execution_role.name
15+
policy_arn = "arn:aws:iam::aws:policy/SecretsManagerReadWrite"
16+
}
17+
18+
# The Apps
19+
################################################################################
20+
21+
# Backend Prod
22+
module "python_backend_prod" {
23+
source = "./python_backend"
24+
25+
env = "prod"
26+
vpc_id = data.aws_vpc.use2.id
27+
logs_group = aws_cloudwatch_log_group.ecslogs.name
28+
ecs_cluster_id = module.ecs.cluster_id
29+
task_execution_role = data.aws_iam_role.ecs_task_execution_role.arn
30+
image_tag = "master"
31+
}
32+
33+
resource "aws_lb_listener_rule" "python_backend_prod" {
34+
listener_arn = aws_lb_listener.default_https.arn
35+
36+
action {
37+
type = "forward"
38+
target_group_arn = module.python_backend_prod.lb_tg_arn
39+
}
40+
41+
condition {
42+
host_header {
43+
values = ["backend.operationcode.org", "api.operationcode.org"]
44+
}
45+
}
46+
}
47+
48+
# Backend Staging
49+
module "python_backend_staging" {
50+
source = "./python_backend"
51+
52+
env = "staging"
53+
vpc_id = data.aws_vpc.use2.id
54+
logs_group = aws_cloudwatch_log_group.ecslogs.name
55+
ecs_cluster_id = module.ecs.cluster_id
56+
task_execution_role = data.aws_iam_role.ecs_task_execution_role.arn
57+
image_tag = "staging"
58+
}
59+
60+
resource "aws_lb_listener_rule" "python_backend_staging" {
61+
listener_arn = aws_lb_listener.default_https.arn
62+
63+
action {
64+
type = "forward"
65+
target_group_arn = module.python_backend_staging.lb_tg_arn
66+
}
67+
68+
condition {
69+
host_header {
70+
values = ["backend-staging.operationcode.org", "api.staging.operationcode.org"]
71+
}
72+
}
73+
}
74+
75+
# Redirector for shut down sites
76+
resource "aws_lb_listener_rule" "shutdown_sites_redirector" {
77+
listener_arn = aws_lb_listener.default_https.arn
78+
79+
action {
80+
type = "redirect"
81+
82+
redirect {
83+
host = "www.operationcode.org"
84+
port = "443"
85+
protocol = "HTTPS"
86+
status_code = "HTTP_301"
87+
}
88+
}
89+
90+
condition {
91+
host_header {
92+
values = [
93+
"resources.operationcode.org",
94+
"resources.staging.operationcode.org",
95+
"resources-staging.operationcode.org",
96+
"pybot.staging.operationcode.org",
97+
]
98+
}
99+
}
100+
}
101+
102+
103+
# Resources API has been shut down
104+
# # Resources API prod
105+
# module "resources_api_prod" {
106+
# source = "./resources_api"
107+
108+
# env = "prod"
109+
# vpc_id = data.aws_vpc.use2.id
110+
# logs_group = aws_cloudwatch_log_group.ecslogs.name
111+
# ecs_cluster_id = module.ecs.cluster_id
112+
# task_execution_role = data.aws_iam_role.ecs_task_execution_role.arn
113+
# image_tag = "202b27d4a8be4418089469e1c79e04277268962e"
114+
# }
115+
116+
# resource "aws_lb_listener_rule" "resources_api_prod" {
117+
# listener_arn = aws_lb_listener.default_https.arn
118+
119+
# action {
120+
# type = "forward"
121+
# target_group_arn = module.resources_api_prod.lb_tg_arn
122+
# }
123+
124+
# condition {
125+
# host_header {
126+
# values = ["resources.operationcode.org"]
127+
# }
128+
# }
129+
# }
130+
131+
# # Resources API staging
132+
# module "resources_api_staging" {
133+
# source = "./resources_api"
134+
135+
# env = "staging"
136+
# vpc_id = data.aws_vpc.use2.id
137+
# logs_group = aws_cloudwatch_log_group.ecslogs.name
138+
# ecs_cluster_id = module.ecs.cluster_id
139+
# task_execution_role = data.aws_iam_role.ecs_task_execution_role.arn
140+
# image_tag = "fb8c59d54a5a4aed9f9cf58144eecee69f9fc58e"
141+
# }
142+
143+
# resource "aws_lb_listener_rule" "resources_api_staging" {
144+
# listener_arn = aws_lb_listener.default_https.arn
145+
146+
# action {
147+
# type = "forward"
148+
# target_group_arn = module.resources_api_staging.lb_tg_arn
149+
# }
150+
151+
# condition {
152+
# host_header {
153+
# values = ["resources.staging.operationcode.org", "resources-staging.operationcode.org"]
154+
# }
155+
# }
156+
# }
157+
158+
159+
# note: pybot moving off to Render.com
160+
# Pybot staging
161+
# module "pybot_staging" {
162+
# source = "./pybot"
163+
164+
# env = "staging"
165+
# vpc_id = data.aws_vpc.use2.id
166+
# logs_group = aws_cloudwatch_log_group.ecslogs.name
167+
# ecs_cluster_id = module.ecs.cluster_id
168+
# task_execution_role = data.aws_iam_role.ecs_task_execution_role.arn
169+
# image_tag = "staging"
170+
# }
171+
172+
# resource "aws_lb_listener_rule" "pybot_staging" {
173+
# listener_arn = aws_lb_listener.default_https.arn
174+
175+
# action {
176+
# type = "forward"
177+
# target_group_arn = module.pybot_staging.lb_tg_arn
178+
# }
179+
180+
# condition {
181+
# host_header {
182+
# values = ["pybot.staging.operationcode.org"]
183+
# }
184+
# }
185+
186+
# condition {
187+
# path_pattern {
188+
# values = ["/slack/*", "/pybot/*", "/airtable/*"]
189+
# }
190+
# }
191+
# }

0 commit comments

Comments
 (0)