Skip to content

Commit 1629913

Browse files
JuanadelacuestaJuanadelacuesta
committed
func: unify keys and make them cluster grouped
1 parent 3c1059f commit 1629913

15 files changed

+63
-53
lines changed

‎e2e/terraform/Makefile

+4-4
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,10 @@ destroy_full:
4545
# don't run this by default in plan/apply because it prevents you from
4646
# updating a running cluster
4747
tidy:
48-
rm -rf keys
49-
mkdir keys
50-
chmod 0700 keys
51-
rm -rf uploads/*
48+
rm -rf provision-infra/keys
49+
mkdir -p provision-infra/keys
50+
chmod 0700 provision-infra/keys
51+
rm -rf provision-infra/uploads/*
5252
git checkout uploads/README.md
5353
rm -f terraform.tfstate.*.backup
5454
rm custom.tfvars

‎e2e/terraform/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -140,14 +140,14 @@ about the cluster:
140140
You can use Terraform outputs above to access nodes via ssh:
141141

142142
```sh
143-
ssh -i keys/nomad-e2e-*.pem ubuntu@${EC2_IP_ADDR}
143+
ssh -i keys/<cluster-name>/nomad-e2e-*.pem ubuntu@${EC2_IP_ADDR}
144144
```
145145

146146
The Windows client runs OpenSSH for convenience, but has a different
147147
user and will drop you into a Powershell shell instead of bash:
148148

149149
```sh
150-
ssh -i keys/nomad-e2e-*.pem Administrator@${EC2_IP_ADDR}
150+
ssh -i keys/<cluster-name>/nomad-e2e-*.pem Administrator@${EC2_IP_ADDR}
151151
```
152152

153153
## Teardown

‎e2e/terraform/provision-infra/compute.tf

+6-6
Original file line numberDiff line numberDiff line change
@@ -102,10 +102,10 @@ data "aws_ami" "ubuntu_jammy_amd64" {
102102
values = ["Ubuntu"]
103103
}
104104

105-
filter {
105+
/* filter {
106106
name = "tag:BuilderSha"
107107
values = [data.external.packer_sha.result["sha"]]
108-
}
108+
} */
109109
}
110110

111111
data "aws_ami" "ubuntu_jammy" {
@@ -122,10 +122,10 @@ data "aws_ami" "ubuntu_jammy" {
122122
values = ["Ubuntu"]
123123
}
124124

125-
filter {
125+
/* filter {
126126
name = "tag:BuilderSha"
127127
values = [data.external.packer_sha.result["sha"]]
128-
}
128+
} */
129129
}
130130

131131
data "aws_ami" "windows_2016" {
@@ -144,8 +144,8 @@ data "aws_ami" "windows_2016" {
144144
values = ["Windows2016"]
145145
}
146146

147-
filter {
147+
/* filter {
148148
name = "tag:BuilderSha"
149149
values = [data.external.packer_sha.result["sha"]]
150-
}
150+
} */
151151
}

‎e2e/terraform/provision-infra/consul-servers.tf

+5-5
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ resource "random_uuid" "consul_initial_management_token" {}
1010

1111
resource "local_sensitive_file" "consul_initial_management_token" {
1212
content = random_uuid.consul_initial_management_token.result
13-
filename = "${path.module}/keys/consul_initial_management_token"
13+
filename = "${local.keys_dir}/consul_initial_management_token"
1414
file_permission = "0600"
1515
}
1616

@@ -91,13 +91,13 @@ resource "null_resource" "upload_consul_server_configs" {
9191
user = "ubuntu"
9292
host = aws_instance.consul_server.public_ip
9393
port = 22
94-
private_key = file("${path.module}/../keys/${local.random_name}.pem")
94+
private_key = file("${local.keys_dir}/${local.random_name}.pem")
9595
target_platform = "unix"
9696
timeout = "15m"
9797
}
9898

9999
provisioner "file" {
100-
source = "${path.module}/keys/tls_ca.crt"
100+
source = "${local.keys_dir}/tls_ca.crt"
101101
destination = "/tmp/consul_ca.pem"
102102
}
103103
provisioner "file" {
@@ -133,7 +133,7 @@ resource "null_resource" "install_consul_server_configs" {
133133
user = "ubuntu"
134134
host = aws_instance.consul_server.public_ip
135135
port = 22
136-
private_key = file("${path.module}/../keys/${local.random_name}.pem")
136+
private_key = file("${local.keys_dir}/${local.random_name}.pem")
137137
target_platform = "unix"
138138
timeout = "15m"
139139
}
@@ -169,7 +169,7 @@ resource "null_resource" "bootstrap_consul_acls" {
169169
command = "${path.module}/scripts/bootstrap-consul.sh"
170170
environment = {
171171
CONSUL_HTTP_ADDR = "https://${aws_instance.consul_server.public_ip}:8501"
172-
CONSUL_CACERT = "${path.module}/keys/tls_ca.crt"
172+
CONSUL_CACERT = "${local.keys_dir}/tls_ca.crt"
173173
CONSUL_HTTP_TOKEN = "${random_uuid.consul_initial_management_token.result}"
174174
CONSUL_AGENT_TOKEN = "${random_uuid.consul_agent_token.result}"
175175
NOMAD_CLUSTER_CONSUL_TOKEN = "${random_uuid.consul_token_for_nomad.result}"

‎e2e/terraform/provision-infra/keys/nomad_root_token

-1
This file was deleted.

‎e2e/terraform/provision-infra/main.tf

+2-1
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,13 @@ resource "random_password" "windows_admin_password" {
1616
locals {
1717
random_name = "${var.name}-${random_pet.e2e.id}"
1818
uploads_dir = "${path.module}/provision-nomad/uploads/${random_pet.e2e.id}"
19+
keys_dir = "${path.module}/keys/${random_pet.e2e.id}"
1920
}
2021

2122
# Generates keys to use for provisioning and access
2223
module "keys" {
2324
name = local.random_name
24-
path = "${path.module}/../keys"
25+
path = "${local.keys_dir}"
2526
source = "mitchellh/dynamic-keys/aws"
2627
version = "v2.0.0"
2728
}

‎e2e/terraform/provision-infra/nomad-acls.tf

+6-5
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,17 @@ resource "null_resource" "bootstrap_nomad_acls" {
1414
command = "${path.module}/scripts/bootstrap-nomad.sh"
1515
environment = {
1616
NOMAD_ADDR = "https://${aws_instance.server.0.public_ip}:4646"
17-
NOMAD_CACERT = "${path.module}/keys/tls_ca.crt"
18-
NOMAD_CLIENT_CERT = "${path.module}/keys/tls_api_client.crt"
19-
NOMAD_CLIENT_KEY = "${path.module}/keys/tls_api_client.key"
17+
NOMAD_CACERT = "${local.keys_dir}/tls_ca.crt"
18+
NOMAD_CLIENT_CERT = "${local.keys_dir}/tls_api_client.crt"
19+
NOMAD_CLIENT_KEY = "${local.keys_dir}/tls_api_client.key"
20+
NOMAD_TOKEN_PATH = "${local.keys_dir}"
2021
}
2122
}
2223
}
2324

2425
data "local_sensitive_file" "nomad_token" {
2526
depends_on = [null_resource.bootstrap_nomad_acls]
26-
filename = "${path.module}/keys/nomad_root_token"
27+
filename = "${local.keys_dir}/nomad_root_token"
2728
}
2829

2930
# push the token out to the servers for humans to use.
@@ -53,7 +54,7 @@ resource "null_resource" "root_nomad_env_servers" {
5354
user = "ubuntu"
5455
host = aws_instance.server[count.index].public_ip
5556
port = 22
56-
private_key = file("${path.module}/../keys/${local.random_name}.pem")
57+
private_key = file("${local.keys_dir}/${local.random_name}.pem")
5758
timeout = "5m"
5859
}
5960
provisioner "remote-exec" {

‎e2e/terraform/provision-infra/nomad.tf

+6-3
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,13 @@ module "nomad_server" {
2323
aws_kms_key_id = data.aws_kms_alias.e2e.target_key_id
2424

2525
uploads_dir = local.uploads_dir
26+
keys_dir = local.keys_dir
2627

2728
connection = {
2829
type = "ssh"
2930
user = "ubuntu"
3031
port = 22
31-
private_key = "${path.module}/../keys/${local.random_name}.pem"
32+
private_key = "${local.keys_dir}/${local.random_name}.pem"
3233
}
3334
}
3435

@@ -52,12 +53,13 @@ module "nomad_client_ubuntu_jammy" {
5253
tls_ca_cert = tls_self_signed_cert.ca.cert_pem
5354

5455
uploads_dir = local.uploads_dir
56+
keys_dir = local.keys_dir
5557

5658
connection = {
5759
type = "ssh"
5860
user = "ubuntu"
5961
port = 22
60-
private_key = "${path.module}/../keys/${local.random_name}.pem"
62+
private_key = "${local.keys_dir}/${local.random_name}.pem"
6163
}
6264
}
6365

@@ -83,11 +85,12 @@ module "nomad_client_windows_2016" {
8385
tls_ca_cert = tls_self_signed_cert.ca.cert_pem
8486

8587
uploads_dir = local.uploads_dir
88+
keys_dir = local.keys_dir
8689

8790
connection = {
8891
type = "ssh"
8992
user = "Administrator"
9093
port = 22
91-
private_key = "${path.module}/../keys/${local.random_name}.pem"
94+
private_key = "${local.keys_dir}/${local.random_name}.pem"
9295
}
9396
}

‎e2e/terraform/provision-infra/outputs.tf

+10-10
Original file line numberDiff line numberDiff line change
@@ -26,16 +26,16 @@ Then you can run tests from the e2e directory with:
2626
ssh into servers with:
2727
2828
%{for ip in aws_instance.server.*.public_ip~}
29-
ssh -i keys/${local.random_name}.pem ubuntu@${ip}
29+
ssh -i keys/${local.random_name}/${local.random_name}.pem ubuntu@${ip}
3030
%{endfor~}
3131
3232
ssh into clients with:
3333
3434
%{for ip in aws_instance.client_ubuntu_jammy.*.public_ip~}
35-
ssh -i keys/${local.random_name}.pem ubuntu@${ip}
35+
ssh -i keys/${local.random_name}/${local.random_name}.pem ubuntu@${ip}
3636
%{endfor~}
3737
%{for ip in aws_instance.client_windows_2016.*.public_ip~}
38-
ssh -i keys/${local.random_name}.pem Administrator@${ip}
38+
ssh -i keys/${local.random_name}/${local.random_name}.pem Administrator@${ip}
3939
%{endfor~}
4040
4141
EOM
@@ -49,14 +49,14 @@ output "environment" {
4949
sensitive = true
5050
value = <<EOM
5151
export NOMAD_ADDR=https://${aws_instance.server[0].public_ip}:4646
52-
export NOMAD_CACERT=${abspath(path.module)}/keys/tls_ca.crt
53-
export NOMAD_CLIENT_CERT=${abspath(path.module)}/keys/tls_api_client.crt
54-
export NOMAD_CLIENT_KEY=${abspath(path.module)}/keys/tls_api_client.key
52+
export NOMAD_CACERT=${abspath(local.keys_dir)}/tls_ca.crt
53+
export NOMAD_CLIENT_CERT=${abspath(local.keys_dir)}/tls_api_client.crt
54+
export NOMAD_CLIENT_KEY=${abspath(local.keys_dir)}/tls_api_client.key
5555
export NOMAD_TOKEN=${data.local_sensitive_file.nomad_token.content}
5656
export NOMAD_E2E=1
5757
export CONSUL_HTTP_ADDR=https://${aws_instance.consul_server.public_ip}:8501
5858
export CONSUL_HTTP_TOKEN=${local_sensitive_file.consul_initial_management_token.content}
59-
export CONSUL_CACERT=${abspath(path.module)}/keys/tls_ca.crt
59+
export CONSUL_CACERT=${abspath(local.keys_dir)}/tls_ca.crt
6060
EOM
6161
}
6262

@@ -65,15 +65,15 @@ output "nomad_addr" {
6565
}
6666

6767
output "ca_file" {
68-
value = "${abspath(path.module)}/keys/tls_ca.crt"
68+
value = "${abspath(local.keys_dir)}/tls_ca.crt"
6969
}
7070

7171
output "cert_file" {
72-
value = "${abspath(path.module)}/keys/tls_api_client.crt"
72+
value = "${abspath(local.keys_dir)}/tls_api_client.crt"
7373
}
7474

7575
output "key_file" {
76-
value = "${abspath(path.module)}/keys/tls_api_client.key"
76+
value = "${abspath(local.keys_dir)}/tls_api_client.key"
7777
}
7878

7979
output "nomad_token" {

‎e2e/terraform/provision-infra/provision-nomad/main.tf

+6-6
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ resource "null_resource" "upload_consul_configs" {
6767
destination = "/tmp/consul_cert.pem"
6868
}
6969
provisioner "file" {
70-
source = "${path.module}/../keys/tls_ca.crt"
70+
source = "${var.keys_dir}/tls_ca.crt"
7171
destination = "/tmp/consul_ca.crt"
7272
}
7373
provisioner "file" {
@@ -136,23 +136,23 @@ resource "null_resource" "upload_nomad_configs" {
136136
destination = "/tmp/agent-${var.instance.public_ip}.crt"
137137
}
138138
provisioner "file" {
139-
source = "${path.module}/../keys/tls_api_client.key"
139+
source = "${var.keys_dir}/tls_api_client.key"
140140
destination = "/tmp/tls_proxy.key"
141141
}
142142
provisioner "file" {
143-
source = "${path.module}/../keys/tls_api_client.crt"
143+
source = "${var.keys_dir}/tls_api_client.crt"
144144
destination = "/tmp/tls_proxy.crt"
145145
}
146146
provisioner "file" {
147-
source = "${path.module}/../keys/tls_ca.crt"
147+
source = "${var.keys_dir}/tls_ca.crt"
148148
destination = "/tmp/ca.crt"
149149
}
150150
provisioner "file" {
151-
source = "${path.module}/../keys/self_signed.key"
151+
source = "${var.keys_dir}/self_signed.key"
152152
destination = "/tmp/self_signed.key"
153153
}
154154
provisioner "file" {
155-
source = "${path.module}/../keys/self_signed.crt"
155+
source = "${var.keys_dir}/self_signed.crt"
156156
destination = "/tmp/self_signed.crt"
157157
}
158158
}

‎e2e/terraform/provision-infra/provision-nomad/tls.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,10 @@ resource "tls_locally_signed_cert" "nomad" {
3434

3535
resource "local_sensitive_file" "nomad_client_key" {
3636
content = tls_private_key.nomad.private_key_pem
37-
filename = "keys/agent-${var.instance.public_ip}.key"
37+
filename = "${var.keys_dir}/agent-${var.instance.public_ip}.key"
3838
}
3939

4040
resource "local_sensitive_file" "nomad_client_cert" {
4141
content = tls_locally_signed_cert.nomad.cert_pem
42-
filename = "keys/agent-${var.instance.public_ip}.crt"
42+
filename = "${var.keys_dir}/agent-${var.instance.public_ip}.crt"
4343
}

‎e2e/terraform/provision-infra/provision-nomad/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -93,3 +93,9 @@ variable "uploads_dir" {
9393
description = "Directory where all the configuration files for nomad, consul and vault will be taken from to configure each nomad node"
9494
default = ""
9595
}
96+
97+
variable "keys_dir" {
98+
type = string
99+
description = "Directory where all the configuration TLS and SSH keys and certificates will be stored fro provisioning"
100+
default = ""
101+
}

‎e2e/terraform/provision-infra/scripts/bootstrap-nomad.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ set -e
1919

2020
export NOMAD_TOKEN="$ROOT_TOKEN"
2121

22-
mkdir -p ../keys
23-
echo $NOMAD_TOKEN > "${DIR}/../keys/nomad_root_token"
22+
mkdir -p "$NOMAD_TOKEN_PATH"
23+
echo $NOMAD_TOKEN > "${NOMAD_TOKEN_PATH}/nomad_root_token"
2424
echo NOMAD_TOKEN=$NOMAD_TOKEN
2525

2626
# Our default policy after bootstrapping will be full-access. Without

‎e2e/terraform/provision-infra/tls_ca.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@ resource "tls_self_signed_cert" "ca" {
2323
}
2424

2525
resource "local_sensitive_file" "ca_key" {
26-
filename = "${path.module}/keys/tls_ca.key"
26+
filename = "${local.keys_dir}/tls_ca.key"
2727
content = tls_private_key.ca.private_key_pem
2828
}
2929

3030
resource "local_sensitive_file" "ca_cert" {
31-
filename = "${path.module}/keys/tls_ca.crt"
31+
filename = "${local.keys_dir}/tls_ca.crt"
3232
content = tls_self_signed_cert.ca.cert_pem
3333
}

‎e2e/terraform/provision-infra/tls_client.tf

+4-4
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,12 @@ resource "tls_locally_signed_cert" "api_client" {
3434

3535
resource "local_sensitive_file" "api_client_key" {
3636
content = tls_private_key.api_client.private_key_pem
37-
filename = "${path.module}/keys/tls_api_client.key"
37+
filename = "${local.keys_dir}/tls_api_client.key"
3838
}
3939

4040
resource "local_sensitive_file" "api_client_cert" {
4141
content = tls_locally_signed_cert.api_client.cert_pem
42-
filename = "${path.module}/keys/tls_api_client.crt"
42+
filename = "${local.keys_dir}/tls_api_client.crt"
4343
}
4444

4545
# Self signed cert for reverse proxy
@@ -66,10 +66,10 @@ resource "tls_self_signed_cert" "self_signed" {
6666

6767
resource "local_sensitive_file" "self_signed_key" {
6868
content = tls_private_key.self_signed.private_key_pem
69-
filename = "${path.module}/keys/self_signed.key"
69+
filename = "${local.keys_dir}/self_signed.key"
7070
}
7171

7272
resource "local_sensitive_file" "self_signed_cert" {
7373
content = tls_self_signed_cert.self_signed.cert_pem
74-
filename = "${path.module}/keys/self_signed.crt"
74+
filename = "${local.keys_dir}/self_signed.crt"
7575
}

0 commit comments

Comments
 (0)