From 70831ff5d72ad32022cf3a04a973b11285b1d413 Mon Sep 17 00:00:00 2001 From: Ruslan Gladov Date: Mon, 17 Jun 2024 19:10:21 +0300 Subject: [PATCH] tf code --- .github/workflows/ci_build.yaml | 37 ---- .../{ci_deploy.yaml => ci_workflow.yaml} | 50 +++--- hardhat/Dockerfile | 4 +- terraform/infra.yaml | 20 +++ terraform/locals.tf | 13 ++ terraform/main.tf | 164 ++++++++++++++++++ terraform/providers.tf | 14 ++ terraform/variables.tf | 13 ++ terraform/vpc.tf | 35 ++++ 9 files changed, 290 insertions(+), 60 deletions(-) delete mode 100644 .github/workflows/ci_build.yaml rename .github/workflows/{ci_deploy.yaml => ci_workflow.yaml} (52%) create mode 100644 terraform/infra.yaml create mode 100644 terraform/locals.tf create mode 100644 terraform/main.tf create mode 100644 terraform/providers.tf create mode 100644 terraform/variables.tf create mode 100644 terraform/vpc.tf diff --git a/.github/workflows/ci_build.yaml b/.github/workflows/ci_build.yaml deleted file mode 100644 index c95e288423..0000000000 --- a/.github/workflows/ci_build.yaml +++ /dev/null @@ -1,37 +0,0 @@ -name: Merge Events - -on: - pull_request: - types: - - closed - push: - branches: - - main -jobs: - build: - if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'CI:Build') - runs-on: ubuntu-latest - - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 - - - name: Login to DockerHub - uses: docker/login-action@v3 - with: - username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Build and push Docker image - uses: docker/build-push-action@v5 - with: - context: . - push: true - tags: e1018mc/limechain:latest -# tags: e1018mc/limechain:${{ github.sha }} - - - name: Log out from DockerHub - run: docker logout \ No newline at end of file diff --git a/.github/workflows/ci_deploy.yaml b/.github/workflows/ci_workflow.yaml similarity index 52% rename from .github/workflows/ci_deploy.yaml rename to .github/workflows/ci_workflow.yaml index 5ae3359871..49b40ea7db 100644 --- a/.github/workflows/ci_deploy.yaml +++ b/.github/workflows/ci_workflow.yaml @@ -1,4 +1,4 @@ -name: Deploy Contracts to Devnet +name: Build and Deploy workflow on: pull_request: @@ -7,8 +7,34 @@ on: push: branches: - main - jobs: + build: + if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'CI:Build') + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + + - name: Login to DockerHub + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKER_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Build and push Docker image + uses: docker/build-push-action@v5 + with: + context: . + push: true + tags: e1018mc/limechain:go-ethereum-app + + - name: Log out from DockerHub + run: docker logout + deploy-and-build: if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'CI:Deploy') runs-on: ubuntu-latest @@ -18,7 +44,7 @@ jobs: uses: actions/checkout@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@v2 - name: Login to DockerHub uses: docker/login-action@v3 @@ -26,28 +52,12 @@ jobs: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} -# - name: Set up Node.js -# uses: actions/setup-node@v4 -# with: -# node-version: '20' - -# - name: Install dependencies -# run: npm install --save-dev hardhat - - name: Run local devnet run: docker-compose up -d - name: Build a new image with Apollo contract run: docker build -t hardhat-ignition . -# - name: Deploy contracts -# run: | -# cd /home/runner/work/go-ethereum/go-ethereum/hardhat -# npm install --save-dev @nomicfoundation/hardhat-toolbox -# npx hardhat ignition deploy ./ignition/modules/Lock.js - - - - name: Build and push Docker image uses: docker/build-push-action@v5 with: @@ -56,4 +66,4 @@ jobs: tags: e1018mc/limechain:apollo_contract - name: Destroy local devnet - run: docker-compose down + run: docker-compose down \ No newline at end of file diff --git a/hardhat/Dockerfile b/hardhat/Dockerfile index c0ccc748e1..418b156397 100644 --- a/hardhat/Dockerfile +++ b/hardhat/Dockerfile @@ -16,6 +16,4 @@ COPY entrypoint.sh /usr/app/entrypoint.sh RUN chmod +x /usr/app/entrypoint.sh -ENTRYPOINT ["/usr/app/entrypoint.sh"] - -#CMD ["npx", "hardhat", "ignition", "deploy", "/usr/app/ignition/modules/Apollo.js"] \ No newline at end of file +ENTRYPOINT ["/usr/app/entrypoint.sh"] \ No newline at end of file diff --git a/terraform/infra.yaml b/terraform/infra.yaml new file mode 100644 index 0000000000..f954f45031 --- /dev/null +++ b/terraform/infra.yaml @@ -0,0 +1,20 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: smart-contract +spec: + selector: + matchLabels: + name: smart-contract + template: + metadata: + labels: + name: smart-contract + spec: + imagePullSecrets: + - name: regcred + containers: + - name: app + image: e1018mc/limechain:apollo_contract + ports: + - containerPort: 8545 diff --git a/terraform/locals.tf b/terraform/locals.tf new file mode 100644 index 0000000000..a53e37d06d --- /dev/null +++ b/terraform/locals.tf @@ -0,0 +1,13 @@ +locals { + name = "Limechain-project" + cluster_version = "1.28" + region = var.region + account_id = "924841524423" + + tags = merge({ + Example = local.name + GithubRepo = "terraform-aws-eks" + GithubOrg = "terraform-aws-modules" + }, var.tags) +} + diff --git a/terraform/main.tf b/terraform/main.tf new file mode 100644 index 0000000000..c284eb3131 --- /dev/null +++ b/terraform/main.tf @@ -0,0 +1,164 @@ +provider "kubernetes" { + host = module.eks.cluster_endpoint + cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data) + alias = "lc" + + exec { + api_version = "client.authentication.k8s.io/v1beta1" + command = "aws" + # This requires the awscli to be installed locally where Terraform is executed + args = ["eks", "get-token", "--cluster-name", module.eks.cluster_name] + } +} + +################################################################################ +# EKS Module +################################################################################ + +module "eks" { + source = "terraform-aws-modules/eks/aws" + version = "19.15.3" + + providers = { + kubernetes = kubernetes.lc + } + + cluster_addons = { + aws-ebs-csi-driver = { + resolve_conflicts = "OVERWRITE" +# addon_version = var.aws-ebs-csi-driver_addon_version + } + coredns = { + preserve = true + # addon_version = var.coredns_addon_version + + timeouts = { + create = "25m" + delete = "10m" + } + } + kube-proxy = { + # addon_version = var.kube-proxy_addon_version + } + } + + cluster_name = local.name + cluster_version = local.cluster_version + + enable_irsa = true + + cluster_endpoint_private_access = true + cluster_endpoint_public_access = false + + create_kms_key = true +# kms_key_administrators = [data.aws_caller_identity.current.arn] + kms_key_aliases = ["eks/application-infrastructure"] + kms_key_enable_default_policy = true + kms_key_deletion_window_in_days = 7 + enable_kms_key_rotation = true + + cluster_tags = { + Name = local.name + } + + vpc_id = module.vpc.vpc_id + subnet_ids = module.vpc.private_subnets + control_plane_subnet_ids = module.vpc.private_subnets + + manage_aws_auth_configmap = true + + #When deploying the cluster in a new env, this option should be enabled at first deployment. + #If you receive a timeout error during apply, disable it, and redeploy. + create_aws_auth_configmap = true + + # Extend cluster security group rules + cluster_security_group_additional_rules = { + egress_nodes_ephemeral_ports_tcp = { + description = "To node 1025-65535" + protocol = "tcp" + from_port = 1025 + to_port = 65535 + type = "egress" + source_node_security_group = true + } + } + # Extend node-to-node security group rules + node_security_group_additional_rules = { + ingress_self_all = { + description = "Node to node all ports/protocols" + protocol = "-1" + from_port = 0 + to_port = 0 + type = "ingress" + self = true + } + egress_all = { + description = "Node all egress" + protocol = "-1" + from_port = 0 + to_port = 0 + type = "egress" + cidr_blocks = ["0.0.0.0/0"] + } + } + eks_managed_node_groups = { + blue = { + name = local.name + use_name_prefix = true + + iam_role_additional_policies = { + EBS_CSI = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy" + EFS_CSI = "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy" + } + + subnet_ids = module.vpc.private_subnets + + min_size = 1 + max_size = 10 + desired_size = 1 + + force_update_version = true + instance_types = ["t3.small"] + ami_type = "AL2_x86_64" + + description = "EKS managed node group launch template" + + ebs_optimized = true + disable_api_termination = false + enable_monitoring = false + + create_iam_role = true + iam_role_name = "${local.name}-node-group" + iam_role_use_name_prefix = false + iam_role_description = "EKS managed node group complete role" + iam_role_tags = { + Purpose = "Protector of the kubelet" + } + + iam_role_attach_cni_policy = true + + create_security_group = true + security_group_name = "${local.name}-node-group-sg" + security_group_use_name_prefix = false + + tags = { + ExtraTag = "EKS managed node group" + "k8s.io/cluster-autoscaler/enabled" = 1 + "k8s.io/cluster-autoscaler/APP-DEV-EKS-RCON" = 1 + } + } + } + + aws_auth_roles = [ + { + rolearn = "arn:aws:iam::${local.account_id}:role/HeleCloud-Admin" + username = "HeleCloud" + groups = ["system:masters"] + } + ] + + + tags = { + ClusterName = local.name + } +} \ No newline at end of file diff --git a/terraform/providers.tf b/terraform/providers.tf new file mode 100644 index 0000000000..a5ea5ba62f --- /dev/null +++ b/terraform/providers.tf @@ -0,0 +1,14 @@ +provider "aws" { + region = local.region +} + +provider "kubernetes" { + host = module.eks.cluster_endpoint + cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data) + + exec { + api_version = "client.authentication.k8s.io/v1beta1" + command = "aws" + args = ["eks", "get-token", "--cluster-name", module.eks.cluster_id] + } +} \ No newline at end of file diff --git a/terraform/variables.tf b/terraform/variables.tf new file mode 100644 index 0000000000..291f6cd5f6 --- /dev/null +++ b/terraform/variables.tf @@ -0,0 +1,13 @@ + variable "region" { + default = "eu-west-1" +} + +variable "tags" { + default = {} +} + + variable "account_id" { + description = "AWS Account ID" + type = string + default = null +} diff --git a/terraform/vpc.tf b/terraform/vpc.tf new file mode 100644 index 0000000000..bc3f3a3354 --- /dev/null +++ b/terraform/vpc.tf @@ -0,0 +1,35 @@ +module "vpc" { + source = "terraform-aws-modules/vpc/aws" + version = "~> 5.0" + + name = local.name + cidr = "10.0.0.0/16" + + azs = ["${local.region}a", "${local.region}b", "${local.region}c"] + private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] + public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"] + + enable_ipv6 = false +# assign_ipv6_address_on_creation = false + create_egress_only_igw = true + + enable_nat_gateway = true + single_nat_gateway = true + enable_dns_hostnames = true + + enable_flow_log = false + create_flow_log_cloudwatch_iam_role = false + create_flow_log_cloudwatch_log_group = false + + public_subnet_tags = { + "kubernetes.io/cluster/${local.name}" = "shared" + "kubernetes.io/role/elb" = 1 + } + + private_subnet_tags = { + "kubernetes.io/cluster/${local.name}" = "shared" + "kubernetes.io/role/internal-elb" = 1 + } + + tags = local.tags +} \ No newline at end of file