Skip to content

Commit

Permalink
adding requested changes
Browse files Browse the repository at this point in the history
  • Loading branch information
@jpl-btlunsfo
jpl-btlunsfo committed Sep 17, 2024
1 parent ccde60f commit f6bc00b
Show file tree
Hide file tree
Showing 6 changed files with 20 additions and 50 deletions.
4 changes: 1 addition & 3 deletions terraform-unity/modules/terraform-unity-sps-airflow/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,9 +49,7 @@ No modules.
| [aws_ssm_parameter.airflow_ui_health_check_endpoint](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/ssm_parameter) | resource |
| [aws_ssm_parameter.airflow_ui_url](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/ssm_parameter) | resource |
| [aws_ssm_parameter.unity_proxy_airflow_ui](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/ssm_parameter) | resource |
| [aws_vpc_security_group_ingress_rule.airflow_ingress_sg_jpl_rule1](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [aws_vpc_security_group_ingress_rule.airflow_ingress_sg_jpl_rule2](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [aws_vpc_security_group_ingress_rule.airflow_ingress_sg_jpl_rule3](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [aws_vpc_security_group_ingress_rule.airflow_ingress_sg_jpl_rule](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [aws_vpc_security_group_ingress_rule.airflow_ingress_sg_proxy_rule](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [helm_release.airflow](https://registry.terraform.io/providers/hashicorp/helm/2.13.1/docs/resources/release) | resource |
| [helm_release.keda](https://registry.terraform.io/providers/hashicorp/helm/2.13.1/docs/resources/release) | resource |
Expand Down
1 change: 1 addition & 0 deletions terraform-unity/modules/terraform-unity-sps-airflow/locals.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ locals {
mission = var.project
Stack = ""
}
load_balancer_port = 5000
oidc_provider_url = replace(data.aws_eks_cluster.cluster.identity[0].oidc[0].issuer, "https://", "")
airflow_metadata_kubernetes_secret = "airflow-metadata-secret"
airflow_webserver_kubernetes_secret = "airflow-webserver-secret"
Expand Down
29 changes: 8 additions & 21 deletions terraform-unity/modules/terraform-unity-sps-airflow/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -414,26 +414,13 @@ resource "aws_security_group" "airflow_ingress_sg" {
})
}

resource "aws_vpc_security_group_ingress_rule" "airflow_ingress_sg_jpl_rule1" {
resource "aws_vpc_security_group_ingress_rule" "airflow_ingress_sg_jpl_rule" {
for_each = toset(["128.149.0.0/16", "137.78.0.0/16", "137.79.0.0/16"])
security_group_id = aws_security_group.airflow_ingress_sg.id
ip_protocol = "tcp"
from_port = 5000
to_port = 5000
cidr_ipv4 = "128.149.0.0/16"
}
resource "aws_vpc_security_group_ingress_rule" "airflow_ingress_sg_jpl_rule2" {
security_group_id = aws_security_group.airflow_ingress_sg.id
ip_protocol = "tcp"
from_port = 5000
to_port = 5000
cidr_ipv4 = "137.78.0.0/16"
}
resource "aws_vpc_security_group_ingress_rule" "airflow_ingress_sg_jpl_rule3" {
security_group_id = aws_security_group.airflow_ingress_sg.id
ip_protocol = "tcp"
from_port = 5000
to_port = 5000
cidr_ipv4 = "137.79.0.0/16"
from_port = local.load_balancer_port
to_port = local.load_balancer_port
cidr_ipv4 = each.key
}

data "aws_security_groups" "venue_proxy_sg" {
Expand All @@ -450,8 +437,8 @@ resource "aws_vpc_security_group_ingress_rule" "airflow_ingress_sg_proxy_rule" {
count = length(data.aws_security_groups.venue_proxy_sg.ids) > 0 ? 1 : 0
security_group_id = aws_security_group.airflow_ingress_sg.id
ip_protocol = "tcp"
from_port = 5000
to_port = 5000
from_port = local.load_balancer_port
to_port = local.load_balancer_port
referenced_security_group_id = data.aws_security_groups.venue_proxy_sg.ids[0]
}

Expand All @@ -463,7 +450,7 @@ resource "kubernetes_ingress_v1" "airflow_ingress" {
"alb.ingress.kubernetes.io/scheme" = "internet-facing"
"alb.ingress.kubernetes.io/target-type" = "ip"
"alb.ingress.kubernetes.io/subnets" = join(",", jsondecode(data.aws_ssm_parameter.subnet_ids.value)["public"])
"alb.ingress.kubernetes.io/listen-ports" = "[{\"HTTP\": 5000}]"
"alb.ingress.kubernetes.io/listen-ports" = "[{\"HTTP\": ${local.load_balancer_port}}]"
"alb.ingress.kubernetes.io/security-groups" = aws_security_group.airflow_ingress_sg.id
"alb.ingress.kubernetes.io/healthcheck-path" = "/health"
}
Expand Down
4 changes: 1 addition & 3 deletions terraform-unity/modules/terraform-unity-sps-ogc-processes-api/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,7 @@ No modules.
| [aws_ssm_parameter.ogc_processes_api_url](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/ssm_parameter) | resource |
| [aws_ssm_parameter.ogc_processes_ui_url](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/ssm_parameter) | resource |
| [aws_ssm_parameter.unity_proxy_ogc_api](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/ssm_parameter) | resource |
| [aws_vpc_security_group_ingress_rule.ogc_ingress_sg_jpl_rule1](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [aws_vpc_security_group_ingress_rule.ogc_ingress_sg_jpl_rule2](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [aws_vpc_security_group_ingress_rule.ogc_ingress_sg_jpl_rule3](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [aws_vpc_security_group_ingress_rule.ogc_ingress_sg_jpl_rule](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [aws_vpc_security_group_ingress_rule.ogc_ingress_sg_proxy_rule](https://registry.terraform.io/providers/hashicorp/aws/5.50.0/docs/resources/vpc_security_group_ingress_rule) | resource |
| [kubernetes_deployment.ogc_processes_api](https://registry.terraform.io/providers/hashicorp/kubernetes/2.29.0/docs/resources/deployment) | resource |
| [kubernetes_deployment.redis](https://registry.terraform.io/providers/hashicorp/kubernetes/2.29.0/docs/resources/deployment) | resource |
Expand Down
1 change: 1 addition & 0 deletions terraform-unity/modules/terraform-unity-sps-ogc-processes-api/locals.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,5 @@ locals {
mission = var.project
Stack = ""
}
load_balancer_port = 5001
}
31 changes: 8 additions & 23 deletions terraform-unity/modules/terraform-unity-sps-ogc-processes-api/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -217,28 +217,13 @@ resource "aws_security_group" "ogc_ingress_sg" {
})
}

resource "aws_vpc_security_group_ingress_rule" "ogc_ingress_sg_jpl_rule1" {
resource "aws_vpc_security_group_ingress_rule" "ogc_ingress_sg_jpl_rule" {
for_each = toset(["128.149.0.0/16", "137.78.0.0/16", "137.79.0.0/16"])
security_group_id = aws_security_group.ogc_ingress_sg.id
ip_protocol = "tcp"
from_port = 5001
to_port = 5001
cidr_ipv4 = "128.149.0.0/16"
}

resource "aws_vpc_security_group_ingress_rule" "ogc_ingress_sg_jpl_rule2" {
security_group_id = aws_security_group.ogc_ingress_sg.id
ip_protocol = "tcp"
from_port = 5001
to_port = 5001
cidr_ipv4 = "137.78.0.0/16"
}

resource "aws_vpc_security_group_ingress_rule" "ogc_ingress_sg_jpl_rule3" {
security_group_id = aws_security_group.ogc_ingress_sg.id
ip_protocol = "tcp"
from_port = 5001
to_port = 5001
cidr_ipv4 = "137.79.0.0/16"
from_port = local.load_balancer_port
to_port = local.load_balancer_port
cidr_ipv4 = each.key
}

data "aws_security_groups" "venue_proxy_sg" {
Expand All @@ -255,8 +240,8 @@ resource "aws_vpc_security_group_ingress_rule" "ogc_ingress_sg_proxy_rule" {
count = length(data.aws_security_groups.venue_proxy_sg.ids) > 0 ? 1 : 0
security_group_id = aws_security_group.ogc_ingress_sg.id
ip_protocol = "tcp"
from_port = 5001
to_port = 5001
from_port = local.load_balancer_port
to_port = local.load_balancer_port
referenced_security_group_id = data.aws_security_groups.venue_proxy_sg.ids[0]
}

Expand All @@ -268,7 +253,7 @@ resource "kubernetes_ingress_v1" "ogc_processes_api_ingress" {
"alb.ingress.kubernetes.io/scheme" = "internet-facing"
"alb.ingress.kubernetes.io/target-type" = "ip"
"alb.ingress.kubernetes.io/subnets" = join(",", jsondecode(data.aws_ssm_parameter.subnet_ids.value)["public"])
"alb.ingress.kubernetes.io/listen-ports" = "[{\"HTTP\": 5001}]"
"alb.ingress.kubernetes.io/listen-ports" = "[{\"HTTP\": ${local.load_balancer_port}}]"
"alb.ingress.kubernetes.io/security-groups" = aws_security_group.ogc_ingress_sg.id
"alb.ingress.kubernetes.io/healthcheck-path" = "/health"
}
Expand Down

0 comments on commit f6bc00b

Please sign in to comment.