Skip to content

Commit d41b12b

Browse files
xshot9011lycbrian
xshot9011
and
lycbrian
authored
feat: support multiple sidecar container (#38)
* feat: support select container to attached lb * fix: error in target group * feat: configuration mem, cpu as task level * feat: secret base on container inside * feat: secret separate by container * fix: secrets typo * fix: code smell and example usage * fix: security issue log group with kms (#39) * feat: add defualt kms with additional override kms * fix: typo * fix: count depends on undetermined resource * fix: fix provider version to 4.65 dua to bug of 4.66 * fix: ref to non created resource --------- Co-authored-by: Brian - oozou <98243528+lycbrian@users.noreply.github.com>
1 parent 7239283 commit d41b12b

13 files changed

+352
-298
lines changed

‎CHANGELOG.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,30 @@
11
# Change Log
22

3+
## [v1.2.0] - 2023-10-11
4+
5+
### Added
6+
7+
- Support custom and built-in module KMS for cloudwatch log group
8+
- resources: `data.aws_iam_policy_document.cloudwatch_log_group_kms_policy`, `module.cloudwatch_log_group_kms`
9+
- variables: `is_create_default_kms`, `cloudwatch_log_group_kms_key_arn`
10+
- Validation condition `local.raise_multiple_container_attach_to_alb`
11+
- New method to create task definition with support multiple container `local.container_task_definitions`
12+
- variables: `container`
13+
- Support for 1 secretManager: N secret
14+
- resources: `aws_secretsmanager_secret.this`, `aws_secretsmanager_secret_version.this`, `aws_iam_role_policy.task_execution_role_access_secret`
15+
16+
### Changed
17+
18+
- Update example of simple usage `examples/simple/main.tf`, `examples/simple/versions.tf` and `examples/simple/outputs.tf`
19+
20+
### Removed
21+
22+
- Non-used module level validation `local.raise_vpc_id_empty`, `local.raise_service_port_empty`, `local.raise_health_check_empty` and `local.raise_alb_listener_arn_empty`
23+
- Remove all previous method to construct the task definition for ECS
24+
- Remove all secrets usage 1 key : 1 secret; use 1 secret in JSON form
25+
- resources: `aws_secretsmanager_secret.service_secrets`, `aws_secretsmanager_secret_version.service_secrets`, `aws_iam_role_policy.task_execution_secrets`
26+
- Remove unused variables `is_attach_service_with_lb`, `service_info`, `apm_sidecar_ecr_url`, `apm_config`. `unix_max_connection`, `entry_point` and `command`
27+
328
## [v1.1.12] - 2023-01-23
429

530
### Added

‎SECURITY.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,4 @@ Your can also report the vulnerabilities by emailing to Oozou DevOps team at:
2020
devops@oozou.com
2121
```
2222

23-
We will acknowledge your email within 72 hours on workday, and will send a more details response within 5 days. After the initial email start, we will investigate the security issue snd fix it as soon as possible.
23+
We will acknowledge your email within 72 hours on workday, and will send a more details response within 5 days. After the initial email start, we will investigate the security issue snd fix it as soon as possible.

‎examples/simple/main.tf

Lines changed: 146 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
data "aws_caller_identity" "this" {}
2-
data "aws_region" "this" {}
2+
3+
locals {
4+
name = format("%s-%s-%s", var.prefix, var.environment, var.name)
5+
}
36

47
/* -------------------------------------------------------------------------- */
58
/* VPC */
@@ -69,72 +72,182 @@ module "fargate_cluster" {
6972
/* -------------------------------------------------------------------------- */
7073
/* Service */
7174
/* -------------------------------------------------------------------------- */
72-
module "service_api" {
75+
module "api_service" {
7376
source = "../.."
7477

75-
# Generics
7678
prefix = var.prefix
7779
environment = var.environment
78-
name = format("%s-service-api", var.name)
80+
name = format("%s-api-service", var.name)
7981

80-
# IAM Role
81-
is_create_iam_role = true
82+
# ECS service
83+
task_cpu = 1024
84+
task_memory = 2048
85+
ecs_cluster_name = module.fargate_cluster.ecs_cluster_name
86+
service_discovery_namespace = module.fargate_cluster.service_discovery_namespace
87+
is_enable_execute_command = true
88+
application_subnet_ids = module.vpc.private_subnet_ids
89+
security_groups = [
90+
module.fargate_cluster.ecs_task_security_group_id
91+
]
8292
additional_ecs_task_role_policy_arns = [
8393
"arn:aws:iam::aws:policy/AmazonSSMFullAccess"
8494
]
8595

8696
# ALB
87-
is_attach_service_with_lb = true
88-
alb_listener_arn = module.fargate_cluster.alb_listener_http_arn
89-
alb_host_header = null
90-
alb_paths = ["/*"]
91-
alb_priority = "100"
92-
vpc_id = module.vpc.vpc_id
97+
alb_listener_arn = module.fargate_cluster.alb_listener_http_arn
98+
alb_host_header = null
99+
alb_paths = ["/*"]
100+
alb_priority = "100"
101+
vpc_id = module.vpc.vpc_id
93102
health_check = {
94103
interval = 20,
95-
path = "/",
104+
path = "",
96105
timeout = 10,
97106
healthy_threshold = 3,
98107
unhealthy_threshold = 3,
99108
matcher = "200,201,204"
100109
}
101110

102-
# Logging
103111
is_create_cloudwatch_log_group = true
104112

105-
# Task definition
106-
service_info = {
107-
cpu_allocation = 256,
108-
mem_allocation = 512,
109-
port = 80,
110-
image = "nginx"
111-
mount_points = []
113+
container = {
114+
main_container = {
115+
name = format("%s-api-service", local.name)
116+
image = "nginx"
117+
cpu = 128
118+
memory = 256
119+
is_attach_to_lb = true
120+
port_mappings = [
121+
{
122+
# If a container has multiple ports, index 0 will be used for target group
123+
host_port = 80
124+
container_port = 80
125+
protocol = "tcp"
126+
}
127+
]
128+
entry_point = []
129+
command = []
130+
}
131+
side_container = {
132+
name = format("%s-nginx", local.name)
133+
image = "tutum/dnsutils"
134+
cpu = 128
135+
memory = 256
136+
port_mappings = [
137+
{
138+
host_port = 443
139+
container_port = 443
140+
protocol = "tcp"
141+
},
142+
]
143+
}
112144
}
113-
is_application_scratch_volume_enabled = true
114-
115-
# Secret and Env
116145
environment_variables = {
117-
THIS_IS_ENV = "ENV1",
118-
THIS_IS_ENVV = "ENVV",
146+
main_container = {
147+
THIS_IS_ENV = "ENV1",
148+
THIS_IS_ENVV = "ENVV",
149+
}
150+
side_container = {
151+
XXXX = "XXXX",
152+
XXXXX = "XXXXX",
153+
}
119154
}
120-
# WARNING Secret should not be in plain text
121155
secret_variables = {
122-
THIS_IS_SECRET = "1xxxxx",
123-
THIS_IS_SECRETT = "2xxxxx",
124-
THIS_IS_SECRETTT = "3xxxxx",
125-
THIS_IS_SECRETTTTT = "4xxxxx",
126-
THIS_IS_SECRETTTTTT = "5xxxxx",
127-
THIS_IS_SECRETTTTTTT = "6xxxxx",
156+
main_container = {
157+
THIS_IS_SECRET = "1xxxxx",
158+
THIS_IS_SECRETT = "2xxxxx",
159+
}
128160
}
129161

162+
tags = var.custom_tags
163+
}
164+
165+
module "payment_service" {
166+
source = "../.."
167+
168+
prefix = var.prefix
169+
environment = var.environment
170+
name = format("%s-api-service", var.name)
171+
130172
# ECS service
173+
task_cpu = 1024
174+
task_memory = 2048
131175
ecs_cluster_name = module.fargate_cluster.ecs_cluster_name
132176
service_discovery_namespace = module.fargate_cluster.service_discovery_namespace
133177
is_enable_execute_command = true
134178
application_subnet_ids = module.vpc.private_subnet_ids
135179
security_groups = [
136180
module.fargate_cluster.ecs_task_security_group_id
137181
]
182+
additional_ecs_task_role_policy_arns = [
183+
"arn:aws:iam::aws:policy/AmazonSSMFullAccess"
184+
]
185+
186+
# ALB
187+
alb_listener_arn = module.fargate_cluster.alb_listener_http_arn
188+
alb_host_header = null
189+
alb_paths = ["/*"]
190+
alb_priority = "100"
191+
vpc_id = module.vpc.vpc_id
192+
health_check = {
193+
interval = 20,
194+
path = "",
195+
timeout = 10,
196+
healthy_threshold = 3,
197+
unhealthy_threshold = 3,
198+
matcher = "200,201,204"
199+
}
200+
201+
is_create_cloudwatch_log_group = true
202+
203+
container = {
204+
main_container = {
205+
name = format("%s-api-service", local.name)
206+
image = "nginx"
207+
cpu = 128
208+
memory = 256
209+
is_attach_to_lb = true
210+
port_mappings = [
211+
{
212+
# If a container has multiple ports, index 0 will be used for target group
213+
host_port = 80
214+
container_port = 80
215+
protocol = "tcp"
216+
}
217+
]
218+
entry_point = []
219+
command = []
220+
}
221+
side_container = {
222+
name = format("%s-nginx", local.name)
223+
image = "tutum/dnsutils"
224+
cpu = 128
225+
memory = 256
226+
port_mappings = [
227+
{
228+
host_port = 443
229+
container_port = 443
230+
protocol = "tcp"
231+
},
232+
]
233+
}
234+
}
235+
environment_variables = {
236+
main_container = {
237+
THIS_IS_ENV = "ENV1",
238+
THIS_IS_ENVV = "ENVV",
239+
}
240+
side_container = {
241+
XXXX = "XXXX",
242+
XXXXX = "XXXXX",
243+
}
244+
}
245+
secret_variables = {
246+
main_container = {
247+
THIS_IS_SECRET = "1xxxxx",
248+
THIS_IS_SECRETT = "2xxxxx",
249+
}
250+
}
138251

139252
tags = var.custom_tags
140253
}

‎examples/simple/outputs.tf

Whitespace-only changes.

‎examples/simple/versions.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 1.0.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 4.0.0, < 5.0.0"
8+
}
9+
random = {
10+
source = "hashicorp/random"
11+
version = ">= 2.3.0"
12+
}
13+
}
14+
}

0 commit comments

Comments
 (0)