icurfer/terraform-demo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

route53 add

Browse Source
This commit is contained in:
Seong-dong 2023-01-11 20:21:43 +09:00
parent c96cac92b9
commit e9c35f55b5
11 changed files with 143 additions and 227 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
modules/route53-record/main.tf Normal file
View File

@ -0,0 +1,20 @@
resource "aws_route53_record" "default" {
count = var.type_alias ? 0 : 1
zone_id = var.zone_id
name = var.prefix
type = var.type
ttl = var.ttl
records = var.record_list
}
resource "aws_route53_record" "alias" {
count = var.type_alias ? 1 : 0
zone_id = var.zone_id
name = var.name
type = var.type
ttl = var.ttl
records = var.record_list
}

0
modules/route53-record/outputs.tf Normal file
View File

20
modules/route53-record/variables.tf Normal file
View File

@ -0,0 +1,20 @@
variable "zone_id" {
description = "set host-zone id"
type = string
}
variable "prefix" {
description = "set host-zone id"
type = string
}
variable "type" {
description = "set host-zone id"
type = string
}
variable "ttl" {
description = "set host-zone id"
type = string
}
variable "record_list" {
description = "set host-zone id"
type = list(string)
}

8
modules/route53/main.tf
View File

@ -1,9 +1,5 @@
resource "aws_route53_zone" "primary" { resource "aws_route53_zone" "primary" {
name = var.name name = var.name
comment = "hq-dns-server"
//public 이면 vpc 불필요
count = var.public ? 0 : 1
vpc {
vpc_id = var.vpc_id
}
} }

5
modules/route53/outputs.tf
View File

@ -1,3 +1,4 @@
output "id" { output "zone_id" {
value = aws_route53_zone.primary.id value = aws_route53_zone.primary.zone_id
} }

10
modules/route53/variables.tf
View File

@ -2,13 +2,3 @@ variable "name" {
description = "route53 name" description = "route53 name"
type = string type = string
} }
variable "public" {
description = "route53 name"
type = bool
}
variable "vpc_id" {
description = "vpc_id"
type = string
}

10
prod-hq-dns/.terraform.lock.hcl Normal file
View File

@ -0,0 +1,10 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/aws" {
version = "4.49.0"
constraints = "~> 4.0"
hashes = [
"h1:HxPUxrHpAJey832OwVk3J2T7lHpRzMavqjXDzaFyM6I=",
]
}

206
prod-hq-dns/main.tf
View File

@ -1,15 +1,16 @@
// prod - main // prod - dev
provider "aws" { provider "aws" {
region = "ap-northeast-2" region = "ap-northeast-2"
profile = "22shop"
#2.x버전의 AWS공급자 허용 shared_credentials_file = "C:/Users/aa/.aws/credentials"
version = "~> 3.0" #4.x버전의 AWS공급자 허용
version = "~> 4.0"
} }
locals { locals {
vpc_id = data.terraform_remote_state.hq_vpc_id.outputs.vpc_id vpc_id = data.terraform_remote_state.hq_vpc_id.outputs.vpc_id
public_subnet = data.terraform_remote_state.hq_vpc_id.outputs.subnet
common_tags = { common_tags = {
project = "22shop" project = "22shop"
owner = "icurfer" owner = "icurfer"
@ -42,192 +43,35 @@ locals {
// GET 계정정보 // GET 계정정보
data "aws_caller_identity" "this" {} data "aws_caller_identity" "this" {}
// eks를 위한 iam역할 생성 데이터 조회 locals {
data "aws_iam_policy_document" "eks-assume-role-policy" { dns_name = "ddochi.ml"
statement {
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["eks.amazonaws.com"]
}
}
} }
data "aws_iam_policy_document" "eks_node_group_role" {
statement {
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["ec2.amazonaws.com"]
}
}
}
// 테라폼클라우드 // 테라폼클라우드
data "terraform_remote_state" "hq_vpc_id" { data "terraform_remote_state" "hq_vpc_id" {
backend = "remote" backend = "remote"
config = { config = {
organization = "icurfer" organization = "22shop"
workspaces = { workspaces = {
name = "tf-22shop-network" name = "hq-network"
} }
} }
} }
// eks 클러스터 역할 생성 module "rote53" {
module "eks_cluster_iam" { source = "../modules/route53"
source = "../modules/iam" name = local.dns_name
iam_name = "eks-cluster-test"
policy = data.aws_iam_policy_document.eks-assume-role-policy.json
tag_name = local.common_tags.project
} }
// eks 클러스터 역할 정책 추가 resource "aws_route53_record" "www" {
module "eks_cluster_iam_att" { zone_id = module.rote53.zone_id
source = "../modules/iam-policy-attach" name = "hq.ddochi.ml"
iam_name = "eks-cluster-att" type = "A"
role_name = module.eks_cluster_iam.iam_name
arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
depends_on = [ alias {
module.eks_cluster_iam name = "k8s-22shopekscluster-42f56c4a0b-158144463.ap-northeast-2.elb.amazonaws.com"
] zone_id = "ZWKZPGTI48KDX"
} evaluate_target_health = true
module "eks_cluster_iam_att2" { }
source = "../modules/iam-policy-attach" }
iam_name = "eks-cluster-att"
role_name = module.eks_cluster_iam.iam_name
arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
depends_on = [
module.eks_cluster_iam
]
}
// eks 노드그룹 역할 생성 및 추가
module "eks_nodegroup_iam" {
source = "../modules/iam"
iam_name = "eks-nodegroup-test"
policy = data.aws_iam_policy_document.eks_node_group_role.json
tag_name = local.common_tags.project
}
module "eks_nodegroup_iam_att_1" {
source = "../modules/iam-policy-attach"
iam_name = "eks-nodegroup-att"
role_name = module.eks_nodegroup_iam.iam_name
arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
depends_on = [
module.eks_nodegroup_iam
]
}
module "eks_nodegroup_iam_att_2" {
source = "../modules/iam-policy-attach"
iam_name = "eks-nodegroup-att"
role_name = module.eks_nodegroup_iam.iam_name
arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
depends_on = [
module.eks_nodegroup_iam
]
}
module "eks_nodegroup_iam_att_3" {
source = "../modules/iam-policy-attach"
iam_name = "eks-nodegroup-att"
role_name = module.eks_nodegroup_iam.iam_name
arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
depends_on = [
module.eks_nodegroup_iam
]
}
// 보안그룹 생성
module "eks_sg" {
source = "../modules/sg"
sg_name = "${local.common_tags.project}-sg"
# vpc_id = module.vpc_hq.vpc_hq_id
vpc_id = local.vpc_id
}
module "eks_sg_ingress_http" {
for_each = local.tcp_port
source = "../modules/sg-rule-add"
type = "ingress"
from_port = each.value
to_port = each.value
protocol = local.tcp_protocol
cidr_blocks = local.all_ips
security_group_id = module.eks_sg.sg_id
tag_name = each.key
}
module "eks_sg_egress_all" {
source = "../modules/sg-rule-add"
type = "egress"
from_port = local.any_protocol
to_port = local.any_protocol
protocol = local.any_protocol
cidr_blocks = local.all_ips
security_group_id = module.eks_sg.sg_id
tag_name = "egress-all"
}
module "eks_cluster" {
source = "../modules/eks-cluster"
name = local.common_tags.project
iam_role_arn = module.eks_cluster_iam.iam_arn
sg_list = [module.eks_sg.sg_id]
# subnet_list = [module.subnet_public.subnet.zone-a.id, module.subnet_public.subnet.zone-c.id] #변경해야될수있음.
subnet_list = [local.public_subnet.zone-a.id, local.public_subnet.zone-c.id]
depends_on = [
module.eks_cluster_iam,
module.eks_sg,
]
client_id = data.aws_caller_identity.this.id
}
module "eks_node_group" {
source = "../modules/eks-node-group"
node_group_name = "${local.common_tags.project}-ng"
cluster_name = module.eks_cluster.cluster_name
# iam_role_arn = module.eks_nodegroup_iam.iam_arn
iam_role_arn = "arn:aws:iam::448559955338:role/eks-nodegroup-test"
# subnet_list = [module.subnet_public.subnet.zone-a.id, module.subnet_public.subnet.zone-c.id] #변경해야될수있음.
subnet_list = [local.public_subnet.zone-a.id, local.public_subnet.zone-c.id]
desired_size = local.node_group_scaling_config.desired_size
max_size = local.node_group_scaling_config.max_size
min_size = local.node_group_scaling_config.min_size
depends_on = [
module.eks_nodegroup_iam,
module.eks_cluster,
]
}
module "ng_sg_ingress_http" {
# for_each = local.tcp_port
source = "../modules/sg-rule-add"
type = "ingress"
from_port = "2049"
to_port = "2049"
protocol = local.tcp_protocol
cidr_blocks = local.all_ips
security_group_id = module.eks_node_group.ng_sg
tag_name = "ng_sg_sub"
depends_on = [
module.eks_node_group
]
}

13
prod-hq-dns/outputs.tf
View File

@ -1,13 +1,8 @@
//main-outputs //main-outputs
output "aws_id" { # output "aws_id" {
description = "The AWS Account ID." # description = "The AWS Account ID."
value = data.aws_caller_identity.this.account_id # value = data.aws_caller_identity.this.account_id
} # }
output "ng_sg" {
description = "Identifier of the remote access EC2 Security Group."
value = module.eks_node_group.ng_sg
}
# output "cluster_oidc" { # output "cluster_oidc" {
# description = "eks_cluster_identity" # description = "eks_cluster_identity"
# value = module.eks_cluster.cluster_oidc # value = module.eks_cluster.cluster_oidc

4
prod-hq-dns/terraform.tf
View File

@ -1,10 +1,10 @@
terraform { terraform {
backend "remote"{ backend "remote"{
hostname = "app.terraform.io" hostname = "app.terraform.io"
organization = "icurfer" organization = "22shop"
workspaces { workspaces {
name = "tf-cloud-dns" name = "hq-dns"
} }
} }
} }

74
prod-hq-network/main.tf
View File

@ -15,11 +15,13 @@ locals {
owner = "icurfer" owner = "icurfer"
} }
cidr = { cidr = {
vpc = "10.3.0.0/16" vpc = "10.3.0.0/16"
zone_a = "10.3.1.0/24" zone_a = "10.3.1.0/24"
zone_c = "10.3.3.0/24" zone_c = "10.3.3.0/24"
zone_a_private = "10.3.2.0/24" zone_a_private = "10.3.2.0/24"
zone_c_private = "10.3.4.0/24" zone_c_private = "10.3.4.0/24"
zone_a_tgw = "10.3.5.0/24"
zone_c_tgw = "10.3.6.0/24"
} }
tcp_port = { tcp_port = {
any_port = 0 any_port = 0
@ -114,7 +116,7 @@ module "vpc_igw" {
module "subnet_public" { module "subnet_public" {
source = "../modules/vpc-subnet" source = "../modules/vpc-subnet"
vpc_id = module.vpc_hq.vpc_hq_id vpc_id = module.vpc_hq.vpc_hq_id
subnet-az-list = { subnet-az-list = {
"zone-a" = { "zone-a" = {
name = "${local.region}a" name = "${local.region}a"
@ -125,16 +127,16 @@ module "subnet_public" {
cidr = local.cidr.zone_c cidr = local.cidr.zone_c
} }
} }
public_ip_on = true public_ip_on = true
# vpc_name = "${local.common_tags.project}-public" # vpc_name = "${local.common_tags.project}-public"
#alb-ingress 생성을 위해 지정 #alb-ingress 생성을 위해 지정
k8s_ingress = true k8s_ingress = true
# vpc_name = local.eks_ingress_type.public # vpc_name = local.eks_ingress_type.public
vpc_name = local.eks_ingress_type.private vpc_name = local.eks_ingress_type.private
} }
// private외부통신을 위한 nat // private외부통신을 위한 nat
module "nat_gw" { module "nat_gw" {
source = "../modules/nat-gateway" source = "../modules/nat-gateway"
subnet_id = module.subnet_public.subnet.zone-a.id subnet_id = module.subnet_public.subnet.zone-a.id
depends_on = [ depends_on = [
@ -151,10 +153,10 @@ module "route_public" {
} }
module "route_add" { module "route_add" {
source = "../modules/route-add" source = "../modules/route-add"
route_id = module.route_public.route_id route_id = module.route_public.route_id
igw_id = module.vpc_igw.igw_id igw_id = module.vpc_igw.igw_id
gw_type = "igw" gw_type = "igw"
} }
module "route_association" { module "route_association" {
@ -170,7 +172,7 @@ module "route_association" {
module "subnet_private" { module "subnet_private" {
source = "../modules/vpc-subnet" source = "../modules/vpc-subnet"
vpc_id = module.vpc_hq.vpc_hq_id vpc_id = module.vpc_hq.vpc_hq_id
subnet-az-list = { subnet-az-list = {
"zone-a" = { "zone-a" = {
name = "${local.region}a" name = "${local.region}a"
@ -181,11 +183,11 @@ module "subnet_private" {
cidr = local.cidr.zone_c_private cidr = local.cidr.zone_c_private
} }
} }
public_ip_on = false public_ip_on = false
# vpc_name = "${local.common_tags.project}-public" # vpc_name = "${local.common_tags.project}-public"
#alb-ingress 생성을 위해 지정 #alb-ingress 생성을 위해 지정
k8s_ingress = false k8s_ingress = false
vpc_name = "null" vpc_name = "null"
} }
// private route // private route
@ -196,10 +198,10 @@ module "route_private" {
} }
module "route_add_nat" { module "route_add_nat" {
source = "../modules/route-add" source = "../modules/route-add"
route_id = module.route_private.route_id route_id = module.route_private.route_id
nat_id = module.nat_gw.nat_id nat_id = module.nat_gw.nat_id
gw_type = "nat" gw_type = "nat"
} }
module "route_association_nat" { module "route_association_nat" {
source = "../modules/route-association" source = "../modules/route-association"
@ -208,3 +210,41 @@ module "route_association_nat" {
association_count = 2 association_count = 2
subnet_ids = [module.subnet_private.subnet.zone-a.id, module.subnet_private.subnet.zone-c.id] subnet_ids = [module.subnet_private.subnet.zone-a.id, module.subnet_private.subnet.zone-c.id]
} }
#----------------------------------------------------------------------------------------------------#
######################################################################################################
#----------------------------------------------------------------------------------------------------#
//tgw-subnet
module "subnet_private_tgw" {
source = "../modules/vpc-subnet"
vpc_id = module.vpc_hq.vpc_hq_id
subnet-az-list = {
"zone-a" = {
name = "${local.region}a"
cidr = local.cidr.zone_a_tgw
}
"zone-c" = {
name = "${local.region}c"
cidr = local.cidr.zone_c_tgw
}
}
public_ip_on = false
# vpc_name = "${local.common_tags.project}-public"
#alb-ingress 생성을 위해 지정
k8s_ingress = false
vpc_name = "null"
}
// private route
module "route_private_tgw" {
source = "../modules/route-table"
tag_name = "${local.common_tags.project}-private_tbl_tgw"
vpc_id = module.vpc_hq.vpc_hq_id
}
module "route_association_tgw" {
source = "../modules/route-association"
route_table_id = module.route_private_tgw.route_id
association_count = 2
subnet_ids = [module.subnet_private_tgw.subnet.zone-a.id, module.subnet_private_tgw.subnet.zone-c.id]
}