Files
nomad/e2e/terraform/compute.tf
Tim Gross cf25cf5cd5 E2E: use a self-hosted Consul for easier WI testing (#20256)
Our `consulcompat` tests exercise both the Workload Identity and legacy Consul
token workflow, but they are limited to running single node tests. The E2E
cluster is network isolated, so using our HCP Consul cluster runs into a
problem validating WI tokens because it can't reach the JWKS endpoint. In real
production environments, you'd solve this with a CNAME pointing to a public IP
pointing to a proxy with a real domain name. But that's logisitcally
impractical for our ephemeral nightly cluster.

Migrate the HCP Consul to a single-node Consul cluster on AWS EC2 alongside our
Nomad cluster. Bootstrap TLS and ACLs in Terraform and ensure all nodes can
reach each other. This will allow us to update our Consul tests so they can use
Workload Identity, in a separate PR.

Ref: #19698
2024-04-02 15:24:51 -04:00

126 lines
3.6 KiB
HCL

# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
locals {
ami_prefix = "nomad-e2e-v3"
}
resource "aws_instance" "server" {
ami = data.aws_ami.ubuntu_jammy_amd64.image_id
instance_type = var.instance_type
key_name = module.keys.key_name
vpc_security_group_ids = [aws_security_group.servers.id] # see also the secondary ENI
count = var.server_count
iam_instance_profile = data.aws_iam_instance_profile.nomad_e2e_cluster.name
availability_zone = var.availability_zone
# Instance tags
tags = {
Name = "${local.random_name}-server-${count.index}"
ConsulAutoJoin = "auto-join-${local.random_name}"
User = data.aws_caller_identity.current.arn
}
}
resource "aws_instance" "client_ubuntu_jammy_amd64" {
ami = data.aws_ami.ubuntu_jammy_amd64.image_id
instance_type = var.instance_type
key_name = module.keys.key_name
vpc_security_group_ids = [aws_security_group.clients.id] # see also the secondary ENI
count = var.client_count_ubuntu_jammy_amd64
iam_instance_profile = data.aws_iam_instance_profile.nomad_e2e_cluster.name
availability_zone = var.availability_zone
# Instance tags
tags = {
Name = "${local.random_name}-client-ubuntu-jammy-amd64-${count.index}"
ConsulAutoJoin = "auto-join-${local.random_name}"
User = data.aws_caller_identity.current.arn
}
}
resource "aws_instance" "client_windows_2016_amd64" {
ami = data.aws_ami.windows_2016_amd64.image_id
instance_type = var.instance_type
key_name = module.keys.key_name
vpc_security_group_ids = [aws_security_group.clients.id]
count = var.client_count_windows_2016_amd64
iam_instance_profile = data.aws_iam_instance_profile.nomad_e2e_cluster.name
availability_zone = var.availability_zone
user_data = file("${path.root}/userdata/windows-2016.ps1")
# Instance tags
tags = {
Name = "${local.random_name}-client-windows-2016-${count.index}"
ConsulAutoJoin = "auto-join-${local.random_name}"
User = data.aws_caller_identity.current.arn
}
}
resource "aws_instance" "consul_server" {
ami = data.aws_ami.ubuntu_jammy_amd64.image_id
instance_type = var.instance_type
key_name = module.keys.key_name
vpc_security_group_ids = [aws_security_group.consul_server.id]
iam_instance_profile = data.aws_iam_instance_profile.nomad_e2e_cluster.name
availability_zone = var.availability_zone
# Instance tags
tags = {
Name = "${local.random_name}-consul-server-ubuntu-jammy-amd64"
ConsulAutoJoin = "auto-join-${local.random_name}"
User = data.aws_caller_identity.current.arn
}
}
data "external" "packer_sha" {
program = ["/bin/sh", "-c", <<EOT
sha=$(git log -n 1 --pretty=format:%H packer)
echo "{\"sha\":\"$${sha}\"}"
EOT
]
}
data "aws_ami" "ubuntu_jammy_amd64" {
most_recent = true
owners = ["self"]
filter {
name = "name"
values = ["${local.ami_prefix}-ubuntu-jammy-amd64-*"]
}
filter {
name = "tag:OS"
values = ["Ubuntu"]
}
filter {
name = "tag:BuilderSha"
values = [data.external.packer_sha.result["sha"]]
}
}
data "aws_ami" "windows_2016_amd64" {
most_recent = true
owners = ["self"]
filter {
name = "name"
values = ["${local.ami_prefix}-windows-2016-amd64-*"]
}
filter {
name = "tag:OS"
values = ["Windows2016"]
}
filter {
name = "tag:BuilderSha"
values = [data.external.packer_sha.result["sha"]]
}
}