Acmesmith

misc/roll_apps.rb

@@ -6,12 +6,13 @@
   gem 'aws-sdk-ecr'
 end
 
+FILES = %W[k8s/**/*.{j,lib}sonnet tf/**/*.tf]
 REGISTRIES = %w[005216166247]
 TAG_RE = %r{(?<registry>\d+)\.dkr\.ecr\.(?<region>[\w-]+)\.amazonaws\.com/(?<repository>[\w/-]+):\K(?<tag>[0-9a-f]{40})}
 
 @ecr = Hash.new {|h, region| h[region] = Aws::ECR::Client.new(region:) }
 
-Pathname(__dir__).glob('../k8s/**/*.{j,lib}sonnet') do |path|
+Pathname(__dir__).parent.glob(FILES) do |path|
   content = path.read
 
   updated = content.gsub!(TAG_RE) do

tf/acme-responder/ec2.tf

@@ -37,7 +37,6 @@ resource "aws_instance" "acme-responder-apne1c" {
 
   user_data = local.user_data
 
-  associate_public_ip_address = false
   ipv6_addresses = [
     cidrhost(data.aws_subnet.main-public-c.ipv6_cidr_block, 4294945854) # 0xFFFF_AC3E
   ]
@@ -86,7 +85,6 @@ resource "aws_instance" "acme-responder-apne1d" {
 
   user_data = local.user_data
 
-  associate_public_ip_address = false
   ipv6_addresses = [
     cidrhost(data.aws_subnet.main-public-d.ipv6_cidr_block, 4294945854) # 0xFFFF_AC3E
   ]

tf/acmesmith/acmesmith.tf

@@ -0,0 +1,241 @@
+locals {
+  image = "005216166247.dkr.ecr.ap-northeast-1.amazonaws.com/acmesmith:aec356de54ac789e482af0043cdd002b4e5ba9ab"
+
+  hosted_zones = [data.aws_route53_zone.rubykaigi_net]
+  hosted_zone_map = {
+    for z in local.hosted_zones : "${z.name}." => "/hostedzone/${z.zone_id}"
+  }
+}
+
+data "aws_route53_zone" "rubykaigi_net" {
+  name         = "rubykaigi.net."
+  private_zone = false
+}
+
+data "aws_s3_bucket" "rubykaigi-public" {
+  bucket = "rubykaigi-public"
+}
+
+data "external" "letsencrypt-staging" {
+  program = ["${path.module}/../jsonnet.rb"]
+  query = {
+    path = "${path.module}/letsencrypt.jsonnet"
+    args = jsonencode({
+      staging         = true
+      hosted_zone_map = local.hosted_zone_map
+      bucket          = data.aws_s3_bucket.rubykaigi-public.bucket
+    })
+  }
+}
+
+data "external" "letsencrypt" {
+  program = ["${path.module}/../jsonnet.rb"]
+  query = {
+    path = "${path.module}/letsencrypt.jsonnet"
+    args = jsonencode({
+      staging         = false
+      hosted_zone_map = local.hosted_zone_map
+      bucket          = data.aws_s3_bucket.rubykaigi-public.bucket
+    })
+  }
+}
+
+resource "kubernetes_config_map_v1" "letsencrypt-staging" {
+  metadata {
+    name      = "acmesmith-letsencrypt-staging"
+    namespace = "default"
+  }
+  data = {
+    "acmesmith.yml" = data.external.letsencrypt-staging.result.json
+  }
+}
+
+resource "kubernetes_config_map_v1" "letsencrypt" {
+  metadata {
+    name      = "acmesmith-letsencrypt"
+    namespace = "default"
+  }
+  data = {
+    "acmesmith.yml" = data.external.letsencrypt.result.json
+  }
+}
+
+resource "kubernetes_service_account_v1" "acmesmith" {
+  metadata {
+    name      = "acmesmith"
+    namespace = "default"
+    annotations = {
+      "eks.amazonaws.com/role-arn"               = aws_iam_role.acmesmith.arn
+      "eks.amazonaws.com/sts-regional-endpoints" = true
+    }
+  }
+}
+
+resource "kubernetes_role_v1" "acmesmith" {
+  metadata {
+    name      = "acmesmith"
+    namespace = "default"
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["secrets"]
+    verbs      = ["get", "list", "watch", "create", "update", "patch", "delete"]
+  }
+  rule {
+    api_groups = ["apps"]
+    resources  = ["deployments"]
+    verbs      = ["get", "list", "patch", "update"]
+  }
+}
+
+resource "kubernetes_role_binding_v1" "acmesmith" {
+  metadata {
+    name      = "acmesmith"
+    namespace = "default"
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = kubernetes_role_v1.acmesmith.metadata[0].name
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = kubernetes_service_account_v1.acmesmith.metadata[0].name
+    namespace = "default"
+  }
+}
+
+resource "kubernetes_job_v1" "new-account" {
+  for_each = tomap({
+    letsencrypt-staging = kubernetes_config_map_v1.letsencrypt-staging
+    letsencrypt         = kubernetes_config_map_v1.letsencrypt
+  })
+
+  metadata {
+    name      = "acmesmith-new-account-${each.key}"
+    namespace = "default"
+  }
+  spec {
+    template {
+      metadata {}
+      spec {
+        container {
+          name  = "acmesmith"
+          image = local.image
+          args = [
+            "new-account",
+            "-c", "/config/acmesmith/acmesmith.yml",
+            "mailto:info@rubykaigi.org",
+          ]
+          volume_mount {
+            name       = "config"
+            mount_path = "/config/acmesmith"
+            read_only  = true
+          }
+        }
+        volume {
+          name = "config"
+          config_map {
+            name = each.value.metadata[0].name
+          }
+        }
+        service_account_name = kubernetes_service_account_v1.acmesmith.metadata[0].name
+        restart_policy       = "Never"
+      }
+    }
+  }
+
+  wait_for_completion = false
+}
+
+resource "kubernetes_cron_job_v1" "autorenew" {
+  for_each = tomap({
+    letsencrypt-staging = kubernetes_config_map_v1.letsencrypt-staging
+    letsencrypt         = kubernetes_config_map_v1.letsencrypt
+  })
+
+  metadata {
+    name      = "acmesmith-autorenew-${each.key}"
+    namespace = "default"
+  }
+  spec {
+    schedule = "0 * * * *"
+    job_template {
+      metadata {}
+      spec {
+        template {
+          metadata {}
+          spec {
+            container {
+              name  = "acmesmith"
+              image = local.image
+              args = [
+                "autorenew",
+                "-c", "/config/acmesmith/acmesmith.yml",
+                "-r", "1/2",
+              ]
+              volume_mount {
+                name       = "config"
+                mount_path = "/config/acmesmith"
+                read_only  = true
+              }
+            }
+            volume {
+              name = "config"
+              config_map {
+                name = each.value.metadata[0].name
+              }
+            }
+            service_account_name = kubernetes_service_account_v1.acmesmith.metadata[0].name
+            restart_policy       = "Never"
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_job_v1" "order-resolver-rubykaigi-net" {
+  for_each = tomap({
+    letsencrypt = kubernetes_config_map_v1.letsencrypt
+  })
+
+  metadata {
+    name      = "acmesmith-order-resolver-rubykaigi-net-${each.key}"
+    namespace = "default"
+  }
+  spec {
+    template {
+      metadata {}
+      spec {
+        container {
+          name  = "acmesmith"
+          image = local.image
+          args = [
+            "order",
+            "-c", "/config/acmesmith/acmesmith.yml",
+            "--key-type", "ec", "--elliptic-curve", "prime256v1",
+            "resolver.rubykaigi.net",
+            "192.50.220.164", "192.50.220.165",
+            "2001:df0:8500:ca6d:53::0:c", "2001:df0:8500:ca6d:53:0::d",
+          ]
+          volume_mount {
+            name       = "config"
+            mount_path = "/config/acmesmith"
+            read_only  = true
+          }
+        }
+        volume {
+          name = "config"
+          config_map {
+            name = each.value.metadata[0].name
+          }
+        }
+        service_account_name = kubernetes_service_account_v1.acmesmith.metadata[0].name
+        restart_policy       = "Never"
+      }
+    }
+  }
+
+  wait_for_completion = false
+}

tf/acmesmith/aws.tf

@@ -0,0 +1,12 @@
+provider "aws" {
+  region              = "ap-northeast-1"
+  allowed_account_ids = ["005216166247"]
+  default_tags {
+    tags = {
+      Project   = "rk26net"
+      Component = "acmesmith"
+    }
+  }
+}
+
+data "aws_caller_identity" "current" {}

tf/acmesmith/backend.tf

@@ -0,0 +1,17 @@
+terraform {
+  backend "s3" {
+    bucket         = "rk-infra"
+    region         = "ap-northeast-1"
+    key            = "terraform/nw-acmesmith.tfstate"
+    dynamodb_table = "rk-terraform"
+  }
+}
+
+data "terraform_remote_state" "k8s" {
+  backend = "s3"
+  config = {
+    bucket = "rk-infra"
+    region = "ap-northeast-1"
+    key    = "terraform/nw-k8s.tfstate"
+  }
+}

tf/acmesmith/ecr.tf

@@ -0,0 +1,23 @@
+resource "aws_ecr_repository" "acmesmith" {
+  name = "acmesmith"
+}
+
+resource "aws_ecr_lifecycle_policy" "acmesmith" {
+  repository = aws_ecr_repository.acmesmith.name
+  policy = jsonencode({
+    rules = [
+      {
+        rulePriority = 10
+        description  = "expire old images"
+        selection = {
+          tagStatus   = "any"
+          countType   = "imageCountMoreThan"
+          countNumber = 10
+        }
+        action = {
+          type = "expire"
+        }
+      }
+    ]
+  })
+}