Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add IPv6 support #44

Merged
merged 20 commits into from
Apr 19, 2024
Merged

Add IPv6 support #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
c0bebe5
Add IPv6 support
hellais Apr 17, 2024
45e6908
Assign an IPv6 address to the ECS clusters
hellais Apr 17, 2024
20a122e
Allow ipv6 egress traffic from sg
hellais Apr 17, 2024
e213733
Update sg
hellais Apr 17, 2024
53ff155
Enable egress only IPv6 route
hellais Apr 17, 2024
565cc22
Add 4.th
hellais Apr 17, 2024
c70a21c
Switch to network mode awsvpc
hellais Apr 17, 2024
b4d355a
AWS uses different notation for /0 of ipv6
hellais Apr 17, 2024
82606fa
WIP on IPv6 support in the container
hellais Apr 17, 2024
f10966a
Fix networking configuration
hellais Apr 18, 2024
d5007f5
WIP
hellais Apr 18, 2024
f8ffff7
Add security group for service
hellais Apr 19, 2024
42e3e07
Add security group to th service
hellais Apr 19, 2024
25bd5ac
Fix security group definition
hellais Apr 19, 2024
2f0018c
Refactoring of networking into private and public subnets
hellais Apr 19, 2024
5965570
Apply subnet refactoring to prod env
hellais Apr 19, 2024
b9e26b7
Tweaks to tasks and networking
hellais Apr 19, 2024
b4beb20
Fix NAT configuration and properly set Name tags
hellais Apr 19, 2024
fe4cfa9
Tweak ASGs
hellais Apr 19, 2024
be13598
Drop moved blocks
hellais Apr 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 20 additions & 16 deletions tf/environments/dev/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ module "oonipg" {
name = "ooni-tier0-postgres"
aws_region = var.aws_region
vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id
db_instance_class = "db.t3.micro"
db_storage_type = "standard"
db_allocated_storage = "5"
Expand Down Expand Up @@ -251,7 +251,7 @@ module "ooni_backendproxy" {
source = "../../modules/ooni_backendproxy"

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id

key_name = module.adm_iam_roles.oonidevops_key_name
instance_type = "t2.micro"
Expand All @@ -270,7 +270,7 @@ module "ooniapi_cluster" {
name = "ooniapi-ecs-cluster"
key_name = module.adm_iam_roles.oonidevops_key_name
vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id

asg_min = 2
asg_max = 6
Expand All @@ -290,11 +290,11 @@ module "oonith_cluster" {
name = "oonith-ecs-cluster"
key_name = module.adm_iam_roles.oonidevops_key_name
vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id

asg_min = 2
asg_max = 6
asg_desired = 2
asg_min = 1
asg_max = 4
asg_desired = 1

instance_type = "t2.small"

Expand Down Expand Up @@ -329,8 +329,9 @@ module "ooniapi_ooniprobe" {
# First run should be set on first run to bootstrap the task definition
# first_run = true

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
vpc_id = module.network.vpc_id
public_subnet_ids = module.network.vpc_subnet_public[*].id
private_subnet_ids = module.network.vpc_subnet_private[*].id

service_name = "ooniprobe"
default_docker_image_url = "ooni/api-ooniprobe:latest"
Expand Down Expand Up @@ -376,8 +377,9 @@ module "ooniapi_oonirun_deployer" {
module "ooniapi_oonirun" {
source = "../../modules/ooniapi_service"

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
vpc_id = module.network.vpc_id
public_subnet_ids = module.network.vpc_subnet_public[*].id
private_subnet_ids = module.network.vpc_subnet_private[*].id

service_name = "oonirun"
default_docker_image_url = "ooni/api-oonirun:latest"
Expand Down Expand Up @@ -422,8 +424,9 @@ module "ooniapi_ooniauth_deployer" {
module "ooniapi_ooniauth" {
source = "../../modules/ooniapi_service"

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
vpc_id = module.network.vpc_id
public_subnet_ids = module.network.vpc_subnet_public[*].id
private_subnet_ids = module.network.vpc_subnet_private[*].id

service_name = "ooniauth"
default_docker_image_url = "ooni/api-ooniauth:latest"
Expand Down Expand Up @@ -473,7 +476,7 @@ module "ooniapi_frontend" {
source = "../../modules/ooniapi_frontend"

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id

oonibackend_proxy_target_group_arn = module.ooni_backendproxy.alb_target_group_id
ooniapi_oonirun_target_group_arn = module.ooniapi_oonirun.alb_target_group_id
Expand Down Expand Up @@ -513,8 +516,9 @@ module "oonith_oohelperd_deployer" {
module "oonith_oohelperd" {
source = "../../modules/oonith_service"

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
vpc_id = module.network.vpc_id
public_subnet_ids = module.network.vpc_subnet_public[*].id
private_subnet_ids = module.network.vpc_subnet_private[*].id

service_name = "oohelperd"
default_docker_image_url = "ooni/oonith-oohelperd:latest"
Expand Down
45 changes: 29 additions & 16 deletions tf/environments/prod/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ module "oonipg" {
name = "ooni-tier0-postgres"
aws_region = var.aws_region
vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id
db_instance_class = "db.t3.micro"
db_storage_type = "standard"
db_allocated_storage = "5"
Expand Down Expand Up @@ -256,7 +256,7 @@ module "ooni_backendproxy" {
source = "../../modules/ooni_backendproxy"

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id

key_name = module.adm_iam_roles.oonidevops_key_name
instance_type = "t2.micro"
Expand All @@ -275,11 +275,11 @@ module "ooniapi_cluster" {
name = "ooniapi-ecs-cluster"
key_name = module.adm_iam_roles.oonidevops_key_name
vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id

asg_min = 2
asg_max = 6
asg_desired = 2
asg_min = 3
asg_max = 8
asg_desired = 3

instance_type = "t2.small"

Expand All @@ -295,7 +295,7 @@ module "oonith_cluster" {
name = "oonith-ecs-cluster"
key_name = module.adm_iam_roles.oonidevops_key_name
vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id

asg_min = 2
asg_max = 6
Expand Down Expand Up @@ -334,8 +334,9 @@ module "ooniapi_ooniprobe" {
# First run should be set on first run to bootstrap the task definition
#first_run = true

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
vpc_id = module.network.vpc_id
private_subnet_ids = module.network.vpc_subnet_private[*].id
public_subnet_ids = module.network.vpc_subnet_public[*].id

service_name = "ooniprobe"
default_docker_image_url = "ooni/api-ooniprobe:latest"
Expand All @@ -344,6 +345,8 @@ module "ooniapi_ooniprobe" {
key_name = module.adm_iam_roles.oonidevops_key_name
ecs_cluster_id = module.ooniapi_cluster.cluster_id

service_desired_count = 2

task_secrets = {
POSTGRESQL_URL = aws_secretsmanager_secret_version.oonipg_url.arn
JWT_ENCRYPTION_KEY = aws_secretsmanager_secret_version.jwt_secret.arn
Expand Down Expand Up @@ -382,8 +385,9 @@ module "ooniapi_oonirun" {
source = "../../modules/ooniapi_service"
#first_run = true

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
vpc_id = module.network.vpc_id
private_subnet_ids = module.network.vpc_subnet_private[*].id
public_subnet_ids = module.network.vpc_subnet_public[*].id

service_name = "oonirun"
default_docker_image_url = "ooni/api-oonirun:latest"
Expand All @@ -392,6 +396,8 @@ module "ooniapi_oonirun" {
key_name = module.adm_iam_roles.oonidevops_key_name
ecs_cluster_id = module.ooniapi_cluster.cluster_id

service_desired_count = 2

task_secrets = {
POSTGRESQL_URL = aws_secretsmanager_secret_version.oonipg_url.arn
JWT_ENCRYPTION_KEY = aws_secretsmanager_secret_version.jwt_secret.arn
Expand Down Expand Up @@ -429,8 +435,9 @@ module "ooniapi_ooniauth" {
source = "../../modules/ooniapi_service"
#first_run = true

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
vpc_id = module.network.vpc_id
private_subnet_ids = module.network.vpc_subnet_private[*].id
public_subnet_ids = module.network.vpc_subnet_public[*].id

service_name = "ooniauth"
default_docker_image_url = "ooni/api-ooniauth:latest"
Expand All @@ -439,6 +446,8 @@ module "ooniapi_ooniauth" {
key_name = module.adm_iam_roles.oonidevops_key_name
ecs_cluster_id = module.ooniapi_cluster.cluster_id

service_desired_count = 2

task_secrets = {
POSTGRESQL_URL = aws_secretsmanager_secret_version.oonipg_url.arn
JWT_ENCRYPTION_KEY = aws_secretsmanager_secret_version.jwt_secret.arn
Expand Down Expand Up @@ -480,7 +489,7 @@ module "ooniapi_frontend" {
source = "../../modules/ooniapi_frontend"

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
subnet_ids = module.network.vpc_subnet_public[*].id

oonibackend_proxy_target_group_arn = module.ooni_backendproxy.alb_target_group_id
ooniapi_oonirun_target_group_arn = module.ooniapi_oonirun.alb_target_group_id
Expand Down Expand Up @@ -521,8 +530,9 @@ module "oonith_oohelperd" {
source = "../../modules/oonith_service"
#first_run = true

vpc_id = module.network.vpc_id
subnet_ids = module.network.vpc_subnet[*].id
vpc_id = module.network.vpc_id
private_subnet_ids = module.network.vpc_subnet_private[*].id
public_subnet_ids = module.network.vpc_subnet_public[*].id

service_name = "oohelperd"
default_docker_image_url = "ooni/oonith-oohelperd:latest"
Expand All @@ -531,11 +541,14 @@ module "oonith_oohelperd" {
key_name = module.adm_iam_roles.oonidevops_key_name
ecs_cluster_id = module.oonith_cluster.cluster_id

service_desired_count = 2

task_secrets = {
PROMETHEUS_METRICS_PASSWORD = aws_secretsmanager_secret_version.prometheus_metrics_password.arn
}

alternative_names = {
"4.th.ooni.org" = local.dns_root_zone_ooni_org,
"5.th.ooni.org" = local.dns_root_zone_ooni_org,
"6.th.ooni.org" = local.dns_root_zone_ooni_org,
}
Expand Down
11 changes: 7 additions & 4 deletions tf/modules/ecs_cluster/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ resource "aws_security_group" "web" {
cidr_blocks = [
"0.0.0.0/0",
]
ipv6_cidr_blocks = ["::/0"]
}

tags = var.tags
Expand Down Expand Up @@ -116,10 +117,11 @@ resource "aws_security_group" "container_host" {
}

egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
ipv6_cidr_blocks = ["::/0"]
}

tags = var.tags
Expand Down Expand Up @@ -147,6 +149,7 @@ resource "aws_launch_template" "container_host" {
network_interfaces {
associate_public_ip_address = true
delete_on_termination = true
ipv6_address_count = 1
security_groups = [
aws_security_group.container_host.id,
]
Expand Down
10 changes: 8 additions & 2 deletions tf/modules/ecs_cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ variable "vpc_id" {

variable "subnet_ids" {
description = "the ids of the subnet of the subnets to deploy the instance into"
type = list(string)
}

variable "tags" {
Expand All @@ -30,13 +31,18 @@ variable "name" {
}

variable "asg_min" {
description = "Min numbers of servers in ASG"
description = <<EOT
Min numbers of servers in ASG. Keep in mind the ENI restrictions,
where small-large have a limit of 3 and micro has a limit of 2.
This means that if you plan to run 3 tasks in the ECS cluster with a task count of 2,
you need a minimum of 3 in the ASG
EOT
default = 1
}

variable "asg_max" {
description = "Max numbers of servers in ASG"
default = 4
default = 6
}

variable "asg_desired" {
Expand Down
Loading
Loading