Merge pull request #95 from sixfeetup/nvernooy/67-cloudfront

Add cloudfront CDN

{{cookiecutter.project_slug}}/terraform/modules/application/acm.tf

@@ -0,0 +1,21 @@
+resource "aws_acm_certificate" "cert" {
+  domain_name       = var.domain
+  validation_method = "DNS"
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "aws_route53_record" "cert" {
+  name     = tolist(aws_acm_certificate.cert.domain_validation_options)[0].resource_record_name
+  type     = tolist(aws_acm_certificate.cert.domain_validation_options)[0].resource_record_type
+  zone_id  = data.aws_route53_zone.route_zone.id
+  records  = [tolist(aws_acm_certificate.cert.domain_validation_options)[0].resource_record_value]
+  ttl      = 300
+}
+
+resource "aws_acm_certificate_validation" "cert" {
+  certificate_arn         = aws_acm_certificate.cert.arn
+  validation_record_fqdns = aws_route53_record.cert.*.fqdn
+}

{{cookiecutter.project_slug}}/terraform/modules/application/cloudfront.tf

@@ -1,3 +1,72 @@
 resource "aws_cloudfront_origin_access_identity" "static_storage" {
   comment = "${var.application}-${var.environment}"
 }
+
+resource "aws_cloudfront_distribution" "ec2_cluster" {
+  enabled             = true
+  aliases             = [var.domain_zone]
+  is_ipv6_enabled     = true
+  price_class         = "PriceClass_100"
+  default_root_object = ""
+
+  origin {
+    domain_name = var.cluster_domain
+    origin_id   = var.cluster_id
+
+    custom_origin_config {
+      http_port              = 80
+      https_port             = 443
+      origin_protocol_policy = "match-viewer"
+      origin_ssl_protocols   = ["TLSv1.1", "TLSv1.2"]
+    }
+  }
+
+  default_cache_behavior {
+    # Using the CachingOptimized policy:
+    cache_policy_id = data.aws_cloudfront_cache_policy.caching_optimized.id
+    # Using the AllViewerExceptHostHeader origin policy
+    origin_request_policy_id = data.aws_cloudfront_origin_request_policy.all_viewer_except_host.id
+
+    allowed_methods        = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
+    cached_methods         = ["GET", "HEAD"]
+    viewer_protocol_policy = "redirect-to-https"
+    target_origin_id       = var.cluster_id
+  }
+
+  viewer_certificate {
+    ssl_support_method       = "sni-only"
+    acm_certificate_arn      = aws_acm_certificate.cert.arn
+    minimum_protocol_version = "TLSv1.2_2018"
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  tags = local.common_tags
+}
+
+resource "aws_iam_user" "cloudfront_invalidator" {
+  name = "${var.environment}-cloudfront-invalidator"
+}
+
+resource "aws_iam_user_policy" "cloudfront_invalidator" {
+  name   = "${var.environment}-cloudfront-invalidator"
+  user   = aws_iam_user.cloudfront_invalidator.name
+  policy = data.aws_iam_policy_document.cloudfront_invalidator.json
+}
+
+data "aws_iam_policy_document" "cloudfront_invalidator" {
+  statement {
+    sid       = "CloudfrontInvalidation"
+    actions   = ["cloudfront:CreateInvalidation"]
+    effect    = "Allow"
+    resources = [var.cluster_arn]
+  }
+}
+
+resource "aws_iam_access_key" "cloudfront_invalidator" {
+  user = aws_iam_user.cloudfront_invalidator.name
+}

{{cookiecutter.project_slug}}/terraform/modules/application/data.tf

@@ -0,0 +1,7 @@
+data "aws_cloudfront_cache_policy" "caching_optimized" {
+  name = "Managed-CachingOptimized"
+}
+
+data "aws_cloudfront_origin_request_policy" "all_viewer_except_host" {
+  name = "Managed-AllViewerExceptHostHeader"
+}

{{cookiecutter.project_slug}}/terraform/modules/application/route53.tf

@@ -3,12 +3,42 @@ data "aws_route53_zone" "route_zone" {
   name = var.domain_zone
 }
 
-# record for calls to cluster
-resource "aws_route53_record" "routes" {
-  for_each = var.domain_urls
-  zone_id  = data.aws_route53_zone.route_zone.zone_id
-  name     = each.value
-  type     = "A"
-  records  = [var.cluster_public_id]
-  ttl      = 600
+# record for api calls to backend
+resource "aws_route53_record" "application-api" {
+  zone_id = data.aws_route53_zone.route_zone.zone_id
+  name    = var.api_domain
+  type    = "A"
+  records = [var.cluster_public_id]
+  ttl     = 600
+}
+
+// record for cluster ip
+resource "aws_route53_record" "application-k8s" {
+  zone_id = data.aws_route53_zone.route_zone.zone_id
+  name    = var.cluster_domain
+  ttl     = 3600
+  type    = "A"
+  records = [var.cluster_public_id]
+}
+
+# record for argocd call
+resource "aws_route53_record" "application-argocd" {
+  zone_id = data.aws_route53_zone.route_zone.zone_id
+  name    = var.argocd_domain
+  type    = "A"
+  records = [var.cluster_public_id]
+  ttl     = 600
+}
+
+# record for frontend call
+resource "aws_route53_record" "application" {
+  zone_id = data.aws_route53_zone.route_zone.zone_id
+  name    = var.domain
+  type    = "A"
+
+  alias {
+    name                   = aws_cloudfront_distribution.ec2_cluster.domain_name
+    zone_id                = aws_cloudfront_distribution.ec2_cluster.hosted_zone_id
+    evaluate_target_health = false
+  }
 }

{{cookiecutter.project_slug}}/terraform/modules/application/variables.tf

@@ -10,15 +10,27 @@ variable "domain_zone" {
   default = "{{ cookiecutter.domain_name }}"
 }
 
-variable "domain_urls" {
-  type    = list(string)
-  default = ["{{ cookiecutter.domain_name }}"]
+variable "api_domain" {
+  type    = string
+  default = "api.{{ cookiecutter.domain_name }}"
+}
+
+variable "cluster_domain" {
+  default = "k8s.{{ cookiecutter.domain_name }}"
 }
 
 variable "cluster_public_id" {
   default = ""
 }
 
+variable "cluster_id" {
+  default = ""
+}
+
+variable "cluster_arn" {
+  default = ""
+}
+
 variable "tags" {
   type    = map(string)
   default = {}

{{cookiecutter.project_slug}}/terraform/prod/application.tf

@@ -5,6 +5,9 @@ module "application" {
   application       = module.global_variables.application
   environment       = var.environment
   domain_zone       = var.domain
-  domain_urls       = [var.domain, var.api_domain]
+  cluster_domain    = var.cluster_domain
+  argocd_domain     = var.argocd_domain
   cluster_public_id = data.aws_instance.ec2_cluster.public_ip
+  cluster_id        = data.aws_instance.ec2_cluster.id
+  cluster_arn       = data.aws_instance.ec2_cluster.arn
 }

{{cookiecutter.project_slug}}/terraform/prod/variables.tf

@@ -8,6 +8,16 @@ variable "api_domain" {
   default = "api.{{ cookiecutter.domain_name }}"
 }
 
+variable "cluster_domain" {
+  type    = string
+  default = "k8s.{{ cookiecutter.domain_name }}"
+}
+
+variable "argocd_domain" {
+  type    = string
+  default = "argocd.{{ cookiecutter.domain_name }}"
+}
+
 variable "environment" {
   default = "prod"
 }

{{cookiecutter.project_slug}}/terraform/sandbox/application.tf

@@ -5,6 +5,9 @@ module "application" {
   application       = module.global_variables.application
   environment       = var.environment
   domain_zone       = var.domain
-  domain_urls       = [var.domain, var.api_domain]
+  cluster_domain    = var.cluster_domain
+  argocd_domain     = var.argocd_domain
   cluster_public_id = data.aws_instance.ec2_cluster.public_ip
+  cluster_id        = data.aws_instance.ec2_cluster.id
+  cluster_arn       = data.aws_instance.ec2_cluster.arn
 }

{{cookiecutter.project_slug}}/terraform/sandbox/variables.tf

@@ -5,7 +5,17 @@ variable "domain" {
 
 variable "api_domain" {
   type    = string
-  default = "sandbox.api.{{ cookiecutter.domain_name }}"
+  default = "api.sandbox.{{ cookiecutter.domain_name }}"
+}
+
+variable "cluster_domain" {
+  type    = string
+  default = "k8s.sandbox.{{ cookiecutter.domain_name }}"
+}
+
+variable "argocd_domain" {
+  type    = string
+  default = "argocd.sandbox.{{ cookiecutter.domain_name }}"
 }
 
 variable "environment" {