Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(trusted): controller VM #337

Merged
merged 4 commits into from
May 2, 2023
Merged

feat(trusted): controller VM #337

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9fe5b7e
feat(trusted): controller VM
smerleCB Apr 28, 2023
2065b7b
change ip to static and disk to ssd
smerleCB Apr 28, 2023
d0623a2
fmt
smerleCB Apr 28, 2023
10d5afc
rename trusted_ci_controller and increase disk size to 128Gb
smerleCB May 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 81 additions & 11 deletions trusted.ci.jenkins.io.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ data "azurerm_virtual_network" "trusted" {
name = "${data.azurerm_resource_group.trusted.name}-vnet"
resource_group_name = data.azurerm_resource_group.trusted.name
}
data "azurerm_subnet" "trusted_controller" {
data "azurerm_subnet" "trusted_ci_controller" {
name = "${data.azurerm_virtual_network.trusted.name}-trusted-jenkins-ci-io-controller"
virtual_network_name = data.azurerm_virtual_network.trusted.name
resource_group_name = data.azurerm_resource_group.trusted.name
Expand All @@ -17,7 +17,7 @@ resource "azurerm_resource_group" "trusted_ci_jenkins_io_agents" {
location = "East US"
}
resource "azurerm_resource_group" "trusted_ci_jenkins_io_controller" {
name = "jenkinsinfra-trusted-controller"
name = "jenkinsinfra-trusted-ci-controller"
location = var.location
tags = local.default_tags
}
Expand Down Expand Up @@ -69,6 +69,8 @@ resource "azurerm_role_assignment" "trusted_ci_jenkins_io_allow_packer" {
principal_id = azuread_service_principal.trusted_ci_jenkins_io.id
}

# VMs
# BOUNCE VM
resource "azurerm_public_ip" "trusted_bounce" {
name = "trusted-bounce"
location = azurerm_resource_group.trusted_ci_jenkins_io_controller.location
Expand All @@ -88,7 +90,7 @@ resource "azurerm_network_interface" "trusted_bounce" {
name = "external"
private_ip_address_allocation = "Dynamic"
public_ip_address_id = azurerm_public_ip.trusted_bounce.id
subnet_id = data.azurerm_subnet.trusted_controller.id
subnet_id = data.azurerm_subnet.trusted_ci_controller.id
}
}
## MACHINE (bounce)
Expand Down Expand Up @@ -122,12 +124,80 @@ resource "azurerm_linux_virtual_machine" "trusted_bounce" {
}
}

# CONTROLLER VM
## NETWORK INTERFACE with internal ip
resource "azurerm_network_interface" "trusted_ci_controller" {
name = "trusted-ci-controller"
location = azurerm_resource_group.trusted_ci_jenkins_io_controller.location
resource_group_name = azurerm_resource_group.trusted_ci_jenkins_io_controller.name
tags = local.default_tags

ip_configuration {
name = "internal"
subnet_id = data.azurerm_subnet.trusted_ci_controller.id
private_ip_address_allocation = "Static"
# TODO add a dns record to point on this private ip
private_ip_address = "10.252.0.1" # Manually chosen first IP of the controller subnet
}
}

## MACHINE (controller)
resource "azurerm_linux_virtual_machine" "trusted_ci_controller" {
name = "trusted-ci-controller"
resource_group_name = azurerm_resource_group.trusted_ci_jenkins_io_controller.name
location = azurerm_resource_group.trusted_ci_jenkins_io_controller.location
tags = local.default_tags
size = "Standard_D2as_v5"
admin_username = local.trusted_ci_jenkins_io.admin_username
disable_password_authentication = true
network_interface_ids = [
azurerm_network_interface.trusted_ci_controller.id,
]

admin_ssh_key {
username = local.trusted_ci_jenkins_io.admin_username
public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5K7Ro7jBl5Kc68RdzG6EXHstIBFSxO5Da8SQJSMeCbb4cHTYuBBH8jNsAFcnkN64kEu+YhmlxaWEVEIrPgfGfs13ZL7v9p+Nt76tsz6gnVdAy2zCz607pAWe7p4bBn6T9zdZcBSnvjawO+8t/5ue4ngcfAjanN5OsOgLeD6yqVyP8YTERjW78jvp2TFrIYmgWMI5ES1ln32PQmRZwc1eAOsyGJW/YIBdOxaSkZ41qUvb9b3dCorGuCovpSK2EeNphjLPpVX/NRpVY4YlDqAcTCdLdDrEeVqkiA/VDCYNhudZTDa8f1iHwBE/GEtlKmoO6dxJ5LAkRk3RIVHYrmI6XXSw5l0tHhW5D12MNwzUfDxQEzBpGK5iSfOBt5zJ5OiI9ftnsq/GV7vCXfvMVGDLUC551P5/s/wM70QmHwhlGQNLNeJxRTvd6tL11bof3K+29ivFYUmpU17iVxYOWhkNY86WyngHU6Ux0zaczF3H6H0tpg1Ca/cFO428AVPw/RTJpcAe6OVKq5zwARNApQ/p6fJKUAdXap+PpQGZlQhPLkUbwtFXGTrpX9ePTcdzryCYjgrZouvy4ZMzruJiIbFUH8mRY3xVREVaIsJakruvgw3b14oQgcB4BwYVBBqi62xIvbRzAv7Su9t2jK6OR2z3sM/hLJRqIJ5oILMORa7XqrQ=="
}

os_disk {
caching = "ReadWrite"
storage_account_type = "StandardSSD_LRS"
disk_size_gb = 32 # Minimal size for ubuntu 22.04 image
}

source_image_reference {
publisher = "Canonical"
offer = "0001-com-ubuntu-minimal-jammy"
sku = "minimal-22_04-lts-gen2"
version = "latest"
}
}

resource "azurerm_managed_disk" "trusted_ci_controller_data_disk" {
name = "trusted-ci-controller-data-disk"
location = azurerm_resource_group.trusted_ci_jenkins_io_controller.location
resource_group_name = azurerm_resource_group.trusted_ci_jenkins_io_controller.name
storage_account_type = "StandardSSD_LRS"
create_option = "Empty"
disk_size_gb = "128"

tags = local.default_tags
}

resource "azurerm_virtual_machine_data_disk_attachment" "trusted_ci_controller_data_disk" {
managed_disk_id = azurerm_managed_disk.trusted_ci_controller_data_disk.id
virtual_machine_id = azurerm_linux_virtual_machine.trusted_ci_controller.id
lun = "10"
caching = "ReadWrite"
}


####################################################################################
## Network Security Groups for TRUSTED subnets
####################################################################################
# subnet trusted_controller
resource "azurerm_network_security_group" "trusted_controller" {
name = data.azurerm_subnet.trusted_controller.name
# subnet trusted_ci_controller
resource "azurerm_network_security_group" "trusted_ci_controller" {
name = data.azurerm_subnet.trusted_ci_controller.name
location = data.azurerm_resource_group.trusted.location
resource_group_name = data.azurerm_resource_group.trusted.name

Expand All @@ -136,9 +206,9 @@ resource "azurerm_network_security_group" "trusted_controller" {
tags = local.default_tags
}

resource "azurerm_subnet_network_security_group_association" "trusted_controller" {
subnet_id = data.azurerm_subnet.trusted_controller.id
network_security_group_id = azurerm_network_security_group.trusted_controller.id
resource "azurerm_subnet_network_security_group_association" "trusted_ci_controller" {
subnet_id = data.azurerm_subnet.trusted_ci_controller.id
network_security_group_id = azurerm_network_security_group.trusted_ci_controller.id
}

resource "azurerm_network_security_rule" "deny_all_to_vnet" {
Expand All @@ -154,7 +224,7 @@ resource "azurerm_network_security_rule" "deny_all_to_vnet" {
source_address_prefix = "*"
destination_address_prefixes = data.azurerm_virtual_network.trusted.address_space
resource_group_name = data.azurerm_resource_group.trusted.name
network_security_group_name = azurerm_network_security_group.trusted_controller.name
network_security_group_name = azurerm_network_security_group.trusted_ci_controller.name
}

# TODO: add all ips from people needing access to trusted.ci.jenkins.io, or remove the rule at final migration. (Cf https://github.com/jenkins-infra/azure/pull/334#discussion_r1179955821)
Expand All @@ -171,5 +241,5 @@ resource "azurerm_network_security_rule" "allow_ssh_from_admins_to_bounce" {
source_address_prefix = each.value
destination_address_prefix = azurerm_linux_virtual_machine.trusted_bounce.private_ip_address
resource_group_name = data.azurerm_resource_group.trusted.name
network_security_group_name = azurerm_network_security_group.trusted_controller.name
network_security_group_name = azurerm_network_security_group.trusted_ci_controller.name
}