From 206503bdefa504170a6d90aef4ea6f2c029e150b Mon Sep 17 00:00:00 2001 From: Guy Barros Date: Wed, 22 Feb 2023 17:26:11 +0000 Subject: [PATCH 1/3] update aws/docker/kube for 0.12 release --- deployment/aws/README.md | 20 ++++++++++++---- deployment/aws/aws/cert.tf | 1 - deployment/aws/aws/net.tf | 2 +- deployment/aws/boundary/main.tf | 1 - deployment/aws/boundary/outputs.tf | 7 ++++++ deployment/aws/boundary/targets.tf | 4 ++-- deployment/aws/destroy-tf-run.sh | 2 ++ deployment/aws/outputs.tf | 25 ++++++++++++++++++++ deployment/docker/compose/docker-compose.yml | 4 ++-- deployment/docker/terraform/main.tf | 6 ++++- deployment/kube/README.md | 2 +- deployment/kube/boundary/boundary.tf | 1 - deployment/kube/boundary/outputs.tf | 7 ++++++ deployment/kube/boundary/targets.tf | 12 +++++----- deployment/kube/destroy-tf-run.sh | 2 ++ deployment/kube/kubernetes/boundary.tf | 2 +- deployment/kube/main.tf | 9 +++++-- 17 files changed, 83 insertions(+), 24 deletions(-) create mode 100644 deployment/aws/boundary/outputs.tf create mode 100644 deployment/aws/destroy-tf-run.sh create mode 100644 deployment/aws/outputs.tf create mode 100644 deployment/kube/boundary/outputs.tf create mode 100755 deployment/kube/destroy-tf-run.sh diff --git a/deployment/aws/README.md b/deployment/aws/README.md index c63887f..f6d6422 100644 --- a/deployment/aws/README.md +++ b/deployment/aws/README.md @@ -8,6 +8,14 @@ This directory contains an AWS deployment example for Boundary using Terraform. ## Setup - Make sure you have a local checkout of `github.com/hashicorp/boundary` - Build the `boundary` binary for linux using `XC_OSARCH=linux/amd64 make dev` or download from our [release page](https://boundaryproject.io/) on our docs site. +```bash +mkdir bin +cd bin +export BOUNDARY_VERSION=0.12.0 +curl -O https://releases.hashicorp.com/boundary/$(echo $BOUNDARY_VERSION)/boundary_$(echo $BOUNDARY_VERSION)_linux_amd64.zip +unzip boundary_$(echo $BOUNDARY_VERSION)_linux_amd64.zip +rm boundary_$(echo $BOUNDARY_VERSION)_linux_amd64.zip +``` - Provide appropriate AWS credentials through the command line ## Deploy @@ -16,7 +24,7 @@ To deploy this example: 1. Clone this repo by running `git clone https://github.com/hashicorp/boundary-reference-architecture.git` 2. Navigate to `boundary-reference-architecture/deployment/aws` - If you want to change your AWS region, navigate to `aws/aws/net.tf` and change `region = ` + If you want to change your AWS region, navigate to `aws/aws/net.tf` and change `region = ` on line 6 In addition, run the command `export AWS_REGION=` to set the region in your command line 3. Run `terraform init` @@ -25,8 +33,10 @@ To deploy this example: For example: `terraform apply -target module.aws -var boundary_bin=/usr/bin` If the public SSH key you want use is not located at `~/.ssh/id_rsa.pub` then you'll also need to override that value: - ``` - terraform apply -target module.aws -var boundary_bin= -var pub_ssh_key_path= + ```bash + terraform apply -target module.aws \ + -var boundary_bin= \ + -var pub_ssh_key_path= ``` If the private key is not named the same as the public key but without the .pub suffix and/or is not stored in the same directory, you can use the `priv_ssh_key_path` variable also to point to its location; otherwise its filename will be inferred from the filename of the public key. @@ -46,7 +56,7 @@ To deploy this example: - Login on the CLI: ``` -BOUNDARY_ADDR='http://:9200' \ +BOUNDARY_ADDR='http://:9200' \ boundary authenticate password \ -login-name=jim \ -password foofoofoo \ @@ -60,7 +70,7 @@ You can also use this login name in the Boundary console that you navigated to i Connect to the target in the private subnet via Boundary: ``` -BOUNDARY_ADDR='http://:9200' \ +BOUNDARY_ADDR='http://:9200' \ boundary connect ssh --username ubuntu -target-id ttcp_ ``` diff --git a/deployment/aws/aws/cert.tf b/deployment/aws/aws/cert.tf index 1c40c66..7232d5b 100644 --- a/deployment/aws/aws/cert.tf +++ b/deployment/aws/aws/cert.tf @@ -6,7 +6,6 @@ resource "tls_private_key" "boundary" { } resource "tls_self_signed_cert" "boundary" { - key_algorithm = "RSA" private_key_pem = tls_private_key.boundary.private_key_pem subject { diff --git a/deployment/aws/aws/net.tf b/deployment/aws/aws/net.tf index 36c0b82..3430b7b 100644 --- a/deployment/aws/aws/net.tf +++ b/deployment/aws/aws/net.tf @@ -3,7 +3,7 @@ provider "aws" { version = "~> 3.0" - region = "us-east-1" + region = "eu-west-2" } data "aws_availability_zones" "available" { diff --git a/deployment/aws/boundary/main.tf b/deployment/aws/boundary/main.tf index e262a5a..5317dc3 100644 --- a/deployment/aws/boundary/main.tf +++ b/deployment/aws/boundary/main.tf @@ -5,7 +5,6 @@ terraform { required_providers { boundary = { source = "hashicorp/boundary" - version = "1.0.5" } } } diff --git a/deployment/aws/boundary/outputs.tf b/deployment/aws/boundary/outputs.tf new file mode 100644 index 0000000..6e73f17 --- /dev/null +++ b/deployment/aws/boundary/outputs.tf @@ -0,0 +1,7 @@ +output "boundary_auth_method_id" { + value = boundary_auth_method.password.id +} + +output "boundary_ssh_target_id" { + value = boundary_target.backend_servers_ssh.id +} diff --git a/deployment/aws/boundary/targets.tf b/deployment/aws/boundary/targets.tf index 9206788..d1fcac7 100644 --- a/deployment/aws/boundary/targets.tf +++ b/deployment/aws/boundary/targets.tf @@ -8,7 +8,7 @@ resource "boundary_target" "backend_servers_ssh" { scope_id = boundary_scope.core_infra.id session_connection_limit = -1 default_port = 22 - host_set_ids = [ + host_source_ids = [ boundary_host_set.backend_servers.id ] } @@ -20,7 +20,7 @@ resource "boundary_target" "backend_servers_website" { scope_id = boundary_scope.core_infra.id session_connection_limit = -1 default_port = 8000 - host_set_ids = [ + host_source_ids = [ boundary_host_set.backend_servers.id ] } diff --git a/deployment/aws/destroy-tf-run.sh b/deployment/aws/destroy-tf-run.sh new file mode 100644 index 0000000..8eae51d --- /dev/null +++ b/deployment/aws/destroy-tf-run.sh @@ -0,0 +1,2 @@ +terraform state rm module.boundary +terraform destroy diff --git a/deployment/aws/outputs.tf b/deployment/aws/outputs.tf new file mode 100644 index 0000000..1851b5b --- /dev/null +++ b/deployment/aws/outputs.tf @@ -0,0 +1,25 @@ +output "boundary_url" { + value = "http://${module.aws.boundary_lb}:9200" +} + + +output "Next_steps" { + value = < Date: Wed, 22 Feb 2023 19:25:28 +0000 Subject: [PATCH 2/3] Update deployment/aws/README.md Co-authored-by: Johan Brandhorst-Satzkorn --- deployment/aws/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deployment/aws/README.md b/deployment/aws/README.md index f6d6422..b262fe7 100644 --- a/deployment/aws/README.md +++ b/deployment/aws/README.md @@ -56,7 +56,7 @@ To deploy this example: - Login on the CLI: ``` -BOUNDARY_ADDR='http://:9200' \ +BOUNDARY_ADDR='http://:9200' \ boundary authenticate password \ -login-name=jim \ -password foofoofoo \ From 6989db81dab74c30a8fb5c613f9084e9690787c2 Mon Sep 17 00:00:00 2001 From: Guy Barros <38210175+GuyBarros@users.noreply.github.com> Date: Wed, 22 Feb 2023 19:28:03 +0000 Subject: [PATCH 3/3] Update deployment/kube/README.md Co-authored-by: Johan Brandhorst-Satzkorn --- deployment/kube/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deployment/kube/README.md b/deployment/kube/README.md index ce59d5a..23897fe 100644 --- a/deployment/kube/README.md +++ b/deployment/kube/README.md @@ -36,7 +36,7 @@ Run terraform apply against the kubernetes terraform module: $ terraform apply -target module.kubernetes ``` -use minikube tunnel or expose all 3 Boundary services running on minikube, on your local host using `kubectl port-forward` (you'll +Use minikube tunnel or expose all 3 Boundary services running on minikube, on your local host using `kubectl port-forward` (you'll need to do this in 3 separate long running shells): ```