Guidance for using the cdk in a cli tool to deploy an "app"

[pierreozoux]

We are currently designing an internal project for my company.
As I know Amazon is driven by customer stories, I wanted to comment on #233 and get recommendation or guidance (we also have a TAM so if you think I should ask him, let me know) .

Problem space

We manage OpenShift clusters, and we want to automatize operation of cloud resources.
For that, we have multiple AWS accounts and multiple clusters in each accounts.
We also use and contribute to the openshift QuickStart.

We are in an enterprise env, so we have some challenges, like we are required to use custom KMS everywhere and encrypt everything, run behind proxy and use local repositories for popular package manager, classic enterprise I'd say.
We also don't have API for domain names nor TLS certs, so we have to create them manually, and import them before running our automation.

We are contributing to the quickstart, but still, we need some resources to be created around:

• per AWS account:
  • KMS key
  • route53 zones
  • associated TLS certs
• per OpenShift cluster
  • our custom AMI
  • KMS key
  • SSH key
  • s3 encrypted bucket

Solution Space

The idea is to create a cli and wrap these resources with cdk. Let's say the cli is called "customopenshift".
then we are developing something that wrap cdk in such a way that:

customopenshift infra deploy

would deploy the base infra (KMS, and route53 zones).

customopenshift cluster deploy

would deploy the kms key, create our base AMI and upload the openshift quickstart to our encrypted s3 bucket and deploy the openshift quickstart with our parameters.

Using TypeScript would help us:

• test our code
• version
• build an artifact (cli as an npm package)
• distribute this artifact (npm package)

The challenges I see are the following:

• include packer into this javascript code
• "sync" the openshift quickstart to s3 bucket
• workflow to manage TLS certs (in secrets manager I guess)
• workflow to manage SSH keys

The idea is then to use this cli in each pipeline, and have a pipeline per AWS account, and a pipeline per cluster with the different configuration of each AWS account and each cluster.

Question

Do you think it makes sense? I think it does, but as it is all new, I'm not really sure I'm using the right tool for the problem I'm trying to solve.
If you have any advice to help us reach our desired goal, I'd glad to hear.

I hope it also helps you to define the #233 story.

[eladb]

@pierreozoux thanks for raising this issue. As you noted, it's very helpful for us to work against real-world user stories!

Would it make sense perhaps to design all of these components just as CDK constructs and not as a CLI, and simply vend a construct library for customers to use (you can even use jsii to vend it to multiple programming languages, like we do with the CDK). Then, customers will simply define their CDK apps in code and instantiate these constructs.

const app = new cdk.App();

const base = new openshift.InfrastructureStack(app);

for (const cluster of clusters) {
  new openshift.ClusterStack(app, cluster.name, { baseInfrastructure: base });
}

The benefit is that constructs can expose a rich object-oriented API, and customers can use their favorite IDEs and languages to define their apps. They can also mix and match these with other constructs and resources.

Integrating with packer is an interesting problem. @RomainMuller is working on extending our assets capabilities to support docker images, and we just discussed supporting AMIs today.

[Doug-AWS]

Why is this a documentation issue? I don't see any actionable info.

[pierreozoux]

We now have our own CLI to deploy base infrastructure and OpenShift clusters, it is pretty neat ;)
We also vendor the packer configuration in it. What is the current status with Ami building? After answering this.last question, we can close this issue.

(We could make a demo of our setup if interested?)

[NGL321]

@pierreozoux I'm sorry this has gone so long without response.
AMIs should be fully implemented at this point (although I am not completely sure the state they were at at time of posting).

If you are still open to it, a demo of your setup would be amazing! If you want to add a PR to link it on Awesome-CDK that would be really cool! (or just comment here and I can share it).

If this covers it, I would love to close out this issue.