-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add support for use of existing VPC with Cloudformation (#1957)
- Cloudformation now expects an existing VPC, 2 public and 4 private subnets to run - Updated Teleport to version 2.6.0 - Randomised domain name to make SSL certificate issuing work more frequently - S3 buckets are now deleted after running - Old AMIs/snapshots are deleted automtaically
- Loading branch information
Showing
9 changed files
with
593 additions
and
294 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| files/system/license.pem | ||
|
|
||
| *.swp |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,33 +1,78 @@ | ||
| # Teleport AWS Quickstart Guide | ||
|
|
||
| AWS quickstart for teleport | ||
| AWS Quickstart for Teleport | ||
|
|
||
| ## Development instructions | ||
|
|
||
| **Prerequisites** | ||
|
|
||
| AWS CLI and Packer are required to build and launch a CloudFormation stack. | ||
|
|
||
| On macOS: | ||
|
|
||
| ``` | ||
| brew install awscli | ||
| brew install packer | ||
| ``` | ||
|
|
||
| On Linux: | ||
|
|
||
| ``` | ||
| apt install awscli | ||
| Follow instructions at: https://www.packer.io/docs/install/index.html | ||
| ``` | ||
|
|
||
| **To build an AMI** | ||
|
|
||
| ``` | ||
| make oss | ||
| ``` | ||
|
|
||
| Update oss.yaml with new AMI image IDs. | ||
| **Update YAML files with the new AMI image IDs** | ||
|
|
||
| ``` | ||
| make update-ami-ids-oss | ||
| ``` | ||
|
|
||
| **Launch a dev cloudformation stack using an existing VPC** | ||
|
|
||
| **Launch a dev cloudformation stack** | ||
| When using an existing VPC it must have both DNS support and DNS hostnames enabled. | ||
|
|
||
| The deployment needs six VPC subnet IDs provided - two public (for the proxy) and four private (for auth and nodes). | ||
| For redundancy, the subnets should be split across availability zones - odd numbers in AZ A and even numbers in AZ B, for example. | ||
|
|
||
| Replace the placeholder values in the exports below. | ||
|
|
||
| ``` | ||
| export STACK=test1 | ||
| export STACK_PARAMS="ParameterKey=KeyName,ParameterValue=KeyName ParameterKey=DomainName,ParameterValue=teleport.example.com ParameterKey=DomainAdminEmail,ParameterValue=admin@example.com ParameterKey=HostedZoneID,ParameterValue=AWSZONEID" | ||
| export STACK_PARAMS="\ | ||
| ParameterKey=VPCID,ParameterValue=EXISTING_VPC_ID \ | ||
| ParameterKey=ProxySubnetA,ParameterValue=PUBLIC_SUBNET_ID_1 \ | ||
| ParameterKey=ProxySubnetB,ParameterValue=PUBLIC_SUBNET_ID_2 \ | ||
| ParameterKey=AuthSubnetA,ParameterValue=PRIVATE_SUBNET_ID_1 \ | ||
| ParameterKey=AuthSubnetB,ParameterValue=PRIVATE_SUBNET_ID_2 \ | ||
| ParameterKey=NodeSubnetA,ParameterValue=PRIVATE_SUBNET_ID_3 \ | ||
| ParameterKey=NodeSubnetB,ParameterValue=PRIVATE_SUBNET_ID_4 \ | ||
| ParameterKey=KeyName,ParameterValue=KeyName \ | ||
| ParameterKey=DomainName,ParameterValue=teleport.example.com \ | ||
| ParameterKey=DomainAdminEmail,ParameterValue=admin@example.com \ | ||
| ParameterKey=HostedZoneID,ParameterValue=AWS_ZONE_ID" | ||
| make create-stack | ||
| ``` | ||
|
|
||
| ## Usage instructions | ||
|
|
||
| After stack has been provisioned, add admin user: | ||
| After stack has been provisioned, login to the AWS Console and capture the IP address of a Proxy Server and a Auth Server then type the following to add a admin user: | ||
|
|
||
| ``` | ||
| ssh -i key.pem -o ProxyCommand="ssh -i key.pem -W %h:%p ec2-user@PROXY_SERVER" ec2-user@$AUTH_SERVER | ||
| sudo -u teleport tctl users add bob --roles=admin | ||
| ``` | ||
| # For OSS | ||
| sudo -u teleport tctl users add bob bob | ||
| # For Enterprise | ||
| sudo -u teleport tctl users add bob --roles=admin | ||
| ``` | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| #!/bin/bash | ||
| if [[ "${AWS_REGION}" == "" ]]; then | ||
| echo "AWS_REGION must be set" | ||
| exit 1 | ||
| fi | ||
| bucket=$1 | ||
| if [[ "${bucket}" == "" ]]; then | ||
| echo "Usage: $(basename $0) <bucket>" | ||
| exit 1 | ||
| fi | ||
|
|
||
| set -e | ||
| echo "Removing all versions from ${bucket}" | ||
|
|
||
| versions=$(aws s3api list-object-versions --bucket ${bucket} | jq '.Versions') | ||
| markers=$(aws s3api list-object-versions --bucket ${bucket} | jq '.DeleteMarkers') | ||
| let count=$(echo ${versions} | jq 'length')-1 | ||
|
|
||
| if [ ${count} -gt -1 ]; then | ||
| echo "removing files" | ||
| for i in $(seq 0 ${count}); do | ||
| key=$(echo ${versions} | jq .[$i].Key | sed -e 's/\"//g') | ||
| versionId=$(echo ${versions} | jq .[$i].VersionId | sed -e 's/\"//g') | ||
| cmd="aws s3api delete-object --region=${AWS_REGION} --bucket ${bucket} --key ${key} --version-id ${versionId}" | ||
| echo $cmd | ||
| $cmd | ||
| done | ||
| fi | ||
|
|
||
| let count=$(echo ${markers} | jq 'length')-1 | ||
|
|
||
| if [ ${count} -gt -1 ]; then | ||
| echo "removing delete markers" | ||
| for i in $(seq 0 ${count}); do | ||
| key=$(echo ${markers} | jq .[$i].Key | sed -e 's/\"//g') | ||
| versionId=$(echo ${markers} | jq .[$i].VersionId | sed -e 's/\"//g') | ||
| cmd="aws s3api delete-object --region=${AWS_REGION} --bucket ${bucket} --key ${key} --version-id ${versionId}" | ||
| echo $cmd | ||
| $cmd | ||
| done | ||
| fi |
Oops, something went wrong.