vpc.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Template for OpenShift cluster VPC containing 1-3 AZs

Parameters:
  InfrastructureName:
    AllowedPattern: ^([a-zA-Z][a-zA-Z0-9\-]{0,26})$
    MaxLength: 27
    MinLength: 1
    ConstraintDescription: >-
      Infrastructure name must be alphanumeric, start with a letter, and have
      a maximum of 27 characters.
    Description: >-
      A short, unique cluster ID used to tag cloud resources and identify items
      owned or used by the cluster. You should use the value generated when
      creating the manifest files using `openshift-install create manifests`.
    Type: String

  VpcCidr:
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-4]))$
    ConstraintDescription: >-
      CIDR block parameter must be in the form x.x.x.x/16-24.
    Description: >-
      CIDR block for VPC.
    Default: 10.0.0.0/16
    Type: String

  VpcOwner:
    Type: String

  AvailabilityZoneCount:
    MinValue: 1
    MaxValue: 3
    ConstraintDescription: >-
      The number of availability zones. (Min: 1, Max: 3)
    Description: >-
      How many AZs to create VPC subnets for. (Min: 1, Max: 3)
    Default: 3
    Type: Number

  SubnetBits:
    MinValue: 5
    MaxValue: 13
    ConstraintDescription: >-
      The size of each subnet in each availability zone.
      (Min: 5 = /27, Max: 13 = /19)
    Description: >-
      Size of each subnet to create within the availability zones.
      (Min: 5 = /27, Max: 13 = /19)
    Default: 12
    Type: Number

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Network Configuration"
        Parameters:
          - VpcCidr
          - SubnetBits
      - Label:
          default: "Availability Zones"
        Parameters:
          - AvailabilityZoneCount
    ParameterLabels:
      AvailabilityZoneCount:
        default: "Availability Zone Count"
      VpcCidr:
        default: "VPC CIDR"
      SubnetBits:
        default: "Bits Per Subnet"

Conditions:
  DoAz3: !Equals [3, !Ref AvailabilityZoneCount]
  DoAz2: !Or [!Equals [2, !Ref AvailabilityZoneCount], Condition: DoAz3]

Resources:
  VPC:
    Type: "AWS::EC2::VPC"
    Properties:
      EnableDnsSupport: "true"
      EnableDnsHostnames: "true"
      CidrBlock: !Ref VpcCidr
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "vpc"]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned
        - Key: "Owner"
          Value: !Ref VpcOwner

  PublicSubnet1:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [0, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
      AvailabilityZone: !Select [0, Fn::GetAZs: !Ref "AWS::Region"]
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "public", !Select [0, Fn::GetAZs: !Ref "AWS::Region"]]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  PublicSubnet2:
    Type: "AWS::EC2::Subnet"
    Condition: DoAz2
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [1, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
      AvailabilityZone: !Select [1, Fn::GetAZs: !Ref "AWS::Region"]
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "public", !Select [1, Fn::GetAZs: !Ref "AWS::Region"]]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  PublicSubnet3:
    Type: "AWS::EC2::Subnet"
    Condition: DoAz3
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [2, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
      AvailabilityZone: !Select [2, Fn::GetAZs: !Ref "AWS::Region"]
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "public", !Select [2, Fn::GetAZs: !Ref "AWS::Region"]]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  InternetGateway:
    Type: "AWS::EC2::InternetGateway"
    Properties:
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "igw"]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  GatewayToInternet:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicRouteTable:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "public"]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  PublicRoute:
    Type: "AWS::EC2::Route"
    DependsOn: GatewayToInternet
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetRouteTableAssociation1:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  PublicSubnetRouteTableAssociation2:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Condition: DoAz2
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  PublicSubnetRouteTableAssociation3:
    Condition: DoAz3
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref PublicSubnet3
      RouteTableId: !Ref PublicRouteTable

  PrivateSubnet1:
    Type: "AWS::EC2::Subnet"
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [3, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
      AvailabilityZone: !Select [0, Fn::GetAZs: !Ref "AWS::Region"]
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "private", !Select [0, Fn::GetAZs: !Ref "AWS::Region"]]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned
        - Key: kubernetes.io/role/internal-elb
          Value: ""

  PrivateRouteTable1:
    Type: "AWS::EC2::RouteTable"
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "private", !GetAtt PublicSubnet1.AvailabilityZone]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  PrivateSubnetRouteTableAssociation1:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRouteTable1

  #  NAT1:
  #    DependsOn:
  #      - GatewayToInternet
  #    Type: "AWS::EC2::NatGateway"
  #    Properties:
  #      AllocationId: !GetAtt EIP1.AllocationId
  #      SubnetId: !Ref PublicSubnet1
  #      Tags:
  #        - Key: "Name"
  #          Value: !Join ["-", [!Ref InfrastructureName, "nat", !GetAtt PublicSubnet1.AvailabilityZone]]
  #        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
  #          Value: owned
  #
  EIP1:
    Type: "AWS::EC2::EIP"
    Properties:
      Domain: vpc
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "eip", !GetAtt PublicSubnet1.AvailabilityZone]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  Route1:
    Type: "AWS::EC2::Route"
    Properties:
      RouteTableId:
        Ref: PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway

  PrivateSubnet2:
    Type: "AWS::EC2::Subnet"
    Condition: DoAz2
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [4, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
      AvailabilityZone: !Select [1, Fn::GetAZs: !Ref "AWS::Region"]
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "private", !Select [1, Fn::GetAZs: !Ref "AWS::Region"]]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned
        - Key: kubernetes.io/role/internal-elb
          Value: ""

  PrivateRouteTable2:
    Type: "AWS::EC2::RouteTable"
    Condition: DoAz2
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "private", !GetAtt PublicSubnet2.AvailabilityZone]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  PrivateSubnetRouteTableAssociation2:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Condition: DoAz2
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable2

  #  NAT2:
  #    DependsOn:
  #      - GatewayToInternet
  #    Type: "AWS::EC2::NatGateway"
  #    Condition: DoAz2
  #    Properties:
  #      AllocationId: !GetAtt EIP2.AllocationId
  #      SubnetId: !Ref PublicSubnet2
  #      Tags:
  #        - Key: "Name"
  #          Value: !Join ["-", [!Ref InfrastructureName, "nat", !GetAtt PublicSubnet2.AvailabilityZone]]
  #        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
  #          Value: owned
  #
  EIP2:
    Type: "AWS::EC2::EIP"
    Condition: DoAz2
    Properties:
      Domain: vpc
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "eip", !GetAtt PublicSubnet2.AvailabilityZone]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  Route2:
    Type: "AWS::EC2::Route"
    Condition: DoAz2
    Properties:
      RouteTableId:
        Ref: PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway

  PrivateSubnet3:
    Type: "AWS::EC2::Subnet"
    Condition: DoAz3
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select [5, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
      AvailabilityZone: !Select [2, Fn::GetAZs: !Ref "AWS::Region"]
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "private", !Select [2, Fn::GetAZs: !Ref "AWS::Region"]]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned
        - Key: kubernetes.io/role/internal-elb
          Value: ""

  PrivateRouteTable3:
    Type: "AWS::EC2::RouteTable"
    Condition: DoAz3
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "private", !GetAtt PublicSubnet3.AvailabilityZone]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  PrivateSubnetRouteTableAssociation3:
    Type: "AWS::EC2::SubnetRouteTableAssociation"
    Condition: DoAz3
    Properties:
      SubnetId: !Ref PrivateSubnet3
      RouteTableId: !Ref PrivateRouteTable3

  #  NAT3:
  #    DependsOn:
  #      - GatewayToInternet
  #    Type: "AWS::EC2::NatGateway"
  #    Condition: DoAz3
  #    Properties:
  #      AllocationId: !GetAtt EIP3.AllocationId
  #      SubnetId: !Ref PublicSubnet3
  #      Tags:
  #        - Key: "Name"
  #          Value: !Join ["-", [!Ref InfrastructureName, "nat", !GetAtt PublicSubnet3.AvailabilityZone]]
  #        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
  #          Value: owned
  #
  EIP3:
    Type: "AWS::EC2::EIP"
    Condition: DoAz3
    Properties:
      Domain: vpc
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref InfrastructureName, "eip", !GetAtt PublicSubnet3.AvailabilityZone]]
        - Key: !Join ["", [kubernetes.io/cluster/, !Ref InfrastructureName]]
          Value: owned

  Route3:
    Type: "AWS::EC2::Route"
    Condition: DoAz3
    Properties:
      RouteTableId:
        Ref: PrivateRouteTable3
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway

  S3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: '*'
            Action:
              - '*'
            Resource:
              - '*'
      RouteTableIds:
        - !Ref PublicRouteTable
        - !Ref PrivateRouteTable1
        - !If [DoAz2, !Ref PrivateRouteTable2, !Ref "AWS::NoValue"]
        - !If [DoAz3, !Ref PrivateRouteTable3, !Ref "AWS::NoValue"]
      ServiceName: !Join [".", ["com.amazonaws", !Ref "AWS::Region", "s3"]]
      VpcId: !Ref VPC

Outputs:
  VpcId:
    Description: ID of the new VPC.
    Value: !Ref VPC

  PublicSubnetIds:
    Description: Subnet IDs of the public subnets.
    Value:
      !Join [
          ",",
        [
          !Ref PublicSubnet1,
          !If [DoAz2, !Ref PublicSubnet2, !Ref "AWS::NoValue"],
          !If [DoAz3, !Ref PublicSubnet3, !Ref "AWS::NoValue"]
        ]
      ]

  PrivateSubnetIds:
    Description: Subnet IDs of the private subnets.
    Value:
      !Join [
          ",",
        [
          !Ref PrivateSubnet1,
          !If [DoAz2, !Ref PrivateSubnet2, !Ref "AWS::NoValue"],
          !If [DoAz3, !Ref PrivateSubnet3, !Ref "AWS::NoValue"]
        ]
      ]