Skip to content

Commit bd4802a

Browse files
pallakartheekreddypallakartheekreddy
authored
Merge pull request #11 from mozammil89/main
feat: cdk project improvements
2 parents 96bfbb1 + 7cc08e0 commit bd4802a

File tree

14 files changed

+283
-346
lines changed

14 files changed

+283
-346
lines changed

‎README.md‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,13 @@
22

33

44
### Description
5-
Sunbird RC 2.0 is an interoperable and unified registry infrastructure that needs to be established to enable "live," "reusable," and "trustworthy" registries as a "single source of truth" to address the three core issues mentioned. To learn more about Sunbird RC, please visit [SunbirdRC 2.0](https://docs.sunbirdrc.dev/).
5+
Sunbird RC 2.0 is an interoperable and unified registry infrastructure that needs to be established to enable "live," "reusable," and "trustworthy" registries as a "single source of truth" to address the three core issues mentioned.
6+
7+
**Sunbird-RC has two core components:**
8+
[Registry](https://rc.sunbird.org/learn/technical-overview/registry/high-level-architecture)
9+
[Credentialling](https://rc.sunbird.org/learn/technical-overview/credentialling/high-level-architecture)
10+
11+
To learn more about Sunbird RC, please visit [SunbirdRC 2.0](https://docs.sunbirdrc.dev/).
612

713
### Packaging overview
814
This packaging initiative offers a practical approach to increase the adoption, streamline deployment and management of Sunbird RC 2.0 building blocks on AWS by providing a reference architecture and one-click deployment automation scripts. It allows builders to manage AWS resource provisioning and application deployment in a programmatic and repeatable way.
@@ -23,9 +29,9 @@ An alternative deployment approach accommodates users with existing essential AW
2329
* [Helm Chart Deployment](documentation/02-Deployment-Helm-Sunbirdrc2.md)
2430

2531
### Sunbird RC 2.0 reference architecture
26-
Required AWS services to operate the core Sunbird RC 2.0 registry services:
32+
Required AWS services to operate the core Sunbird RC 2.0 registry and credentialling services:
2733
* Amazon VPC
28-
* Amazon RDS for PostgreSQL Serverless V2
34+
* Amazon RDS for PostgreSQL
2935
* Amazon Elastic Kubernetes Service (Amazon EKS)
3036
* Elastic Load Balancing (ELB)
3137

‎bin/sunbirdrc2-cdk.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ const rds = new rdsStack(app, "rdsstacksbrc2", {
4343
rdspassword: config.RDS_PASSWORD,
4444
});
4545

46-
// Provision target EKS with Fargate Cluster within the VPC
46+
// Provision target EKS cluster with PRIVATE access
4747
const eksCluster = new eksec2Stack(app, "eksstacksbrc2", {
4848
env: {
4949
region: config.REGION,

‎documentation/01-Deployment-CDK-Sunbirdrc2.md‎

Lines changed: 39 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,15 @@
44

55
- **AWS Account**: An AWS account to deploy AWS CDK stacks
66
- **[AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html)**: Configured with AWS account
7-
- **Kubectl Client**: Configured with the Amazon EKS cluster.
7+
- **Amazon EC2 bastion host**: For accessing a [private only Amazon EKS API](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html) server.
8+
- **Kubectl Client**: Configured on Amazon EC2 bastion host with the Amazon EKS cluster.
89
- **Public Domain/Sub-Domain**: Along with SSL certificates for HTTPS.
910

11+
12+
![AWS CDK Flow](imgs/aws-cdk-diagrams-Page-4.jpg)
13+
14+
15+
1016
### Public Domain/sub-domain
1117

1218
Sunbird RC requires a public domain to be associated with `Registry` service.
@@ -74,25 +80,21 @@ cdk bootstrap aws://<ACCOUNT-NUMBER>/<REGION>
7480

7581
## Deploy CDK
7682

77-
<<<<<<< HEAD
78-
| ENVIRONMENT VARIABLES | EXAMPLE VALUE | DESCRIPTION |
79-
|---------------------------|---------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
80-
| REGION | us-east-1 | AWS region |
81-
| ACCOUNT | 123456789123 | AWS 12 digit account number |
82-
| CIDR | 10.20.0.0/16 | VPC CIDR, change it as per your environment |
83-
| MAX_AZS | 2 | AWS Availability Zone count, default 2 |
84-
| RDS_USER | postgres | Database user name for core registory service, default 'postgres' |
85-
| RDS_PASSWORD | NLhL*I-e54e | Database password, used while DB creation and passed down to Sunbrd RC services helm chart |
86-
| EKS_CLUSTER_NAME | ekscluster-sbrc2 | AWS EKS Cluster name |
87-
| ROLE_ARN | `arn:aws:iam::<aws-account-id>:role/Admin` | Amazon EKS mastersRole, to be associated with the system:masters RBAC group, giving super-user access to the cluster
88-
| CERT_ARN | `arn:aws:acm:ap-south-1:<aws-account-id>:certificate/<identifier>` | SSL Certificate Role ARN obtain from AWS Certificate Manager service
89-
|
90-
| RC_EXTERNAL_DOMAIN | `sunbric-rc.exmaple.com` | Domain/subdomain to be used with `registry` service and for which SSL CERT ARN is generated.
91-
|
92-
| SUNBIRD_RC_MODULES_CHOICE | RC | Modules to be installed as part of this deployment. Values may be **'R'** - Registry, **'C'** - Credentialing, **'RC'** - Registry and Credentialing. Default value is 'RC' |
93-
=======
83+
| ENVIRONMENT VARIABLES | EXAMPLE VALUE | DESCRIPTION |
84+
|----------------------------|-------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
85+
| REGION | us-east-1 | AWS region |
86+
| ACCOUNT | 123456789123 | AWS 12-digit account number |
87+
| CIDR | 10.20.0.0/16 | VPC CIDR, change it as per your environment |
88+
| MAX_AZS | 2 | AWS Availability Zone count, default 2 |
89+
| RDS_USER | postgres | Database user name for core registry service, default 'postgres' |
90+
| RDS_PASSWORD | NLhL*I-e54e | Database password, used while DB creation and passed down to Sunbird RC services Helm chart |
91+
| EKS_CLUSTER_NAME | ekscluster-sbrc2 | AWS EKS Cluster name |
92+
| ROLE_ARN | `arn:aws:iam::<aws-account-id>:role/Admin` | Amazon EKS mastersRole, to be associated with the system:masters RBAC group, giving super-user access to the cluster |
93+
| CERT_ARN | `arn:aws:acm:ap-south-1:<aws-account-id>:certificate/<identifier>` | SSL Certificate ARN obtained from AWS Certificate Manager service |
94+
| RC_EXTERNAL_DOMAIN | `sunbird-rc.example.com` | Domain/subdomain to be used with `registry` service and for which SSL CERT ARN is generated. |
95+
| SUNBIRD_RC_MODULES_CHOICE | RC | Modules to be installed as part of this deployment. Values may be **'R'** - Registry, **'C'** - Credentialing, **'RC'** - Registry and Credentialing. Default is 'RC'. |
96+
9497
**Ensure you have updated the .env file before running following commands to begin deployment.**
95-
>>>>>>> 934116f0a2f90356de78f18792b55e39e7f0a9fc
9698

9799
```
98100
# Emits the synthesized CloudFormation template
@@ -101,16 +103,30 @@ cdk synth
101103
# List CDK stack
102104
cdk list
103105
104-
# Deploy single stack - vpcstacksbrc2, rdsstacksbrc2, eksstacksbrc2,sunbirdrc2helmStacksbrc2
106+
Expected output:
107+
vpcstacksbrc2
108+
rdsstacksbrc2
109+
eksstacksbrc2
110+
vaulthelmstacksbrc2
111+
vaultinithelmstacksbrc2
112+
sunbirdrc2helmStacksbrc2
113+
114+
# Deploy single stack
105115
cdk deploy <stack_name>
106116
107-
# Alternatively you could also deploy all stacks and CDK would handle the sequence
117+
# Alternatively you could also deploy all stacks and CDK would handle the dependencies
108118
cdk deploy --all
109119
```
110120

111-
After installing all the CDK stacks, verify the AWS services in the AWS web console. The stack 'sunbirdrc2helmStacksbrc2' installs the Sunbird RC 2.0 helm chart, vault helm chart and vault init helm chart to initialize and unseal the vault in the EKS cluster. It is recommended to review the [Deployment through Helm](02-Deployment-Helm-Sunbirdrc2.md) guide to become familiar with Helm charts, services, and parameters. This will be beneficial if you opt to run the Helm chart separately from the CDK, following the "Mode Two: Direct Helm Chart Invocation" approach for installing the Sunbird RC stack.
121+
After installing all the CDK stacks, verify the AWS services in the AWS web console such as VPC, Amazon EKS cluster and RDS Postgres instance.
122+
123+
The CDK creates a private only EKS cluster. You would require to have an EC2 client machine in the same VPC where EKS is deployed. The `ROLE_ARN` variable governs Amazon EKS mastersRole, giving super-user access to the cluster. If you need to grant access to additional IAM users, groups, or roles, create the necessary [EKS access entries](https://docs.aws.amazon.com/eks/latest/userguide/creating-access-entries.html) accordingly.
124+
125+
The stack `sunbirdrc2helmStacksbrc2` installs the Sunbird RC 2.0 services' helm chart including its dependencies `vaulthelmstacksbrc2` and `vaultinithelmstacksbrc2` that initializes and unseal the vault in the EKS cluster.
126+
127+
It is recommended to review the [Deployment through Helm](02-Deployment-Helm-Sunbirdrc2.md) guide to become familiar with Sunbird RC 2.0 Helm charts.
112128

113-
Follow the post installation steps to start using Sunbird RC2.0 services
129+
Follow the post installation steps to start using Sunbird RC 2.0 services
114130

115131
* [Post Installation Procedure](03-Post-Installation-Procedure.md)
116132

‎documentation/imgs/aws-cdk-diagrams-Page-4.jpg‎

72.8 KB
Loading

‎helm/vault-init/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ type: application
1515
# This is the chart version. This version number should be incremented each time you make changes
1616
# to the chart and its templates, including the app version.
1717
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18-
version: 0.3.0
18+
version: 0.4.0
1919

2020
# This is the version number of the application being deployed. This version number should be
2121
# incremented each time you make changes to the application. Versions are not expected to

‎helm/vault-init/templates/init-sa-role.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,6 @@ rules:
1515
- secrets
1616
verbs:
1717
- create
18+
- delete
1819
- get
1920
- list

‎helm/vault-init/templates/service.yaml‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎lib/eks-ec2-stack.ts‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import * as eks from "aws-cdk-lib/aws-eks";
55
import * as iam from "aws-cdk-lib/aws-iam";
66
import { Construct } from "constructs";
77
import { ConfigProps } from "./config";
8-
import { KubectlV30Layer } from '@aws-cdk/lambda-layer-kubectl-v30'
8+
import { KubectlV31Layer } from '@aws-cdk/lambda-layer-kubectl-v31'
99

1010
export interface EksEC2StackProps extends cdk.StackProps {
1111
config: ConfigProps;
@@ -47,11 +47,12 @@ export class eksec2Stack extends cdk.Stack {
4747
vpc: vpc,
4848
vpcSubnets: [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }],
4949
defaultCapacity: 3,
50-
defaultCapacityInstance: new ec2.InstanceType("t2.large"),
51-
kubectlLayer: new KubectlV30Layer(this, "kubectl"),
52-
version: eks.KubernetesVersion.V1_30,
53-
securityGroup: securityGroupEKS,
54-
endpointAccess: eks.EndpointAccess.PUBLIC_AND_PRIVATE,
50+
defaultCapacityInstance: new ec2.InstanceType("t3.large"),
51+
kubectlLayer: new KubectlV31Layer(this, "kubectl"),
52+
version: eks.KubernetesVersion.V1_31,
53+
//securityGroup: securityGroupEKS,
54+
endpointAccess: eks.EndpointAccess.PRIVATE,
55+
//endpointAccess: eks.EndpointAccess.PUBLIC_AND_PRIVATE,
5556
ipFamily: eks.IpFamily.IP_V4,
5657
clusterName: EKS_CLUSTER_NAME,
5758
mastersRole: iamRole,
@@ -60,7 +61,7 @@ export class eksec2Stack extends cdk.Stack {
6061
outputConfigCommand: true,
6162

6263
albController: {
63-
version: eks.AlbControllerVersion.V2_8_1,
64+
version: eks.AlbControllerVersion.V2_8_2,
6465
repository: "public.ecr.aws/eks/aws-load-balancer-controller",
6566
},
6667
});

‎lib/helm-vault-stack.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ export class helmvaultStack extends cdk.Stack {
3535
},
3636
server: {
3737
affinity: "",
38+
dataStorage: {
39+
storageClass: "gp2", // Default storage class for EBS CSI driver.
40+
},
3841
ha: {
3942
enabled: true,
4043
raft: {

‎lib/vpc-stack.ts‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,10 @@ type AwsEnvStackProps = StackProps & {
88
config: Readonly<ConfigProps>;
99
};
1010

11-
// Provisons VPC with 3 Subnets (App, DB & Public)
11+
// Provisions VPC with 3 Subnets (App, DB & Public)
1212
export class vpcStack extends cdk.Stack {
1313
public readonly vpc: ec2.Vpc;
14+
1415
constructor(scope: Construct, id: string, props: AwsEnvStackProps) {
1516
super(scope, id, props);
1617

@@ -20,21 +21,19 @@ export class vpcStack extends cdk.Stack {
2021

2122
this.vpc = new ec2.Vpc(this, "sbrc2", {
2223
maxAzs: MAX_AZS,
23-
cidr: cidr,
24+
ipAddresses: ec2.IpAddresses.cidr(cidr),
2425
natGateways: 1,
2526
subnetConfiguration: [
2627
{
2728
cidrMask: 24,
2829
name: "public-",
2930
subnetType: ec2.SubnetType.PUBLIC,
3031
},
31-
3232
{
3333
cidrMask: 24,
3434
name: "app-pvt-",
3535
subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
3636
},
37-
3837
{
3938
cidrMask: 24,
4039
name: "db-pvt-",
@@ -43,4 +42,4 @@ export class vpcStack extends cdk.Stack {
4342
],
4443
});
4544
}
46-
}
45+
}

0 commit comments

Comments
 (0)