docs/report/introduction/methodology_aws/aws_terraform.rst

   1 AWS Deployments
   2 ---------------
   3
   4 CSIT performance testbed deployments in AWS rely on
   5 Infrastructure-as-a-C (IaaC) Terraform AWS providers. Terraform
   6 providers specified in CSIT interact with resources provided by AWS to
   7 orchestrate virtual environment for running CSIT performance tests. For
   8 more information, see
   9 `Terraform Registry aws <https://registry.terraform.io/providers/hashicorp/aws/latest/>`_.
  10
  11 Compatibility
  12 ~~~~~~~~~~~~~
  13
  14 +-----------+----------------+
  15 | Software  | OSS Version    |
  16 +===========+================+
  17 | Terraform | 1.0.3 or newer |
  18 +-----------+----------------+
  19 | Vault     | 1.8.4 or newer |
  20 +-----------+----------------+
  21
  22 Requirements
  23 ~~~~~~~~~~~~
  24
  25 - Required Modules and Providers
  26
  27   - `Terraform Registry aws <https://registry.terraform.io/providers/hashicorp/aws/latest>`_.
  28   - `Terraform Registry null <https://registry.terraform.io/providers/hashicorp/null/latest>`_.
  29   - `Terraform Registry tls <https://registry.terraform.io/providers/hashicorp/tls>`_.
  30   - `Terraform Registry vault <https://registry.terraform.io/providers/hashicorp/vault>`_.
  31
  32 - Required software
  33
  34   - `Vault <https://releases.hashicorp.com/vault/>`_ service available
  35     on specified ip/port.
  36
  37 Deployment Example
  38 ~~~~~~~~~~~~~~~~~~
  39
  40 Following is an example of a
  41 `Terraform deploy module <https://git.fd.io/csit/tree/fdio.infra.terraform/2n_aws_c5n/main.tf>`_
  42 for a CSIT 2-Node testbed topology with AWS variables set to default
  43 values. A number of variables is also defined in a
  44 `separate Terraform variable file <https://git.fd.io/csit/tree/fdio.infra.terraform/2n_aws_c5n/variables.tf>`_.
  45
  46 ::
  47
  48   module "deploy" {
  49     source = "./deploy"
  50
  51     # Parameters starting with var. can be set using "TF_VAR_*" environment
  52     # variables or -var parameter when running "terraform apply", for default
  53     # values see ./variables.tf
  54     testbed_name          = var.testbed_name
  55     topology_name         = var.topology_name
  56     environment_name      = var.environment_name
  57     resources_name_prefix = var.resources_name_prefix
  58
  59     # AWS general
  60     region        = var.region
  61     avail_zone    = var.avail_zone
  62     instance_type = var.instance_type
  63     ami_image_tg  = var.ami_image_tg
  64     ami_image_sut = var.ami_image_sut
  65
  66     # AWS Network
  67     vpc_cidr_mgmt = "192.168.0.0/24"
  68     vpc_cidr_b    = "192.168.10.0/24"
  69     vpc_cidr_c    = "200.0.0.0/24"
  70     vpc_cidr_d    = "192.168.20.0/24"
  71
  72     tg_mgmt_ip   = "192.168.0.10"
  73     dut1_mgmt_ip = "192.168.0.11"
  74
  75     tg_if1_ip   = "192.168.10.254"
  76     tg_if2_ip   = "192.168.20.254"
  77     dut1_if1_ip = "192.168.10.11"
  78     dut1_if2_ip = "192.168.20.11"
  79
  80     trex_dummy_cidr_port_0 = "10.0.0.0/24"
  81     trex_dummy_cidr_port_1 = "20.0.0.0/24"
  82
  83     # Ansible
  84     ansible_python_executable = "/usr/bin/python3"
  85     ansible_file_path         = "../../fdio.infra.ansible/site.yaml"
  86     ansible_topology_path     = "../../fdio.infra.ansible/cloud_topology.yaml"
  87     ansible_provision_pwd     = "Csit1234"
  88
  89     # First run
  90     first_run_commands = [
  91       "sudo sed -i 's/^PasswordAuthentication/#PasswordAuthentication/' /etc/ssh/sshd_config",
  92       "sudo systemctl restart sshd",
  93       "sudo useradd --create-home -s /bin/bash provisionuser",
  94       "echo 'provisionuser:Csit1234' | sudo chpasswd",
  95       "echo 'provisionuser ALL = (ALL) NOPASSWD: ALL' | sudo tee -a /etc/sudoers",
  96       "sudo useradd --create-home -s /bin/bash testuser",
  97       "echo 'testuser:Csit1234' | sudo chpasswd",
  98       "echo 'testuser ALL = (ALL) NOPASSWD: ALL' | sudo tee -a /etc/sudoers"
  99     ]
 100   }
 101
 102 Secrets & Credentials
 103 ~~~~~~~~~~~~~~~~~~~~~
 104
 105 Set credentials manually
 106 ^^^^^^^^^^^^^^^^^^^^^^^^
 107
 108 To set the credentials manually you first need to tell the module to not
 109 fetch credentials from Vault. To do that, set `provider "aws"`
 110 `access_key` and `secret_key` to custom value or use credentials file
 111 as a source.
 112
 113 ::
 114
 115   provider "aws" {
 116     region     = var.region
 117     access_key = data.vault_aws_access_credentials.creds.access_key
 118     secret_key = data.vault_aws_access_credentials.creds.secret_key
 119   }