From bcc8b334d1961894b54c080f3d58032aacb1a048 Mon Sep 17 00:00:00 2001 From: pmikus Date: Fri, 27 Aug 2021 07:24:38 +0000 Subject: Infra: Minor terraform cleanup Signed-off-by: pmikus Change-Id: I1f6c9b2f9e3ac607fac76b12100992d901820e38 --- .../alertmanager/conf/nomad/alertmanager.hcl | 5 + .../1n_nmd/alertmanager/providers.tf | 13 +++ .../1n_nmd/alertmanager/versions.tf | 13 --- .../1n_nmd/grafana/conf/nomad/grafana.hcl | 12 +-- fdio.infra.terraform/1n_nmd/grafana/providers.tf | 13 +++ fdio.infra.terraform/1n_nmd/grafana/versions.tf | 13 --- fdio.infra.terraform/1n_nmd/minio/providers.tf | 13 +++ fdio.infra.terraform/1n_nmd/minio/versions.tf | 13 --- .../1n_nmd/nginx/conf/nomad/nginx.hcl | 104 +++++++++++---------- fdio.infra.terraform/1n_nmd/nginx/providers.tf | 13 +++ fdio.infra.terraform/1n_nmd/nginx/versions.tf | 13 --- .../1n_nmd/prometheus/conf/nomad/prometheus.hcl | 5 + .../1n_nmd/prometheus/providers.tf | 13 +++ fdio.infra.terraform/1n_nmd/prometheus/versions.tf | 13 --- fdio.infra.terraform/1n_nmd/terraform.tfstate | 88 +++++++++-------- .../1n_nmd/terraform.tfstate.backup | 20 ++-- .../1n_nmd/vpp_device/providers.tf | 13 +++ fdio.infra.terraform/1n_nmd/vpp_device/versions.tf | 13 --- 18 files changed, 202 insertions(+), 188 deletions(-) create mode 100644 fdio.infra.terraform/1n_nmd/alertmanager/providers.tf delete mode 100644 fdio.infra.terraform/1n_nmd/alertmanager/versions.tf create mode 100644 fdio.infra.terraform/1n_nmd/grafana/providers.tf delete mode 100644 fdio.infra.terraform/1n_nmd/grafana/versions.tf create mode 100644 fdio.infra.terraform/1n_nmd/minio/providers.tf delete mode 100644 fdio.infra.terraform/1n_nmd/minio/versions.tf create mode 100644 fdio.infra.terraform/1n_nmd/nginx/providers.tf delete mode 100644 fdio.infra.terraform/1n_nmd/nginx/versions.tf create mode 100644 fdio.infra.terraform/1n_nmd/prometheus/providers.tf delete mode 100644 fdio.infra.terraform/1n_nmd/prometheus/versions.tf create mode 100644 fdio.infra.terraform/1n_nmd/vpp_device/providers.tf delete mode 100644 fdio.infra.terraform/1n_nmd/vpp_device/versions.tf diff --git a/fdio.infra.terraform/1n_nmd/alertmanager/conf/nomad/alertmanager.hcl b/fdio.infra.terraform/1n_nmd/alertmanager/conf/nomad/alertmanager.hcl index 6b0d669d0e..ab92761ac2 100644 --- a/fdio.infra.terraform/1n_nmd/alertmanager/conf/nomad/alertmanager.hcl +++ b/fdio.infra.terraform/1n_nmd/alertmanager/conf/nomad/alertmanager.hcl @@ -123,6 +123,11 @@ job "${job_name}" { value = "arm64" } + constraint { + attribute = "$${node.class}" + value = "builder" + } + # The "task" stanza creates an individual unit of work, such as a Docker # container, web application, or batch processing. # diff --git a/fdio.infra.terraform/1n_nmd/alertmanager/providers.tf b/fdio.infra.terraform/1n_nmd/alertmanager/providers.tf new file mode 100644 index 0000000000..1399201d21 --- /dev/null +++ b/fdio.infra.terraform/1n_nmd/alertmanager/providers.tf @@ -0,0 +1,13 @@ +terraform { + required_providers { + nomad = { + source = "hashicorp/nomad" + version = "~> 1.4.9" + } + template = { + source = "hashicorp/template" + version = "~> 2.1.2" + } + } + required_version = ">= 1.0.3" +} diff --git a/fdio.infra.terraform/1n_nmd/alertmanager/versions.tf b/fdio.infra.terraform/1n_nmd/alertmanager/versions.tf deleted file mode 100644 index 960bd4bba6..0000000000 --- a/fdio.infra.terraform/1n_nmd/alertmanager/versions.tf +++ /dev/null @@ -1,13 +0,0 @@ -terraform { - required_providers { - nomad = { - source = "hashicorp/nomad" - version = "~> 1.4.9" - } - template = { - source = "hashicorp/template" - version = "~> 2.1.2" - } - } - required_version = ">= 0.13" -} diff --git a/fdio.infra.terraform/1n_nmd/grafana/conf/nomad/grafana.hcl b/fdio.infra.terraform/1n_nmd/grafana/conf/nomad/grafana.hcl index a759abc4f7..0faace1b62 100644 --- a/fdio.infra.terraform/1n_nmd/grafana/conf/nomad/grafana.hcl +++ b/fdio.infra.terraform/1n_nmd/grafana/conf/nomad/grafana.hcl @@ -123,6 +123,11 @@ job "${job_name}" { value = "arm64" } + constraint { + attribute = "$${node.class}" + value = "builder" + } + # The "task" stanza creates an individual unit of work, such as a Docker # container, web application, or batch processing. # @@ -148,7 +153,6 @@ job "${job_name}" { "secrets/dashboards.yml:/etc/grafana/provisioning/dashboards/dashboards.yml", "secrets/grafana.ini:/etc/grafana/grafana.ini", "secrets/node_exporter.json:/etc/grafana/provisioning/dashboards/node_exporter.json", - "secrets/docker_cadvisor.json:/etc/grafana/provisioning/dashboards/docker_cadvisor.json", "secrets/nomad.json:/etc/grafana/provisioning/dashboards/nomad.json", "secrets/consul.json:/etc/grafana/provisioning/dashboards/consul.json", "secrets/prometheus.json:/etc/grafana/provisioning/dashboards/prometheus.json", @@ -163,12 +167,6 @@ job "${job_name}" { destination = "secrets/" } - artifact { - # Docker cAdvisor - source = "https://raw.githubusercontent.com/pmikus/grafana-dashboards/main/docker_cadvisor.json" - destination = "secrets/" - } - artifact { # Nomad source = "https://raw.githubusercontent.com/pmikus/grafana-dashboards/main/nomad.json" diff --git a/fdio.infra.terraform/1n_nmd/grafana/providers.tf b/fdio.infra.terraform/1n_nmd/grafana/providers.tf new file mode 100644 index 0000000000..1399201d21 --- /dev/null +++ b/fdio.infra.terraform/1n_nmd/grafana/providers.tf @@ -0,0 +1,13 @@ +terraform { + required_providers { + nomad = { + source = "hashicorp/nomad" + version = "~> 1.4.9" + } + template = { + source = "hashicorp/template" + version = "~> 2.1.2" + } + } + required_version = ">= 1.0.3" +} diff --git a/fdio.infra.terraform/1n_nmd/grafana/versions.tf b/fdio.infra.terraform/1n_nmd/grafana/versions.tf deleted file mode 100644 index 960bd4bba6..0000000000 --- a/fdio.infra.terraform/1n_nmd/grafana/versions.tf +++ /dev/null @@ -1,13 +0,0 @@ -terraform { - required_providers { - nomad = { - source = "hashicorp/nomad" - version = "~> 1.4.9" - } - template = { - source = "hashicorp/template" - version = "~> 2.1.2" - } - } - required_version = ">= 0.13" -} diff --git a/fdio.infra.terraform/1n_nmd/minio/providers.tf b/fdio.infra.terraform/1n_nmd/minio/providers.tf new file mode 100644 index 0000000000..1399201d21 --- /dev/null +++ b/fdio.infra.terraform/1n_nmd/minio/providers.tf @@ -0,0 +1,13 @@ +terraform { + required_providers { + nomad = { + source = "hashicorp/nomad" + version = "~> 1.4.9" + } + template = { + source = "hashicorp/template" + version = "~> 2.1.2" + } + } + required_version = ">= 1.0.3" +} diff --git a/fdio.infra.terraform/1n_nmd/minio/versions.tf b/fdio.infra.terraform/1n_nmd/minio/versions.tf deleted file mode 100644 index 960bd4bba6..0000000000 --- a/fdio.infra.terraform/1n_nmd/minio/versions.tf +++ /dev/null @@ -1,13 +0,0 @@ -terraform { - required_providers { - nomad = { - source = "hashicorp/nomad" - version = "~> 1.4.9" - } - template = { - source = "hashicorp/template" - version = "~> 2.1.2" - } - } - required_version = ">= 0.13" -} diff --git a/fdio.infra.terraform/1n_nmd/nginx/conf/nomad/nginx.hcl b/fdio.infra.terraform/1n_nmd/nginx/conf/nomad/nginx.hcl index 1382060ba6..3bbbe5309f 100644 --- a/fdio.infra.terraform/1n_nmd/nginx/conf/nomad/nginx.hcl +++ b/fdio.infra.terraform/1n_nmd/nginx/conf/nomad/nginx.hcl @@ -85,14 +85,14 @@ job "${job_name}" { # The "count" parameter specifies the number of the task groups that should # be running under this group. This value must be non-negative and defaults # to 1. - count = 1 + count = 1 # https://www.nomadproject.io/docs/job-specification/volume %{ if use_host_volume } volume "prod-volume1-nginx" { - type = "host" - read_only = false - source = "${host_volume}" + type = "host" + read_only = false + source = "${host_volume}" } %{ endif } @@ -102,10 +102,29 @@ job "${job_name}" { # https://www.nomadproject.io/docs/job-specification/restart # restart { - interval = "30m" - attempts = 40 - delay = "15s" - mode = "delay" + interval = "30m" + attempts = 40 + delay = "15s" + mode = "delay" + } + + # The constraint allows restricting the set of eligible nodes. Constraints + # may filter on attributes or client metadata. + # + # For more information and examples on the "volume" stanza, please see + # the online documentation at: + # + # https://www.nomadproject.io/docs/job-specification/constraint + # + constraint { + attribute = "$${attr.cpu.arch}" + operator = "!=" + value = "arm64" + } + + constraint { + attribute = "$${node.class}" + value = "builder" } # The "task" stanza creates an individual unit of work, such as a Docker @@ -119,26 +138,23 @@ job "${job_name}" { task "prod-task1-nginx" { # The "driver" parameter specifies the task driver that should be used to # run the task. - driver = "docker" + driver = "docker" # The "config" stanza specifies the driver configuration, which is passed # directly to the driver to start the task. The details of configurations # are specific to each driver, so please see specific driver # documentation for more information. config { - image = "nginx:stable" + image = "nginx:stable" port_map { - https = 443 + https = 443 } - privileged = false - volumes = [ - "/etc/ssl/certs/docs.nginx.service.consul.crt:/etc/ssl/certs/docs.nginx.service.consul.crt", - "/etc/ssl/private/docs.nginx.service.consul.key:/etc/ssl/private/docs.nginx.service.consul.key", + privileged = false + volumes = [ "/etc/ssl/certs/logs.nginx.service.consul.crt:/etc/ssl/certs/logs.nginx.service.consul.crt", "/etc/ssl/private/logs.nginx.service.consul.key:/etc/ssl/private/logs.nginx.service.consul.key", "custom/upstream.conf:/etc/nginx/conf.d/upstream.conf", - "custom/logs.conf:/etc/nginx/conf.d/logs.conf", - "custom/docs.conf:/etc/nginx/conf.d/docs.conf" + "custom/server_logs.conf:/etc/nginx/conf.d/server_logs.conf" ] } @@ -166,14 +182,30 @@ job "${job_name}" { server { listen 443 ssl default_server; server_name logs.nginx.service.consul; - keepalive_timeout 70; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; + + ssl_certificate /etc/ssl/certs/logs.nginx.service.consul.crt; + ssl_certificate_key /etc/ssl/private/logs.nginx.service.consul.key; ssl_protocols TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384"; - ssl_certificate /etc/ssl/certs/logs.nginx.service.consul.crt; - ssl_certificate_key /etc/ssl/private/logs.nginx.service.consul.key; + ssl_session_timeout 10m; + ssl_session_cache shared:SSL:10m; + ssl_session_tickets off; + ssl_stapling on; + ssl_stapling_verify on; + + fastcgi_hide_header X-Powered-By; + + client_max_body_size 0; + client_header_timeout 60; + client_body_timeout 86400; + fastcgi_read_timeout 86400; + proxy_connect_timeout 60; + proxy_read_timeout 86400; + proxy_send_timeout 86400; + send_timeout 86400; + + keepalive_timeout 70; location / { chunked_transfer_encoding off; proxy_connect_timeout 300; @@ -220,32 +252,6 @@ job "${job_name}" { EOH destination = "custom/logs.conf" } - template { - data = <