central-cli 0.6.3

data/lib/central/machine/aws/common.rb

@@ -0,0 +1,31 @@
+module Central
+  module Machine
+    module Aws
+      module Common
+        # @param [String] region
+        # @return String
+        def resolve_ami(region)
+          response = Excon.get('https://coreos.com/dist/aws/aws-stable.json')
+          images = JSON.parse(response.body)
+          info = images[region]
+          info ? info['hvm'] : nil
+        end
+
+        # @param [String] vpc_id
+        # @param [String] zone
+        # @return [Aws::EC2::Types::Subnet, NilClass]
+        def default_subnet(vpc_id, zone)
+          ec2.subnets(filters: [
+                        { name: 'vpc-id', values: [vpc_id] },
+                        { name: 'availability-zone', values: [zone] }
+                      ]).first
+        end
+
+        # @return [Aws::EC2::Types::Vpc, NilClass]
+        def default_vpc
+          ec2.vpcs(filters: [{ name: 'is-default', values: ['true'] }]).first
+        end
+      end
+    end
+  end
+end

data/lib/central/machine/aws/master_provisioner.rb

@@ -0,0 +1,171 @@
+require 'fileutils'
+require 'erb'
+require 'open3'
+require 'shell-spinner'
+require_relative 'common'
+
+module Central
+  module Machine
+    module Aws
+      class MasterProvisioner
+        include RandomName
+        include Common
+        include Machine::CertHelper
+        attr_reader :ec2, :http_client, :region
+
+        # @param [String] access_key_id aws_access_key_id
+        # @param [String] secret_key aws_secret_access_key
+        # @param [String] region
+        def initialize(access_key_id, secret_key, region)
+          @ec2 = ::Aws::EC2::Resource.new(
+            region: region,
+            credentials: ::Aws::Credentials.new(access_key_id, secret_key)
+          )
+        end
+
+        # @param [Hash] opts
+        def run!(opts)
+          ssl_cert = nil
+          if opts[:ssl_cert]
+            unless File.exist?(File.expand_path(opts[:ssl_cert]))
+              abort('Invalid ssl cert')
+            end
+            ssl_cert = File.read(File.expand_path(opts[:ssl_cert]))
+          else
+            ShellSpinner 'Generating self-signed SSL certificate' do
+              ssl_cert = generate_self_signed_cert
+            end
+          end
+
+          ami = resolve_ami(region)
+          abort('No valid AMI found for region') unless ami
+          opts[:vpc] = default_vpc.vpc_id unless opts[:vpc]
+          subnet = if opts[:subnet].nil?
+                     default_subnet(opts[:vpc], region + opts[:zone])
+                   else
+                     ec2.subnet(opts[:subnet])
+                   end
+          userdata_vars = {
+            ssl_cert: ssl_cert,
+            auth_server: opts[:auth_server],
+            version: opts[:version],
+            vault_secret: opts[:vault_secret],
+            vault_iv: opts[:vault_iv],
+            mongodb_uri: opts[:mongodb_uri]
+          }
+
+          security_group = ensure_security_group(opts[:vpc])
+          name = generate_name
+          ec2_instance = ec2.create_instances(
+            image_id: ami,
+            min_count: 1,
+            max_count: 1,
+            instance_type: opts[:type],
+            security_group_ids: [security_group.group_id],
+            key_name: opts[:key_pair],
+            subnet_id: subnet.subnet_id,
+            user_data: Base64.encode64(user_data(userdata_vars)),
+            block_device_mappings: [
+              {
+                device_name: '/dev/xvda',
+                virtual_name: 'Root',
+                ebs: {
+                  volume_size: opts[:storage],
+                  volume_type: 'gp2'
+                }
+              }
+            ]
+          ).first
+          ec2_instance.create_tags(tags: [{ key: 'Name', value: name }])
+          ShellSpinner "Creating AWS instance #{name.colorize(:cyan)} " do
+            sleep 5 until ec2_instance.reload.state.name == 'running'
+          end
+          master_url = "https://#{ec2_instance.public_ip_address}"
+          Excon.defaults[:ssl_verify_peer] = false
+          http_client = Excon.new(master_url, connect_timeout: 10)
+          ShellSpinner "Waiting for #{name.colorize(:cyan)} to start " do
+            sleep 5 until master_running?(http_client)
+          end
+
+          puts "Central Machine is now running at #{master_url}"
+          puts "Use #{"cm login --name=#{name.sub('central-machine-', '')} #{master_url}".colorize(:yellow)} to complete Central Machine setup"
+        end
+
+        # @param [String] vpc_id
+        # @return [Aws::EC2::SecurityGroup]
+        def ensure_security_group(vpc_id)
+          group_name = 'central_machine'
+          sg = ec2.security_groups(
+            filters: [
+              { name: 'group-name', values: [group_name] },
+              { name: 'vpc-id', values: [vpc_id] }
+            ]
+          ).first
+          unless sg
+            ShellSpinner 'Creating AWS security group' do
+              sg = create_security_group(group_name, vpc_id)
+            end
+          end
+          sg
+        end
+
+        # creates security_group and authorizes default port ranges
+        #
+        # @param [String] name
+        # @param [String, NilClass] vpc_id
+        # @return Aws::EC2::SecurityGroup
+        def create_security_group(name, vpc_id = nil)
+          sg = ec2.create_security_group(
+            group_name: name,
+            description: 'Central Machine',
+            vpc_id: vpc_id)
+          sg.create_tags(tags: [
+                           { key: 'Name', value: name }
+                         ])
+          sg.authorize_ingress( # SSHD
+            ip_protocol: 'tcp',
+            from_port:    22,
+            to_port:      22,
+            cidr_ip:     '24.7.32.100/32')
+          sg.authorize_ingress( # HTTPS
+            ip_protocol: 'tcp',
+            from_port:    443,
+            to_port:      443,
+            cidr_ip:     '0.0.0.0/0')
+          sg.authorize_ingress( # OAUTH
+            ip_protocol: 'tcp',
+            from_port:    5000,
+            to_port:      5000,
+            cidr_ip:     '24.7.32.100/32')
+          sg
+        end
+
+        # @return [String]
+        def region
+          ec2.client.config.region
+        end
+
+        def user_data(vars)
+          cloudinit_template = File.join(__dir__, '/cloudinit_master.yml')
+          erb(File.read(cloudinit_template), vars)
+        end
+
+        def generate_name
+          "central-machine-#{super}-#{rand(1..9)}"
+        end
+
+        def master_running?(http_client)
+          http_client.get(path: '/').status == 200
+        rescue
+          false
+        end
+
+        def erb(template, vars)
+          ERB.new(template, nil, '%<>-').result(
+            OpenStruct.new(vars).instance_eval { binding }
+          )
+        end
+      end
+    end
+  end
+end

data/lib/central/machine/aws/node_destroyer.rb

@@ -0,0 +1,46 @@
+require 'shell-spinner'
+
+module Central
+  module Machine
+    module Aws
+      class NodeDestroyer
+        attr_reader :ec2, :api_client
+
+        # @param [Central::Client] api_client Central api client
+        # @param [String] access_key_id aws_access_key_id
+        # @param [String] secret_key aws_secret_access_key
+        # @param [String] region
+        def initialize(api_client, access_key_id, secret_key, region = 'us-west-2')
+          @api_client = api_client
+          @ec2 = ::Aws::EC2::Resource.new(
+            region: region,
+            credentials: ::Aws::Credentials.new(access_key_id, secret_key)
+          )
+        end
+
+        def run!(stack, name)
+          instances = ec2.instances(filters: [
+                                      { name: 'tag:Name', values: [name] }
+                                    ])
+          abort("Cannot find AWS instance #{name}") if instances.to_a.size == 0
+          abort("There are multiple instances with name #{name}") if instances.to_a.size > 1
+          instance = instances.first
+          if instance
+            ShellSpinner "Terminating AWS instance #{name.colorize(:cyan)} " do
+              instance.terminate
+              sleep 2 until instance.reload.state.name.to_s == 'terminated'
+            end
+          else
+            abort "Cannot find instance #{name.colorize(:cyan)} in AWS"
+          end
+          node = api_client.get("stacks/#{stack['id']}/nodes")['nodes'].find { |n| n['name'] == name }
+          if node
+            ShellSpinner "Removing node #{name.colorize(:cyan)} from stack #{stack['name'].colorize(:cyan)} " do
+              api_client.delete("stacks/#{stack['id']}/nodes/#{name}")
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/central/machine/aws/node_provisioner.rb

@@ -0,0 +1,214 @@
+require 'fileutils'
+require 'erb'
+require 'open3'
+require 'shell-spinner'
+require_relative 'common'
+
+module Central
+  module Machine
+    module Aws
+      class NodeProvisioner
+        include RandomName
+        include Common
+
+        attr_reader :ec2, :api_client
+
+        # @param [Central::Client] api_client Central api client
+        # @param [String] access_key_id aws_access_key_id
+        # @param [String] secret_key aws_secret_access_key
+        # @param [String] region
+        def initialize(api_client, access_key_id, secret_key, region)
+          @api_client = api_client
+          @ec2 = ::Aws::EC2::Resource.new(
+            region: region,
+            credentials: ::Aws::Credentials.new(access_key_id, secret_key)
+          )
+        end
+
+        # @param [Hash] opts
+        def run!(opts)
+          ami = resolve_ami(region)
+          abort('No valid AMI found for region') unless ami
+
+          opts[:vpc] = default_vpc.vpc_id unless opts[:vpc]
+
+          security_group = ensure_security_group(opts[:stack], opts[:vpc])
+          name = opts[:name] || generate_name
+
+          subnet = if opts[:subnet].nil?
+                     default_subnet(opts[:vpc], region + opts[:zone])
+                   else
+                     ec2.subnet(opts[:subnet])
+                   end
+          dns_server = aws_dns_supported?(opts[:vpc]) ? '169.254.169.253' : '8.8.8.8'
+          userdata_vars = {
+            name: name,
+            version: opts[:version],
+            master_uri: opts[:master_uri],
+            stack_token: opts[:stack_token],
+            dns_server: dns_server
+          }
+
+          ec2_instance = ec2.create_instances(
+            image_id: ami,
+            min_count: 1,
+            max_count: 1,
+            instance_type: opts[:type],
+            security_group_ids: [security_group.group_id],
+            key_name: opts[:key_pair],
+            subnet_id: subnet.subnet_id,
+            user_data: Base64.encode64(user_data(userdata_vars)),
+            block_device_mappings: [
+              {
+                device_name: '/dev/xvda',
+                virtual_name: 'Root',
+                ebs: {
+                  volume_size: opts[:storage],
+                  volume_type: 'gp2'
+                }
+              }
+            ]
+          ).first
+          ec2_instance.create_tags(tags: [
+                                     { key: 'Name', value: name },
+                                     { key: 'central_stack', value: opts[:stack] }
+                                   ])
+
+          ShellSpinner "Creating AWS instance #{name.colorize(:cyan)} " do
+            sleep 5 until ec2_instance.reload.state.name == 'running'
+          end
+          node = nil
+          ShellSpinner "Waiting for node #{name.colorize(:cyan)} join to stack #{opts[:stack].colorize(:cyan)} " do
+            sleep 2 until node = instance_exists_in_stack?(opts[:stack], name)
+          end
+          labels = ["region=#{region}", "az=#{opts[:zone]}"]
+          set_labels(node, labels)
+        end
+
+        # @param [String] stack
+        # @return [Aws::EC2::SecurityGroup]
+        def ensure_security_group(stack, vpc_id)
+          group_name = "central_stack_#{stack}"
+          sg = ec2.security_groups(
+            filters: [
+              {
+                name: 'group-name',
+                values: [group_name]
+              },
+              {
+                name: 'vpc-id',
+                values: [vpc_id]
+              }
+            ]
+          ).first
+          unless sg
+            ShellSpinner 'Creating AWS security group' do
+              sg = create_security_group(group_name, vpc_id)
+            end
+          end
+          sg
+        end
+
+        # creates security_group and authorizes default port ranges
+        #
+        # @param [String] name
+        # @param [String] vpc_id
+        # @return [Aws::EC2::SecurityGroup]
+        def create_security_group(name, vpc_id)
+          sg = ec2.create_security_group(
+            group_name: name,
+            description: 'Central Stack',
+            vpc_id: vpc_id)
+          sg.create_tags(tags: [
+                           { key: 'Name', value: name }
+                         ])
+          sg.authorize_ingress( # SSHD
+            ip_protocol: 'tcp',
+            from_port: 22,
+            to_port: 22,
+            cidr_ip: '24.7.32.100/32')
+          sg.authorize_ingress( # HTTPS
+            ip_protocol: 'tcp',
+            from_port: 443,
+            to_port: 443,
+            cidr_ip: '24.7.32.100/32')
+          sg.authorize_ingress( # OAUTH
+            ip_protocol: 'tcp',
+            from_port: 5000,
+            to_port: 5000,
+            cidr_ip: '24.7.32.100/32')
+          sg.authorize_ingress( # OpenVPN
+            ip_protocol: 'udp',
+            from_port: 1194,
+            to_port: 1194,
+            cidr_ip: '0.0.0.0/0')
+          sg.authorize_ingress( # Overlay / Weave network
+            ip_permissions: [
+              {
+                from_port: 6783,
+                to_port: 6783,
+                ip_protocol: 'tcp',
+                user_id_group_pairs: [
+                  {
+                    group_id: sg.group_id,
+                    vpc_id: vpc_id
+                  }
+                ]
+              },
+              {
+                from_port: 6783,
+                to_port: 6784,
+                ip_protocol: 'udp',
+                user_id_group_pairs: [
+                  {
+                    group_id: sg.group_id,
+                    vpc_id: vpc_id
+                  }
+                ]
+              }
+            ]
+          )
+          sg
+        end
+
+        # @return [String]
+        def region
+          ec2.client.config.region
+        end
+
+        def user_data(vars)
+          cloudinit_template = File.join(__dir__, '/cloudinit.yml')
+          erb(File.read(cloudinit_template), vars)
+        end
+
+        def generate_name
+          "#{super}-#{rand(1..99)}"
+        end
+
+        def instance_exists_in_stack?(stack, name)
+          api_client.get("stacks/#{stack}/nodes")['nodes'].find { |n| n['name'] == name }
+        end
+
+        def erb(template, vars)
+          ERB.new(template).result(OpenStruct.new(vars).instance_eval { binding })
+        end
+
+        # @param [Hash] node
+        # @param [Array<String>] labels
+        def set_labels(node, labels)
+          data = {}
+          data[:labels] = labels
+          api_client.put("nodes/#{node['id']}", data, {}, 'Central-Stack-Token' => node['stack']['token'])
+        end
+
+        # @param [String] vpc_id
+        # @return [Boolean]
+        def aws_dns_supported?(vpc_id)
+          vpc = ec2.vpc(vpc_id)
+          response = vpc.describe_attribute(attribute: 'enableDnsSupport')
+          response.enable_dns_support
+        end
+      end
+    end
+  end
+end