Data-marketplace infrastructure

This code can be used to create infrasturcture which includes for services of data marketplace.

Pre-requisites:

Install git: https://linux.how2shout.com/how-to-install-git-on-aws-ec2-amazon-linux-2/
Install Terraform: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli (Required version - Terraform v1.5.7)
Install kubectl: https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/
Install awscli: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html#getting-started-install-instructions
Cognito user pool and client app
a domain name and tls certificate for the domainname.
SSO settings on the security.gov.uk

Local development

Use assume role access to run terraform plan locally.

Require AWS user account with assume role (ROLE_ARN=arn:aws:iam::855859226163:role/dm-gen-devops-role) access

Create sts session keys

export ROLE_ARN="arn:aws:iam::855859226163:role/dm-gen-devops-role"
export MFA_DEVICE_ARN="arn:aws:iam::855859226163:mfa/<MFANAME>"

aws sts assume-role \
  --role-arn "$ROLE_ARN" \
  --serial-number "$MFA_DEVICE_ARN" \
  --token-code "<MFA_CODE>" \
  --role-session-name "terraform-session"

export AWS_PROFILE=terraform-session

Alternately, the jump host (adm-instance) on AWS account can be used for deployment as well.

For Environment Creation:

There are multiple environments: dev, tst, mvp. One can create any other environment by copying one of them and updating the variables section (for example, CIDR, env name, etc). Below process is for dev envrionment creation. By replacing the dev to other environment, one can create the other environment as well

Run cd dev
Run terraform init
Run terraform plan and check the output. If the output is what you expect and there are no errors:
Run terraform apply

If CoreDNS patch failed for due to some error then run terraform apply again and then kubectl rollout restart -n kube-system deployment coredns
For SSO, define client settings on security.gov.uk (for first time, only once!)
For restricted access to the env, create cognito user pool and define app client in the userpool
Go to Paramater Store in AWS Systems Manager portal and fill in the values for the parameters for /dm/dev/*.
Generate ACM for the required domain (To be automated)
cd app.
Create .env file with parameters (dev.env file is a template file for .env)
Then run sh dm-deploy.sh install.
define a custom DNS record (CNAME) for Application Load Balancer DNS
Update the EFS backup for the newly create environment.

Destroy Resources:

If you want to destroy the dev environment:

Run sh dm-deploy.sh uninstall from the app folder.
cd dev , then run terraform destroy
remove kubernetes config for the environment.

MVP & TST environments destroyed as new test environments created by AGM in Azure Cloud.

Update the services

cd app.
Create .env file with parameters (dev.env file is a template file for .env)
Then run sh dm-deploy.sh update.

Backup and Restore

Backend database fuseki using EFS as persistence and its protected by AWS backup service. Backup restore can be done manually in the event of any data loss using AWS backup restore feature.

Add IAM users to aws_auth config if required

kubectl edit configmap aws-auth -n kube-system

mapUsers: |
    - userarn: arn:aws:iam::<AWS_ACCOUNT_ID>:user/<USERNAME>
      username: admin
      groups:
        - system:masters

Additional improvements notes

CoreDNS plugin resources created for MVP environment to avoid applying DNS patching. Dev environment is still using CoreDNS patching which is controlled through terraform variable.

TODO by Code

Generate certificate the new test domain
Add DNS record for the new environment
CI/CD for IaC & app deployment
Import AWS backup resource creation in IaC

co-cddo / data-marketplace-infrastructure Goto Github PK