Merge pull request #50 from gozer/issue/26/acl-tokens

Support for ACL Tokens
nubisproject · Jul 30, 2015 · 29a5a05 · 29a5a05
2 parents cf97e1f + 302704d
commit 29a5a05
Show file tree

Hide file tree

Showing 5 changed files with 31 additions and 4 deletions.
diff --git a/nubis/terraform/inputs.tf b/nubis/terraform/inputs.tf
@@ -81,3 +81,24 @@ variable "shared_services_security_group_id" {
   description = "ID of that SG"
 }
 
+variable "master_acl_token" {
+  description = "Master ACL Token (use uuidgen)"
+}
+
+variable "acl_down_policy" {
+  description = "Policy for when ACL master is down"
+  default = "extend-cache"
+}
+
+variable "acl_default_policy" {
+  description = "Default ACL action for anonymous users"
+  default = "allow"
+}
+
+variable "manage_iam" {
+  description = "IAM roles should be managed in which region"
+  default = {
+    us-east-1 = "1"
+    us-west-2 = "0"
+  }
+}
diff --git a/nubis/terraform/main.tf b/nubis/terraform/main.tf
@@ -9,15 +9,15 @@ resource "aws_launch_configuration" "consul" {
     image_id = "${var.ami}"
     instance_type = "m3.medium"
     key_name = "${var.key_name}"
-    iam_instance_profile = "${aws_iam_instance_profile.consul.name}"
+    iam_instance_profile = "${var.project}"
 
     security_groups = [
       "${aws_security_group.consul.id}",
       "${var.internet_security_group_id}",
       "${var.shared_services_security_group_id}",
     ]
     lifecycle { create_before_destroy = true }
-    user_data = "NUBIS_PROJECT=${var.project}\nNUBIS_ENVIRONMENT=${var.environment}\nNUBIS_DOMAIN=${var.nubis_domain}\nCONSUL_SECRET=${var.consul_secret}\nCONSUL_BOOTSTRAP_EXPECT=$(( 1 +${var.servers} ))\nCONSUL_KEY=\"${file("${var.ssl_key}")}\"\nCONSUL_CERT=\"${file("${var.ssl_cert}")}\""
+    user_data = "NUBIS_PROJECT=${var.project}\nNUBIS_ENVIRONMENT=${var.environment}\nNUBIS_DOMAIN=${var.nubis_domain}\nCONSUL_MASTER_ACL_TOKEN=${var.master_acl_token}\nCONSUL_ACL_DEFAULT_POLICY=${var.acl_default_policy}\nCONSUL_ACL_DOWN_POLICY=${var.acl_down_policy}\nCONSUL_SECRET=${var.consul_secret}\nCONSUL_BOOTSTRAP_EXPECT=$(( 1 +${var.servers} ))\nCONSUL_KEY=\"${file("${var.ssl_key}")}\"\nCONSUL_CERT=\"${file("${var.ssl_cert}")}\""
 }
 
 resource "aws_autoscaling_group" "consul" {
@@ -57,14 +57,14 @@ resource "aws_instance" "bootstrap" {
     "${var.shared_services_security_group_id}",
   ]
 
-  iam_instance_profile = "${aws_iam_instance_profile.consul.name}"
+  iam_instance_profile = "${var.project}"
 
   tags {
         Name = "Consul boostrap node (v/${var.release}.${var.build})"
         Release = "${var.release}"
   }
 
-  user_data = "NUBIS_PROJECT=${var.project}\nNUBIS_ENVIRONMENT=${var.environment}\nNUBIS_DOMAIN=${var.nubis_domain}\nCONSUL_SECRET=${var.consul_secret}\nCONSUL_BOOTSTRAP_EXPECT=$(( 1 + ${var.servers} ))\nCONSUL_KEY=\"${file("${var.ssl_key}")}\"\nCONSUL_CERT=\"${file("${var.ssl_cert}")}\""
+  user_data = "NUBIS_PROJECT=${var.project}\nNUBIS_ENVIRONMENT=${var.environment}\nNUBIS_DOMAIN=${var.nubis_domain}\nCONSUL_MASTER_ACL_TOKEN=${var.master_acl_token}\nCONSUL_ACL_DEFAULT_POLICY=${var.acl_default_policy}\nCONSUL_ACL_DOWN_POLICY=${var.acl_down_policy}\nCONSUL_SECRET=${var.consul_secret}\nCONSUL_BOOTSTRAP_EXPECT=$(( 1 + ${var.servers} ))\nCONSUL_KEY=\"${file("${var.ssl_key}")}\"\nCONSUL_CERT=\"${file("${var.ssl_cert}")}\""
 }
 
 resource "aws_security_group" "consul" {
@@ -195,11 +195,13 @@ resource "aws_route53_record" "ui" {
 }
 
 resource "aws_iam_instance_profile" "consul" {
+    count = "${lookup(var.manage_iam, var.region)}"
     name = "${var.project}"
     roles = ["${aws_iam_role.consul.name}"]
 }
 
 resource "aws_iam_role" "consul" {
+    count = "${lookup(var.manage_iam, var.region)}"
     name = "${var.project}"
     path = "/"
     assume_role_policy = <<EOF
@@ -220,6 +222,7 @@ EOF
 }
 
 resource "aws_iam_role_policy" "consul" {
+    count = "${lookup(var.manage_iam, var.region)}"
     name = "${var.project}"
     role = "${aws_iam_role.consul.id}"
     policy = <<EOF

diff --git a/nubis/terraform/sandbox/us-west-2/inputs.tf b/nubis/terraform/sandbox/us-west-2/inputs.tf
@@ -0,0 +1 @@
+../../inputs.tf
diff --git a/nubis/terraform/sandbox/us-west-2/main.tf b/nubis/terraform/sandbox/us-west-2/main.tf
@@ -0,0 +1 @@
+../../main.tf
diff --git a/nubis/terraform/terraform.tfvars-dist b/nubis/terraform/terraform.tfvars-dist
@@ -15,3 +15,4 @@ ssl_cert = "consul.pem"
 internet_security_group_id = "sg-XXXXXXXX"
 shared_services_security_group_id = "sg-XXXXXXXX"
 https_cert_arn = "arn:aws:iam::xxxxx"
+master_acl_token = "AAAAAAAA-BBBB-CCCC-DDDD-EEEEFFFF0000" # use uuidgen