From d18c114b8c702fab1293114dd452af1cecf6de89 Mon Sep 17 00:00:00 2001 From: Matt Gowie Date: Sun, 18 Feb 2024 14:41:12 -0700 Subject: [PATCH 1/5] feat: adds SSH support + tagging + upgrades ssm-agent 1.0 chore: cleans up trunk issues chore: cleans up trunk issues chore: cleans up trunk issues --- .trunk/.gitignore | 1 + .trunk/trunk.yaml | 25 +++++++++++++--------- examples/complete/main.tf | 1 + main.tf | 32 +++++++++++++++++------------ userdata.sh.tpl => userdata.sh.tmpl | 9 ++++---- variables.tf | 18 ++++++++++------ 6 files changed, 53 insertions(+), 33 deletions(-) rename userdata.sh.tpl => userdata.sh.tmpl (70%) diff --git a/.trunk/.gitignore b/.trunk/.gitignore index 1e24652..15966d0 100644 --- a/.trunk/.gitignore +++ b/.trunk/.gitignore @@ -6,3 +6,4 @@ plugins user_trunk.yaml user.yaml +tmp diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml index 241cf9c..605f25f 100644 --- a/.trunk/trunk.yaml +++ b/.trunk/trunk.yaml @@ -2,11 +2,11 @@ # To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml version: 0.1 cli: - version: 1.17.2 + version: 1.20.0 plugins: sources: - id: trunk - ref: v1.2.6 + ref: v1.4.3 uri: https://github.com/trunk-io/plugins runtimes: enabled: @@ -15,17 +15,22 @@ runtimes: - python@3.10.8 lint: enabled: - - checkov@3.0.40 + - actionlint@1.6.26 + - checkov@3.2.21 - git-diff-check - - markdownlint@0.37.0 - - prettier@3.1.0 + - markdownlint@0.39.0 + - prettier@3.2.5 - shellcheck@0.9.0 - shfmt@3.6.0 - - terrascan@1.18.3 - - tflint@0.49.0 - - trivy@0.47.0 - - trufflehog@3.63.0 - - yamllint@1.33.0 + - terrascan@1.18.11 + - tflint@0.50.3 + - trivy@0.49.1 + - trufflehog@3.67.6 + - yamllint@1.35.0 + ignore: + - linters: [shellcheck] + paths: + - userdata.sh.tmpl actions: enabled: - trunk-announce diff --git a/examples/complete/main.tf b/examples/complete/main.tf index f89f091..aabd572 100644 --- a/examples/complete/main.tf +++ b/examples/complete/main.tf @@ -1,3 +1,4 @@ +# trunk-ignore-all(trivy/AVD-AWS-0178): We don't need have VPC Flow logs. provider "aws" { region = var.region } diff --git a/main.tf b/main.tf index bc36b49..326da3f 100644 --- a/main.tf +++ b/main.tf @@ -1,32 +1,38 @@ locals { - tailscale_tags = [for k, v in module.this.tags : "tag:${v}" if k == "Name"] - userdata = templatefile("${path.module}/userdata.sh.tpl", { - routes = join(",", var.advertise_routes) - authkey = tailscale_tailnet_key.default.key - hostname = module.this.id + + name_tag = "tag:${module.this.id}" + prefixed_machine_tags = [for tag in var.machine_tags : "tag:${tag}"] + tailscale_tags = concat(local.prefixed_machine_tags, [local.name_tag]) + + userdata = templatefile("${path.module}/userdata.sh.tmpl", { + routes = join(",", var.advertise_routes) + authkey = tailscale_tailnet_key.default.key + hostname = module.this.id + tags = join(",", local.prefixed_machine_tags) + ssh_enabled = var.ssh_enabled }) } module "tailscale_subnet_router" { source = "masterpointio/ssm-agent/aws" - version = "0.17.0" + version = "1.0.0" context = module.this.context tags = module.this.tags - vpc_id = var.vpc_id - subnet_ids = var.subnet_ids - key_pair_name = var.key_pair_name + vpc_id = var.vpc_id + subnet_ids = var.subnet_ids + key_pair_name = var.key_pair_name + create_run_shell_document = var.create_run_shell_document + additional_security_group_ids = var.additional_security_group_ids - create_run_shell_document = var.create_run_shell_document session_logging_kms_key_alias = var.session_logging_kms_key_alias session_logging_enabled = var.session_logging_enabled session_logging_ssm_document_name = var.session_logging_ssm_document_name - ami = var.ami - instance_type = var.instance_type - instance_count = var.instance_count + ami = var.ami + instance_type = var.instance_type monitoring_enabled = var.monitoring_enabled associate_public_ip_address = var.associate_public_ip_address diff --git a/userdata.sh.tpl b/userdata.sh.tmpl similarity index 70% rename from userdata.sh.tpl rename to userdata.sh.tmpl index 69aae49..5101643 100644 --- a/userdata.sh.tpl +++ b/userdata.sh.tmpl @@ -1,5 +1,5 @@ #!/bin/bash -ex -exec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1 +exec > >(tee /var/log/user-data.log | logger -t user-data -s 2>/dev/console) 2>&1 # Enable ip_forward to allow advertising routes echo 'net.ipv4.ip_forward = 1' | sudo tee -a /etc/sysctl.conf @@ -19,6 +19,7 @@ sleep 5 # Start tailscale sudo tailscale up \ - --advertise-routes=${routes} \ - --authkey=${authkey} \ - --hostname=${hostname} + --advertise-routes=${routes} \ + --advertise-tags=${tags} \ + --authkey=${authkey} \ + --hostname=${hostname}%{ if ssh_enabled == true } --ssh%{ endif } diff --git a/variables.tf b/variables.tf index d3d0a6e..4f0aec1 100644 --- a/variables.tf +++ b/variables.tf @@ -86,12 +86,6 @@ variable "instance_type" { description = "The instance type to use for the Tailscale Subnet Router EC2 instance." } -variable "instance_count" { - default = 1 - type = number - description = "The number of Tailscale Subnet Router EC2 instances you would like to deploy." -} - variable "monitoring_enabled" { description = "Enable detailed monitoring of instances" type = bool @@ -108,6 +102,18 @@ variable "associate_public_ip_address" { ## Tailscale ## ############## +variable "machine_tags" { + default = [] + type = list(string) + description = "The Tailscale tags to apply to the Tailscale Subnet Router machine in addition to the full hostname tag." +} + +variable "ssh_enabled" { + type = bool + default = true + description = "Enable SSH access to the Tailscale Subnet Router EC2 instance. Defaults to true." +} + variable "advertise_routes" { default = [] type = list(string) From 26a3cb4bff44504941a135e1bba4ad126e6d22ae Mon Sep 17 00:00:00 2001 From: Matt Gowie Date: Sun, 18 Feb 2024 15:09:21 -0700 Subject: [PATCH 2/5] feat: adds ability to supply primary_tag > convention based primary_tag --- main.tf | 4 ++-- variables.tf | 8 +++++++- versions.tf | 8 -------- 3 files changed, 9 insertions(+), 11 deletions(-) diff --git a/main.tf b/main.tf index 326da3f..fc45c63 100644 --- a/main.tf +++ b/main.tf @@ -1,8 +1,8 @@ locals { - name_tag = "tag:${module.this.id}" + primary_tag = coalesce(var.primary_tag, "tag:${module.this.id}") prefixed_machine_tags = [for tag in var.machine_tags : "tag:${tag}"] - tailscale_tags = concat(local.prefixed_machine_tags, [local.name_tag]) + tailscale_tags = concat([local.primary_tag], local.prefixed_machine_tags) userdata = templatefile("${path.module}/userdata.sh.tmpl", { routes = join(",", var.advertise_routes) diff --git a/variables.tf b/variables.tf index 4f0aec1..196a3ea 100644 --- a/variables.tf +++ b/variables.tf @@ -102,10 +102,16 @@ variable "associate_public_ip_address" { ## Tailscale ## ############## +variable "primary_tag" { + default = null + type = string + description = "The primary tag to apply to the Tailscale Subnet Router machine. This must match the OAuth client's tag. If not provided, the module will use the module's ID as the primary tag, which is configured in context.tf" +} + variable "machine_tags" { default = [] type = list(string) - description = "The Tailscale tags to apply to the Tailscale Subnet Router machine in addition to the full hostname tag." + description = "Additional Tailscale tags to apply to the Tailscale Subnet Router machine in addition to `primary_tag`." } variable "ssh_enabled" { diff --git a/versions.tf b/versions.tf index 617f5f1..f523a8f 100644 --- a/versions.tf +++ b/versions.tf @@ -6,14 +6,6 @@ terraform { source = "hashicorp/aws" version = ">= 4.0" } - local = { - source = "hashicorp/local" - version = ">= 1.2" - } - null = { - source = "hashicorp/null" - version = ">= 2.0" - } tailscale = { source = "tailscale/tailscale" version = ">= 0.13.7" From d7a7f56d06b4beb1466bd58a6fe52c59c384d225 Mon Sep 17 00:00:00 2001 From: Matt Gowie Date: Sun, 18 Feb 2024 15:10:40 -0700 Subject: [PATCH 3/5] chore: adds aqua + updates README --- README.md | 8 ++++---- aqua.yaml | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 aqua.yaml diff --git a/README.md b/README.md index 3672dcc..0791da0 100644 --- a/README.md +++ b/README.md @@ -65,8 +65,6 @@ Here is an example of using this module: | ------------------------------------------------------------------------ | --------- | | [terraform](#requirement_terraform) | >= 1.0 | | [aws](#requirement_aws) | >= 4.0 | -| [local](#requirement_local) | >= 1.2 | -| [null](#requirement_null) | >= 2.0 | | [tailscale](#requirement_tailscale) | >= 0.13.7 | ## Providers @@ -79,7 +77,7 @@ Here is an example of using this module: | Name | Source | Version | | -------------------------------------------------------------------------------------------------------- | --------------------------- | ------- | -| [tailscale_subnet_router](#module_tailscale_subnet_router) | masterpointio/ssm-agent/aws | 0.17.0 | +| [tailscale_subnet_router](#module_tailscale_subnet_router) | masterpointio/ssm-agent/aws | 1.0.0 | | [this](#module_this) | cloudposse/label/null | 0.25.0 | ## Resources @@ -107,22 +105,24 @@ Here is an example of using this module: | [ephemeral](#input_ephemeral) | Indicates if the key is ephemeral. | `bool` | `false` | no | | [expiry](#input_expiry) | The expiry of the auth key in seconds. | `number` | `7776000` | no | | [id_length_limit](#input_id_length_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no | -| [instance_count](#input_instance_count) | The number of Tailscale Subnet Router EC2 instances you would like to deploy. | `number` | `1` | no | | [instance_type](#input_instance_type) | The instance type to use for the Tailscale Subnet Router EC2 instance. | `string` | `"t3.nano"` | no | | [key_pair_name](#input_key_pair_name) | The name of the key-pair to associate with the Tailscale Subnet Router EC2 instance. | `string` | `null` | no | | [label_key_case](#input_label_key_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no | | [label_order](#input_label_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no | | [label_value_case](#input_label_value_case) | Controls the letter case of ID elements (labels) as included in `id`,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
Default value: `lower`. | `string` | `null` | no | | [labels_as_tags](#input_labels_as_tags) | Set of labels (ID elements) to include as tags in the `tags` output.
Default is to include all labels.
Tags with empty values will not be included in the `tags` output.
Set to `[]` to suppress all generated tags.
**Notes:**
The value of the `name` tag, if included, will be the `id`, not the `name`.
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | 
[
 "default"
]
| no | +| [machine_tags](#input_machine_tags) | Additional Tailscale tags to apply to the Tailscale Subnet Router machine in addition to `primary_tag`. | `list(string)` | `[]` | no | | [monitoring_enabled](#input_monitoring_enabled) | Enable detailed monitoring of instances | `bool` | `true` | no | | [name](#input_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no | | [namespace](#input_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no | | [preauthorized](#input_preauthorized) | Determines whether or not the machines authenticated by the key will be authorized for the tailnet by default. | `bool` | `true` | no | +| [primary_tag](#input_primary_tag) | The primary tag to apply to the Tailscale Subnet Router machine. This must match the OAuth client's tag. If not provided, the module will use the module's ID as the primary tag, which is configured in context.tf | `string` | `null` | no | | [regex_replace_chars](#input_regex_replace_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | | [reusable](#input_reusable) | Indicates if the key is reusable or single-use. | `bool` | `true` | no | | [session_logging_enabled](#input_session_logging_enabled) | To enable CloudWatch and S3 session logging or not.
Note this does not apply to SSH sessions as AWS cannot log those sessions. | `bool` | `true` | no | | [session_logging_kms_key_alias](#input_session_logging_kms_key_alias) | Alias name for `session_logging` KMS Key.
This is only applied if 2 conditions are met: (1) `session_logging_kms_key_arn` is unset,
(2) `session_logging_encryption_enabled` = true. | `string` | `"alias/session_logging"` | no | | [session_logging_ssm_document_name](#input_session_logging_ssm_document_name) | Name for `session_logging` SSM document.
This is only applied if 2 conditions are met: (1) `session_logging_enabled` = true,
(2) `create_run_shell_document` = true. | `string` | `"SSM-SessionManagerRunShell-Tailscale"` | no | +| [ssh_enabled](#input_ssh_enabled) | Enable SSH access to the Tailscale Subnet Router EC2 instance. Defaults to true. | `bool` | `true` | no | | [stage](#input_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | [subnet_ids](#input_subnet_ids) | The Subnet IDs which the Tailscale Subnet Router EC2 instance will run in. These _should_ be private subnets. | `list(string)` | n/a | yes | | [tags](#input_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | diff --git a/aqua.yaml b/aqua.yaml new file mode 100644 index 0000000..52019ad --- /dev/null +++ b/aqua.yaml @@ -0,0 +1,14 @@ +--- +# aqua - Declarative CLI Version Manager +# https://aquaproj.github.io/ +# checksum: +# enabled: true +# require_checksum: true +# supported_envs: +# - all +registries: + - type: standard + ref: v4.137.0 # renovate: depName=aquaproj/aqua-registry +packages: + - name: hashicorp/terraform@v1.7.3 + - name: opentofu/opentofu@v1.6.1 From 02673eb1ac6eb72266deccd56f46c943092f0bf4 Mon Sep 17 00:00:00 2001 From: Matt Gowie Date: Mon, 19 Feb 2024 11:14:19 -0700 Subject: [PATCH 4/5] fix: pass primary tag to --advertise-tags + clean up naming / docs --- main.tf | 9 +++++---- userdata.sh.tmpl | 2 ++ variables.tf | 6 +++--- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/main.tf b/main.tf index fc45c63..1a1c34c 100644 --- a/main.tf +++ b/main.tf @@ -1,14 +1,15 @@ locals { - primary_tag = coalesce(var.primary_tag, "tag:${module.this.id}") - prefixed_machine_tags = [for tag in var.machine_tags : "tag:${tag}"] - tailscale_tags = concat([local.primary_tag], local.prefixed_machine_tags) + primary_tag = coalesce(var.primary_tag, module.this.id) + prefixed_primary_tag = "tag:${local.primary_tag}" + prefixed_additional_tags = [for tag in var.additional_tags : "tag:${tag}"] + tailscale_tags = concat([local.prefixed_primary_tag], local.prefixed_additional_tags) userdata = templatefile("${path.module}/userdata.sh.tmpl", { routes = join(",", var.advertise_routes) authkey = tailscale_tailnet_key.default.key hostname = module.this.id - tags = join(",", local.prefixed_machine_tags) + tags = join(",", local.tailscale_tags) ssh_enabled = var.ssh_enabled }) } diff --git a/userdata.sh.tmpl b/userdata.sh.tmpl index 5101643..39ecaf2 100644 --- a/userdata.sh.tmpl +++ b/userdata.sh.tmpl @@ -18,6 +18,8 @@ sudo systemctl enable --now tailscaled sleep 5 # Start tailscale +# We pass --advertise-tags below even though the authkey being created with those tags should result +# in the same effect. This is to be more explicit because tailscale tags are a complicated topic. sudo tailscale up \ --advertise-routes=${routes} \ --advertise-tags=${tags} \ diff --git a/variables.tf b/variables.tf index 196a3ea..29b4659 100644 --- a/variables.tf +++ b/variables.tf @@ -105,13 +105,13 @@ variable "associate_public_ip_address" { variable "primary_tag" { default = null type = string - description = "The primary tag to apply to the Tailscale Subnet Router machine. This must match the OAuth client's tag. If not provided, the module will use the module's ID as the primary tag, which is configured in context.tf" + description = "The primary tag to apply to the Tailscale Subnet Router machine. Do not include the `tag:` prefix. This must match the OAuth client's tag. If not provided, the module will use the module's ID as the primary tag, which is configured in context.tf" } -variable "machine_tags" { +variable "additional_tags" { default = [] type = list(string) - description = "Additional Tailscale tags to apply to the Tailscale Subnet Router machine in addition to `primary_tag`." + description = "Additional Tailscale tags to apply to the Tailscale Subnet Router machine in addition to `primary_tag`. These should not include the `tag:` prefix." } variable "ssh_enabled" { From f9b7b04d130ed4a03ee454691147033454d852d1 Mon Sep 17 00:00:00 2001 From: Matt Gowie Date: Mon, 19 Feb 2024 11:14:38 -0700 Subject: [PATCH 5/5] chore: trunk upgrade --- .trunk/trunk.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml index 605f25f..ce4de99 100644 --- a/.trunk/trunk.yaml +++ b/.trunk/trunk.yaml @@ -16,7 +16,7 @@ runtimes: lint: enabled: - actionlint@1.6.26 - - checkov@3.2.21 + - checkov@3.2.22 - git-diff-check - markdownlint@0.39.0 - prettier@3.2.5 @@ -26,7 +26,7 @@ lint: - tflint@0.50.3 - trivy@0.49.1 - trufflehog@3.67.6 - - yamllint@1.35.0 + - yamllint@1.35.1 ignore: - linters: [shellcheck] paths: