[terraform] create comm database on aws rds startup
ClosedPublic
Actions

Authored by will on Jul 8 2024, 5:37 AM.

Details

Reviewers

bartek
varun

Commits

rCOMMcda5310213fd: [terraform] create comm database on aws rds startup

Summary

Our scripts take care of creating the comm database. However, AWS RDS initializes empty, causing
ecs tasks running the keyserver image to fail. This uses a null_resource to setup the comm database before launching keyserver nodes

Depends on D12688

Test Plan

On terraform apply, I no longer need to mysql remotely into aws rds to create the comm database. The comm database is first created and then the ecs tasks are launched

Diff Detail

Repository

rCOMM Comm

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

will created this revision.Jul 8 2024, 5:37 AM

Herald added subscribers: tomek, ashoat. · View Herald TranscriptJul 8 2024, 5:37 AM

will edited the summary of this revision. (Show Details)Jul 8 2024, 5:38 AM

will added a parent revision: D12688: [terraform] make aws rds instance class configurable for self-hosting.

will added a child revision: D12690: [terraform] restrict redis access to ecs keyserver service only.

Harbormaster returned this revision to the author for changes because remote builds failed.Jul 8 2024, 6:04 AM

Harbormaster failed remote builds in B30193: Diff 42105!

rebase

Harbormaster completed remote builds in B30222: Diff 42143.Jul 9 2024, 6:56 AM

will requested review of this revision.Jul 9 2024, 6:56 AM

run this command every time

Harbormaster completed remote builds in B30272: Diff 42213.Jul 10 2024, 2:42 PM

varun accepted this revision.Jul 10 2024, 11:58 PM

varun added inline comments.

services/terraform/self-host/aws_db.tf
104 ↗	(On Diff #42213)	what does this line do?

This revision is now accepted and ready to land.Jul 10 2024, 11:58 PM

this solution is pretty neat

will added inline comments.Jul 11 2024, 8:32 AM

services/terraform/self-host/aws_db.tf
104 ↗	(On Diff #42213)	So this ensures that the command is constantly run on every `terraform apply` as the changing timestamp always triggers the null resource. This might be overkill, but the case I'm accounting for is if AWS RDS needs to be relaunched or the database was dropped (which I had to do for testing) and the null_resource isn't destroyed with it. I think it's safe to put in for now, and maybe we can rethink how useful it is later

remove timestamp trigger, running only on first rds creation

will added inline comments.Jul 17 2024, 9:02 AM

services/terraform/self-host/aws_db.tf
104 ↗	(On Diff #42213)	Ended up removing this. When one need to switch ip addresses, this prevents you from running terraform apply

Harbormaster completed remote builds in B30419: Diff 42391.Jul 17 2024, 9:33 AM

Closed by commit rCOMMcda5310213fd: [terraform] create comm database on aws rds startup (authored by will). · Explain WhyJul 17 2024, 7:01 PM

This revision was automatically updated to reflect the committed changes.

will added a commit: rCOMMcda5310213fd: [terraform] create comm database on aws rds startup.

Revision Contents
Changeset List

Path

Size

services/

terraform/

self-host/

aws_db.tf

14 lines

keyserver_primary.tf

2 lines

Diff 42442

View Options

services/terraform/self-host/aws_db.tf

		locals {
		mariadb_database_name = local.local_with_default_environment_vars.COMM_DATABASE_DATABASE
		mariadb_username = local.local_with_default_environment_vars.COMM_DATABASE_USER
		mariadb_password = local.local_with_default_environment_vars.COMM_DATABASE_PASSWORD
		mariadb_port = jsondecode(local.local_with_default_environment_vars.COMM_DATABASE_PORT)
		}

# MariaDB Security Group		# MariaDB Security Group
resource "aws_security_group" "keyserver_mariadb_security_group" {		resource "aws_security_group" "keyserver_mariadb_security_group" {
name = "keyserver-mariadb-sg"		name = "keyserver-mariadb-sg"
description = "Allow inbound traffic on port 3307 and all outbound traffic"		description = "Allow inbound traffic on port 3307 and all outbound traffic"
vpc_id = local.vpc_id		vpc_id = local.vpc_id

# Inbound rules		# Inbound rules
ingress {		ingress {
from_port = 3307		from_port = local.mariadb_port
to_port = 3307		to_port = local.mariadb_port
protocol = "tcp"		protocol = "tcp"
security_groups = [aws_security_group.keyserver_service.id]		security_groups = [aws_security_group.keyserver_service.id]
}		}

ingress {		ingress {
from_port = 3307		from_port = local.mariadb_port
to_port = 3307		to_port = local.mariadb_port
protocol = "tcp"		protocol = "tcp"
cidr_blocks = ["${var.allowed_ip}/32"]		cidr_blocks = ["${var.allowed_ip}/32"]
}		}

# Outbound rules		# Outbound rules
egress {		egress {
from_port = 0		from_port = 0
to_port = 0		to_port = 0
Show All 9 Lines	resource "aws_db_instance" "mariadb" {
storage_type = "gp3"		storage_type = "gp3"
db_name = "mariadb"		db_name = "mariadb"
identifier = "mariadb-instance"		identifier = "mariadb-instance"
engine = "mariadb"		engine = "mariadb"
engine_version = "10.11"		engine_version = "10.11"
instance_class = "db.m6g.large"		instance_class = "db.m6g.large"
db_subnet_group_name = aws_db_subnet_group.public_db_subnet_group.name		db_subnet_group_name = aws_db_subnet_group.public_db_subnet_group.name
vpc_security_group_ids = [aws_security_group.keyserver_mariadb_security_group.id]		vpc_security_group_ids = [aws_security_group.keyserver_mariadb_security_group.id]
username = var.mariadb_username		username = local.mariadb_username
password = var.mariadb_password		password = local.mariadb_password
parameter_group_name = aws_db_parameter_group.mariadb_parameter_group.name		parameter_group_name = aws_db_parameter_group.mariadb_parameter_group.name
storage_encrypted = true		storage_encrypted = true
publicly_accessible = true		publicly_accessible = true
port = 3307		port = local.mariadb_port
skip_final_snapshot = true		skip_final_snapshot = true
}		}

# MariaDB Parameter Group		# MariaDB Parameter Group
resource "aws_db_parameter_group" "mariadb_parameter_group" {		resource "aws_db_parameter_group" "mariadb_parameter_group" {
name = "mariadb-parameter-group"		name = "mariadb-parameter-group"
family = "mariadb10.11"		family = "mariadb10.11"

▲ Show 20 Lines • Show All 41 Lines • ▼ Show 20 Lines	resource "aws_db_parameter_group" "mariadb_parameter_group" {
}		}
}		}

resource "null_resource" "create_comm_database" {		resource "null_resource" "create_comm_database" {
depends_on = [aws_db_instance.mariadb, aws_security_group.keyserver_mariadb_security_group]		depends_on = [aws_db_instance.mariadb, aws_security_group.keyserver_mariadb_security_group]

provisioner "local-exec" {		provisioner "local-exec" {
command = <<EOT		command = <<EOT
mysql --user=${var.mariadb_username} \		mysql --user=${local.mariadb_username} \
--port=3307 \		--port=${local.mariadb_port} \
--host=${aws_db_instance.mariadb.address} \		--host=${aws_db_instance.mariadb.address} \
--execute="CREATE DATABASE IF NOT EXISTS comm;" \		--execute="CREATE DATABASE IF NOT EXISTS ${local.mariadb_database_name};" \
--password=${var.mariadb_password}		--password=${local.mariadb_password}
EOT		EOT
}		}
}		}