template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  SAM Template for Deploying 3xEC2 Kubernetes Cluster

Parameters:
  # This is a security group which permits all ports from my ip only
  DevopsFireWall:
    Description: The DevOps Firewall Security Group ID
    Type: AWS::EC2::SecurityGroup::Id 
  # ID of an existing VPC to create internal firewall and deploy the machines  
  TheVPC:
    Description: ID of An existing VPC
    Type: AWS::EC2::VPC::Id   
  # AMI id - this is ubuntu 18.04 on ap-south-1  
  ImageID:
    Description: AMI id preferred to use ubuntu 18.04
    Type: AWS::EC2::Image::Id
  # Intstance type ( defines memory and processor )  
  InstanceSize:
    Description: Instance Size
    Type: String
    Default: c5.large
  # SSH key pair, will need to ssh into sometimes  
  KeyPair:
    Description: Key Pair Name - Should be existing key pair
    Type: String


Resources: 

  # delete ssm parameter from store when stack is deleted
  DeleteParameterOnStackDelete:
    Type: Custom::DeleteSSMParameter
    Properties:
      ServiceToken: !GetAtt DeleteParameterFunction.Arn
      ParameterName: !Sub "${AWS::StackName}-join-cmd"
      InstanceId: !Ref KubeMaster

  # Note: This absolutely requires the inline code with ZipFile 
  # to get the cfn-response module included 
  DeleteParameterFunction:
    Type: AWS::Lambda::Function 
    Properties:
      Handler: index.handler
      Role: !GetAtt DeleteParameterExecutionRole.Arn
      Runtime: nodejs12.x
      Timeout: 30
      Code:
        ZipFile: |      
          const AWS = require('aws-sdk');
          var response = require('cfn-response');
          const ssm = new AWS.SSM({apiVersion: '2014-11-06'});

          exports.handler = function(event, context) {
              console.log("request received:\n" + JSON.stringify(event));

              var physicalId = event.PhysicalResourceId;

              function success(data) {
                  data = data || {}
                  console.log('SUCCESS:\n', data);
                  return response.send(event, context, response.SUCCESS, data, physicalId);
              }

              function failed(err) {
                  console.log('FAILED:\n', err);
                  return response.send(event, context, response.FAILED, err, physicalId);
              }

              // ignore non-delete requests
              if (event.RequestType !== 'Delete') {
                  console.log('Non-delete request is ignored');
                  return success();
              }

              // this is the extra property on the cf custom resource
              var parameterName = event.ResourceProperties.ParameterName;
              if (!parameterName) {
                  return failed('parameterName required');
              }

              var params = {
                  Name: parameterName
                };
              ssm.deleteParameter(params)
              .promise()
              .then((data) => {
                  console.log('"DeleteParameters" Response:\n', JSON.stringify(data));
                  success();
              })
              .catch((err) => failed(err));
          };

  DeleteParameterExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
              - lambda.amazonaws.com
          Action:
            - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: ParameterDeletePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - "ssm:DeleteParameter"
                Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}-join-cmd"    

  # create an internal firewall - security group
  FireWallInternal:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Internal All Traffic Group 
      VpcId: !Ref TheVPC

  # this rule opens all ports and protocols with source as the same security group
  # when multiple ec2 is attached they can communicate internally without issues
  FireWallRuleInternal:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: "-1"
      SourceSecurityGroupId:
        Fn::GetAtt:
        - FireWallInternal
        - GroupId
      GroupId:
        Fn::GetAtt:
        - FireWallInternal
        - GroupId

  # the EC2 machine role, which is the recommended practice to provide access to aws services internally
  MachineRole: 
    Type: "AWS::IAM::Role"
    Properties: 
      AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement: 
          - 
            Effect: "Allow"
            Principal: 
              Service: 
                - "ec2.amazonaws.com"
            Action: 
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: CFN2StackAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: 
                  - "cloudformation:SignalResource"
                  - "cloudformation:DescribeStackResource"
                Resource: !Sub "${AWS::StackId}"
              - Effect: Allow
                Action:
                  - "ssm:PutParameter"
                  - "ssm:GetParameter"
                Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${AWS::StackName}-join-cmd"    

  # the EC2 Access Profile which utilizes the above machine role
  EC2AccessProfile: 
    Type: "AWS::IAM::InstanceProfile"
    Properties: 
      Path: "/"
      Roles: 
        - 
          Ref: "MachineRole"

  KubeNodeOne:
    Type: AWS::EC2::Instance
    CreationPolicy:
      ResourceSignal:
        Timeout: PT30M
    DependsOn: KubeMaster       
    Properties:
      ImageId: !Ref ImageID
      KeyName: !Ref KeyPair 
      InstanceType: !Ref InstanceSize
      IamInstanceProfile: !Ref EC2AccessProfile
      SecurityGroupIds:
        - !Ref DevopsFireWall
        - !Ref FireWallInternal
      UserData: 
        Fn::Base64: 
          Fn::Sub: |
            #!/bin/bash
            wget -q https://www.jijutm.com/downloads/kube-bootstrap.sh -O /tmp/install.sh
            . /tmp/install.sh
            aws ssm get-parameter --region ${AWS::Region} --name ${AWS::StackName}-join-cmd | grep Value | awk -F'"' '{print $4}' | base64 -d > /tmp/kube-join.sh
            . /tmp/kube-join.sh
            /usr/local/bin/cfn-signal --exit-code 0 --resource KubeNodeOne --region ${AWS::Region} --stack ${AWS::StackName}

  KubeNodeTwo:
    Type: AWS::EC2::Instance
    CreationPolicy:
      ResourceSignal:
        Timeout: PT30M    
    DependsOn: KubeMaster       
    Properties:
      ImageId: !Ref ImageID
      KeyName: !Ref KeyPair 
      InstanceType: !Ref InstanceSize
      IamInstanceProfile: !Ref EC2AccessProfile
      SecurityGroupIds:
        - !Ref DevopsFireWall
        - !Ref FireWallInternal
      UserData: 
        Fn::Base64: 
          Fn::Sub: |
            #!/bin/bash
            wget -q https://www.jijutm.com/downloads/kube-bootstrap.sh -O /tmp/install.sh
            . /tmp/install.sh
            aws ssm get-parameter --region ${AWS::Region} --name ${AWS::StackName}-join-cmd | grep Value | awk -F'"' '{print $4}' | base64 -d > /tmp/kube-join.sh
            . /tmp/kube-join.sh
            /usr/local/bin/cfn-signal --exit-code 0 --resource KubeNodeTwo --region ${AWS::Region} --stack ${AWS::StackName}

  KubeMaster:
    Type: AWS::EC2::Instance
    CreationPolicy:
      ResourceSignal:
        Timeout: PT30M    
    Properties:
      ImageId: !Ref ImageID
      KeyName: !Ref KeyPair 
      InstanceType: !Ref InstanceSize
      IamInstanceProfile: !Ref EC2AccessProfile
      SecurityGroupIds:
        - !Ref DevopsFireWall
        - !Ref FireWallInternal
      UserData: 
        Fn::Base64: 
          Fn::Sub: |
            #!/bin/bash
            wget -q https://www.jijutm.com/downloads/kube-bootstrap.sh -O /tmp/install.sh
            . /tmp/install.sh
            wget -q https://www.jijutm.com/downloads/kube-init-cluster.sh -O /tmp/init.sh
            . /tmp/init.sh
            aws ssm put-parameter --region ${AWS::Region} --name ${AWS::StackName}-join-cmd --type String --value "`cat /tmp/join.sh | base64 -w 0`"
            /usr/local/bin/cfn-signal --exit-code 0 --resource KubeMaster --region ${AWS::Region} --stack ${AWS::StackName}

  # EIP (Static IP) for only master machine
  KubeMasterEIP:
    Type: AWS::EC2::EIP
    Properties:
      InstanceId: !Ref KubeMaster     


Outputs:
  MasterPublicDNS:
    Description: "KubeMaster Public DNS Name"
    Value: !GetAtt KubeMaster.PublicDnsName
  NodeOnePublicDNS:
    Description: "KubeNodeOne Public DNS Name"
    Value: !GetAtt KubeNodeOne.PublicDnsName
  NodeTwoPublicDNS:
    Description: "KubeNodeTwo Public DNS"
    Value: !GetAtt KubeNodeTwo.PublicDnsName