-
Notifications
You must be signed in to change notification settings - Fork 168
BM-1948: prover cluster update #1336
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 18 commits
Commits
Show all changes
26 commits
Select commit
Hold shift + click to select a range
7bc9c79
mv services to aws, add broker config
zeroecco 6a49fe8
update note
zeroecco d99596a
another note
zeroecco 6e52ca4
names are too long
zeroecco 12d641e
postgres needs to be a higher version
zeroecco 37ed375
use cloud-init instead
zeroecco 9fbccfa
naming is hard
zeroecco 184d5c4
note
zeroecco fc88c9d
reduce encoding
zeroecco 25f6437
reduce encoding
zeroecco 819a3ca
reduce encoding
zeroecco ff3fad2
get yaml working
zeroecco 01bc972
bento needs keys
zeroecco 3d65464
bento needs keys
zeroecco 3cbb932
bento needs access keys
zeroecco 29395bc
joiner support
zeroecco 445beac
update configs
zeroecco 7622137
Merge branch 'main' into zeroecco/prover_cluster_update
zeroecco 629c450
scope down
zeroecco 71af768
Merge branch 'zeroecco/prover_cluster_update' of github.com:boundless…
zeroecco 01d1676
revert compose changes
zeroecco a92b1ac
var update
zeroecco a73f663
use the name generator
zeroecco 178ab6e
Merge branch 'main' into zeroecco/prover_cluster_update
zeroecco 1d5ba31
need to push at launch
zeroecco ff7c083
use the correct tag name lolol
zeroecco File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
195 changes: 195 additions & 0 deletions
195
infra/prover-cluster/components/DataServicesComponent.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,195 @@ | ||
| import * as pulumi from "@pulumi/pulumi"; | ||
| import * as aws from "@pulumi/aws"; | ||
| import { BaseComponent, BaseComponentConfig } from "./BaseComponent"; | ||
|
|
||
| export interface DataServicesComponentConfig extends BaseComponentConfig { | ||
| taskDBName: string; | ||
| taskDBUsername: string; | ||
| taskDBPassword: string; | ||
| securityGroupId: pulumi.Output<string>; | ||
| rdsInstanceClass?: string; | ||
| redisNodeType?: string; | ||
| } | ||
|
|
||
| export class DataServicesComponent extends BaseComponent { | ||
| public readonly rdsInstance: aws.rds.Instance; | ||
| public readonly rdsEndpoint: pulumi.Output<string>; | ||
| public readonly redisCluster: aws.elasticache.ReplicationGroup; | ||
| public readonly redisEndpoint: pulumi.Output<string>; | ||
| public readonly s3Bucket: aws.s3.Bucket; | ||
| public readonly s3BucketName: pulumi.Output<string>; | ||
| public readonly dbSubnetGroup: aws.rds.SubnetGroup; | ||
| public readonly rdsSecurityGroup: aws.ec2.SecurityGroup; | ||
| public readonly redisSecurityGroup: aws.ec2.SecurityGroup; | ||
| public readonly redisSubnetGroup: aws.elasticache.SubnetGroup; | ||
|
|
||
| constructor(config: DataServicesComponentConfig) { | ||
| super(config, "boundless-bento"); | ||
|
|
||
| // Create DB subnet group | ||
| this.dbSubnetGroup = new aws.rds.SubnetGroup(`${config.stackName}-db-subnet-group`, { | ||
| name: this.generateName("db-subnet-group"), | ||
| subnetIds: config.privateSubnetIds, | ||
| tags: { | ||
| Environment: config.environment, | ||
| Stack: config.stackName, | ||
| Component: "data-services", | ||
| }, | ||
| }); | ||
|
|
||
| // Create RDS security group | ||
| this.rdsSecurityGroup = new aws.ec2.SecurityGroup(`${config.stackName}-rds-sg`, { | ||
| name: this.generateName("rds-sg"), | ||
| vpcId: config.vpcId, | ||
| description: "Security group for RDS PostgreSQL", | ||
| ingress: [{ | ||
| protocol: "tcp", | ||
| fromPort: 5432, | ||
| toPort: 5432, | ||
| securityGroups: [config.securityGroupId], | ||
| description: "PostgreSQL access from cluster instances", | ||
| }], | ||
| egress: [{ | ||
| protocol: "-1", | ||
| fromPort: 0, | ||
| toPort: 0, | ||
| cidrBlocks: ["0.0.0.0/0"], | ||
| description: "All outbound traffic", | ||
| }], | ||
| tags: { | ||
| Environment: config.environment, | ||
| Stack: config.stackName, | ||
| Component: "rds", | ||
| }, | ||
| }); | ||
|
|
||
| // Create Redis subnet group | ||
| // ElastiCache subnet group names must be unique across account and max 40 chars | ||
| // Use format: bb-redis-{stackName} (truncated to fit 40 chars) | ||
| const prefix = "bb-redis-"; | ||
| const maxStackNameLength = 40 - prefix.length; | ||
| const truncatedStackName = config.stackName.length > maxStackNameLength | ||
| ? config.stackName.substring(0, maxStackNameLength) | ||
| : config.stackName; | ||
| const redisSubnetGroupName = `${prefix}${truncatedStackName}`; | ||
| this.redisSubnetGroup = new aws.elasticache.SubnetGroup(`${config.stackName}-redis-subnet-group`, { | ||
| name: redisSubnetGroupName, | ||
| subnetIds: config.privateSubnetIds, | ||
| tags: { | ||
| Environment: config.environment, | ||
| Stack: config.stackName, | ||
| Component: "data-services", | ||
| }, | ||
| }); | ||
|
|
||
| // Create Redis security group | ||
| this.redisSecurityGroup = new aws.ec2.SecurityGroup(`${config.stackName}-redis`, { | ||
| name: config.stackName, | ||
| vpcId: config.vpcId, | ||
| description: "Security group for ElastiCache Redis", | ||
| ingress: [{ | ||
| protocol: "tcp", | ||
| fromPort: 6379, | ||
| toPort: 6379, | ||
| securityGroups: [config.securityGroupId], | ||
| description: "Redis access from cluster instances", | ||
| }], | ||
| egress: [{ | ||
| protocol: "-1", | ||
| fromPort: 0, | ||
| toPort: 0, | ||
| cidrBlocks: ["0.0.0.0/0"], | ||
| description: "All outbound traffic", | ||
| }], | ||
| tags: { | ||
| Environment: config.environment, | ||
| Stack: config.stackName, | ||
| Component: "redis", | ||
| }, | ||
| }); | ||
|
|
||
| // Create RDS PostgreSQL instance | ||
| this.rdsInstance = new aws.rds.Instance(`${config.stackName}`, { | ||
| identifier: this.generateName("postgres"), | ||
| engine: "postgres", | ||
| engineVersion: "17.4", | ||
| instanceClass: config.rdsInstanceClass || "db.t4g.micro", | ||
| allocatedStorage: 20, | ||
| maxAllocatedStorage: 100, | ||
| storageType: "gp3", | ||
| storageEncrypted: true, | ||
| dbName: config.taskDBName, | ||
| username: config.taskDBUsername, | ||
| password: config.taskDBPassword, | ||
| port: 5432, | ||
| publiclyAccessible: false, | ||
| dbSubnetGroupName: this.dbSubnetGroup.name, | ||
| vpcSecurityGroupIds: [this.rdsSecurityGroup.id], | ||
| skipFinalSnapshot: true, | ||
| backupRetentionPeriod: 7, | ||
| tags: { | ||
| Environment: config.environment, | ||
| Stack: config.stackName, | ||
| Component: "postgres", | ||
| }, | ||
| }); | ||
|
|
||
| // RDS endpoint is just the hostname, need to append port | ||
| this.rdsEndpoint = pulumi.interpolate`${this.rdsInstance.endpoint}:${this.rdsInstance.port}`; | ||
|
|
||
| // Create ElastiCache Redis replication group | ||
| // ElastiCache replication group IDs must be 1-40 characters | ||
| // Use a shorter name: stackName-redis (max 40 chars) | ||
| const redisGroupId = config.stackName.length > 35 | ||
| ? `${config.stackName.substring(0, 34)}-redis` | ||
| : `${config.stackName}-redis`; | ||
| this.redisCluster = new aws.elasticache.ReplicationGroup(`${config.stackName}`, { | ||
| replicationGroupId: redisGroupId, | ||
| description: `Redis cluster for ${config.stackName}`, | ||
| engine: "redis", | ||
| engineVersion: "7.1", | ||
| nodeType: config.redisNodeType || "cache.t4g.micro", | ||
| port: 6379, | ||
| parameterGroupName: "default.redis7", | ||
| numCacheClusters: 1, | ||
| subnetGroupName: this.redisSubnetGroup.name, | ||
| securityGroupIds: [this.redisSecurityGroup.id], | ||
| atRestEncryptionEnabled: true, | ||
| transitEncryptionEnabled: false, | ||
| automaticFailoverEnabled: false, | ||
| tags: { | ||
| Name: config.stackName, | ||
| Environment: config.environment, | ||
| Stack: config.stackName, | ||
| Component: "redis", | ||
| }, | ||
| }); | ||
|
|
||
| // Redis endpoint is just the hostname, need to append port | ||
| this.redisEndpoint = pulumi.interpolate`${this.redisCluster.primaryEndpointAddress}:${this.redisCluster.port}`; | ||
|
|
||
| // Create S3 bucket for workflow storage | ||
| const bucketName = this.generateName("bento-storage"); | ||
| this.s3Bucket = new aws.s3.Bucket(`${config.stackName}-storage`, { | ||
| bucket: bucketName, | ||
| forceDestroy: false, // Prevent accidental deletion | ||
| tags: { | ||
| Environment: config.environment, | ||
| Stack: config.stackName, | ||
| Component: "s3-storage", | ||
| }, | ||
| }); | ||
|
|
||
| // Block public access | ||
| new aws.s3.BucketPublicAccessBlock(`${config.stackName}-storage-pab`, { | ||
| bucket: this.s3Bucket.id, | ||
| blockPublicAcls: true, | ||
| blockPublicPolicy: true, | ||
| ignorePublicAcls: true, | ||
| restrictPublicBuckets: true, | ||
| }); | ||
|
|
||
| this.s3BucketName = this.s3Bucket.id; | ||
| } | ||
| } | ||
|
|
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.