bootstrap.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: Docker Swarm cluster deployed with InfraKit 

Mappings:
  AMI:
    # Ubuntu 16.04 HVM
    eu-central-1:
      Ubuntu: ami-2830f947
    eu-west-1:
      Ubuntu: ami-98ecb7fe
    us-east-1:
      Ubuntu: ami-f0768de6
    us-west-1:
      Ubuntu: ami-79df8219
    us-west-2:
      Ubuntu: ami-d206bdb2
  VpcCidrs:
    subnet1:
      cidr: 192.168.2.0/24
    vpc:
      cidr: 192.168.0.0/16

Parameters:
  BootstrapInstanceType:
    Type: String
    AllowedValues:
    - t2.nano
    - t2.micro
    - t2.small
    - t2.medium
    - t2.large
    - m3.medium
    - m4.large
    ConstraintDescription: Must be a valid EC2 HVM instance type
    Default: t2.micro
    Description: EC2 HVM instance type (t2.micro, m3.medium, etc)
  InstanceType:
    Type: String
    AllowedValues:
    - t2.micro
    - t2.small
    - t2.medium
    - t2.large
    - m3.medium
    - m4.large
    ConstraintDescription: Must be a valid EC2 HVM instance type
    Default: t2.micro
    Description: EC2 HVM instance type (t2.micro, m3.medium, etc)
  BootstrapKeyName:
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair
    Description: Name of an existing EC2 KeyPair to enable SSH access to the bootstrap instances
    MinLength: '1'
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
    MinLength: '1'
  InfraKitConfigurationBaseURL:
    Type: String
    ConstraintDescription: must be an URL
    Description: Base URL for InfraKit configuration. there should be a bootstrap.sh, a variables.ikt and a config.tpl file
    Default: https://raw.githubusercontent.com/ndegory/swarm-infrakit/master
    AllowedPattern: "https?://[0-9a-z\\.-]+\\.[a-z\\.]{2,6}[/\\w\\.-]*/?"
  AufsVolumeSize:
    Type: Number
    Description: Size in GB of the EBS volume for the Docker AUFS storage on each node
    Default: 26

Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock:
        Fn::FindInMap:
        - VpcCidrs
        - vpc
        - cidr
      EnableDnsHostnames: 'true'
      EnableDnsSupport: 'true'
      Tags:
      - Key: Name
        Value:
          Fn::Join:
          - '-'
          - - Ref: AWS::StackName
            - VPC
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    DependsOn: Vpc
    Properties:
      Tags:
      - Key: Name
        Value:
          Fn::Join:
          - '-'
          - - Ref: AWS::StackName
            - IGW
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    DependsOn:
    - Vpc
    - InternetGateway
    Properties:
      InternetGatewayId:
        Ref: InternetGateway
      VpcId:
        Ref: Vpc
  RouteViaIgw:
    Type: AWS::EC2::RouteTable
    DependsOn: Vpc
    Properties:
      Tags:
      - Key: Name
        Value:
          Fn::Join:
          - '-'
          - - Ref: AWS::StackName
            - RT
      VpcId:
        Ref: Vpc
  PublicRouteViaIgw:
    Type: AWS::EC2::Route
    DependsOn:
    - AttachGateway
    - RouteViaIgw
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: InternetGateway
      RouteTableId:
        Ref: RouteViaIgw
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: InternetGateway
    Properties:
      GroupDescription: VPC-wide security group
      SecurityGroupIngress:
      - CidrIp:
          Fn::FindInMap:
          - VpcCidrs
          - vpc
          - cidr
        IpProtocol: '-1'
      - CidrIp: 0.0.0.0/0
        IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
      - CidrIp: 0.0.0.0/0
        IpProtocol: tcp
        FromPort: '80'
        ToPort: '80'
      - CidrIp: 0.0.0.0/0
        IpProtocol: tcp
        FromPort: '443'
        ToPort: '443'
      VpcId:
        Ref: Vpc
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    DependsOn: Vpc
    Properties:
      AvailabilityZone:
        Fn::Select:
        - '0'
        - Fn::GetAZs:
            Ref: AWS::Region
      CidrBlock:
        Fn::FindInMap:
        - VpcCidrs
        - subnet1
        - cidr
      MapPublicIpOnLaunch: true
      Tags:
      - Key: Name
        Value:
          Fn::Join:
          - '-'
          - - Ref: AWS::StackName
            - PublicSubnet1
      VpcId:
        Ref: Vpc
  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn:
    - PublicSubnet1
    - RouteViaIgw
    Properties:
      RouteTableId:
        Ref: RouteViaIgw
      SubnetId:
        Ref: PublicSubnet1
  ProvisionerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
        Version: '2012-10-17'
      Path: /
  ProvisionerPolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action: 
          - 'ec2:Describe*'
          - 'ec2:Get*'
          - 'ec2:CreateTags'
          Resource: '*'
          Effect: Allow
        - Action: 
          - 'ec2:RunInstances'
          - 'ec2:StartInstances'
          - 'ec2:StopInstances'
          - 'ec2:RebootInstances'
          - 'ec2:TerminateInstances'
          - 'ec2:AttachVolume'
          - 'ec2:DetachVolume'
          Resource: !Sub 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/*'
          Condition: 
            StringEquals:
              "ec2:vpc": !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${Vpc}"
          Effect: Allow
        - Action: 
          - 'ec2:RunInstances'
          - 'ec2:StartInstances'
          - 'ec2:StopInstances'
          - 'ec2:RebootInstances'
          - 'ec2:TerminateInstances'
          - 'ec2:AttachVolume'
          - 'ec2:DetachVolume'
          Resource: !Sub 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:instance/*'
          Condition: 
            StringEquals:
              "ec2:InstanceProfile": !Sub "arn:aws:iam::${AWS::AccountId}:instance-profile/${ClusterInstanceProfile}"
          Effect: Allow
        - Action: 
          - 'ec2:RunInstances'
          Resource:
          - !Sub 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:volume/*'
          - !Sub 'arn:aws:ec2:${AWS::Region}::image/*'
          - !Sub 'arn:aws:ec2:${AWS::Region}::snapshot/*'
          - !Sub 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:network-interface/*'
          - !Sub 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:key-pair/*'
          - !Sub 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:security-group/*'
          Effect: Allow
        - Action: 
          - 'iam:PassRole'
          Resource: !Sub 'arn:aws:iam::${AWS::AccountId}:role/${ClusterRole}'
          Effect: Allow
        Version: '2012-10-17'
      PolicyName: provisioner-policy
      Roles:
      - Ref: ProvisionerRole
  ProvisionerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - Ref: ProvisionerRole
  ClusterRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
        Version: '2012-10-17'
      Path: /
  ClusterPolicies:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
        - Action: 
          - 'ec2:DescribeVolume*'
          - 'ec2:AttachVolume'
          - 'ec2:CreateVolume'
          - 'ec2:CreateTags'
          - 'ec2:ModifyInstanceAttribute'
          Resource: '*'
          Effect: Allow
        Version: '2012-10-17'
      PolicyName: cluster-policy
      Roles:
      - Ref: ClusterRole
  ClusterInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
      - Ref: ClusterRole
  BootstrapInstance:
    Type: AWS::EC2::Instance
    DependsOn: PublicSubnet1
    Properties:
      SubnetId: !Ref PublicSubnet1
      SecurityGroupIds:
        - !GetAtt SecurityGroup.GroupId
      AvailabilityZone: !GetAtt PublicSubnet1.AvailabilityZone
      IamInstanceProfile: !Ref ProvisionerInstanceProfile
      ImageId:
        Fn::FindInMap:
        - AMI
        - Ref: AWS::Region
        - Ubuntu
      InstanceType: !Ref BootstrapInstanceType
      PrivateIpAddress: "192.168.2.254"
      KeyName: !Ref BootstrapKeyName
      Tags:
      - Key: Name
        Value:
          Fn::Join:
          - '-'
          - - Ref: AWS::StackName
            - controller
      - Key: infrakit.group
        Value: swarm-managers
      - Key: infrakit.role
        Value: managers
      UserData:
        "Fn::Base64":
          !Sub
            - |
              #cloud-config
              repo_update: true
              repo_upgrade: security
              packages:
                - ca-certificates
                - jq
                - git
                - curl
                - unzip
              write_files:
                - path: /root/.config/infrakit/infrakit/env.ikt
                  content: |
                    {{/* Global variables */}}
                    {{ global "/aws/region" "${region}" }}
                    {{ global "/aws/stackname" "${stackname}" }}
                    {{ global "/aws/vpcid" "${Vpc}" }}
                    {{ global "/aws/subnetid" "${PublicSubnet1}" }}
                    {{ global "/aws/securitygroupid" "${SecurityGroup}" }}
                    {{ global "/aws/amiid" "${ami}" }}
                    {{ global "/aws/instancetype" "${InstanceType}" }}
                    {{ global "/aws/instanceprofile" "${ClusterInstanceProfile}" }}
                    {{ global "/aws/keyname" "${KeyName}" }}
                    {{ global "/script/baseurl" "${InfraKitConfigurationBaseURL}" }}
                    {{ global "/docker/aufs/size" "${AufsVolumeSize}" }}
              runcmd:
                - wget -qO- https://get.docker.com/ | sh
                - usermod -G docker ubuntu
                - systemctl enable docker.service
                - systemctl start docker.service
                - curl ${InfraKitConfigurationBaseURL}/bootstrap.sh -o /usr/local/bin/bootstrap.sh
                - bash /usr/local/bin/bootstrap.sh -p aws ${InfraKitConfigurationBaseURL}
            - { ami: !FindInMap [ AMI, !Ref "AWS::Region", Ubuntu ], stackname: !Ref "AWS::StackName", region: !Ref "AWS::Region" }

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Cluster Properties
      Parameters:
      - BootstrapInstanceType
      - BootstrapKeyName
      - InstanceType
      - KeyName
    - Label:
        default: InfraKit Configuration
      Parameters:
      - InfraKitConfigurationBaseURL
    - Label:
        default: Docker Configuration
      Parameters:
      - AufsVolumeSize
    ParameterLabels:
      BootstrapInstanceType:
        default: Bootstrap instance type
      InstanceType:
        default: Cluster instances type
      BootstrapKeyName:
        default: Bootstrap instance SSH key
      KeyName:
        default: Cluster instances SSH key
      InfraKitConfigurationBaseURL:
        default: InfraKit configuration base URL
      AufsVolumeSize:
        default: EBS Volume Size

Outputs:
  BootNodePublicIP:
    Description: The public IP of the boot node
    Value:
      Fn::GetAtt:
      - BootstrapInstance
      - PublicIp