README.yaml

name: "staging.cloudposse.co"

# Canonical GitHub repo
github_repo: "cloudposse/staging.cloudposse.co"

# License of this project
license: "APACHE2"

# Badges to display
badges:
  - name: "Codefresh Build Status"
    image: "https://g.codefresh.io/api/badges/build?repoOwner=cloudposse&repoName=staging.cloudposse.co&branch=master&pipelineName=staging.cloudposse.co&accountName=cloudposse&type=cf-1"
    url: "https://g.codefresh.io/pipelines/staging.cloudposse.co/builds"
  - name: "Latest Release"
    image: "https://img.shields.io/github/release/cloudposse/staging.cloudposse.co.svg"
    url: "https://github.com/cloudposse/staging.cloudposse.co/releases"
  - name: "Slack Community"
    image: "https://slack.cloudposse.com/badge.svg"
    url: "https://slack.cloudposse.com"

description: |-
  Terraform/Kubernetes Reference Infrastructure for Cloud Posse Staging Organization in AWS.

  __NOTE:__ Before creating the Production infrastructure, you need to provision the [Parent ("Root") Organization](https://github.com/cloudposse/root.cloudposse.co) in AWS (because it creates resources needed for all other accounts). Follow the steps in [README](https://github.com/cloudposse/root.cloudposse.co) first. You need to do it only once.

introduction: |-
  We use [geodesic](https://github.com/cloudposse/geodesic) to define and build world-class cloud infrastructures backed by AWS and powered by Kubernetes.

  `geodesic` exposes many tools that can be used to define and provision AWS and Kubernetes resources.

  Here is the list of tools we use to provision `cloudposse.co` infrastructure:

  * [aws-vault](https://github.com/99designs/aws-vault)
  * [chamber](https://github.com/segmentio/chamber)
  * [terraform](https://www.terraform.io/)
  * [kops](https://github.com/kubernetes/kops)
  * [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/)
  * [helm](https://helm.sh/)
  * [helmfile](https://github.com/roboll/helmfile)

include:
  - "docs/terraform.md"
  - "docs/targets.md"

quickstart: |-

  ### Setup AWS Role

  __NOTE:__ You need to do it only once.

  Configure AWS profile in `~/.aws/config`. Make sure to change username (username@cloudposse.co) to your own.

  ```bash
  [profile cpco-staging-admin]
  region=us-west-2
  role_arn=arn:aws:iam::781281608584:role/OrganizationAccountAccessRole
  mfa_serial=arn:aws:iam::323330167063:mfa/username@cloudposse.co
  source_profile=cpco
  ```

  ### Install and setup aws-vault

  __NOTE:__ You need to do it only once.

  We use [aws-vault](https://docs.cloudposse.com/tools/aws-vault/) to store IAM credentials in your operating system's secure keystore and then generates temporary credentials from those to expose to your shell and applications.

  Install [aws-vault](https://docs.cloudposse.com/tools/aws-vault/) on your local computer first.

  On MacOS, you may use `homebrew cask`

  ```bash
  brew cask install aws-vault
  ```

  Then setup your secret credentials for AWS in `aws-vault`
  ```bash
  aws-vault add --backend file cpco
  ```

  __NOTE:__ You should set `AWS_VAULT_BACKEND=file` in your shell rc config (e.g. `~/.bashrc`) so it persists.

  For more info, see [aws-vault](https://docs.cloudposse.com/tools/aws-vault/)


examples: |-
  ### Build Docker Image
  
  ```
  # Initialize the project's build-harness
  make init

  # Build docker image
  make docker/build
  ```

  ### Install the wrapper shell
  ```bash
  make install
  ```

  ### Run the shell
  ```bash
  staging.cloudposse.co
  ```

  ### Login to AWS with your MFA device
  ```bash
  assume-role
  ```

  ### Populate `chamber` secrets

  __NOTE:__ You need to do it only once for a given set of secrets. Repeat this step if you want to add new secrets.

  Populate `chamber` secrets for `kops` project (make sure to change the keys and values to reflect your environment; add new secrets as needed)

  ```bash
  chamber write kops <key1> <value1>
  chamber write kops <key2> <value2>
  ...
  ```

  __NOTE:__ Run `chamber list -e kops` to list the secrets stored for `kops` project

  Populate `chamber` secrets for `backing-services` project (make sure to change the values to reflect your environment; add new secrets as needed)

  ```bash
  chamber write backing-services TF_VAR_POSTGRES_ADMIN_NAME admin
  chamber write backing-services TF_VAR_POSTGRES_ADMIN_PASSWORD supersecret
  chamber write backing-services TF_VAR_POSTGRES_DB_NAME app
  ```

  __NOTE:__ Run `chamber list -e backing-services` to list the secrets stored for `backing-services` project

  __NOTE:__ Before provisioning AWS resources with Terraform, you need to create `tfstate-backend` first (S3 bucket to store Terraform state and DynamoDB table for state locking).

  Follow the steps in this [README](conf/tfstate-backend/README.md). You need to do it only once.

  After `tfstate-backend` has been provisioned, follow the rest of the instructions in the order shown below.


  ### Provision `dns` with Terraform

  Change directory to `dns` folder
  ```bash
  cd /conf/dns
  ```

  Run Terraform
  ```bash
  init-terraform
  terraform plan
  terraform apply
  ```

  For more info, see [geodesic-with-terraform](https://docs.cloudposse.com/geodesic/module/with-terraform/)

  ### Provision `cloudtrail` with Terraform

  ```bash
  cd /conf/cloudtrail
  init-terraform
  terraform plan
  terraform apply
  ```

  ### Provision `acm` with Terraform

  ```bash
  cd /conf/acm
  init-terraform
  terraform plan
  terraform apply
  ```

  ### Provision `chamber` with Terraform

  ```bash
  cd /conf/chamber
  init-terraform
  terraform plan
  terraform apply
  ```


related:
  - name: "Packages"
    description: "Cloud Posse installer and distribution of native apps"
    url: "https://github.com/cloudposse/packages"

  - name: "Build Harness"
    description: "Collection of Makefiles to facilitate building Golang projects, Dockerfiles, Helm charts, and more"
    url: "https://github.com/cloudposse/dev"

  - name: "terraform-root-modules"
    description: "Collection of Terraform \"root module\" invocations for provisioning reference architectures"
    url: "https://github.com/cloudposse/terraform-root-modules"

  - name: "root.cloudposse.co"
    description: "Example Terraform Reference Architecture of a Geodesic Module for a Parent (\"Root\") Organization in AWS."
    url: "https://github.com/cloudposse/root.cloudposse.co"

  - name: "audit.cloudposse.co"
    description: "Example Terraform Reference Architecture of a Geodesic Module for an Audit Logs Organization in AWS."
    url: "https://github.com/cloudposse/audit.cloudposse.co"

  - name: "prod.cloudposse.co"
    description: "Example Terraform Reference Architecture of a Geodesic Module for a Production Organization in AWS."
    url: "https://github.com/cloudposse/prod.cloudposse.co"

  - name: "dev.cloudposse.co"
    description: "Example Terraform Reference Architecture of a Geodesic Module for a Development Sandbox Organization in AWS."
    url: "https://github.com/cloudposse/dev.cloudposse.co"
 
  - name: "testing.cloudposse.co"
    description: "Example Terraform Reference Architecture of a Geodesic Module for a Testing Organization in AWS."
    url: "https://github.com/cloudposse/testing.cloudposse.co"

references:
  - name: "Cloud Posse Documentation"
    description: "Complete documentation for the Cloud Posse solution"
    url: "https://docs.cloudposse.com"

  - name: "Chamber"
    description: "Chamber is a CRUD tool for managing secrets stored in AWS Systems Manager Parameter Store and exposing those secrets as Environment Variables to processes."
    url: "https://docs.cloudposse.com/tools/chamber/"

  - name: "The Right Way to Store Secrets using Parameter Store"
    description: "Centrally and securely manage secrets with Amazon EC2 Systems Manager Parameter Store, lots of Terraform code, and chamber. This post has all the information you need to get running with Parameter Store in production."
    url: "https://aws.amazon.com/blogs/mt/the-right-way-to-store-secrets-using-parameter-store/"

  - name: "external-dns"
    description: "Frequently asked Questions & Answers"
    url: "https://github.com/kubernetes-incubator/external-dns/blob/master/docs/faq.md"