Skip to content

Commit

Permalink
allow using public subnets
Browse files Browse the repository at this point in the history
  • Loading branch information
@jaxxstorm
jaxxstorm committed Feb 21, 2024
1 parent b06220b commit ecf1e2a
Show file tree
Hide file tree
Showing 7 changed files with 86 additions and 10 deletions.
6 changes: 2 additions & 4 deletions examples/aws/py/__main__.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,20 +7,18 @@
vpc = awsx.ec2.Vpc(
"example",
cidr_block="172.20.0.0/22",
# nat_gateways=awsx.ec2.NatGatewayConfigurationArgs(
# strategy=awsx.ec2.NatGatewayStrategy.NONE
# ),
)

bastion = tailscale.aws.Bastion(
"example",
vpc_id=vpc.vpc_id,
subnet_ids=vpc.private_subnet_ids,
subnet_ids=vpc.public_subnet_ids,
route="172.20.0.0/22",
tailscale_tags=["tag:bastion"],
region="us-west-2",
high_availability=True,
enable_ssh=True,
public=True,
)


Expand Down
41 changes: 36 additions & 5 deletions provider/pkg/provider/aws/bastion.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ type BastionArgs struct {
InstanceType pulumi.StringInput `pulumi:"instanceType"`
HighAvailability bool `pulumi:"highAvailability"`
EnableSSH bool `pulumi:"enableSSH"`
Public bool `pulumi:"public"`
}

type UserDataArgs struct {
Expand Down Expand Up @@ -179,9 +180,12 @@ func NewBastion(ctx *pulumi.Context,
return nil, fmt.Errorf("error creating IAM instance profile: %v", err)
}

sg, err := ec2.NewSecurityGroup(ctx, name, &ec2.SecurityGroupArgs{
VpcId: args.VpcID,
Ingress: ec2.SecurityGroupIngressArray{
var ingress ec2.SecurityGroupIngressArray

// if we're using public subnets, we open the UDP port
// this ensure we don't use DERP relays
if args.Public {
ingress = ec2.SecurityGroupIngressArray{
ec2.SecurityGroupIngressArgs{
Protocol: pulumi.String("icmp"),
FromPort: pulumi.Int(0),
Expand All @@ -190,7 +194,32 @@ func NewBastion(ctx *pulumi.Context,
pulumi.String("0.0.0.0/0"),
},
},
},
// allow access to udp port 41641
ec2.SecurityGroupIngressArgs{
Protocol: pulumi.String("udp"),
FromPort: pulumi.Int(41641),
ToPort: pulumi.Int(41641),
CidrBlocks: pulumi.StringArray{
pulumi.String("0.0.0.0/0"),
},
},
}
} else {
ingress = ec2.SecurityGroupIngressArray{
ec2.SecurityGroupIngressArgs{
Protocol: pulumi.String("icmp"),
FromPort: pulumi.Int(0),
ToPort: pulumi.Int(0),
CidrBlocks: pulumi.StringArray{
pulumi.String("0.0.0.0/0"),
},
},
}
}

sg, err := ec2.NewSecurityGroup(ctx, name, &ec2.SecurityGroupArgs{
VpcId: args.VpcID,
Ingress: ingress,
Egress: ec2.SecurityGroupEgressArray{
ec2.SecurityGroupEgressArgs{
Protocol: pulumi.String("-1"),
Expand Down Expand Up @@ -280,9 +309,11 @@ func NewBastion(ctx *pulumi.Context,
PublicKey: key.PublicKeyOpenssh,
}, pulumi.Parent(component))



launchConfiguration, err := ec2.NewLaunchConfiguration(ctx, name, &ec2.LaunchConfigurationArgs{
InstanceType: instanceType,
AssociatePublicIpAddress: pulumi.Bool(false),
AssociatePublicIpAddress: pulumi.Bool(args.Public),
ImageId: ami.Id(),
SecurityGroups: pulumi.StringArray{
sg.ID(),
Expand Down
4 changes: 4 additions & 0 deletions schema.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,10 @@ resources:
tailscale-bastion:aws:Bastion:
isComponent: true
inputProperties:
public:
type: boolean
description: "Whether the bastion is going in public subnets."
default: false
enableSSH:
type: boolean
description: "Whether to enable SSH access to the bastion."
Expand Down
7 changes: 7 additions & 0 deletions sdk/dotnet/TailscaleBastion/Aws/Bastion.cs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,12 @@ public sealed class BastionArgs : global::Pulumi.ResourceArgs
[Input("instanceType")]
public Input<string>? InstanceType { get; set; }

/// <summary>
/// Whether the bastion is going in public subnets.
/// </summary>
[Input("public")]
public Input<bool>? Public { get; set; }

/// <summary>
/// The AWS region you're using.
/// </summary>
Expand Down Expand Up @@ -118,6 +124,7 @@ public BastionArgs()
{
EnableSSH = true;
HighAvailability = false;
Public = false;
}
public static new BastionArgs Empty => new BastionArgs();
}
Expand Down
7 changes: 7 additions & 0 deletions sdk/go/bastion/aws/bastion.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions sdk/nodejs/aws/bastion.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ export class Bastion extends pulumi.ComponentResource {
resourceInputs["enableSSH"] = (args ? args.enableSSH : undefined) ?? true;
resourceInputs["highAvailability"] = (args ? args.highAvailability : undefined) ?? false;
resourceInputs["instanceType"] = args ? args.instanceType : undefined;
resourceInputs["public"] = (args ? args.public : undefined) ?? false;
resourceInputs["region"] = args ? args.region : undefined;
resourceInputs["route"] = args ? args.route : undefined;
resourceInputs["subnetIds"] = args ? args.subnetIds : undefined;
Expand Down Expand Up @@ -92,6 +93,10 @@ export interface BastionArgs {
* The EC2 instance type to use for the bastion.
*/
instanceType?: pulumi.Input<string>;
/**
* Whether the bastion is going in public subnets.
*/
public?: pulumi.Input<boolean>;
/**
* The AWS region you're using.
*/
Expand Down
26 changes: 25 additions & 1 deletion sdk/python/lbrlabs_pulumi_tailscalebastion/aws/bastion.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,8 @@ def __init__(__self__, *,
tailscale_tags: pulumi.Input[Sequence[pulumi.Input[str]]],
vpc_id: pulumi.Input[str],
enable_ssh: Optional[pulumi.Input[bool]] = None,
instance_type: Optional[pulumi.Input[str]] = None):
instance_type: Optional[pulumi.Input[str]] = None,
public: Optional[pulumi.Input[bool]] = None):
"""
The set of arguments for constructing a Bastion resource.
:param pulumi.Input[bool] high_availability: Whether the bastion should be highly available.
Expand All @@ -32,6 +33,7 @@ def __init__(__self__, *,
:param pulumi.Input[str] vpc_id: The VPC the Bastion should be created in.
:param pulumi.Input[bool] enable_ssh: Whether to enable SSH access to the bastion.
:param pulumi.Input[str] instance_type: The EC2 instance type to use for the bastion.
:param pulumi.Input[bool] public: Whether the bastion is going in public subnets.
"""
if high_availability is None:
high_availability = False
Expand All @@ -47,6 +49,10 @@ def __init__(__self__, *,
pulumi.set(__self__, "enable_ssh", enable_ssh)
if instance_type is not None:
pulumi.set(__self__, "instance_type", instance_type)
if public is None:
public = False
if public is not None:
pulumi.set(__self__, "public", public)

@property
@pulumi.getter(name="highAvailability")
Expand Down Expand Up @@ -144,6 +150,18 @@ def instance_type(self) -> Optional[pulumi.Input[str]]:
def instance_type(self, value: Optional[pulumi.Input[str]]):
pulumi.set(self, "instance_type", value)

@property
@pulumi.getter
def public(self) -> Optional[pulumi.Input[bool]]:
"""
Whether the bastion is going in public subnets.
"""
return pulumi.get(self, "public")

@public.setter
def public(self, value: Optional[pulumi.Input[bool]]):
pulumi.set(self, "public", value)


class Bastion(pulumi.ComponentResource):
@overload
Expand All @@ -153,6 +171,7 @@ def __init__(__self__,
enable_ssh: Optional[pulumi.Input[bool]] = None,
high_availability: Optional[pulumi.Input[bool]] = None,
instance_type: Optional[pulumi.Input[str]] = None,
public: Optional[pulumi.Input[bool]] = None,
region: Optional[pulumi.Input[str]] = None,
route: Optional[pulumi.Input[str]] = None,
subnet_ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
Expand All @@ -166,6 +185,7 @@ def __init__(__self__,
:param pulumi.Input[bool] enable_ssh: Whether to enable SSH access to the bastion.
:param pulumi.Input[bool] high_availability: Whether the bastion should be highly available.
:param pulumi.Input[str] instance_type: The EC2 instance type to use for the bastion.
:param pulumi.Input[bool] public: Whether the bastion is going in public subnets.
:param pulumi.Input[str] region: The AWS region you're using.
:param pulumi.Input[str] route: The route you'd like to advertise via tailscale.
:param pulumi.Input[Sequence[pulumi.Input[str]]] subnet_ids: The subnet Ids to launch instances in.
Expand Down Expand Up @@ -198,6 +218,7 @@ def _internal_init(__self__,
enable_ssh: Optional[pulumi.Input[bool]] = None,
high_availability: Optional[pulumi.Input[bool]] = None,
instance_type: Optional[pulumi.Input[str]] = None,
public: Optional[pulumi.Input[bool]] = None,
region: Optional[pulumi.Input[str]] = None,
route: Optional[pulumi.Input[str]] = None,
subnet_ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
Expand All @@ -223,6 +244,9 @@ def _internal_init(__self__,
raise TypeError("Missing required property 'high_availability'")
__props__.__dict__["high_availability"] = high_availability
__props__.__dict__["instance_type"] = instance_type
if public is None:
public = False
__props__.__dict__["public"] = public
if region is None and not opts.urn:
raise TypeError("Missing required property 'region'")
__props__.__dict__["region"] = region
Expand Down

0 comments on commit ecf1e2a

Please sign in to comment.