Skip to content

Commit f36dc73

Browse files
dpoirierdpoirier
committed
Cleanup, make things DRYer, undo some over-enthusiastic blackening
1 parent 8374fff commit f36dc73

15 files changed

+226
-288
lines changed

‎stack/__init__.py

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,14 @@
11
import os
22

3-
if os.environ.get("USE_EKS") == "on":
3+
USE_DOKKU = os.environ.get("USE_DOKKU") == "on"
4+
USE_EB = os.environ.get("USE_EB") == "on"
5+
USE_EC2 = os.environ.get("USE_EC2") == "on"
6+
USE_ECS = os.environ.get("USE_ECS") == "on"
7+
USE_EKS = os.environ.get("USE_EKS") == "on"
8+
USE_GOVCLOUD = os.environ.get("USE_GOVCLOUD") == "on"
9+
USE_NAT_GATEWAY = os.environ.get("USE_NAT_GATEWAY") == "on"
10+
11+
if USE_EKS:
412
from . import vpc # noqa: F401
513
from . import template
614
from . import repository # noqa: F401
@@ -14,23 +22,24 @@
1422
from . import vpc # noqa: F401
1523
from . import template
1624

17-
if os.environ.get("USE_GOVCLOUD") != "on":
25+
if not USE_GOVCLOUD:
1826
# make sure this isn't added to the template for GovCloud, as it's not
1927
# supported in this region
2028
from . import search # noqa: F401
2129

22-
if os.environ.get("USE_NAT_GATEWAY") == "on":
30+
if USE_NAT_GATEWAY:
2331
from . import bastion # noqa: F401
2432

25-
if os.environ.get("USE_ECS") == "on":
33+
if USE_ECS:
2634
from . import repository # noqa: F401
2735
from . import ecs_cluster # noqa: F401
28-
elif os.environ.get("USE_EB") == "on":
36+
elif USE_EB:
2937
from . import repository # noqa: F401
3038
from . import eb # noqa: F401
31-
elif os.environ.get("USE_DOKKU") == "on":
39+
elif USE_DOKKU:
3240
from . import dokku # noqa: F401
33-
else: # USE_GOVCLOUD and USE_EC2 both provide EC2 instances
41+
elif USE_EC2 or USE_GOVCLOUD:
42+
# USE_GOVCLOUD and USE_EC2 both provide EC2 instances
3443
from . import instances # noqa: F401
3544

3645
# Must be last to tag all resources

‎stack/assets.py

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
import os
2-
31
from troposphere import (
42
AWS_REGION,
53
And,
@@ -36,6 +34,7 @@
3634
VersioningConfiguration
3735
)
3836

37+
from . import USE_GOVCLOUD
3938
from .common import (
4039
arn_prefix,
4140
cmk_arn,
@@ -263,7 +262,7 @@
263262
)
264263

265264

266-
if os.environ.get('USE_GOVCLOUD') != 'on':
265+
if not USE_GOVCLOUD:
267266
assets_use_cloudfront = template.add_parameter(
268267
Parameter(
269268
"AssetsUseCloudFront",

‎stack/common.py

Lines changed: 34 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
1-
import os
2-
31
from troposphere import AWS_REGION, Equals, If, Not, Ref
42

3+
from . import USE_DOKKU, USE_EB, USE_ECS
54
from .template import template
65
from .utils import ParameterWithDefaults as Parameter
76

@@ -11,53 +10,45 @@
1110
template.add_condition(in_govcloud_region, Equals(Ref(AWS_REGION), "us-gov-west-1"))
1211
arn_prefix = If(in_govcloud_region, "arn:aws-us-gov", "arn:aws")
1312

14-
administrator_ip_address = Ref(
15-
template.add_parameter(
13+
administrator_ip_address = Ref(template.add_parameter(
14+
Parameter(
15+
"AdministratorIPAddress",
16+
Description="The IP address allowed to access containers. "
17+
"Defaults to TEST-NET-1 (ie, no valid IP)",
18+
Type="String",
19+
# RFC5737 - TEST-NET-1 reserved for documentation
20+
Default="192.0.2.0/24",
21+
),
22+
group="Application Server",
23+
label="Admin IP Address",
24+
))
25+
26+
if any([USE_DOKKU, USE_EB, USE_ECS]):
27+
secret_key = Ref(template.add_parameter(
1628
Parameter(
17-
"AdministratorIPAddress",
18-
Description="The IP address allowed to access containers. "
19-
"Defaults to TEST-NET-1 (ie, no valid IP)",
29+
"SecretKey",
30+
Description="Application secret key for this stack (optional)",
2031
Type="String",
21-
# RFC5737 - TEST-NET-1 reserved for documentation
22-
Default="192.0.2.0/24",
32+
NoEcho=True,
2333
),
2434
group="Application Server",
25-
label="Admin IP Address",
26-
)
27-
)
35+
label="Secret Key",
36+
))
2837

29-
if "on" in set([os.getenv("USE_DOKKU"), os.getenv("USE_EB"), os.getenv("USE_ECS")]):
30-
secret_key = Ref(
31-
template.add_parameter(
32-
Parameter(
33-
"SecretKey",
34-
Description="Application secret key for this stack (optional)",
35-
Type="String",
36-
NoEcho=True,
37-
),
38-
group="Application Server",
39-
label="Secret Key",
40-
)
41-
)
42-
43-
use_aes256_encryption = Ref(
44-
template.add_parameter(
45-
Parameter(
46-
"UseAES256Encryption",
47-
Description="Whether or not to use server side encryption for S3, EBS, and RDS. "
48-
"When true, encryption is enabled for all resources.",
49-
Type="String",
50-
AllowedValues=["true", "false"],
51-
Default="false",
52-
),
53-
group="Global",
54-
label="Enable Encryption",
55-
)
56-
)
38+
use_aes256_encryption = Ref(template.add_parameter(
39+
Parameter(
40+
"UseAES256Encryption",
41+
Description="Whether or not to use server side encryption for S3, EBS, and RDS. "
42+
"When true, encryption is enabled for all resources.",
43+
Type="String",
44+
AllowedValues=["true", "false"],
45+
Default="false",
46+
),
47+
group="Global",
48+
label="Enable Encryption",
49+
))
5750
use_aes256_encryption_cond = "UseAES256EncryptionCond"
58-
template.add_condition(
59-
use_aes256_encryption_cond, Equals(use_aes256_encryption, "true")
60-
)
51+
template.add_condition(use_aes256_encryption_cond, Equals(use_aes256_encryption, "true"))
6152

6253
cmk_arn = template.add_parameter(
6354
Parameter(

‎stack/containers.py

Lines changed: 49 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
"""
2-
Common between instances and EKS.
2+
Common (almost) between instances, DOKKU, ECS, and EKS.
33
"""
4-
import os
5-
4+
from awacs import ecr
65
from troposphere import Ref, iam
76

8-
from stack.assets import assets_management_policy
9-
from stack.logs import logging_policy
7+
from stack import USE_EKS, USE_ECS
108
from stack.template import template
119
from stack.utils import ParameterWithDefaults as Parameter
1210

13-
USE_EKS = os.environ.get("USE_EKS") == "on"
11+
if not USE_EKS:
12+
from stack.assets import assets_management_policy
13+
from stack.logs import logging_policy
1414

1515
desired_container_instances = Ref(
1616
template.add_parameter(
1717
Parameter(
1818
"DesiredScale",
1919
Description="Desired container instances count",
2020
Type="Number",
21-
Default="2",
21+
Default="3" if USE_ECS else "2",
2222
),
2323
group="Application Server",
2424
label="Desired Instance Count",
@@ -30,7 +30,7 @@
3030
"MaxScale",
3131
Description="Maximum container instances count",
3232
Type="Number",
33-
Default="4",
33+
Default="3" if USE_ECS else "4",
3434
),
3535
group="Application Server",
3636
label="Maximum Instance Count",
@@ -50,6 +50,45 @@
5050
)
5151
)
5252

53+
if USE_EKS:
54+
container_policies = []
55+
else:
56+
container_policies = [assets_management_policy, logging_policy]
57+
if USE_ECS:
58+
container_policies.extend(
59+
[
60+
iam.Policy(
61+
PolicyName="ECSManagementPolicy",
62+
PolicyDocument=dict(
63+
Statement=[
64+
dict(
65+
Effect="Allow",
66+
Action=["ecs:*", "elasticloadbalancing:*"],
67+
Resource="*",
68+
)
69+
],
70+
),
71+
),
72+
iam.Policy(
73+
PolicyName="ECRManagementPolicy",
74+
PolicyDocument=dict(
75+
Statement=[
76+
dict(
77+
Effect="Allow",
78+
Action=[
79+
ecr.GetAuthorizationToken,
80+
ecr.GetDownloadUrlForLayer,
81+
ecr.BatchGetImage,
82+
ecr.BatchCheckLayerAvailability,
83+
],
84+
Resource="*",
85+
)
86+
],
87+
),
88+
),
89+
]
90+
)
91+
5392
container_instance_role = iam.Role(
5493
"ContainerInstanceRole",
5594
template=template,
@@ -63,7 +102,7 @@
63102
]
64103
),
65104
Path="/",
66-
Policies=[assets_management_policy, logging_policy,],
105+
Policies=container_policies,
67106
**(
68107
dict(
69108
ManagedPolicyArns=[
@@ -83,6 +122,7 @@
83122
Path="/",
84123
Roles=[Ref(container_instance_role)],
85124
)
125+
86126
container_instance_type = Ref(
87127
template.add_parameter(
88128
Parameter(

‎stack/dokku.py

Lines changed: 2 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,11 @@
11
import troposphere.cloudformation as cloudformation
22
import troposphere.ec2 as ec2
3-
import troposphere.iam as iam
43
from troposphere import Base64, FindInMap, Join, Output, Ref, Tags
54
from troposphere.policies import CreationPolicy, ResourceSignal
65

7-
from .assets import assets_management_policy
8-
from .containers import container_instance_type
6+
from .containers import container_instance_type, container_instance_profile
97
from .domain import domain_name
108
from .environment import environment_variables
11-
from .logs import logging_policy
129
from .template import template
1310
from .utils import ParameterWithDefaults as Parameter
1411
from .vpc import private_subnet_a, vpc
@@ -100,30 +97,6 @@
10097
"us-west-2": {"AMI": "ami-8803e0f0"},
10198
})
10299

103-
# EC2 instance role
104-
instance_role = iam.Role(
105-
"ContainerInstanceRole",
106-
template=template,
107-
AssumeRolePolicyDocument=dict(Statement=[dict(
108-
Effect="Allow",
109-
Principal=dict(Service=["ec2.amazonaws.com"]),
110-
Action=["sts:AssumeRole"],
111-
)]),
112-
Path="/",
113-
Policies=[
114-
assets_management_policy,
115-
logging_policy,
116-
]
117-
)
118-
119-
# EC2 instance profile
120-
instance_profile = iam.InstanceProfile(
121-
"ContainerInstanceProfile",
122-
template=template,
123-
Path="/",
124-
Roles=[Ref(instance_role)],
125-
)
126-
127100
# EC2 security group
128101
security_group = template.add_resource(ec2.SecurityGroup(
129102
'SecurityGroup',
@@ -163,7 +136,7 @@
163136
InstanceType=container_instance_type,
164137
KeyName=Ref(key_name),
165138
SecurityGroupIds=[Ref(security_group)],
166-
IamInstanceProfile=Ref(instance_profile),
139+
IamInstanceProfile=Ref(container_instance_profile),
167140
SubnetId=Ref(private_subnet_a),
168141
BlockDeviceMappings=[
169142
ec2.BlockDeviceMapping(

‎stack/eb.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
)
1010
from troposphere.iam import InstanceProfile, Role
1111

12+
from . import USE_NAT_GATEWAY
1213
from .assets import assets_management_policy
1314
from .certificates import application as application_certificate
1415
from .containers import container_instance_type
@@ -21,7 +22,6 @@
2122
from .template import template
2223
from .utils import ParameterWithDefaults as Parameter
2324
from .vpc import (
24-
USE_NAT_GATEWAY,
2525
private_subnet_a,
2626
private_subnet_b,
2727
public_subnet_a,

0 commit comments

Comments
 (0)