Skip to content

Commit f2e3ccb

Browse files
jparrjparr
authored
Staging sftp endpoint for enghouse (#4232)
* Staging sftp endpoint for enghouse references: #4048 # Conflicts: # iac/cal-itp-data-infra-staging/gcs/us/storage_bucket.tf # iac/cal-itp-data-infra-staging/gcs/us/storage_bucket_iam_member.tf * Add static ip address to enghouse sftp load balancer on staging
1 parent 3619b48 commit f2e3ccb

File tree

13 files changed

+364
-0
lines changed

13 files changed

+364
-0
lines changed

‎iac/cal-itp-data-infra-staging/gcs/us/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,3 +249,7 @@ output "google_storage_bucket_calitp-staging-sentry_name" {
249249
output "google_storage_bucket_calitp-staging-state-geoportal-scrape_name" {
250250
value = google_storage_bucket.calitp-staging["calitp-staging-state-geoportal-scrape"].name
251251
}
252+
253+
output "google_storage_bucket_cal-itp-data-infra-enghouse-raw_name" {
254+
value = google_storage_bucket.cal-itp-data-infra-enghouse-raw.name
255+
}

‎iac/cal-itp-data-infra-staging/gcs/us/storage_bucket.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,18 @@ resource "google_storage_bucket" "calitp-staging-pytest" {
134134
uniform_bucket_level_access = "true"
135135
}
136136

137+
resource "google_storage_bucket" "cal-itp-data-infra-enghouse-raw" {
138+
default_event_based_hold = "false"
139+
force_destroy = "true"
140+
location = "US-WEST2"
141+
name = "cal-itp-data-infra-staging-enghouse-raw"
142+
project = "cal-itp-data-infra-staging"
143+
public_access_prevention = "inherited"
144+
requester_pays = "false"
145+
storage_class = "STANDARD"
146+
uniform_bucket_level_access = "true"
147+
}
148+
137149
resource "google_storage_bucket" "calitp-staging" {
138150
for_each = local.environment_buckets
139151
name = each.key

‎iac/cal-itp-data-infra-staging/gcs/us/storage_bucket_iam_member.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@ resource "google_storage_bucket_iam_member" "calitp-staging-composer" {
4040
role = "roles/storage.legacyBucketOwner"
4141
}
4242

43+
resource "google_storage_bucket_iam_member" "enghouse-raw-sftp-service-account" {
44+
bucket = google_storage_bucket.cal-itp-data-infra-enghouse-raw.name
45+
role = "roles/storage.objectAdmin"
46+
member = "serviceAccount:${data.terraform_remote_state.iam.outputs.google_service_account_sftp-pod-service-account_email}"
47+
}
48+
4349
resource "google_storage_bucket_iam_member" "calitp-staging-pytest" {
4450
bucket = google_storage_bucket.calitp-staging-pytest.name
4551
member = "projectViewer:cal-itp-data-infra-staging"

‎iac/cal-itp-data-infra-staging/gke/us/container_cluster.tf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,39 @@ resource "google_container_cluster" "airflow-jobs-staging" {
1515
workload_pool = "cal-itp-data-infra-staging.svc.id.goog"
1616
}
1717
}
18+
19+
resource "google_container_cluster" "sftp-endpoints" {
20+
21+
name = "sftp-endpoints"
22+
location = "us-west2"
23+
project = "cal-itp-data-infra-staging"
24+
25+
enable_autopilot = true
26+
deletion_protection = false
27+
network = data.terraform_remote_state.networks.outputs.google_compute_network_tfer--default_self_link
28+
29+
secret_manager_config {
30+
enabled = true
31+
}
32+
33+
workload_identity_config {
34+
workload_pool = "cal-itp-data-infra-staging.svc.id.goog"
35+
}
36+
37+
node_config {
38+
workload_metadata_config {
39+
mode = "GKE_METADATA"
40+
}
41+
}
42+
43+
addons_config {
44+
gcs_fuse_csi_driver_config {
45+
enabled = true
46+
}
47+
}
48+
49+
timeouts {
50+
create = "10m"
51+
delete = "10m"
52+
}
53+
}

‎iac/cal-itp-data-infra-staging/gke/us/outputs.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,16 @@ output "google_container_cluster_airflow-jobs-staging_endpoint" {
99
output "google_container_cluster_airflow-jobs-staging_ca_certificate" {
1010
value = google_container_cluster.airflow-jobs-staging.master_auth[0].cluster_ca_certificate
1111
}
12+
13+
output "google_container_cluster_sftp-endpoints_name" {
14+
value = google_container_cluster.sftp-endpoints.name
15+
}
16+
17+
output "google_container_cluster_sftp-endpoints_endpoint" {
18+
value = google_container_cluster.sftp-endpoints.endpoint
19+
}
20+
21+
output "google_container_cluster_sftp-endpoints_ca_certificate" {
22+
value = google_container_cluster.sftp-endpoints.master_auth[0].cluster_ca_certificate
23+
sensitive = true
24+
}

‎iac/cal-itp-data-infra-staging/iam/us/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,10 @@ output "google_service_account_composer-service-account_name" {
178178
value = google_service_account.composer-service-account.name
179179
}
180180

181+
output "google_service_account_sftp-pod-service-account_id" {
182+
value = google_service_account.sftp-pod-service-account.id
183+
}
184+
181185
output "google_service_account_sftp-pod-service-account_name" {
182186
value = google_service_account.sftp-pod-service-account.name
183187
}

‎iac/cal-itp-data-infra-staging/networks/us/global_address.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
11
resource "google_compute_global_address" "static-load-balancer-address" {
22
name = "static-load-balancer-address"
33
}
4+
5+
resource "google_compute_global_address" "enghouse-sftp" {
6+
name = "enghouse-sftp-load-balancer"
7+
}

‎iac/cal-itp-data-infra-staging/networks/us/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,7 @@ output "google_compute_network_tfer--default_self_link" {
55
output "google_compute_network_static-load-balancer-address_id" {
66
value = google_compute_global_address.static-load-balancer-address.id
77
}
8+
9+
output "google_compute_global_address_enghouse-sftp_ip" {
10+
value = google_compute_global_address.enghouse-sftp.address
11+
}

‎iac/cal-itp-data-infra-staging/sftp/us/enghouse/.terraform.lock.hcl‎

Lines changed: 41 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎iac/cal-itp-data-infra-staging/sftp/us/enghouse/enghouse-sftp-endpoint.tf‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
2+
locals {
3+
sftp_user = "enghouse"
4+
}
5+
6+
data "google_secret_manager_secret_version" "enghouse-sftp-public-key" {
7+
secret = "enghouse-sftp-public-key"
8+
}
9+
10+
data "google_secret_manager_secret_version" "enghouse-sftp-private-key" {
11+
secret = "enghouse-sftp-private-key"
12+
}
13+
14+
data "google_secret_manager_secret_version" "enghouse-sftp-authorizedkey" {
15+
secret = "enghouse-sftp-authorizedkey"
16+
}
17+
18+
resource "kubernetes_secret" "enghouse-sftp-hostkeys" {
19+
metadata {
20+
name = "enghouse-sftp-hostkeys"
21+
namespace = "default"
22+
}
23+
type = "Opaque"
24+
25+
data = {
26+
"id_rsa" = data.google_secret_manager_secret_version.enghouse-sftp-private-key.secret_data
27+
"id_rsa.pub" = data.google_secret_manager_secret_version.enghouse-sftp-public-key.secret_data
28+
}
29+
}
30+
31+
resource "kubernetes_secret" "enghouse-sftp-authorizedkey" {
32+
metadata {
33+
name = "enghouse-sftp-authorizedkey"
34+
namespace = "default"
35+
}
36+
type = "Opaque"
37+
38+
data = {
39+
"authorized_keys" = data.google_secret_manager_secret_version.enghouse-sftp-authorizedkey.secret_data
40+
}
41+
}
42+
43+
resource "kubernetes_service_account" "sftp-pod-service-account" {
44+
metadata {
45+
name = "sftp-pod-service-account"
46+
annotations = {
47+
"iam.gke.io/gcp-service-account" = data.terraform_remote_state.iam.outputs.google_service_account_sftp-pod-service-account_email
48+
}
49+
}
50+
}
51+
52+
resource "kubernetes_pod_v1" "enghouse-sftp" {
53+
metadata {
54+
name = "enghouse-sftp-pod"
55+
annotations = {
56+
"gke-gcsfuse/volumes" = "true"
57+
}
58+
namespace = "default"
59+
labels = {
60+
app = "enghouse-sftp"
61+
}
62+
}
63+
spec {
64+
container {
65+
name = "sftp-server"
66+
image = "alpine"
67+
port {
68+
container_port = 22
69+
}
70+
volume_mount {
71+
name = "gcs-volume"
72+
mount_path = "/home/${local.sftp_user}/data"
73+
read_only = false
74+
}
75+
volume_mount {
76+
name = "sftp-hostkeys"
77+
mount_path = "/etc/ssh/hostkey"
78+
read_only = true
79+
}
80+
volume_mount {
81+
name = "sftp-authorizedkey"
82+
mount_path = "/tmp/ssh-keys"
83+
read_only = true
84+
}
85+
env {
86+
name = "SFTP_USER"
87+
value = local.sftp_user
88+
}
89+
90+
command = [
91+
"/bin/sh", "-c", <<EOT
92+
apk update
93+
apk add openssh-server
94+
addgroup sftpusers
95+
adduser -S -G sftpusers -s /sbin/nologin -D -H ${local.sftp_user}
96+
echo '${local.sftp_user}:enghousesftpuserpassword' | chpasswd
97+
98+
mkdir -p /home/${local.sftp_user}/.ssh
99+
cp /tmp/ssh-keys/authorized_keys /home/${local.sftp_user}/.ssh/authorized_keys
100+
chmod 700 /home/${local.sftp_user}/.ssh
101+
chmod 600 /home/${local.sftp_user}/.ssh/authorized_keys
102+
chown -R ${local.sftp_user}:sftpusers /home/${local.sftp_user}/.ssh
103+
104+
echo "HostKey /etc/ssh/hostkey/id_rsa" >> /etc/ssh/sshd_config
105+
echo "PasswordAuthentication no" >> /etc/ssh/sshd_config
106+
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
107+
echo "X11Forwarding no" >> /etc/ssh/sshd_config
108+
echo "AllowTcpForwarding no" >> /etc/ssh/sshd_config
109+
echo "ForceCommand internal-sftp" >> /etc/ssh/sshd_config
110+
echo "ChrootDirectory %h" >> /etc/ssh/sshd_config
111+
/usr/sbin/sshd -D -e
112+
EOT
113+
]
114+
liveness_probe {
115+
tcp_socket {
116+
port = 22
117+
}
118+
initial_delay_seconds = 180
119+
period_seconds = 30
120+
}
121+
}
122+
123+
volume {
124+
name = "gcs-volume"
125+
csi {
126+
driver = "gcsfuse.csi.storage.gke.io"
127+
volume_attributes = {
128+
bucketName = data.terraform_remote_state.gcs.outputs.google_storage_bucket_cal-itp-data-infra-enghouse-raw_name
129+
mountOptions = "file-mode=666,dir-mode=777"
130+
}
131+
}
132+
}
133+
volume {
134+
name = "sftp-hostkeys"
135+
secret {
136+
secret_name = "enghouse-sftp-hostkeys"
137+
default_mode = "0600"
138+
}
139+
}
140+
volume {
141+
name = "sftp-authorizedkey"
142+
secret {
143+
secret_name = "enghouse-sftp-authorizedkey"
144+
default_mode = "0600"
145+
}
146+
}
147+
service_account_name = kubernetes_service_account.sftp-pod-service-account.metadata.0.name # Ensure this has GCS permissions to access data bucket
148+
}
149+
150+
timeouts {
151+
create = "2m"
152+
delete = "2m"
153+
}
154+
}
155+
156+
resource "kubernetes_service" "enghouse-sftp" {
157+
metadata {
158+
name = "enghouse-sftp"
159+
}
160+
spec {
161+
selector = {
162+
app = kubernetes_pod_v1.enghouse-sftp.metadata.0.labels.app
163+
}
164+
session_affinity = "ClientIP"
165+
port {
166+
port = 22
167+
target_port = 22
168+
}
169+
170+
type = "LoadBalancer"
171+
load_balancer_ip = data.terraform_remote_state.networks.outputs.google_compute_global_address_enghouse-sftp_ip
172+
}
173+
}

0 commit comments

Comments
 (0)