Add notification service to eks stack (#170) (#171)

* Added sendgrid api key during setup
Add helm support for notification service
Some small formatting / text changes

* fix: Removed duplicate secret, changed name of variable to enable notification service

Author: bmonkman

templates/Makefile

@@ -77,8 +77,9 @@ teardown-secrets:
 	aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='rds' && Value=='$(PROJECT)-$(ENVIRONMENT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
 	aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='rds' && Value=='$(PROJECT)-$(ENVIRONMENT)-devenv']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
 	aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='sendgrid' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
-	aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='cf_keypair' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
+	aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='cf-keypair' && Value=='$(PROJECT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
 	aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='wg' && Value=='$(PROJECT)-$(ENVIRONMENT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
+	aws secretsmanager list-secrets --region $(AWS_DEFAULT_REGION) --query "SecretList[?Tags[?Key=='oathkeeper-jwks' && Value=='$(PROJECT)-$(ENVIRONMENT)']].[Name] | [0][0]" | xargs aws secretsmanager delete-secret --region $(AWS_DEFAULT_REGION) --secret-id || echo "Secret already removed"
 	aws iam list-role-policies --role-name $(PROJECT)-eks-cluster-creator --query "PolicyNames"   | jq -r ".[]" | xargs -n1 aws iam delete-role-policy --role-name $(PROJECT)-eks-cluster-creator --policy-name
 	aws iam list-attached-role-policies --role-name $(PROJECT)-eks-cluster-creator --query "AttachedPolicies[].PolicyArn" | jq -r ".[]" | xargs -n1 aws iam detach-role-policy --role-name $(PROJECT)-eks-cluster-creator --policy-arn
 	aws iam delete-role --role-name $(PROJECT)-eks-cluster-creator

templates/kubernetes/terraform/environments/prod/main.tf

@@ -70,8 +70,8 @@ module "kubernetes" {
   # Wireguard configuration
   vpn_server_address = "10.10.99.0/24"
   vpn_client_publickeys = [
-    ["Max C", "10.10.99.201/32", "/B3Q/Hlf+ILInjpehTLk9DZGgybdGdbm0SsG87OnWV0="],
-    ["Carter L", "10.10.99.202/32", "h2jMuaXNIlx7Z0a3owWFjPsAA8B+ZpQH3FbZK393+08="],
+    # ["Test User 1", "10.10.99.201/32", "/B3Q/Hlf+ILInjpehTLk9DZGgybdGdbm0SsG87OnWV0="],
+    # ["Test User 2", "10.10.99.202/32", "h2jMuaXNIlx7Z0a3owWFjPsAA8B+ZpQH3FbZK393+08="],
   ]
 
   domain_name                 = local.domain_name
@@ -81,4 +81,6 @@ module "kubernetes" {
   frontend_service_domain     = "<% index .Params `productionFrontendSubdomain` %>${local.domain_name}"
   # This domain or address must be verified by the mail provider (Sendgrid, SES, etc.)
   user_auth_mail_from_address = "noreply@${local.domain_name}"
+
+  notification_service_enabled    = <%if eq (index .Params `sendgridApiKey`) "" %>false<% else %>true<% end %>
 }

templates/kubernetes/terraform/environments/stage/main.tf

@@ -69,8 +69,8 @@ module "kubernetes" {
   # Wireguard configuration
   vpn_server_address = "10.10.199.0/24"
   vpn_client_publickeys = [
-    ["Max C", "10.10.199.201/32", "/B3Q/Hlf+ILInjpehTLk9DZGgybdGdbm0SsG87OnWV0="],
-    ["Carter L", "10.10.199.202/32", "h2jMuaXNIlx7Z0a3owWFjPsAA8B+ZpQH3FbZK393+08="],
+    # ["Test User 1", "10.10.199.201/32", "/B3Q/Hlf+ILInjpehTLk9DZGgybdGdbm0SsG87OnWV0="],
+    # ["Test User 2", "10.10.199.202/32", "h2jMuaXNIlx7Z0a3owWFjPsAA8B+ZpQH3FbZK393+08="],
   ]
 
   domain_name                 = local.domain_name
@@ -80,4 +80,6 @@ module "kubernetes" {
   frontend_service_domain     = "<% index .Params `stagingFrontendSubdomain` %>${local.domain_name}"
   # This domain or address must be verified by the mail provider (Sendgrid, SES, etc.)
   user_auth_mail_from_address = "noreply@${local.domain_name}"
+
+  notification_service_enabled    = <%if eq (index .Params `sendgridApiKey`) "" %>false<% else %>true<% end %>
 }

templates/kubernetes/terraform/modules/kubernetes/notification_service.tf

@@ -0,0 +1,40 @@
+locals {
+  sendgrid_api_key_secret_name = "${var.project}-sendgrid-${var.random_seed}" # Created in terraform/bootstrap/secrets
+}
+
+data "aws_secretsmanager_secret" "sendgrid_api_key" {
+  count = var.notification_service_enabled ? 1 : 0
+  name  = local.sendgrid_api_key_secret_name
+}
+data "aws_secretsmanager_secret_version" "sendgrid_api_key" {
+  count     = var.notification_service_enabled ? 1 : 0
+  secret_id = data.aws_secretsmanager_secret.sendgrid_api_key[0].id
+}
+
+resource "kubernetes_namespace" "notification_service" {
+  count = var.notification_service_enabled ? 1 : 0
+  metadata {
+    name = "notification-service"
+  }
+}
+
+#
+resource "helm_release" "notification_service" {
+  count      = var.notification_service_enabled ? 1 : 0
+  name       = "zero-notification-service"
+  repository = "https://commitdev.github.io/zero-notification-service/"
+  chart      = "zero-notification-service"
+  version    = "0.0.4"
+  namespace  = kubernetes_namespace.notification_service[0].metadata[0].name
+
+  set {
+    name  = "application.structuredLogging"
+    value = "true"
+  }
+
+  # This will become a secret provided as an env var
+  set_sensitive {
+    name  = "application.sendgridApiKey"
+    value = data.aws_secretsmanager_secret_version.sendgrid_api_key[0].secret_string
+  }
+}

templates/kubernetes/terraform/modules/kubernetes/variables.tf

@@ -129,3 +129,9 @@ variable "user_auth_mail_from_address" {
   type        = string
   default     = ""
 }
+
+variable "notification_service_enabled" {
+  description = "If enabled, will install the Zero notification service in the cluster to enable easy implementation of notification via email, sms, push, etc."
+  type        = string
+  default     = "false"
+}

templates/scripts/create-db-user.sh

@@ -72,8 +72,9 @@ rm -f ./k8s-job-create-db.yml
 kubectl -n db-ops wait --for=condition=complete --timeout=10s job db-create-users-$NAMESPACE-${JOB_ID}
 if [ $? -eq 0 ]
 then
-  kubectl delete namespace db-ops
+    kubectl delete namespace db-ops
 else
-  echo "Failed to create application database user, please see 'kubectl logs -n db-ops -l job-name=db-create-users-$NAMESPACE-${JOB_ID}'"
+    echo "Failed to create application database user, please see 'kubectl logs -n db-ops -l job-name=db-create-users-$NAMESPACE-${JOB_ID}'"
+    kubectl delete secret -n db-ops ${SECRET_NAME}
 fi
 

templates/scripts/create-dev-env.sh

@@ -21,10 +21,10 @@ if [[ $? -eq 0 ]]; then
     ENVIRONMENT=${ENVIRONMENT} \
     NAMESPACE=${PROJECT} \
     DATABASE_TYPE=<% index .Params `database` %> \
-	DATABASE_NAME="${DEV_DB_LIST}" \
+    DATABASE_NAME="${DEV_DB_LIST}" \
     SECRET_NAME=devenv${PROJECT} \
-	USER_NAME=dev${PROJECT} \
-	USER_PASSWORD=${DEV_DB_SECRET} \
+    USER_NAME=dev${PROJECT} \
+    USER_PASSWORD=${DEV_DB_SECRET} \
     CREATE_SECRET=secret-application.yml.tpl \
-	sh ./create-db-user.sh
+    sh ./create-db-user.sh
 fi

templates/scripts/import-cf-keypair.sh

@@ -44,5 +44,5 @@ aws secretsmanager \
     create-secret \
     --name <% .Name %>_cf_keypair \
     --region <% index .Params `region` %> \
-    --tags '[{"Key":"cf_keypair","Value":"<% .Name %>"}]' \
+    --tags '[{"Key":"cf-keypair","Value":"<% .Name %>"}]' \
     --secret-string "{\"keypair_id\":\"${ID}\",\"private_key\":\"${SECRET}\"}"

templates/terraform/environments/prod/main.tf

@@ -66,6 +66,7 @@ module "prod" {
   eks_worker_ami = "<% index .Params `eksWorkerAMI` %>"
 
   # Hosting configuration. Each domain will have a bucket created for it, but may have mulitple aliases pointing to the same bucket.
+  # Note that because of the way terraform handles lists, new records should be added to the end of the list.
   hosted_domains = [
     {
       domain : local.domain_name,

templates/terraform/environments/stage/main.tf

@@ -45,7 +45,7 @@ data "terraform_remote_state" "shared" {
 module "rds_dev_secret" {
   source  = "commitdev/zero/aws//modules/secret"
   version = "0.0.2"
-  
+
   name          = "${local.project}-stage-rds-${local.random_seed}-devenv"
   type          = "random"
   random_length = 32
@@ -76,6 +76,8 @@ module "stage" {
   # https://<% index .Params `region` %>.console.aws.amazon.com/systems-manager/parameters/%252Faws%252Fservice%252Feks%252Foptimized-ami%252F1.18%252Famazon-linux-2%252Frecommended%252Fimage_id/description?region=<% index .Params `region` %>
   eks_worker_ami = "<% index .Params `eksWorkerAMI` %>"
 
+  # Hosting configuration. Each domain will have a bucket created for it, but may have mulitple aliases pointing to the same bucket.
+  # Note that because of the way terraform handles lists, new records should be added to the end of the list.
   hosted_domains = [
     {
       domain : local.domain_name,