Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Nat ENI via Launch Template and Amazon Linux 2023 support #20

Merged
merged 1 commit into from
Jan 6, 2025
Merged

Nat ENI via Launch Template and Amazon Linux 2023 support #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 56 additions & 18 deletions vpc-v2.cfndsl.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,9 +180,15 @@
RuleAction rule['action'] || 'allow'
Egress rule['egress'] || false
CidrBlock cidr
unless rule.has_key?('protocol') && rule['protocol'].to_s == '-1'
unless rule.has_key?('protocol') && ((rule['protocol'].to_s == '-1' || rule['protocol'].to_s == '1'))
PortRange ({ From: rule['from'], To: rule['to'] || rule['from'] })
end
if rule.has_key?('icmp')
Icmp({
'Type' => 3, # Destination Unreachable
'Code' => 4 # Fragmentation Needed
})
end
}
end
end
Expand Down Expand Up @@ -435,17 +441,52 @@
NetworkInterfaceId Ref("NetworkInterface#{az}")
}

nat_userdata = <<~USERDATA
#!/bin/bash
INSTANCE_ID=$(curl http://169.254.169.254/2014-11-05/meta-data/instance-id -s)
aws ec2 attach-network-interface --instance-id $INSTANCE_ID --network-interface-id ${NetworkInterface#{az}} --device-index 1 --region ${AWS::Region}
/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchTemplate#{az} --region ${AWS::Region}
systemctl disable postfix
systemctl stop postfix
systemctl enable snat
systemctl start snat
USERDATA

if external_parameters[:nat_2023]
nat_userdata = <<~USERDATA
#!/bin/bash
# Fetch the metadata token for IMDSv2
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
INSTANCE_ID=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/2014-11-05/meta-data/instance-id -s)
aws ec2 modify-network-interface-attribute --network-interface-id ${NetworkInterface#{az}} --no-source-dest-check --region ${AWS::Region}
/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchTemplate#{az} --region ${AWS::Region}
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@LewS This AMI doesn't have cfn-init installed the required package is aws-cfn-bootstrap and it new path to cfn-init is /usr/bin/cfn-init

Gus had setup CloudInit metadata to create a systemd service to ensure nat at reboot not sure if want to do the same thoughts?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The userdata sets everything to survive a reboot, we don't need to create a system service, which would probably need rewriting. There's just source dest checking that is set on startup using Cron.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The rspec tests are failing due to the change to the NetworkInterfaces changes. I think this needs to be made conditionally like the user data

dnf -y install iptables iptables-utils iptables-services amazon-ssm-agent cronie
systemctl enable amazon-ssm-agent
systemctl start amazon-ssm-agent
sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv4.conf.ens5.rp_filter=0
echo net.ipv4.ip_forward = 1 >> /etc/sysctl.conf
echo net.ipv4.conf.ens5.rp_filter = 0 >> /etc/sysctl.conf
iptables -t nat -A POSTROUTING -s ${CIDR} -o ens5 -j MASQUERADE
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables-save > /etc/sysconfig/iptables
echo "@reboot root aws ec2 modify-network-interface-attribute --network-interface-id ${NetworkInterface#{az}} --no-source-dest-check --region ${AWS::Region}" >> /etc/crontab
systemctl enable crond --now
systemctl enable iptables --now

USERDATA
else
nat_userdata = <<~USERDATA
#!/bin/bash
INSTANCE_ID=$(curl http://169.254.169.254/2014-11-05/meta-data/instance-id -s)
aws ec2 attach-network-interface --instance-id $INSTANCE_ID --network-interface-id ${NetworkInterface#{az}} --device-index 1 --region ${AWS::Region}
/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchTemplate#{az} --region ${AWS::Region}
systemctl disable postfix
systemctl stop postfix
systemctl enable snat
systemctl start snat
USERDATA
end
network_interfaces = {
DeviceIndex: 0,
AssociatePublicIpAddress: true,
Groups: [ Ref(:NatInstanceSecurityGroup) ]
}
if external_parameters[:nat_2023]
network_interfaces = {
NetworkInterfaceId: Ref("NetworkInterface#{az}"),
DeviceIndex: 0
}
end
template_data = {
TagSpecifications: [
{ ResourceType: 'instance', Tags: nat_tags },
Expand All @@ -455,11 +496,7 @@
InstanceType: Ref(:NatInstanceType),
UserData: FnBase64(FnSub(nat_userdata)),
IamInstanceProfile: { Name: Ref(:NatInstanceProfile) },
NetworkInterfaces: [{
DeviceIndex: 0,
AssociatePublicIpAddress: true,
Groups: [ Ref(:NatInstanceSecurityGroup) ]
}]
NetworkInterfaces: [network_interfaces]
}

spot_options = {
Expand Down Expand Up @@ -546,7 +583,8 @@
DesiredCapacity '1'
MinSize '1'
MaxSize '1'
VPCZoneIdentifier [Ref("SubnetPublic#{az}")]
AvailabilityZones [FnSelect(az, FnGetAZs(Ref('AWS::Region')))] if external_parameters[:nat_2023]
VPCZoneIdentifier [Ref("SubnetPublic#{az}")] unless external_parameters[:nat_2023]
LaunchTemplate({
LaunchTemplateId: Ref("LaunchTemplate#{az}"),
Version: FnGetAtt("LaunchTemplate#{az}", :LatestVersionNumber)
Expand Down
Loading