aleach / terraform-aws-jenkins

Immutable, auto-updating Jenkins Master. Data stored on encrypted EFS.

---

Need help with your Cloud builds GET IN TOUCH

---

Terraform AWS Jenkins Master module

Auto-scaled, self healing, Jenkins Master server for use in AWS.

Prerequisites

• A VPC is already in place
• DHCP options set to AmazonProvidedDNS
• Route 53 zone is already in place ( Optional )
• Terraform version >= 0.13.2
• AWS account

Summary:

• Jenkins Master ec2 instance, created via an AutoScaling Group "ASG".
• Encrypted EFS share to host $JENKINS_HOME.
• EFS Mount points in 2x AZs.
• DNS friendly name in Route53 for connections ( Optional ).
• Application Load balancer "ALB" , forwarding to the Jenkins Master.
• Jenkins Server rebuilds once a week deploying all the latest security patches and the latest jenkins.war. Default = 00:00 - 00:30 each Sunday morning.
• Custom KMS encryption key for EFS.
• HTTP - auto re-directs to - HTTPS
• data_sources.tf can be used to look up the latest AMI to use.

EFS Backups

$JENKINS_HOME is stored on an EFS Share. It is advisable to back this up. AWS provide 2 off-the-shelf solutions that will do this automatically:

• https://aws.amazon.com/answers/infrastructure-management/efs-backup/. This solution is deployed via a CloudFormation template.
• AWS Backup - https://aws.amazon.com/backup/ ( Probably more straight forward to implement )

Current supported Operating Systems:

• Ubuntu Server 20.04 LTS
• Amazon Linux 2

Inputs

Name	Description	Type	Default	Required
alb_listener_port	ALB listener port	number	"443"	no
alb_listener_protocol	ALB listener protocol	string	"HTTPS"	no
ami	AMI to be used to build the ec2 instance (via launch config)	string	n/a	yes
asg_tags	Dynamic tags for ASG	any	[ { "key": "Name", "propagate_at_launch": true, "value": "tags need setting" } ]	no
autoscaling_schedule_create	Allows for disabling of scheduled actions on ASG. Enabled by default	number	1	no
certificate_arn	ARN of the SSL certificate to use	string	n/a	yes
create_dns_record	Create friendly DNS CNAME	bool	true	no
custom_userdata	Set custom userdata	string	""	no
deletion_window_in_days	Number of days before permanent removal	number	"30"	no
desired_capacity	AutoScaling Group desired capacity	number	1	no
domain_name	Domain Name	string	n/a	yes
efs_encrypted	Encrypt the EFS share	bool	true	no
enable_cross_zone_load_balancing	Enable / Disable cross zone load balancing	bool	false	no
enable_deletion_protection	Enable / Disable deletion protection for the ALB.	bool	false	no
enable_key_rotation	KMS key rotation	bool	true	no
enable_monitoring	AutoScaling - enables/disables detailed monitoring	bool	"false"	no
encrypted	Encryption of volumes	bool	true	no
environment	Environment where resources are being created, for example DEV, UAT or PROD	string	n/a	yes
health_check_grace_period	AutoScaling health check grace period	number	180	no
health_check_type	AutoScaling health check type. EC2 or ELB	string	"ELB"	no
healthy_threshold	ALB healthy count	number	2	no
hostname_prefix	Hostname prefix for the Jenkins server	string	"jenkins"	no
http_listener_required	Enables / Disables creating HTTP listener. Listener auto redirects to HTTPS	bool	true	no
iam_instance_profile	IAM instance profile for Jenkins server	string	null	no
instance_type	ec2 instance type	string	"t3a.medium"	no
internal	Is the ALB internal?	bool	false	no
interval	ALB health check interval	number	20	no
key_name	ec2 key pair use	string	n/a	yes
listener1_alb_listener_port	HTTP listener port	number	80	no
listener1_alb_listener_protocol	HTTP listener protocol	string	"HTTP"	no
max_size	AutoScaling Group max size	number	1	no
min_size	AutoScaling Group min size	number	1	no
performance_mode	EFS performance mode.https://docs.aws.amazon.com/efs/latest/ug/performance.html	string	"generalPurpose"	no
private_subnet_a	1st private subnet id	string	n/a	yes
private_subnet_b	2nd private subnet id	string	n/a	yes
route53_endpoint_record	Route 53 endpoint name. Creates route53_endpoint_record	string	"jenkins"	no
scale_down_cron	The time when the recurring scale down action start.Cron format	string	"0 0 * * SUN"	no
scale_up_cron	The time when the recurring scale up action start.Cron format	string	"30 0 * * SUN"	no
security_groups	List of security groups to assign to the ec2 instance. Create outside of module and pass in	list(string)	n/a	yes
security_groups_alb	ALB Security Group. Create outside of module and pass in	list(string)	n/a	yes
security_groups_mount_target_a	Security groups to use for mount target subnet a. Create outside of module and pass in	list(string)	n/a	yes
security_groups_mount_target_b	Security groups to use for mount target subnet b. Create outside of module and pass in	list(string)	n/a	yes
subnets	Subnets where the ALB will be placed	list(string)	n/a	yes
success_codes	Success Codes for the Target Group Health Checks. Default is 200 ( OK )	string	"200"	no
supplementary_user_data	Supplementary shell script commands for adding to user data.Runs at the end of userdata	string	"#supplementary_user_data"	no
svc_port	Service port: The port on which targets receive traffic.	number	8080	no
tags	Tags map	map(string)	{}	no
target_group_path	Health check request path	string	"/"	no
target_group_port	The port to use to connect with the target	number	"8080"	no
target_group_protocol	The protocol to use to connect to the target	string	"HTTP"	no
timeout	ALB timeout value	number	5	no
unhealthy_threshold	ALB unhealthy count	number	10	no
volume_size	ec2 volume size	number	30	no
volume_type	ec2 volume type	string	"gp2"	no
vpc_id	VPC id	string	n/a	yes
vpc_zone_identifier	A list of subnet IDs to launch AutoScaling resources in.	list(string)	n/a	yes
zone_id	Route 53 zone id	string	null	no

Outputs

Name	Description
asg_id	Jenkins ASG id
efs_dns_name	DNS name of the EFS share
lb_arn	Load balancer ARN
lb_dns_name	Load balancer DNS Name
lb_zone_id	Load balancer zone id