tWIL 2022.10 1주차

cdk deploy mystack-vpc

cdk deploy mystack-stack

export enum Stage {
  Development = "dev",
  Staged = "staged",
  Release = "release",
  Production = "prod",
}

export interface MyStackProps extends cdk.StackProps {
  stage: Stage;
  vpcName: string;
  stackAlias: string;
  /**
   * 서비스 기준 도메인: {stage}.myapp.io
   */
  domain: string;
  /**
   * 서비스 기준 도메인의 ARN 값
   */
  certificateArn: string;
}

cdk
├── __tests__
│   └── index.spec.ts
├── index.ts
└── lib
    ├── mystack.ts
    ├── ecs
    │   ├── api.ts
    │   ├── auth.ts
    │   ├── environment
    │   │   ├── index.ts
    │   │   └── validator
    │   │       └── index.ts
    │   └── index.ts
    ├── index.ts
    ├── rds
    │   ├── aurora-rds.ts
    │   └── index.ts
    ├── types.ts
    └── vpc
        └── index.ts

/* eslint-disable @typescript-eslint/no-non-null-assertion */
/* eslint-disable @typescript-eslint/no-non-null-asserted-optional-chain */
import * as cdk from "aws-cdk-lib";
import * as ssm from "aws-cdk-lib/aws-ssm";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as acm from "aws-cdk-lib/aws-certificatemanager";
import * as route53 from "aws-cdk-lib/aws-route53";
import { myStackAuth, myStackApi } from "./ecs";
import { myStackRDS } from "./rds";
import { myStackVpc } from "./vpc";
import { MyStackStackProps } from "./types";

/* It creates a new stack and then calls the stackEnvironment function */
export class MyStackVpc extends cdk.Stack {
  constructor(scope: cdk.App, name: string, props: MyStackStackProps) {
    const { stage, vpcName, stackAlias, ...rest } = props;
    super(scope, name, rest);
    const stringParamter = myStackVpc(
      this,
      name,
      stage,
      vpcName,
      stackAlias,
    );
    new cdk.CfnOutput(this, "OutputVPCId", {
      value: stringParamter.stringValue,
    });
  }
}

export class MyStack extends cdk.Stack {
  constructor(scope: cdk.App, name: string, props: MyStackProps) {
    const { stage, stackAlias, domain, certificateArn, ...rest } = props;
    super(scope, name, rest);
    const vpcId = ssm.StringParameter.valueFromLookup(
      this,
      `/cdk/${stackAlias}/${stage}/vpcProvider`,
    );
    const vpc = ec2.Vpc.fromLookup(this, "ExistingVPC", {
      vpcId,
    });
    /**
     * Create a MyStack Aurora PostgreSQL serverless Cluster
     */
    const cluster = myStackRDS(this, name, vpc, stage, stackAlias);
    const stagedDomain = `${stage}.myapp.io`;
    const domainZone = route53.HostedZone.fromLookup(this, "HostZone", {
      domainName: stagedDomain,
    });
    const certificate = acm.Certificate.fromCertificateArn(
      this,
      "Certificate",
      certificateArn,
    );
    const dbSecret = cluster.secret;
    /**
     * API server domain: api.{stage}.myapp.com
     */
    const apiDomain = `api.${domain}`;
    /**
     * Create a MyStack API Cluster
     */
    const apiFargateService = myStackApi(
      this,
      vpc,
      stage,
      stackAlias,
      apiDomain,
      domainZone,
      certificate,
      dbSecret,
    );
    /**
     * Auth server domain: auth.{stage}.myapp.io
     */
    const authDomain = `auth.${domain}`;
    /**
     * Create an Auth API SuperTokens Cluster
     */
    const authFagateService = myStackAuth(
      this,
      vpc,
      stage,
      stackAlias,
      authDomain,
      domainZone,
      certificate,
      dbSecret,
    );
    new cdk.CfnOutput(this, "OutputSecretName", {
      exportName: cluster.stack.stackName + ":SecretName",
      value: cluster.secret?.secretArn!,
    });

    new cdk.CfnOutput(this, "OutputSecretArn", {
      exportName: cluster.stack.stackName + ":SecretArn",
      value: cluster.secret?.secretArn!,
    });

    new cdk.CfnOutput(this, "OutputGetSecretValue", {
      exportName: cluster.stack.stackName + ":GetSecretValue",
      value:
        "aws secretsmanager get-secret-value --secret-id " +
        cluster.secret?.secretArn,
    });
    new cdk.CfnOutput(this, "ApiLoadBalancerDNS", {
      value: apiFargateService.loadBalancer.loadBalancerDnsName,
      description: "Network LoadBalancer URL",
    });
    new cdk.CfnOutput(this, "AuthLoadBalancerDNS", {
      value: authFagateService.loadBalancer.loadBalancerDnsName,
    });
  }
}

import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as ecs from "aws-cdk-lib/aws-ecs";
import * as cdk from "aws-cdk-lib";
import { Platform } from "aws-cdk-lib/aws-ecr-assets";
import * as ecs_patterns from "aws-cdk-lib/aws-ecs-patterns";
import { setEnvironment } from "./environment";
import { Stage } from "../types";

/**
 * It creates a Fargate service with a load balancer, and scales the number of tasks based on CPU
 * utilization
 * @param stack - The CDK stack object
 * @param vpc - The VPC that the service will be deployed to.
 * @param {Stage} stage - The stage of the application.
 * @param {string} stackAlias - The name of the stack.
 * @param [dbSecret] - This is the secret that we created in the previous step.
 * @returns The fargateService
 */
export function myStackApi(
  stack: cdk.Stack,
  vpc: ec2.IVpc,
  stage: Stage,
  stackAlias: string,
  domainName: string,
  domainZone: cdk.aws_route53.IHostedZone,
  certificate: cdk.aws_certificatemanager.ICertificate,
  dbSecret?: cdk.aws_secretsmanager.ISecret,
) {
  const cluster = new ecs.Cluster(stack, "api", {
    vpc,
    clusterName: `${stackAlias}-api-${stage}`,
  });
  // environment
  const { secrets: defaultSecrets } = setEnvironment(stack, stackAlias, stage);
  // create a task definition with CloudWatch Logs
  const logging = new ecs.AwsLogDriver({
    streamPrefix: "api",
  });
  const taskDefinition = new ecs.FargateTaskDefinition(stack, "api-task", {
    memoryLimitMiB: 512,
    cpu: 256,
  });
  const secrets = (() => {
    if (!dbSecret) return defaultSecrets;
    return {
      ...defaultSecrets,
      APIDATABASE_SECRET: ecs.Secret.fromSecretsManager(dbSecret),
    };
  })();
  taskDefinition.addContainer("api-container", {
    image: ecs.ContainerImage.fromAsset(".", {
      platform: Platform.LINUX_AMD64,
    }),
    logging,
    portMappings: [{ containerPort: 8000, hostPort: 8000 }],
    secrets,
  });

  const fargateService = new ecs_patterns.ApplicationLoadBalancedFargateService(
    stack,
    "api-service",
    {
      cluster,
      taskDefinition,
      domainName,
      domainZone,
      certificate,
      loadBalancerName: `${stage}-api-${stackAlias}`,
    },
  );
  const scaling = fargateService.service.autoScaleTaskCount({
    maxCapacity: 2,
  });
  scaling.scaleOnCpuUtilization("CpuScaling", {
    targetUtilizationPercent: 50,
    scaleInCooldown: cdk.Duration.seconds(60),
    scaleOutCooldown: cdk.Duration.seconds(60),
  });
  return fargateService;
}

export enum Env {
  POSTGRESQL_HOST = "POSTGRESQL_HOST",
  POSTGRESQL_PORT = "POSTGRESQL_PORT",
  // omitted...
  API_SECRET = "API_SECRET"
}

export type Environment = { [P in Env]: string };

import joi from "joi";
import "dotenv/config";
import { Environment, Env } from "../../../types";

const keys = Object.keys(Env).reduce((acc, key) => {
  return { ...acc, [key]: joi.string().required() };
}, {} as { [P in Env]: joi.StringSchema });

const envVarsSchema = joi.object().keys(keys).unknown();

/**
 * It validates the environment variables and returns them as a strongly typed object
 * @returns The environment variables as an object.
 */
export function environmentValues() {
  const { value: envVars, error } = envVarsSchema
    .prefs({ errors: { label: "key" } })
    .validate(process.env);
  if (error) {
    throw new Error(`Environment variables error: ${error.message}`);
  }
  return envVars as { [P in keyof Environment]: string };
}

import * as cdk from "aws-cdk-lib";
import * as ssm from "aws-cdk-lib/aws-ssm";
import * as ecs from "aws-cdk-lib/aws-ecs";
import "dotenv/config";
import { Stage, Environment, Env } from "../../types";
import { environmentValues } from "./validator";

const envVars = environmentValues();

const envKeys = Object.keys(Env) as (keyof typeof envVars)[];

/**
 * It creates SSM parameters for each environment variable and returns the parameters and their
 * corresponding secrets
 * @param scope - the stack that the parameters are being created in
 * @param {string} stackAlias - The name of the stack.
 * @param {Stage} stage - The stage of the environment.
 * @returns {
 *   params: { [P in keyof Environment]: ssm.StringParameter };
 *   secrets: { [P in keyof Environment]: ecs.Secret };
 * }
 */
export function setEnvironment(
  scope: cdk.Stack,
  stackAlias: string,
  stage: Stage,
): {
  params: { [P in keyof Environment]: ssm.StringParameter };
  secrets: { [P in keyof Environment]: ecs.Secret };
} {
  const params = envKeys.reduce((acc, key) => {
    return {
      ...acc,
      [key]: new ssm.StringParameter(scope, key, {
        parameterName: `/cdk/${stackAlias}/${stage}/${key}`,
        stringValue: envVars[key],
      }),
    };
  }, {} as { [P in keyof Environment]: ssm.StringParameter });
  const secrets = envKeys.reduce((acc, key) => {
    return {
      ...acc,
      [key]: ecs.Secret.fromSsmParameter(params[key]),
    };
  }, {} as { [P in keyof Environment]: ecs.Secret });
  return { params, secrets };
}

name: Deploy React App
on:
  push:
    branches: ["main"]
  workflow_dispatch:
permissions:
  contents: read
  pages: write
  id-token: write
concurrency:
  group: "pages"
  cancel-in-progress: true
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Detect package manager
        id: detect-package-manager
        run: |
          if [ -f "${{ github.workspace }}/yarn.lock" ]; then
            echo "::set-output name=manager::yarn"
            echo "::set-output name=command::install"
            echo "::set-output name=runner::yarn"
            exit 0
          elif [ -f "${{ github.workspace }}/package.json" ]; then
            echo "::set-output name=manager::npm"
            echo "::set-output name=command::ci"
            echo "::set-output name=runner::npx --no-install"
            exit 0
          else
            echo "Unable to determine packager manager"
            exit 1
          fi
      - name: Setup Node
        uses: actions/setup-node@v3
        with:
          node-version: "16"
          cache: ${{ steps.detect-package-manager.outputs.manager }}
      - name: Restore cache
        uses: actions/cache@v3
        with:
          path: |
            node_modules
          key: ${{ runner.os }}-${{ hashFiles('**/package-lock.json', '**/yarn.lock') }}-${{ hashFiles('**.[jt]s', '**.[jt]sx') }}
          restore-keys: |
            ${{ runner.os }}-${{ hashFiles('**/package-lock.json', '**/yarn.lock') }}-
      - name: Install dependencies
        run: ${{ steps.detect-package-manager.outputs.manager }} ${{ steps.detect-package-manager.outputs.command }}
      - name: Build
        env:
          CI: false
        run: ${{ steps.detect-package-manager.outputs.runner }} build
      - name: Upload artifact
        uses: actions/upload-pages-artifact@v1
        with:
          path: ./build
  deploy:
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v1