20482: Adds proper compute node instance profile instead of using keepstore's.

We first used keepstore's instance profile because compute nodes run a local
keepstore now.
We also need to give compute nodes permission to change resources related to
the EBS Autoscaler.

Arvados-DCO-1.1-Signed-off-by: Lucas Di Pentima <lucas.dipentima@curii.com>

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/arvados.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/arvados.sls
index 03859c46bde9212a249f85d073e8cf14ad066840..f181c874d2989a9fe378d850849f9e676e119909 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/arvados.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/arvados.sls
@@ -129,7 +129,7 @@ arvados:
           ### This SG should allow SSH from the dispatcher to the compute nodes
           SecurityGroupIDs: ['sg-FIXMEFIXMEFIXMEFI']
           SubnetID: subnet-FIXMEFIXMEFIXMEFI
-          IAMInstanceProfile: __CLUSTER__-keepstore-00-iam-role
+          IAMInstanceProfile: __CLUSTER__-compute-node-00-iam-role
       DispatchPrivateKey: |
         -----BEGIN OPENSSH PRIVATE KEY-----
         Read https://doc.arvados.org/install/crunch2-cloud/install-compute-node.html#sshkeypair

diff --git a/tools/salt-install/terraform/aws/data-storage/main.tf b/tools/salt-install/terraform/aws/data-storage/main.tf
index a3ef8f010f0abb8831e02ab17968cdf225234360..85a67ef4dc23997c66bd8086943bcaa49da31211 100644 (file)
--- a/tools/salt-install/terraform/aws/data-storage/main.tf
+++ b/tools/salt-install/terraform/aws/data-storage/main.tf
@@ -30,6 +30,11 @@ resource "aws_iam_role" "keepstore_iam_role" {
   assume_role_policy = "${file("../assumerolepolicy.json")}"
 }
 
+resource "aws_iam_role" "compute_node_iam_role" {
+  name = "${local.cluster_name}-compute-node-00-iam-role"
+  assume_role_policy = "${file("../assumerolepolicy.json")}"
+}
+
 resource "aws_iam_policy" "s3_full_access" {
   name = "${local.cluster_name}_s3_full_access"
   policy = jsonencode({
@@ -50,7 +55,10 @@ resource "aws_iam_policy" "s3_full_access" {
 
 resource "aws_iam_policy_attachment" "s3_full_access_policy_attachment" {
   name = "${local.cluster_name}_s3_full_access_attachment"
-  roles = [ aws_iam_role.keepstore_iam_role.name ]
+  roles = [
+    aws_iam_role.keepstore_iam_role.name,
+    aws_iam_role.compute_node_iam_role.name,
+  ]
   policy_arn = aws_iam_policy.s3_full_access.arn
 }
 

diff --git a/tools/salt-install/terraform/aws/data-storage/outputs.tf b/tools/salt-install/terraform/aws/data-storage/outputs.tf
index 6298f926adafc8b28c75ac9308d9a35db7d45fd0..de45aa861925787d457d4e806f8692c0d06af083 100644 (file)
--- a/tools/salt-install/terraform/aws/data-storage/outputs.tf
+++ b/tools/salt-install/terraform/aws/data-storage/outputs.tf
@@ -6,6 +6,10 @@ output "keepstore_iam_role_name" {
   value = aws_iam_role.keepstore_iam_role.name
 }
 
+output "compute_node_iam_role_name" {
+  value = aws_iam_role.compute_node_iam_role.name
+}
+
 output "use_external_db" {
   value = var.use_external_db
 }
\ No newline at end of file

diff --git a/tools/salt-install/terraform/aws/services/locals.tf b/tools/salt-install/terraform/aws/services/locals.tf
index abba4aab737f326673273e5fda5557e01aa77c71..191b7e03e0c60df38a467b7a62c7553e83299cb5 100644 (file)
--- a/tools/salt-install/terraform/aws/services/locals.tf
+++ b/tools/salt-install/terraform/aws/services/locals.tf
@@ -17,4 +17,5 @@ locals {
   ssl_password_secret_name = "${local.cluster_name}-${var.ssl_password_secret_name_suffix}"
   instance_ami_id = var.instance_ami != "" ? var.instance_ami : data.aws_ami.debian-11.image_id
   custom_tags = data.terraform_remote_state.vpc.outputs.custom_tags
+  compute_node_iam_role_name = data.terraform_remote_state.data-storage.outputs.compute_node_iam_role_name
 }

diff --git a/tools/salt-install/terraform/aws/services/main.tf b/tools/salt-install/terraform/aws/services/main.tf
index f7a2527c2cc2a6fc79ececf6a62d92a32f00d79b..a253ae26e816c86f615a60b9c13707bc81b06a14 100644 (file)
--- a/tools/salt-install/terraform/aws/services/main.tf
+++ b/tools/salt-install/terraform/aws/services/main.tf
@@ -25,6 +25,11 @@ resource "aws_iam_instance_profile" "keepstore_instance_profile" {
   role = data.terraform_remote_state.data-storage.outputs.keepstore_iam_role_name
 }
 
+resource "aws_iam_instance_profile" "compute_node_instance_profile" {
+  name = "${local.cluster_name}-compute-node-00-iam-role"
+  role = local.compute_node_iam_role_name
+}
+
 resource "aws_iam_instance_profile" "dispatcher_instance_profile" {
   name = "${local.cluster_name}_dispatcher_instance_profile"
   role = aws_iam_role.cloud_dispatcher_iam_role.name
@@ -72,6 +77,35 @@ resource "aws_instance" "arvados_service" {
   }
 }
 
+resource "aws_iam_policy" "compute_node_ebs_autoscaler" {
+  name = "${local.cluster_name}_compute_node_ebs_autoscaler"
+  policy = jsonencode({
+    Version: "2012-10-17",
+    Id: "compute-node EBS Autoscaler policy",
+    Statement: [{
+      Effect: "Allow",
+      Action: [
+          "ec2:AttachVolume",
+          "ec2:DescribeVolumeStatus",
+          "ec2:DescribeVolumes",
+          "ec2:DescribeTags",
+          "ec2:ModifyInstanceAttribute",
+          "ec2:DescribeVolumeAttribute",
+          "ec2:CreateVolume",
+          "ec2:DeleteVolume",
+          "ec2:CreateTags"
+      ],
+      Resource: "*"
+    }]
+  })
+}
+
+resource "aws_iam_policy_attachment" "compute_node_ebs_autoscaler_attachment" {
+  name = "${local.cluster_name}_compute_node_ebs_autoscaler_attachment"
+  roles = [ local.compute_node_iam_role_name ]
+  policy_arn = aws_iam_policy.compute_node_ebs_autoscaler.arn
+}
+
 resource "aws_iam_policy" "cloud_dispatcher_ec2_access" {
   name = "${local.cluster_name}_cloud_dispatcher_ec2_access"
   policy = jsonencode({