cockroachdb/cockroach_insecure_cluster.aws

# Create a new VPC open to Internet to host the subnets
vpc = create vpc cidr=10.0.0.0/16 name=cockroachdb-vpc
gateway = create internetgateway
attach internetgateway id=$gateway vpc=$vpc

# Create a route table for this network and enabling routing from the Internet
rtable = create routetable vpc=$vpc
create route cidr=0.0.0.0/0 gateway=$gateway table=$rtable

# Create 3 public subnets (multi AZ)
pubsubnet1 = create subnet cidr=10.0.128.0/20 vpc=$vpc name=cockroachdb-pubsubnet-1 availabilityzone={availabilityzone.1}
update subnet id=$pubsubnet1 public=true

pubsubnet2 = create subnet cidr=10.0.144.0/20 vpc=$vpc name=cockroachdb-pubsubnet-2 availabilityzone={availabilityzone.2}
update subnet id=$pubsubnet2 public=true

pubsubnet3 = create subnet cidr=10.0.160.0/20 vpc=$vpc name=cockroachdb-pubsubnet-3 availabilityzone={availabilityzone.3}
update subnet id=$pubsubnet3 public=true

# Make the public subnets open to the Internet
attach routetable id=$rtable subnet=$pubsubnet1
attach routetable id=$rtable subnet=$pubsubnet2
attach routetable id=$rtable subnet=$pubsubnet3

# Create 3 private subnets (multi AZ)
privsubnet1 = create subnet cidr=10.0.0.0/19 vpc=$vpc name=cockroachdb-privsubnet-1 availabilityzone={availabilityzone.1}
privsubnet2 = create subnet cidr=10.0.32.0/19 vpc=$vpc name=cockroachdb-privsubnet-2 availabilityzone={availabilityzone.2}
privsubnet3 = create subnet cidr=10.0.64.0/19 vpc=$vpc name=cockroachdb-privsubnet-3 availabilityzone={availabilityzone.3}

# Add a NAT Gateway used by nodes to provision themselves with user data accessing Internet
pubip = create elasticip domain=vpc
natgw = create natgateway elasticip-id=$pubip subnet=$pubsubnet1
# Wait for the NAT Gateway
check natgateway id=$natgw state=available timeout=180

# Routing to attach nat gateway to private subnets
natgw_rtable = create routetable vpc=$vpc
attach routetable id=$natgw_rtable subnet=$privsubnet1
attach routetable id=$natgw_rtable subnet=$privsubnet2
attach routetable id=$natgw_rtable subnet=$privsubnet3
create route cidr=0.0.0.0/0 gateway=$natgw table=$natgw_rtable

## Create the firewalls for HTTP UI
loadb-uifirewall = create securitygroup vpc=$vpc description=cockroachdb-loadb-ui-securitygroup name=CockroachUIAccess
update securitygroup id=$loadb-uifirewall inbound=authorize protocol=tcp cidr=0.0.0.0/0 portrange=8080

## Create the HTTP load balancer
tgroup_ui = create targetgroup name=cockroachdb-ui port=8080 protocol=HTTP vpc=$vpc healthcheckpath="/health"
lb = create loadbalancer name=cockroachdb-cluster subnets=[$pubsubnet1, $pubsubnet2, $pubsubnet3] securitygroups=$loadb-uifirewall
create listener actiontype=forward loadbalancer=$lb port=8080 protocol=HTTP targetgroup=$tgroup_ui

## Create the TCP load balancer
tgroup_node = create targetgroup name=cockroachdb-nodes port=26257 protocol=TCP vpc=$vpc
tcplb = create loadbalancer name=cockroachdb-cluster-tcp type=network subnets=[$pubsubnet1, $pubsubnet2, $pubsubnet3]
create listener actiontype=forward loadbalancer=$tcplb port=26257 protocol=TCP targetgroup=$tgroup_node

# Create firewall for general SSH access
sshfirewall = create securitygroup vpc=$vpc description=ssh-access name=AccessSSH
update securitygroup id=$sshfirewall inbound=authorize protocol=tcp cidr=0.0.0.0/0 portrange=22

# Create nodes firewall to let: inter nodes TCP traffic, TCP traffic from loadb; UI HTTP traffic from loadb
nodefirewall = create securitygroup vpc=$vpc description=cockroachdb-node-access name=CockroachNodesAccess
update securitygroup id=$nodefirewall inbound=authorize protocol=tcp cidr=0.0.0.0/0 portrange=26257
update securitygroup id=$nodefirewall inbound=authorize protocol=tcp securitygroup=$loadb-uifirewall portrange=8080

# Create a role with policy so that cockroach node instances (ec2 resources) can list other nodes using a local `awless`
create role name=DiscoverCockroachNodeRole principal-service="ec2.amazonaws.com" sleep-after=20
attach policy role=DiscoverCockroachNodeRole service=ec2 access=readonly

## Create the cockroachdb nodes
node1 = create instance distro=canonical:ubuntu subnet=$privsubnet1 securitygroup=[$sshfirewall,$nodefirewall] keypair={my.ssh.keypair} type={instance.type} role=DiscoverCockroachNodeRole type=t2.medium count=1 name=cockroachdb-node-1 userdata=./userdata/cockroach_insecure_node.sh
check instance id=$node1 state=running timeout=180

node2 = create instance distro=canonical:ubuntu subnet=$privsubnet2 securitygroup=[$sshfirewall,$nodefirewall] keypair={my.ssh.keypair} type={instance.type} role=DiscoverCockroachNodeRole type=t2.medium count=1 name=cockroachdb-node-2 userdata=./userdata/joining_cockroach_insecure_node.sh
check instance id=$node2 state=running timeout=180

node3 = create instance distro=canonical:ubuntu subnet=$privsubnet3 securitygroup=[$sshfirewall,$nodefirewall] keypair={my.ssh.keypair} type={instance.type} role=DiscoverCockroachNodeRole type=t2.medium count=1 name=cockroachdb-node-3 userdata=./userdata/joining_cockroach_insecure_node.sh
check instance id=$node3 state=running timeout=180

# Put instances in the necessary target groups
attach instance id=$node1 targetgroup=$tgroup_node
attach instance id=$node2 targetgroup=$tgroup_node
attach instance id=$node3 targetgroup=$tgroup_node

attach instance id=$node1 targetgroup=$tgroup_ui
attach instance id=$node2 targetgroup=$tgroup_ui
attach instance id=$node3 targetgroup=$tgroup_ui

# Create a small jump instance in your public subnet to run command on your nodes
create instance distro=canonical:ubuntu keypair={my.ssh.keypair} name=jump-server subnet=$pubsubnet1 securitygroup=$sshfirewall type=t2.micro

# Retrieve the loadbalancer public DNS with `awless show cockroachdb-cluster --local`
# Then to connect to the cluster UI in a browser with https://{PUBLIC_DNS}:8080
# 
# Retrieve the TCP loadbalancer public DNS with `awless show cockroachdb-cluster-tcp --local`
# Then sql connect to the cluster with `cockroach sql --insecure --host {TCP_PUBLIC_DNS}`
#
# Also use awless and the jump server to go to specific nodes:
# awless ssh cockroachdb-node-1 --through jump-server 