-
Notifications
You must be signed in to change notification settings - Fork 0
/
datadog-agent.tf
137 lines (117 loc) · 3.36 KB
/
datadog-agent.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
locals {
# even if it might be obvious for most people:
# do not reword the content of these variables
datadog_enable = length(var.datadog_api_key) > 0 ? 1 : 0
datadog_name = "datadog-agent"
datadog_log_pointer_dir = "/opt/datadog-agent/run/"
}
data "template_file" "definition" {
template = file("${path.module}/datadog/definition.json")
vars = {
datadog_name = local.datadog_name
dd_api_key = var.datadog_api_key
squad = var.squad
environment = var.environment
}
}
data "aws_iam_policy_document" "agent_trust_policy" {
statement {
actions = [
"sts:AssumeRole",
]
principals {
identifiers = [
"ec2.amazonaws.com",
]
type = "Service"
}
}
}
data "aws_iam_policy_document" "agent_policy" {
statement {
actions = [
"ecs:RegisterContainerInstance",
"ecs:DeregisterContainerInstance",
"ecs:DiscoverPollEndpoint",
"ecs:Submit*",
"ecs:Poll",
"ecs:StartTask",
"ecs:StartTelemetrySession",
]
resources = ["*"]
}
}
resource "aws_iam_policy" "agent_policy" {
count = local.datadog_enable
name = "${local.datadog_name}-policy"
policy = data.aws_iam_policy_document.agent_policy.json
}
resource "aws_iam_role" "agent_role" {
count = local.datadog_enable
name = "${local.datadog_name}-ecs"
assume_role_policy = data.aws_iam_policy_document.agent_trust_policy.json
tags = local.tags
}
resource "aws_iam_instance_profile" "agent_profile" {
count = local.datadog_enable
name = local.datadog_name
role = aws_iam_role.agent_role[0].name
}
resource "aws_iam_role_policy_attachment" "agent_role_default" {
count = local.datadog_enable
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role"
role = aws_iam_role.agent_role[0].name
}
resource "aws_iam_role_policy_attachment" "agent_role_attachment" {
count = local.datadog_enable
policy_arn = aws_iam_policy.agent_policy[0].arn
role = aws_iam_role.agent_role[0].name
}
resource "aws_ecs_task_definition" "agent_definition" {
count = local.datadog_enable
depends_on = [aws_iam_role.agent_role]
tags = merge(local.tags, { type = "operations" })
container_definitions = data.template_file.definition.rendered
family = local.datadog_name
network_mode = "bridge"
volume {
name = "datadog_logs"
host_path = "/tmp/datadog-logs"
}
volume {
name = "docker_sock"
host_path = "/var/run/docker.sock"
}
volume {
name = "proc"
host_path = "/proc/"
}
volume {
name = "cgroup"
host_path = "/cgroup/"
}
volume {
name = "log_pointer"
host_path = local.datadog_log_pointer_dir
}
volume {
name = "passwd"
host_path = "/etc/passwd"
}
requires_compatibilities = [
"EC2",
]
}
resource "aws_ecs_service" "agent_service" {
count = local.datadog_enable
name = local.datadog_name
tags = merge(local.tags, { type = "operations" })
cluster = aws_ecs_cluster.cluster.id
task_definition = aws_ecs_task_definition.agent_definition[0].arn
desired_count = var.max_size
placement_constraints {
type = "distinctInstance"
}
deployment_maximum_percent = 100
deployment_minimum_healthy_percent = 0
}