archway-network / networks Goto Github PK

Currently all the terraform files are under infrastructure folder

New proposed structure:

• infrastrucure
  • modules
    • environment
  • environments
    • non-prod
      • main.tf
    • prod
      • main.tf
    • xyz-env
      • main.tf

environment module:

• Setup a new project under non-prod or prod folder
• Use shared VPC from non-prod or prod
• Create and configure GKE cluster
• Create and configure apps in GKE cluster

┆Issue is synchronized with this Jira Task by Unito

┆Issue is synchronized with this Jira Task by Unito

We need to be able to test IBC transfers across various chains and to be able to do so we need the following infrastructure

• An archive node on cosmoshub public testnetwork. funds can be aquired through https://stakely.io/en/faucet/cosmos-atom
• A full node on osmosis public testnetwork. Fund can be aquired through https://faucet.osmosis.zone/#/
• A new testnetwork operated internally
• Relayers to execute on IBC transactions

┆Issue is synchronized with this Jira Task by Unito

Constantine testnetwork must be upgraded through gov proposals.

We need a github action to create these upgrade proposals on constantine with each new release of the archway protocol.

┆Issue is synchronized with this Jira Task by Unito

All critical alerts should be routed from alertmanager to #eng-alerts channel on slack

┆Issue is synchronized with this Jira Task by Unito

┆Issue is synchronized with this Jira Task by Unito

Solves:

• #101

┆Issue is synchronized with this Jira Task by Unito

Nodeset module should be able to set up Cloud DNS enteries to expose RPC, gRPC and API endpoints.

Proposal:

• nodeset should input two variables for zone and domain
• nodeset should create two records in cloud DNS under the give zone
  A record: *.
  A record:

┆Issue is synchronized with this Jira Task by Unito

Relayer operation seems quite unstable -> context

There seems to be multiple issue:

• packets get stuck after a while and the relayer stops relaying until restarted
• ibc client on axelar keep getting expired and chain configs on hermes probably are to blame.

┆Issue is synchronized with this Jira Task by Unito

Currently our nodes are highly available from the internet and it brings quite a significant security risk.

Enhance the security of the cluster by:

• limitting access to nodes through VPN only
• limiting access to Kubernetes through VPN only
• limiting access to public endpoints like Grafana through VPN only

This requires task #62 to be done first

┆Issue is synchronized with this Jira Task by Unito

Currently archway branded big-dippers are deployed from @drewstaylor personal repository on docker hub docker.io/drewstaylor/bigdipper:1.0.1-archway
[ ] Add CI to release docker image to use archway docker repository.
[ ] Update deploy CI to use archway docker repository

┆Issue is synchronized with this Jira Task by Unito

┆Issue is synchronized with this Jira Task by Unito

┆Issue is synchronized with this Jira Task by Unito

Currently there is not automated checks for infrastructure which can cause unnecessary problems and security risks.

Tools:

• Terraform
  • tflint
  • terraform fmt
  • tfsec
• Kubernetes
  • kube-score
  • yamllint

Each tool should be run by CI and also be available from Make file or equivalent

┆Issue is synchronized with this Jira Task by Unito

Atlantis is a Terraform PR automation tool that could help us more easily deploy Terraform code
https://www.runatlantis.io/

┆Issue is synchronized with this Jira Task by Unito

We use GKE as our k8s provider and we do not need to worry about control plane componenets. All control plane related alerts should be disabled in kub-prometheus-stack

┆Issue is synchronized with this Jira Task by Unito

Wireguard base instance now has to be configured manually everytime the instance gets deleted.
It would be good to have cloud-init there to do the following:

• Install packages:
  • wireguard
  • iptables
  • resolvconf
  • qrencode
• Format and automount the disk to /etc/wireguard
• Add these to `/etc/sysctl.d/wg.conf
  • net.ipv4.ip_forward = 1
  • net.ipv6.conf.all.forwarding = 1
• Enable wireguard via systemd : systemdctl enable wg-quick@wg0

┆Issue is synchronized with this Jira Task by Unito

Currently we have manually managed DNS records in CloudDNS

• archway.tech
• area-52.io

Add infrastructure/dns.tf to manage dns records programatically

┆Issue is synchronized with this Jira Task by Unito