@@ -54,17 +54,17 @@ Here's a list of the services we will use and their costs:
## Creating an IAM EC2 instance role and profile
To minimize the permissions of the user, we'll create a new IAM role with
limited access:
To minimize the permissions of the user, we'll create a new [IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
role with limited access:
1. Navigate to the IAM dashboard https://console.aws.amazon.com/iam/home and
click on **Create role**.
1. Create a new role by choosing to **AWS service > EC2**. Once done, click on
click **Create role**.
1. Create a new role by choosing to **AWS service > EC2**. Once done, click
**Next: Permissions**.
![Create role](img/create_iam_role.png)
1. Choose **AmazonEC2FullAccess** and **AmazonS3FullAccess** and click on**Next: Review**.
1. Choose **AmazonEC2FullAccess** and **AmazonS3FullAccess**, then click**Next: Review**.
1. Give the role the name `GitLabAdmin` and click **Create role**.
![Create role](img/create_iam_role_review.png)
...
...
@@ -73,15 +73,15 @@ limited access:
We'll start by creating a VPC for our GitLab cloud infrastructure, then
we can create subnets to have public and private instances in at least
two AZs. Public subnets will require a Route Table keep and an associated
two [Availability Zones (AZs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html). Public subnets will require a Route Table keep and an associated
Internet Gateway.
### VPC
### Creating the Virtual Private Cloud (VPC)
Let's create a VPC:
We'll now create a VPC, a virtual networking environment that you'll control:
1. Navigate to https://console.aws.amazon.com/vpc/home
1. Select **Your VPCs** from the left menu and then click on **Create VPC**.
1. Navigate to https://console.aws.amazon.com/vpc/home.
1. Select **Your VPCs** from the left menu and then click **Create VPC**.
At the name tag enter `gitlab-vpc` and at the IPv4 CIDR block enter `10.0.0.0/16`.
If you don't require dedicated hardware, you can leave tenancy as default.
Click **Yes, Create** when ready.
...
...
@@ -99,7 +99,7 @@ We will create private and public subnets to match load balancers and
RDS instances as well:
1. Select **Subnets** from the left menu.
1. Click on **Create subnet**. Give it a descriptive name tag based on the IP,
1. Click **Create subnet**. Give it a descriptive name tag based on the IP,
for example `gitlab-public-10.0.0.0`, select the VPC we created previously,
and at the IPv4 CIDR block let's give it a 24 subnet `10.0.0.0/24`:
...
...
@@ -126,11 +126,11 @@ to associate an Internet Gateway. On the same VPC dashboard:
### Internet Gateway
Now, still on the same dashboard head over to Internet Gateways and
Now, still on the same dashboard, go to Internet Gateways and
create a new one:
1. Select **Internet Gateways** from the left menu.
1. Click on **Create internet gateway**, give it the name `gitlab-gateway` and
1. Click **Create internet gateway**, give it the name `gitlab-gateway` and
click **Create**.
1. Select it from the table, and then under the **Actions** dropdown choose
"Attach to VPC".
...
...
@@ -168,7 +168,7 @@ Now that we're done with the network, let's create a security group.
The security group is basically the firewall:
1. Select **Security Groups** from the left menu.
1. Click on **Create Security Group** and fill in the details. Give it a name,
1. Click **Create Security Group** and fill in the details. Give it a name,
add a description, and choose the VPC we created previously
1. Select the security group from the list and at the the bottom select the
Inbound Rules tab. You will need to open the SSH, HTTP, and HTTPS ports. Set
...
...
@@ -181,7 +181,7 @@ The security group is basically the firewall:
host or CIDR block. In that case, change the SSH source to be custom and give
it the IP you want to SSH from.
1. When done, click on **Save**.
1. When done, click **Save**.
## PostgreSQL with RDS
...
...
@@ -194,7 +194,7 @@ create the actual RDS instance.
1. Navigate to the RDS dashboard and select **Subnet Groups** from the left menu.
1. Give it a name (`gitlab-rds-group`), a description, and choose the VPC from
the VPC dropdown.
1. Click on "Add all the subnets related to this VPC" and
1. Click "Add all the subnets related to this VPC" and
remove the public ones, we only want the **private subnets**.
In the end, you should see `10.0.1.0/24` and `10.0.3.0/24` (as
we defined them in the [subnets section](#subnets)).
...
...
@@ -206,7 +206,7 @@ create the actual RDS instance.
Now, it's time to create the database:
1. Select **Instances** from the left menu and click on **Create database**.
1. Select **Instances** from the left menu and click **Create database**.
1. Select PostgreSQL and click **Next**.
1. Since this is a production server, let's choose "Production". Click **Next**.
1. Let's see the instance specifications:
...
...
@@ -225,7 +225,7 @@ Now, it's time to create the database:
1. The rest of the settings on this page request a DB isntance identifier, username
and a master password. We've chosen to use `gitlab-db-ha`, `gitlab` and a
very secure password respectively. Keep these in hand for later.
1. Click on **Next** to proceed to the advanced settings.
1. Click **Next** to proceed to the advanced settings.
1. Make sure to choose our gitlab VPC, our subnet group, set public accessibility to
**No**, and to leave it to create a new security group. The only additional
change which will be helpful is the database name for which we can use
...
...
@@ -274,7 +274,7 @@ To set up Redis:
![ElastiCache subnet](img/ec_subnet.png)
1. Select **Redis** on the left menu and click on **Create** to create a new
1. Select **Redis** on the left menu and click **Create** to create a new
Redis cluster. Depending on your load, you can choose whether to enable
cluster mode or not. Even without cluster mode on, you still get the
chance to deploy Redis in multi availability zones. In this guide, we chose
...
...
@@ -317,7 +317,7 @@ On the EC2 dashboard, look for Load Balancer on the left column:
1. In the "Listeners" section, make sure it has HTTP and HTTPS.
1. In the "Availability Zones" section, select the `gitlab-vpc` we have created
and associate the **public subnets**.
1. Click on the **Configure Security Settings** to go to the next section to
1. Click **Configure Security Settings** to go to the next section to
select the TLS certificate. When done, go to the next step.
1. In the "Security Groups" section, create a new one by giving it a name
(`gitlab-loadbalancer-sec-group`) and allow both HTTP ad HTTPS traffic
...
...
@@ -328,7 +328,7 @@ On the EC2 dashboard, look for Load Balancer on the left column:
1. Leave the "Register Targets" section as is, and finally review the settings
and create the ELB.
After the Load Balancer is up and running, you can re-visit your Security
After the Load Balancer is up and running, you can revisit your Security
Groups to improve access only through the ELB and any other requirement
you might have.
...
...
@@ -340,7 +340,7 @@ configure the PostgreSQL and Redis connections.
The Auto Scaling Group option is available through the EC2 dashboard on the left
sidebar.
1. Click on the **Create Auto Scaling group** button.
1. Click **Create Auto Scaling group**.
1. Create a new launch configuration.
### Choose the AMI
...
...
@@ -348,15 +348,15 @@ sidebar.
Choose the AMI:
1. Go to the Community AMIs and search for `GitLab EE <version>`
where `<version>` the latest version as seen in the
where `<version>` the latest version as seen on the