Managed Instance Private Code Hosts support

Architecture

Creation process

AWS GCP VPN extension connects an existing Cloud Instance with customer dedicated AWS account (maintained by Cloud Team).

spec:
  infrastructure:
    privateCodeHost:
      aws:
        accountID: <AWS_ACCOUNT_ID>
        highAvailable: true
        region: <AWS_REGION>
      enabled: true
      type: awsvpn

mi2 generate cdktf

VPN Verification

For each customer using private code host, additional section to our generated operation dashboard is added. Upon enabling the private code host support, follow the process to update the dashboard

AWS VPC Endpoint Service (aka AWS Private Link)

AWS Private Link is a secure method to expose a single endpoint (i.e. code host) from AWS VPC to specific AWS Principals (IAM in specific AWS VPC). This solution ensures code the host is not exposed from AWS and only a given principal can access it.

When a customer exposes the code host via VPC Endpoint Service, the Cloud Instance needs to create an AWS VPC Endpoint to expose connections inside the Sourcegraph Managed AWS VPC.

1. Add addtional field to privateCodeHost section

spec:
  infrastructure:
    privateCodeHost:
      aws:
        # privateLink represents a VPC endpoint exposed by customers
        privateLink:
          # Endpoint VPC Endpoint Service name
          endpoint: com.amazonaws.vpce.<REGION>.<VPC_ENDPOINT_SERVICE_ID>
          # ports list of TCP ports to open for GKE in AWS Security Group, by default only 443
          ports:
            - 443
        # enabled only if customer uses Private DNS Domain, this can be done only after customers accepts VPC Endpoint
        privateDnsEnabled: false

2. Generate additional resources in cdktf and apply

mi2 generate cdktf
mi2 instance cdktf deploy -auto-approve

If customer uses Private Domain for VPC Endpoint Service and accepted VPC Endpoint connection:

3. enable Private DNS in VPC Endpoint

spec:
  infrastructure:
    privateCodeHost:
      aws:
        # enabled only if customer uses Private DNS Domain, this can be done only after customers accepts VPC Endpoint
        privateDnsEnabled: true

4. Generate additional resources in cdktf and apply

mi2 generate cdktf
mi2 instance cdktf deploy -auto-approve

If customer uses Private Domain, addtional DNS proxy sidecar also needs to be used in Cloud Instance.

AWS Private Link playbook for customer

When a customer has private code hosts inside the AWS VPC and needs to expose it for Sourcegraph managed AWS VPC, customers can use AWS Documentation or follow these steps:

1. Create Network Loadbalancer, VPC Endpoint Service and VPC Endpoint Service via terraform file:

Important: if https/ssl is used on NLB (recommended), customer has to create AWS Certificate and set certificate_arn and ssl_policy field in aws_lb_listener resources before apply.

resource "aws_lb" "nlb" {
  name               = "${var.customer_id}-nlb"
  internal           = true
  load_balancer_type = "network"
  subnets            = var.customer_vpc_public_subnets

  enable_deletion_protection = true

  tags = {
   // customer tags
  }
}

resource "aws_lb_listener" "tls" {
  load_balancer_arn = aws_lb.nlb.arn
  port              = "443"
  protocol          = "TLS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = "arn:aws:acm:<REGION>:<ACCOUNT:certificate/<CERTIFICATE_ID"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.customer_gitlab.arn
  }
}

resource "aws_vpc_endpoint_service" "customer_gitlab" {
  acceptance_required        = true
  network_load_balancer_arns = [aws_lb.nlb.arn]

  allowed_principals = [
    "arn:aws:iam::<SOURCEGRAPH_MANAGED_CUSTOMER_AWS_ACCOUNT_ID>:root"
  ]

  tags = {
   // customer tags
  }
}

2. For private VPC Endpoint Service domain, customer has to follow verification steps to prove customer owns the domain.