Modified AWS Launch Config for CoreOS with a load balancer and support for private images

coreos-lb.template

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "CoreOS on EC2 with load balancer and support for private images: http://coreos.com/docs/running-coreos/cloud-providers/ec2/",
  "Mappings" : {
      "RegionMap" : {
          "ap-northeast-1" : {
              "AMI" : "ami-c1421fc0"
          },
          "sa-east-1" : {
              "AMI" : "ami-dfbe17c2"
          },
          "ap-southeast-2" : {
              "AMI" : "ami-1d2c4a27"
          },
          "ap-southeast-1" : {
              "AMI" : "ami-4c5a021e"
          },
          "us-east-1" : {
              "AMI" : "ami-d4c60ebc"
          },
          "us-west-2" : {
              "AMI" : "ami-4d9ee67d"
          },
          "us-west-1" : {
              "AMI" : "ami-e19c9fa4"
          },
          "eu-west-1" : {
              "AMI" : "ami-cb4293bc"
          }
      }
  },
  "Parameters": {
    "InstanceType" : {
      "Description" : "EC2 PV instance type (m3.medium, etc). Note: m1.small is not supported.",
      "Type" : "String",
      "Default" : "t1.micro",
      "AllowedValues" : ["m3.medium", "m3.large", "m3.xlarge", "m3.2xlarge", "m1.medium", "m1.large", "m1.xlarge", "c3.large", "c3.xlarge", "c3.2xlarge", "c3.4xlarge", "c3.8xlarge", "c1.medium", "c1.xlarge", "m2.xlarge", "m2.2xlarge", "m2.4xlarge", "hi1.4xlarge", "hs1.8xlarge", "t1.micro"],
      "ConstraintDescription" : "Must be a valid EC2 PV instance type. Note: m1.small is not supported."
    },
    "ClusterSize": {
      "Default": "5",
      "MinValue": "3",
      "MaxValue": "12",
      "Description": "Number of nodes in cluster (3-12).",
      "Type": "Number"
    },
    "DiscoveryURL": {
      "Description": "An unique etcd cluster discovery URL. Grab a new token from https://discovery.etcd.io/new",
      "Type": "String"
    },
    "AdvertisedIPAddress": {
      "Description": "Use 'private' if your etcd cluster is within one region or 'public' if it spans regions or cloud providers.",
      "Default": "private",
      "AllowedValues": ["private", "public"],
      "Type": "String"
    },
    "AllowSSHFrom": {
      "Description": "The net block (CIDR) that SSH is available to.",
      "Default": "0.0.0.0/0",
      "Type": "String"
    },
    "AllowHTTPFrom": {
      "Description": "The net block (CIDR) that HTTP is available to.",
      "Default": "0.0.0.0/0",
      "Type": "String"
    },
    "AllowMySQLFrom": {
      "Description": "The net block (CIDR) that MySQL (3306) is available to.",
      "Default": "0.0.0.0/0",
      "Type": "String"
    },
    "KeyPair" : {
      "Description" : "The name of an EC2 Key Pair to allow SSH access to the instance.",
      "Type" : "String"
    },
    "DockerCfgEmail" : {
      "Description" : "Email address used for 'docker login'",
      "Type" : "String"
    },
    "DockerCfgToken" : {
      "Description" : "Base64 auth token generated by 'docker login'",
      "Type" : "String"
    }
  },
  "Resources": {
    "CoreOSSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "CoreOS SecurityGroup",
        "SecurityGroupIngress": [
          {"IpProtocol": "tcp", "FromPort": "22", "ToPort": "22", "CidrIp": {"Ref": "AllowSSHFrom"}},
          {"IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "CidrIp": {"Ref": "AllowHTTPFrom"}},
          {"IpProtocol": "tcp", "FromPort": "3306", "ToPort": "3306", "CidrIp": {"Ref": "AllowMySQLFrom"}}
        ]
      }
    },
    "Ingress4001": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupName": {"Ref": "CoreOSSecurityGroup"}, "IpProtocol": "tcp", "FromPort": "4001", "ToPort": "4001", "SourceSecurityGroupId": {
          "Fn::GetAtt" : [ "CoreOSSecurityGroup", "GroupId" ]
        }
      }
    },
    "Ingress5000": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupName": {"Ref": "CoreOSSecurityGroup"}, "IpProtocol": "tcp", "FromPort": "5000", "ToPort": "5050", "SourceSecurityGroupId": {
          "Fn::GetAtt" : [ "CoreOSSecurityGroup", "GroupId" ]
        }
      }
    },
    "Ingress7001": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupName": {"Ref": "CoreOSSecurityGroup"}, "IpProtocol": "tcp", "FromPort": "7001", "ToPort": "7001", "SourceSecurityGroupId": {
          "Fn::GetAtt" : [ "CoreOSSecurityGroup", "GroupId" ]
        }
      }
    },
    "Ingress8182": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupName": {"Ref": "CoreOSSecurityGroup"}, "IpProtocol": "tcp", "FromPort": "8182", "ToPort": "8182", "SourceSecurityGroupId": {
          "Fn::GetAtt" : [ "CoreOSSecurityGroup", "GroupId" ]
        }
      }
    },
    "ClusterLB" : {
      "Type" : "AWS::ElasticLoadBalancing::LoadBalancer",
      "Properties" : {
          "AvailabilityZones" : {"Fn::GetAZs": ""},
          "Listeners" : [ {
              "LoadBalancerPort" : "80",
              "InstancePort" : "80",
              "Protocol" : "HTTP"
          } ],
          "HealthCheck" : {
              "Target" : "HTTP:8182/v1/status",
              "HealthyThreshold" : "3",
              "UnhealthyThreshold" : "5",
              "Interval" : "30",
              "Timeout" : "5"
          }
      }
    },
    "CoreOSServerAutoScale": {
      "Type": "AWS::AutoScaling::AutoScalingGroup",
      "Properties": {
        "AvailabilityZones": {"Fn::GetAZs": ""},
        "LaunchConfigurationName": {"Ref": "CoreOSServerLaunchConfig"},
        "MinSize": "3",
        "MaxSize": "12",
        "DesiredCapacity": {"Ref": "ClusterSize"},
        "LoadBalancerNames" : [ { "Ref" : "ClusterLB" } ],
        "Tags": [
            {"Key": "Name", "Value": { "Ref" : "AWS::StackName" }, "PropagateAtLaunch": true}
        ]
      }
    },
    "CoreOSServerLaunchConfig": {
      "Type": "AWS::AutoScaling::LaunchConfiguration",
      "Properties": {
        "ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "AMI" ]},
        "InstanceType": {"Ref": "InstanceType"},
        "KeyName": {"Ref": "KeyPair"},
        "SecurityGroups": [{"Ref": "CoreOSSecurityGroup"}],
        "UserData" : { "Fn::Base64":
          { "Fn::Join": [ "", [
            "#cloud-config\n\n",
            "coreos:\n",
            "  etcd:\n",
            "    discovery: ", { "Ref": "DiscoveryURL" }, "\n",
            "    addr: $", { "Ref": "AdvertisedIPAddress" }, "_ipv4:4001\n",
            "    peer-addr: $", { "Ref": "AdvertisedIPAddress" }, "_ipv4:7001\n",
            "  units:\n",
            "    - name: etcd.service\n",
            "      command: start\n",
            "    - name: fleet.service\n",
            "      command: start\n",
            "write_files:\n",
            "   - path: /home/core/.dockercfg\n",
            "     owner: core:core\n",
            "     permissions: 0644\n",
            "     content: |\n",
            "       {\"https://index.docker.io/v1/\": {\"auth\": \"", { "Ref": "DockerCfgToken" }, "\", \"email\": \"", { "Ref": "DockerCfgEmail" }, "\"}}\n"
            ] ]
          }
        }
      }
    }
  }
}

help.md

• Initiate a new cloud formation, enter a name for your stack and then upload the template file. On the next screen fill out the form, use docker login to get credentials for registry.hub.docker.com.

• Port 8182 is opened to allow health checks against /v1/status if you use Vulcan Proxy.

• Ports 5000-5050 are intended for use by your applications.