add cloudfront cdn

Author: upodroid

infra/aws/terraform/registry.k8s.io/cdn.tf

@@ -0,0 +1,201 @@
+/*
+Geo-proximity, multi-region active-active delivery via CloudFront + Lambda@Edge.
+Based on: https://aws.amazon.com/blogs/networking-and-content-delivery/using-amazon-cloudfront-and-amazon-s3-to-build-multi-region-active-active-geo-proximity-applications/
+
+On a cache miss, the origin-request Lambda@Edge function looks up the S3
+bucket replica closest to the executing edge region and rewrites the origin
+request to it.
+*/
+
+locals {
+  # Region -> regional S3 bucket domain, generated from the replicated buckets.
+  region_bucket_domains = merge(
+    { for region, mod in module.s3_buckets : region => mod.bucket_regional_domain_name },
+    { "us-east-2" = module.us-east-2.bucket_regional_domain_name }
+  )
+
+  # The authoritative bucket, used when an edge region has no mapping.
+  default_bucket_domain = module.us-east-2.bucket_regional_domain_name
+  default_bucket_region = "us-east-2"
+}
+
+# --- Lambda@Edge origin router -----------------------------------------------
+
+module "geo_router_role" {
+  source          = "terraform-aws-modules/iam/aws//modules/iam-role"
+  version         = "~> 6.6"
+  name            = "${var.prefix}geo-router"
+  use_name_prefix = false
+  trust_policy_permissions = {
+    LambdaEdgeAssume = {
+      actions = ["sts:AssumeRole"]
+      principals = [{
+        type = "Service"
+        identifiers = [
+          "lambda.amazonaws.com",
+          "edgelambda.amazonaws.com",
+        ]
+      }]
+    }
+  }
+  policies = {
+    AWSLambdaBasicExecutionRole = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+  }
+}
+
+data "archive_file" "geo_router" {
+  type        = "zip"
+  output_path = "${path.module}/.terraform/tmp/geo-router.zip"
+
+  source {
+    filename = "index.py"
+    content  = <<-PYTHON
+      # Generated by Terraform - do not edit by hand.
+      # Routes CloudFront origin requests to the closest S3 bucket replica.
+      REGIONS_MAPPING = ${jsonencode(local.region_bucket_domains)}
+      DEFAULT_BUCKET = "${local.default_bucket_domain}"
+      DEFAULT_REGION = "${local.default_bucket_region}"
+
+
+      def lambda_handler(event, context):
+          request = event['Records'][0]['cf']['request']
+
+          # Identify the edge region executing this replica of the function.
+          lambda_region = context.invoked_function_arn.split(':')[3]
+
+          # Pick the closest bucket, falling back to the default bucket.
+          if lambda_region in REGIONS_MAPPING:
+              domain_name = REGIONS_MAPPING[lambda_region]
+              bucket_region = lambda_region
+          else:
+              domain_name = DEFAULT_BUCKET
+              bucket_region = DEFAULT_REGION
+
+          # Update the origin request object.
+          request['origin']['s3']['domainName'] = domain_name
+          request['origin']['s3']['region'] = bucket_region
+          request['headers']['host'] = [{'key': 'host', 'value': domain_name}]
+          return request
+    PYTHON
+  }
+}
+
+resource "aws_lambda_function" "geo_router" {
+  region           = "us-east-1"
+  function_name    = "${var.prefix}geo-router"
+  role             = module.geo_router_role.arn
+  runtime          = "python3.14"
+  handler          = "index.lambda_handler"
+  filename         = data.archive_file.geo_router.output_path
+  source_code_hash = data.archive_file.geo_router.output_base64sha256
+  publish          = true
+
+  # Origin-request functions are limited to 30s / 10240 MB, keep defaults modest
+  timeout     = 5
+  memory_size = 128
+}
+
+module "acm" {
+  source  = "terraform-aws-modules/acm/aws"
+  version = "~> 6.3"
+  region  = "us-east-1"
+
+  domain_name            = "cdn.registry.k8s.io"
+  validation_method      = "DNS"
+  create_route53_records = false
+}
+
+# --- CloudFront distribution --------------------------------------------------
+
+# Redirect requests for the root path to the project repository.
+resource "aws_cloudfront_function" "redirect_root" {
+  name    = "${var.prefix}redirect-root"
+  runtime = "cloudfront-js-2.0"
+  comment = "Redirect / to the registry.k8s.io GitHub repository"
+  publish = true
+  code    = <<-JS
+    function handler(event) {
+      if (event.request.uri === '/') {
+        return {
+          statusCode: 301,
+          statusDescription: 'Moved Permanently',
+          headers: {
+            location: { value: 'https://github.com/kubernetes/registry.k8s.io' }
+          }
+        };
+      }
+      return event.request;
+    }
+  JS
+}
+
+module "cdn" {
+  source  = "terraform-aws-modules/cloudfront/aws"
+  version = "~> 6.7"
+
+  aliases = ["cdn.registry.k8s.io"]
+  comment = "registry.k8s.io CDN"
+
+  # Strip internal S3 metadata headers from CDN responses.
+  response_headers_policies = {
+    drop_s3_headers = {
+      name    = "${var.prefix}drop-s3-headers"
+      comment = "Strip internal S3 metadata headers from responses"
+      remove_headers_config = {
+        items = [
+          { header = "x-amz-meta-mtime" },
+          { header = "x-amz-meta-file-mtime" },
+          { header = "x-amz-replication-status" },
+          { header = "x-amz-server-side-encryption" },
+          { header = "x-amz-version-id" },
+        ]
+      }
+    }
+  }
+
+  origin = {
+    # S3 origin. On a cache miss the Lambda@Edge origin-request function
+    # rewrites this origin to the bucket closest to the edge region.
+    s3 = {
+      domain_name = "prod-registry-k8s-io-us-east-2.s3.us-east-2.amazonaws.com"
+    }
+  }
+
+  default_cache_behavior = {
+    target_origin_id            = "s3"
+    viewer_protocol_policy      = "redirect-to-https"
+    response_headers_policy_key = "drop_s3_headers"
+
+    allowed_methods = ["GET", "HEAD", "OPTIONS"]
+    cached_methods  = ["GET", "HEAD"]
+    compress        = true
+    query_string    = true
+
+    # Blobs are content-addressed (sha256) and immutable: cache aggressively
+    # at the edge to avoid per-request origin revalidation (RefreshHit).
+    min_ttl     = 86400    # 1 day
+    default_ttl = 2592000  # 30 days
+    max_ttl     = 31536000 # 1 year
+
+    # Redirect / to the project repository before hitting cache or origin.
+    function_association = {
+      viewer-request = {
+        function_arn = aws_cloudfront_function.redirect_root.arn
+      }
+    }
+
+    # Geo-proximity routing: runs on cache miss, before the origin request.
+    lambda_function_association = {
+      origin-request = {
+        lambda_arn   = aws_lambda_function.geo_router.qualified_arn
+        include_body = false
+      }
+    }
+  }
+
+  viewer_certificate = {
+    acm_certificate_arn = "arn:aws:acm:us-east-1:513428760722:certificate/05f38392-7830-4d6d-a3cb-bbf0f2bdce5f"
+    ssl_support_method  = "sni-only"
+  }
+}
+

infra/aws/terraform/registry.k8s.io/providers.tf

@@ -28,6 +28,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 6.22"
     }
+    archive = {
+      source  = "hashicorp/archive"
+      version = "~> 2.4"
+    }
   }
 }
 

infra/aws/terraform/registry.k8s.io/s3/output.tf

@@ -17,3 +17,7 @@ limitations under the License.
 output "bucket_arn" {
   value = aws_s3_bucket.registry-k8s-io.arn
 }
+
+output "bucket_regional_domain_name" {
+  value = aws_s3_bucket.registry-k8s-io.bucket_regional_domain_name
+}