single-master-kubernetes.yaml

AWSTemplateFormatVersion: 2010-09-09

Description: CloudFormation template for a single-master Kubernetes cluster.

Outputs:
  DNSName:
    Description: URL of the cluster.
    Value: !GetAtt LoadBalancer.DNSName
    Export:
      Name: !Sub "${AWS::StackName}-Endpoint"

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label: 
          default: AWS Placement
        Parameters:
          - VpcId
          - SubnetId1
          - SubnetId2
          - LoadBalancerScheme
      - Label:
          default: Kubernetes Configuration
        Parameters:
          - ClusterName
          - KubernetesToken
          - PodNetworkCIDR
          - KubernetesVersion
          - DockerVersion
          - FlannelVersion
          - TraefikVersion
      - Label:
          default: Instance Configuration
        Parameters:
          - KeyName
          - MasterInstanceType
          - NodeInstanceType
          - ImageId
    ParameterLabels:
      ClusterName:
        default: Cluster Name
      MasterInstanceType: 
        default: Instance Type (Master)
      MasterDiskSpace:
        default: Disk Size (Master)
      NodeInstanceType: 
        default: Instance Type (Node)
      WorkerDiskSpace:
        default: Disk Size (Worker)
      ImageId:
        default: Amazon Machine Image
      VpcId:
        default: VPC
      KubernetesVersion:
        default: Kubernetes Version
      DockerVersion:
        default: Docker Version
      FlannelVersion:
        default: Flannel Version
      TraefikVersion:
        default: Traefik Version

Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
  SubnetId1:
    Type: AWS::EC2::Subnet::Id
  SubnetId2:
    Type: AWS::EC2::Subnet::Id
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: SSH Key for the EC2 instances
  LoadBalancerScheme:
    Type: String
    Default: internet-facing
    Description: Specifies whether the load balancer is internal or Internet-facing.
    AllowedValues:
      - internet-facing
      - internal
  ClusterName:
    Type: String
    Default: euc1k8s01
    Description: Unique name of the cluster.
    AllowedPattern: ^[\w\.-]{1,25}$
  KubernetesToken:
    Type: String
    Default: "123456.1234567890123456"
    Description: Token to join this Kubernetes cluster
    AllowedPattern: ^[a-z0-9]{6}\.[a-z0-9]{16}$
    MinLength: 23
    MaxLength: 23
    NoEcho: true
  PodNetworkCIDR:
    Type: String
    Default: "10.244.0.0/16"
    Description: CIDR of the overlay network (Flannel), should not conflict with existing subnets.
    MinLength: 10
    MaxLength: 19
  DockerVersion:
    Type: String
    Default: "1.12.6"
    Description: |
      Version of Docker to use. Must be compatible with Kubernetes, 
      see https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG.md
  KubernetesVersion:
    Type: String
    Default: "1.8.0"
    Description: Version of Kubernetes to use, see https://github.com/kubernetes/kubernetes/releases
  FlannelVersion:
    Type: String
    Default: "0.9.0"
    Description: Version of Flannel to use, see https://github.com/coreos/flannel/releases
  TraefikVersion:
    Type: String
    Default: "1.4"
    Description: Version of Traefik to use, see https://github.com/containous/traefik/releases
  MasterInstanceType:
    Type: String
    Default: t2.small
    Description: Instance type for the Master node. Default is t2.small.
    AllowedValues:
      - t2.micro
      - t2.small
      - t2.medium
  NodeInstanceType:
    Type: String
    Default: t2.small
    Description: Instance type for the nodes. Default is t2.small.
    AllowedValues:
      - t2.micro
      - t2.small
      - t2.medium
  ImageId:
    Type: AWS::EC2::Image::Id
    Default: ami-46c1b650
    Description: AMI to use for the EC2 instances
  MasterDiskSpace:
    Type: Number
    Default: 10
    Description: Disk size in GB for Docker images and volumes on the master.
    MinValue: 1
    MaxValue: 16000
  WorkerDiskSpace:
    Type: Number
    Default: 10
    Description: Disk size in GB for Docker images and volumes on the worker nodes.
    MinValue: 1
    MaxValue: 16000

Conditions:
  HasKeyName:
    !Not [ !Equals [ !Ref KeyName, "" ] ]

Resources:
  # Load Balancer
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    DependsOn:
      - Subnet1EIP
      - Subnet2EIP
    Properties:
      Name: !Ref ClusterName
      Type: network
      Scheme: !Ref LoadBalancerScheme
      SubnetMappings:
        - AllocationId: !GetAtt [ Subnet1EIP, AllocationId ]
          SubnetId: !Ref SubnetId1
        - AllocationId: !GetAtt [ Subnet2EIP, AllocationId ]
          SubnetId: !Ref SubnetId2
      Tags:
        - Key: Name
          Value: !Ref ClusterName
  Subnet1EIP:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc
  Subnet2EIP:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc

  # Load Balancer: Master
  MasterAPIListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 6443
      Protocol: TCP
      DefaultActions: 
        - Type: forward
          TargetGroupArn: !Ref MasterAPITargetGroup
  MasterAPITargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${ClusterName}-master
      VpcId: !Ref VpcId
      Port: 6443
      Protocol: TCP
    
  # Load Balancer: Node
  NodeHTTPListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: TCP
      DefaultActions: 
        - Type: forward
          TargetGroupArn: !Ref NodeHTTPTargetGroup
  NodeHTTPTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${ClusterName}-http
      VpcId: !Ref VpcId
      Port: 80
      Protocol: TCP
  NodeHTTPSListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 443
      Protocol: TCP
      DefaultActions: 
        - Type: forward
          TargetGroupArn: !Ref NodeHTTPSTargetGroup
  NodeHTTPSTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${ClusterName}-https
      VpcId: !Ref VpcId
      Port: 443
      Protocol: TCP

  # Master: File System
  MasterFileSystem:
    Type: AWS::EFS::FileSystem
    Properties: 
      FileSystemTags:
        - Key: Name
          Value: !Sub ${ClusterName}-master
  MasterSubnetId1MountTarget:
    Type: AWS::EFS::MountTarget
    Properties: 
      FileSystemId: !Ref MasterFileSystem
      SubnetId: !Ref SubnetId1
      SecurityGroups: 
        - !Ref MasterSecurityGroup
  MasterSubnetId2MountTarget:
    Type: AWS::EFS::MountTarget
    Properties: 
      FileSystemId: !Ref MasterFileSystem
      SubnetId: !Ref SubnetId2
      SecurityGroups: 
        - !Ref MasterSecurityGroup

  # Master: IAM Role
  MasterInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /kubernetes/
      Roles:
        - !Ref MasterRole
  MasterRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ClusterName}-master
      Path: /kubernetes/
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal: 
              Service: 
                - "ec2.amazonaws.com"
            Action: 
              - "sts:AssumeRole"
      Policies:
        # The policies are limited to what's necessary to run Kubernetes with Flannel as an overlay network.
        # Dynamically creating ELBs for Services is not in scope of this template.
        # 
        # See https://docs.google.com/document/d/17d4qinC_HnIwrK0GHnRlD1FKkTNdN__VO4TH9-EzbIY/edit
        # See https://gist.github.com/chrislovecnm/0e23d11903cc36b99ccf73a013d5ae56
        # See https://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html
        - PolicyName: !Sub ${ClusterName}-master
          PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
              - Effect: "Allow"
                Resource: "*"
                Action: 
                  - ec2:DescribeInstances
                  - ec2:DescribeVolumes
                  - ec2:AssociateAddress
                  - ec2:DisassociateAddress
              - Effect: "Allow"
                Resource: "*"
                Condition:
                  StringEquals:
                    ec2:ResourceTag/KubernetesCluster: !Ref AWS::StackName
                Action:
                  - ec2:AttachVolume
                  - ec2:CreateVolume
                  - ec2:DeleteVolume
                  - ec2:DetachVolume
  MasterLaunchConfigurtion:
    Type: AWS::AutoScaling::LaunchConfiguration
    DependsOn: MasterEIP
    Metadata:
      AWS::CloudFormation::Init: 
        configSets:
          master:
            - associateEip
            - mountEFS
            - mountEBS
            - installDocker
            - installKubernetes
            - initialiseKubernetes
          worker:
            - mountEBS
            - installDocker
            - installKubernetes
            - joinCluster
        associateEip:
          commands:
            10downloadPipScript:
              command: curl -o /tmp/get-pip.py https://bootstrap.pypa.io/get-pip.py
            20installPip:
              command: python /tmp/get-pip.py
            30installAwsCli:
              command: pip install awscli --upgrade
            40associateEip:
              command: !Sub aws ec2 associate-address --region ${AWS::Region} --allocation-id ${MasterEIP.AllocationId} --instance-id $(curl http://169.254.169.254/latest/meta-data/instance-id)
        mountEFS:
          # See http://docs.aws.amazon.com/efs/latest/ug/wt1-test.html
          packages:
            yum:
              nfs-utils: []
          commands:
            10createMountDirectory:
              command: mkdir -p /mnt/efs
            20mount:
              command: !Sub mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 ${MasterFileSystem}.efs.${AWS::Region}.amazonaws.com:/ /mnt/efs
            30createPersistentDirectories:
              command: mkdir -p /mnt/efs/kubernetes /mnt/efs/etcd
            40linkEtcdDirectory:
              command: ln -s /mnt/efs/etcd /var/lib/etcd
            50linkKubernetesDirectory:
              command: ln -s /mnt/efs/kubernetes /etc/kubernetes
        mountEBS:
          # See http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-using-volumes.html
          commands:
            10format:
              command: mkfs -t ext4 /dev/xvdb
            20createMountDirectory:
              command: mkdir -p /var/lib/docker
            30mount:
              command: mount /dev/xvdb /var/lib/docker
        installDocker:
          # See https://docs.docker.com/engine/installation/linux/docker-ce/centos/#install-docker-ce
          packages:
            yum: 
              yum-utils: []
              device-mapper-persistent-data: []
              lvm2: []
          commands:
            10addDockerRepo:
              command: yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
            20installDocker:
              command: !Sub yum install -y docker-${DockerVersion}
            30startDocker:
              command: systemctl enable docker.service && systemctl start docker.service
        installKubernetes:
          # See https://kubernetes.io/docs/setup/independent/install-kubeadm/
          commands:
            10disableSELinux:
              command: setenforce 0
            20installKubernetes:
              command: !Sub yum install -y kubelet-${KubernetesVersion} kubeadm-${KubernetesVersion} kubectl-${KubernetesVersion}
            30startKubernetes:
              command: systemctl daemon-reload && systemctl enable kubelet
            40addMasterToEtcHosts:
              command: !Sub echo ${MasterEIP} master >> /etc/hosts
          files:
            /etc/yum.repos.d/kubernetes.repo:
              content: |
                [kubernetes]
                name=Kubernetes
                baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
                enabled=1
                gpgcheck=1
                repo_gpgcheck=1
                gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
                        https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
            # /etc/systemd/system/kubelet.service.d/20-cloud-provider.conf:
            #   content: |
            #     [Service]
            #     Environment="KUBELET_EXTRA_ARGS=--cloud-provider=aws"
        initialiseKubernetes:
          commands:
            10setHostname:
              command: hostnamectl set-hostname --static master
            20initialiseKubernetes:
              command: bash /tmp/cfn-initialise-kubernetes.sh
              test: "! test -e /etc/kubernetes/admin.conf"
            30startKubernetes:
              command: systemctl start kubelet
              test: "! systemctl status kubelet"
          files:
            /tmp/cfn-initialise-kubernetes.sh:
              content: !Sub |
                #!/bin/bash
                # See https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/
                kubeadm init                                                            \
                  --kubernetes-version v${KubernetesVersion}                            \
                  --pod-network-cidr ${PodNetworkCIDR}                                  \
                  --apiserver-advertise-address ${LoadBalancer.DNSName}                 \
                  --apiserver-cert-extra-sans ${LoadBalancer.DNSName}                   \
                  --token ${KubernetesToken}                                            \
                  --token-ttl 0
                
                # Needed until https://github.com/kubernetes/kubeadm/issues/411 is fixed
                sed -i 's#https://.*:6443$#https://${LoadBalancer.DNSName}:6443#' /etc/kubernetes/admin.conf
                export KUBECONFIG=/etc/kubernetes/admin.conf

                # See https://github.com/coreos/flannel
                kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/v${FlannelVersion}/Documentation/kube-flannel.yml

                # See https://docs.traefik.io/user-guide/kubernetes/
                kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v${TraefikVersion}/examples/k8s/traefik-rbac.yaml
                kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v${TraefikVersion}/examples/k8s/traefik-ds.yaml
        joinCluster:
          # See https://kubernetes.io/docs/admin/kubeadm/#kubeadm-join
          commands:
            10join:
              command: !Sub kubeadm join --token ${KubernetesToken} --discovery-token-unsafe-skip-ca-verification ${LoadBalancer.DNSName}:6443
    Properties:
      SecurityGroups: 
        - !Ref MasterSecurityGroup
      ImageId: !Ref ImageId
      InstanceType: !Ref MasterInstanceType
      IamInstanceProfile: !Ref MasterInstanceProfile
      KeyName: !If [ HasKeyName, !Ref KeyName, !Ref "AWS::NoValue" ]
      BlockDeviceMappings:
        - DeviceName: /dev/sdb
          Ebs: 
            VolumeType: gp2
            DeleteOnTermination: true
            VolumeSize: !Ref MasterDiskSpace
      UserData:
        Fn::Base64: 
          !Sub |
            #!/bin/bash

            # See http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-helper-scripts-reference.html
            easy_install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz

            # See http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-init.html
            cfn-init --stack ${AWS::StackName} --resource MasterLaunchConfigurtion --configsets master
  MasterAutoscalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    DependsOn: MasterFileSystem
    Properties:
      LaunchConfigurationName: !Ref MasterLaunchConfigurtion
      VPCZoneIdentifier: 
        - !Ref SubnetId1
        - !Ref SubnetId2
      MinSize: "0"
      DesiredCapacity: "1"
      MaxSize: "1"
      Tags:
        - Key: Name
          Value: !Sub ${ClusterName}-master
          PropagateAtLaunch: true
        - Key: KubernetesCluster
          Value: !Ref ClusterName
          PropagateAtLaunch: true
      TargetGroupARNs:
        - !Ref MasterAPITargetGroup
  MasterEIP:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc

  # Master: Security Group
  # See https://stackoverflow.com/questions/39293441/needed-ports-for-kubernetes-cluster
  MasterSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties: 
      GroupName: !Sub ${ClusterName}-master
      GroupDescription: Kubernetes Master Security Group
      VpcId: !Ref VpcId
      Tags:
        - Key: Name
          Value: !Sub ${ClusterName}-master
      SecurityGroupIngress:
        # Kubernetes API server
        - CidrIp: "0.0.0.0/0"
          IpProtocol: tcp
          FromPort: 6443
          ToPort: 6443
        # SSH Access
        - CidrIp: "0.0.0.0/0"
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
  # Master: Security Group (EFS)
  MasterSecurityGroupEfsMasterIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref MasterSecurityGroup
      SourceSecurityGroupId: !Ref MasterSecurityGroup
      IpProtocol: tcp
      FromPort: 2049
      ToPort: 2049
  # Master: Security Group (Etcd)
  MasterSecurityGroupEtcdMasterIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref MasterSecurityGroup
      SourceSecurityGroupId: !Ref MasterSecurityGroup
      IpProtocol: tcp
      FromPort: 2379
      ToPort: 2380
  MasterSecurityGroupEtcdNodeIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref MasterSecurityGroup
      SourceSecurityGroupId: !Ref NodeSecurityGroup
      IpProtocol: tcp
      FromPort: 2379
      ToPort: 2380
  # Master: Security Group (Flannel overlay network)
  MasterSecurityGroupFlannelUDPMasterIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref MasterSecurityGroup
      SourceSecurityGroupId: !Ref MasterSecurityGroup
      IpProtocol: udp
      FromPort: 8285
      ToPort: 8285
  MasterSecurityGroupFlannelVXLanMasterIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref MasterSecurityGroup
      SourceSecurityGroupId: !Ref MasterSecurityGroup
      IpProtocol: udp
      FromPort: 8472
      ToPort: 8472
  MasterSecurityGroupFlannelUDPNodeIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref MasterSecurityGroup
      SourceSecurityGroupId: !Ref NodeSecurityGroup
      IpProtocol: udp
      FromPort: 8285
      ToPort: 8285
  MasterSecurityGroupFlannelVXLanNodeIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref MasterSecurityGroup
      SourceSecurityGroupId: !Ref NodeSecurityGroup
      IpProtocol: udp
      FromPort: 8472
      ToPort: 8472

  # Node: IAM Role
  # TODO Restrict access to only what's really needed
  NodeInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /kubernetes/
      Roles:
        - !Ref NodeRole
  NodeRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ClusterName}-node
      Path: /kubernetes/
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal: 
              Service: 
                - "ec2.amazonaws.com"
            Action: 
              - "sts:AssumeRole"
      Policies:
        # The policies are limited to what's necessary to run Kubernetes with Flannel as an overlay network.
        # Dynamically creating ELBs for Services is not in scope of this template.
        # 
        # See https://docs.google.com/document/d/17d4qinC_HnIwrK0GHnRlD1FKkTNdN__VO4TH9-EzbIY/edit
        # See https://gist.github.com/chrislovecnm/0e23d11903cc36b99ccf73a013d5ae56
        # See https://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html
        - PolicyName: !Sub ${ClusterName}-node
          PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
              - Effect: "Allow"
                Resource: "*"
                Action: 
                  - ec2:DescribeInstances
  # Node: Autoscaling Group
  NodeLaunchConfigurtion:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !Ref ImageId
      InstanceType: !Ref NodeInstanceType
      IamInstanceProfile: !Ref NodeInstanceProfile
      KeyName: !If [ HasKeyName, !Ref KeyName, !Ref "AWS::NoValue" ]
      SecurityGroups: 
        - !Ref NodeSecurityGroup
      BlockDeviceMappings:
        - DeviceName: /dev/sdb
          Ebs: 
            VolumeType: gp2
            DeleteOnTermination: true
            VolumeSize: !Ref WorkerDiskSpace
      UserData:
        Fn::Base64: 
          !Sub |
            #!/bin/bash
            
            # See http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-helper-scripts-reference.html
            easy_install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz

            # See http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-init.html
            cfn-init --stack ${AWS::StackName} --resource MasterLaunchConfigurtion --configsets worker
  NodeAutoscalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      LaunchConfigurationName: !Ref NodeLaunchConfigurtion
      VPCZoneIdentifier: 
        - !Ref SubnetId1
        - !Ref SubnetId2
      MinSize: "0"
      DesiredCapacity: "0"
      MaxSize: "4"
      Tags:
        - Key: Name
          Value: !Sub ${ClusterName}-node
          PropagateAtLaunch: true
        - Key: KubernetesCluster
          Value: !Ref ClusterName
          PropagateAtLaunch: true
      TargetGroupARNs:
        - !Ref NodeHTTPTargetGroup
        - !Ref NodeHTTPSTargetGroup

  # Node: Security Group
  # See https://stackoverflow.com/questions/39293441/needed-ports-for-kubernetes-cluster
  NodeSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties: 
      GroupName: !Sub ${ClusterName}-node
      GroupDescription: Kubernetes Node Security Group
      VpcId: !Ref VpcId
      Tags:
        - Key: Name
          Value: !Sub ${ClusterName}-node
        - Key: KubernetesCluster
          Value: !Ref ClusterName
      SecurityGroupIngress:
        - CidrIp: "0.0.0.0/0"
          IpProtocol: tcp
          FromPort: 80
          ToPort: 80
        - CidrIp: "0.0.0.0/0"
          IpProtocol: tcp
          FromPort: 443
          ToPort: 443
        - CidrIp: "0.0.0.0/0"
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
  NodeSecurityGroupNodeIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref NodeSecurityGroup
      SourceSecurityGroupId: !Ref NodeSecurityGroup
      IpProtocol: "-1"
  NodeSecurityGroupMasterIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref NodeSecurityGroup
      SourceSecurityGroupId: !Ref MasterSecurityGroup
      IpProtocol: "-1"