Skip to content

Commit 71a2bf5

Browse files
nahsinahsi
authored
feat: Add terraform modules (#16)
1 parent 17b0a77 commit 71a2bf5

37 files changed

+492
-348
lines changed

‎.github/workflows/terraform.yml‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727

2828
defaults:
2929
run:
30-
working-directory: terraform
30+
working-directory: ephemeral
3131

3232
permissions:
3333
contents: read
@@ -80,7 +80,7 @@ jobs:
8080
body-includes: "## ephemeral: ${{ steps.sanitize.outputs.workspace }}"
8181

8282
- name: Add comment
83-
if: steps.comment.outputs.comment-id == null
83+
if: steps.comment.outputs.comment-id == null && (inputs.command == 'create' || inputs.command == 'reset')
8484
uses: peter-evans/create-or-update-comment@v3
8585
with:
8686
comment-id: "${{ steps.comment.outputs.comment-id }}"
@@ -106,10 +106,20 @@ jobs:
106106
run: |
107107
case ${{ inputs.command }} in
108108
create)
109-
terraform apply -auto-approve ;;
109+
terraform apply -target local_sensitive_file.kubeconfig -auto-approve
110+
terraform apply -auto-approve
111+
;;
110112
destroy)
111-
terraform destroy -auto-approve ;;
113+
terraform apply -target local_sensitive_file.kubeconfig -auto-approve
114+
terraform destroy -auto-approve \
115+
-target module.spectrum.helm_release.flux-sync \
116+
-target module.spectrum.helm_release.flux \
117+
-target module.spectrum.helm_release.cilium
118+
terraform destroy -auto-approve
119+
terraform workspace delete ${{ steps.sanitize.outputs.workspace }}
120+
;;
112121
reset)
122+
terraform apply -target local_sensitive_file.kubeconfig -auto-approve
113123
terraform destroy -auto-approve
114124
terraform apply -auto-approve
115125
;;
@@ -126,8 +136,8 @@ jobs:
126136
with:
127137
name: configs
128138
path: |
129-
terraform/kubeconfig
130-
terraform/talosconfig
139+
ephemeral/kubeconfig
140+
ephemeral/talosconfig
131141
132142
- name: Find comment
133143
if: inputs.command == 'create' || inputs.command == 'reset'

‎terraform/backend.tf‎ renamed to ‎ephemeral/backend.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,9 @@ data "cloudflare_zone" "fluence_dev" {
2727
provider "vault" {
2828
address = "https://vault.fluence.dev"
2929
}
30+
31+
provider "helm" {
32+
kubernetes {
33+
config_path = local_sensitive_file.kubeconfig.filename
34+
}
35+
}

‎terraform/controlplane.tf‎ renamed to ‎ephemeral/controlplane.tf‎

Lines changed: 49 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,3 @@
1-
locals {
2-
cp = [
3-
for i in range(1) : format("%s-%d", "cp", i)
4-
]
5-
}
6-
71
resource "digitalocean_loadbalancer" "cp" {
82
name = "rnd-${local.prefix}-controlplane"
93
region = "fra1"
@@ -54,13 +48,38 @@ resource "digitalocean_record" "endpoint" {
5448
ttl = 30
5549
}
5650

51+
resource "digitalocean_droplet" "cp" {
52+
name = "rnd-${local.prefix}-spectrum-cp"
53+
size = "s-4vcpu-8gb"
54+
image = data.digitalocean_image.talos.id
55+
region = "fra1"
56+
vpc_uuid = data.digitalocean_vpc.spectrum.id
57+
user_data = data.talos_machine_configuration.cp.machine_configuration
58+
59+
ssh_keys = [
60+
digitalocean_ssh_key.spectrum.id
61+
]
62+
63+
tags = [
64+
local.prefix,
65+
"${local.prefix}-controlplane",
66+
]
67+
}
68+
69+
resource "digitalocean_record" "cp" {
70+
name = "cp"
71+
value = digitalocean_droplet.cp.ipv4_address
72+
domain = digitalocean_domain.spectrum.id
73+
type = "A"
74+
ttl = 30
75+
}
76+
77+
5778
resource "talos_machine_secrets" "this" {
5879
talos_version = "v1.8"
5980
}
6081

6182
data "talos_machine_configuration" "cp" {
62-
for_each = { for index, name in local.cp : name => index }
63-
6483
cluster_name = terraform.workspace
6584
machine_type = "controlplane"
6685
cluster_endpoint = "https://${local.loadbalancer_dns}:6443"
@@ -69,20 +88,20 @@ data "talos_machine_configuration" "cp" {
6988
config_patches = [
7089
templatefile("${path.module}/templates/controlplane_patch.yml", {
7190
loadbalancerdns = "kube.${local.prefix}.fluence.dev"
72-
loadbalancerip = digitalocean_loadbalancer.cp.ip
73-
hostdns = "${each.key}.${local.prefix}.fluence.dev",
91+
hostdns = "cp.${local.prefix}.fluence.dev",
7492
subnet = data.digitalocean_vpc.spectrum.ip_range,
75-
branch = var.github_branch
76-
dotoken = base64encode(data.vault_generic_secret.spectrum.data.token)
77-
domain = "${local.prefix}.fluence.dev"
78-
prefix = local.prefix
79-
pr_url = var.github_pr_url
8093
docker_username = data.vault_generic_secret.docker.data.username
8194
docker_password = data.vault_generic_secret.docker.data.password
8295
})
8396
]
8497
}
8598

99+
resource "talos_machine_configuration_apply" "this" {
100+
client_configuration = talos_machine_secrets.this.client_configuration
101+
machine_configuration_input = data.talos_machine_configuration.cp.machine_configuration
102+
node = digitalocean_droplet.cp.ipv4_address
103+
}
104+
86105
data "talos_client_configuration" "this" {
87106
cluster_name = terraform.workspace
88107
client_configuration = talos_machine_secrets.this.client_configuration
@@ -91,61 +110,38 @@ data "talos_client_configuration" "this" {
91110
]
92111
}
93112

94-
resource "digitalocean_droplet" "cp" {
95-
for_each = { for index, name in local.cp : name => index }
96-
97-
name = "rnd-${local.prefix}-spectrum-${each.key}"
98-
size = "s-4vcpu-8gb"
99-
image = data.digitalocean_image.talos.id
100-
region = "fra1"
101-
vpc_uuid = data.digitalocean_vpc.spectrum.id
102-
user_data = data.talos_machine_configuration.cp[each.key].machine_configuration
103-
104-
ssh_keys = [
105-
digitalocean_ssh_key.spectrum.id
106-
]
107-
108-
tags = [
109-
local.prefix,
110-
"${local.prefix}-controlplane",
111-
]
112-
}
113-
114-
resource "digitalocean_record" "cp" {
115-
for_each = { for index, name in local.cp : name => index }
116-
117-
name = each.key
118-
value = digitalocean_droplet.cp[each.key].ipv4_address
119-
domain = digitalocean_domain.spectrum.id
120-
type = "A"
121-
ttl = 30
122-
}
123-
124113
resource "talos_machine_bootstrap" "this" {
125114
client_configuration = talos_machine_secrets.this.client_configuration
126-
endpoint = digitalocean_droplet.cp["cp-0"].ipv4_address
127-
node = digitalocean_droplet.cp["cp-0"].ipv4_address
115+
endpoint = digitalocean_droplet.cp.ipv4_address
116+
node = digitalocean_droplet.cp.ipv4_address
128117
timeouts = {
129118
create = "3m"
130119
}
131120

132121
lifecycle {
133122
replace_triggered_by = [
134-
digitalocean_droplet.cp["cp-0"].id
123+
digitalocean_droplet.cp.id
135124
]
136125
}
137126
}
138127

139128
resource "talos_cluster_kubeconfig" "this" {
140129
client_configuration = talos_machine_secrets.this.client_configuration
141-
node = digitalocean_droplet.cp["cp-0"].ipv4_address
130+
node = digitalocean_droplet.cp.ipv4_address
142131
timeouts = {
143132
create = "3m"
144133
}
145134
}
146135

147-
data "talos_cluster_health" "health" {
148-
client_configuration = data.talos_client_configuration.this.client_configuration
149-
control_plane_nodes = [for droplet in digitalocean_droplet.cp : droplet.ipv4_address_private]
150-
endpoints = data.talos_client_configuration.this.endpoints
136+
data "http" "talos_health" {
137+
url = "https://${digitalocean_record.endpoint.fqdn}:6443/version"
138+
insecure = true
139+
retry {
140+
attempts = 20
141+
min_delay_ms = 5000
142+
max_delay_ms = 5000
143+
}
144+
depends_on = [
145+
talos_machine_bootstrap.this,
146+
]
151147
}

‎terraform/dns.tf‎ renamed to ‎ephemeral/dns.tf‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
resource "digitalocean_domain" "spectrum" {
2-
name = "${local.prefix}.fluence.dev"
3-
}
4-
51
resource "cloudflare_record" "ns" {
62
for_each = toset([
73
"ns1.digitalocean.com",
@@ -14,3 +10,8 @@ resource "cloudflare_record" "ns" {
1410
content = each.key
1511
type = "NS"
1612
}
13+
14+
resource "digitalocean_domain" "spectrum" {
15+
depends_on = [cloudflare_record.ns]
16+
name = "${local.prefix}.fluence.dev"
17+
}

‎ephemeral/main.tf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
locals {
2+
prefix = terraform.workspace
3+
loadbalancer_dns = "kube.${local.prefix}.fluence.dev"
4+
}
5+
6+
resource "tls_private_key" "spectrum" {
7+
algorithm = "ED25519"
8+
}
9+
10+
resource "digitalocean_ssh_key" "spectrum" {
11+
name = "${local.prefix}-ssh-key"
12+
public_key = tls_private_key.spectrum.public_key_openssh
13+
}
14+
15+
data "digitalocean_image" "talos" {
16+
name = "talos-v1.8.2"
17+
}
18+
19+
data "vault_generic_secret" "spectrum" {
20+
path = "kv/digitalocean/spectrum"
21+
}
22+
23+
data "vault_generic_secret" "docker" {
24+
path = "kv/docker-registry/basicauth/ci"
25+
}
26+
27+
module "spectrum" {
28+
depends_on = [
29+
data.http.talos_health,
30+
local_sensitive_file.kubeconfig,
31+
]
32+
source = "../terraform-modules/spectrum"
33+
components = ["kubevirt"]
34+
network = var.github_branch
35+
cluster = "ephemeral"
36+
37+
cilium_hubble_enabled = true
38+
39+
flux_variables = {
40+
PR_URL = var.github_pr_url
41+
LOADBALANCER_IP = digitalocean_loadbalancer.cp.ip
42+
BRANCH = var.github_branch
43+
DOTOKEN = base64encode(data.vault_generic_secret.spectrum.data.token)
44+
DOMAIN = "${local.prefix}.fluence.dev"
45+
PREFIX = local.prefix
46+
}
47+
}

‎terraform/network.tf‎ renamed to ‎ephemeral/network.tf‎

File renamed without changes.

‎terraform/outputs.tf‎ renamed to ‎ephemeral/outputs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,13 @@ output "kubeconfig" {
88
sensitive = true
99
}
1010

11-
resource "local_file" "kubeconfig" {
11+
resource "local_sensitive_file" "kubeconfig" {
1212
content = talos_cluster_kubeconfig.this.kubeconfig_raw
1313
filename = "${path.module}/kubeconfig"
1414
file_permission = "0600"
1515
}
1616

17-
resource "local_file" "talosconfig" {
17+
resource "local_sensitive_file" "talosconfig" {
1818
content = data.talos_client_configuration.this.talos_config
1919
filename = "${path.module}/talosconfig"
2020
file_permission = "0600"

‎ephemeral/templates/controlplane_patch.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
machine:
2+
kubelet:
3+
nodeIP:
4+
validSubnets:
5+
- ${subnet}
6+
certSANs:
7+
- ${loadbalancerdns}
8+
- ${hostdns}
9+
time:
10+
servers:
11+
- time.cloudflare.com
12+
registries:
13+
config:
14+
docker.fluence.dev:
15+
auth:
16+
username: ${docker_username}
17+
password: ${docker_password}
18+
19+
cluster:
20+
allowSchedulingOnControlPlanes: true
21+
apiServer:
22+
admissionControl:
23+
- name: PodSecurity
24+
configuration:
25+
exemptions:
26+
namespaces:
27+
- cilium-test # to run cilium connectivity tests
28+
network:
29+
cni:
30+
name: none
31+
proxy:
32+
disabled: true

‎terraform/variables.tf‎ renamed to ‎ephemeral/variables.tf‎

File renamed without changes.

‎flux/apps/cert-manager/issuer/kustomization.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
resources:
44
- cluster-issuer.yml
5-
- secret.yml

0 commit comments

Comments
 (0)