forked from nicusX/k8s-terraform-ansible-sample
-
Notifications
You must be signed in to change notification settings - Fork 99
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Import keypair
- Loading branch information
Showing
11 changed files
with
406 additions
and
383 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,2 @@ | ||
| /environment.tfvars | ||
| /terraform.tfvars | ||
| /util/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| # Retrieve AWS credentials from env variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY | ||
| provider "aws" { | ||
| access_key = "" | ||
| secret_key = "" | ||
| region = "${var.region}" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| ######################### | ||
| ## Generate certificates | ||
| ######################### | ||
|
|
||
| # Generate Certificates | ||
| data "template_file" "certificates" { | ||
| template = "${file("${path.module}/template/kubernetes-csr.json")}" | ||
| depends_on = ["aws_elb.kubernetes_api","aws_instance.etcd","aws_instance.controller","aws_instance.worker"] | ||
| vars { | ||
| kubernetes_api_elb_dns_name = "${aws_elb.kubernetes_api.dns_name}" | ||
| kubernetes_cluster_dns = "${var.kubernetes_cluster_dns}" | ||
|
|
||
| # Unfortunately, variables must be primitives, neither lists nor maps | ||
| etcd0_ip = "${aws_instance.etcd.0.private_ip}" | ||
| etcd1_ip = "${aws_instance.etcd.1.private_ip}" | ||
| etcd2_ip = "${aws_instance.etcd.2.private_ip}" | ||
| controller0_ip = "${aws_instance.controller.0.private_ip}" | ||
| controller1_ip = "${aws_instance.controller.1.private_ip}" | ||
| controller2_ip = "${aws_instance.controller.2.private_ip}" | ||
| worker0_ip = "${aws_instance.worker.0.private_ip}" | ||
| worker1_ip = "${aws_instance.worker.1.private_ip}" | ||
| worker2_ip = "${aws_instance.worker.2.private_ip}" | ||
|
|
||
| etcd0_dns = "${aws_instance.etcd.0.private_dns}" | ||
| etcd1_dns = "${aws_instance.etcd.1.private_dns}" | ||
| etcd2_dns = "${aws_instance.etcd.2.private_dns}" | ||
| controller0_dns = "${aws_instance.controller.0.private_dns}" | ||
| controller1_dns = "${aws_instance.controller.1.private_dns}" | ||
| controller2_dns = "${aws_instance.controller.2.private_dns}" | ||
| worker0_dns = "${aws_instance.worker.0.private_dns}" | ||
| worker1_dns = "${aws_instance.worker.1.private_dns}" | ||
| worker2_dns = "${aws_instance.worker.2.private_dns}" | ||
| } | ||
| } | ||
| resource "null_resource" "certificates" { | ||
| triggers { | ||
| template_rendered = "${ data.template_file.certificates.rendered }" | ||
| } | ||
| provisioner "local-exec" { | ||
| command = "echo '${ data.template_file.certificates.rendered }' > ../cert/kubernetes-csr.json" | ||
| } | ||
| provisioner "local-exec" { | ||
| command = "cd ../cert; cfssl gencert -initca ca-csr.json | cfssljson -bare ca; cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| ######################### | ||
| # etcd cluster instances | ||
| ######################### | ||
|
|
||
| resource "aws_instance" "etcd" { | ||
| count = 3 | ||
| ami = "${var.default_ami}" | ||
| instance_type = "${var.default_instance_type}" | ||
|
|
||
| subnet_id = "${aws_subnet.kubernetes.id}" | ||
| private_ip = "${cidrhost(var.vpc_cidr, 10 + count.index)}" | ||
| associate_public_ip_address = true # Instances have public, dynamic IP | ||
|
|
||
| availability_zone = "${var.zone}" | ||
| vpc_security_group_ids = ["${aws_security_group.kubernetes.id}"] | ||
| key_name = "${var.default_keypair_name}" | ||
|
|
||
| tags { | ||
| Owner = "${var.owner}" | ||
| Name = "etcd-${count.index}" | ||
| ansibleFilter = "${var.ansibleFilter}" | ||
| ansibleNodeType = "etcd" | ||
| ansibleNodeName = "etcd${count.index}" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
|
|
||
| ############################ | ||
| # K8s Control Pane instances | ||
| ############################ | ||
|
|
||
| resource "aws_instance" "controller" { | ||
|
|
||
| count = 3 | ||
| ami = "${var.default_ami}" | ||
| instance_type = "${var.default_instance_type}" | ||
|
|
||
| subnet_id = "${aws_subnet.kubernetes.id}" | ||
| private_ip = "${cidrhost(var.vpc_cidr, 20 + count.index)}" | ||
| associate_public_ip_address = true # Instances have public, dynamic IP | ||
| source_dest_check = false # TODO Required?? | ||
|
|
||
| availability_zone = "${var.zone}" | ||
| vpc_security_group_ids = ["${aws_security_group.kubernetes.id}"] | ||
| key_name = "${var.default_keypair_name}" | ||
|
|
||
| tags { | ||
| Owner = "${var.owner}" | ||
| Name = "controller-${count.index}" | ||
| ansibleFilter = "${var.ansibleFilter}" | ||
| ansibleNodeType = "controller" | ||
| ansibleNodeName = "controller${count.index}" | ||
| } | ||
| } | ||
|
|
||
| ############################### | ||
| ## Kubernetes API Load Balancer | ||
| ############################### | ||
|
|
||
| resource "aws_elb" "kubernetes_api" { | ||
| name = "${var.elb_name}" | ||
| instances = ["${aws_instance.controller.*.id}"] | ||
| subnets = ["${aws_subnet.kubernetes.id}"] | ||
| cross_zone_load_balancing = false | ||
|
|
||
| security_groups = ["${aws_security_group.kubernetes_api.id}"] | ||
|
|
||
| listener { | ||
| lb_port = 6443 | ||
| instance_port = 6443 | ||
| lb_protocol = "TCP" | ||
| instance_protocol = "TCP" | ||
| } | ||
|
|
||
| health_check { | ||
| healthy_threshold = 2 | ||
| unhealthy_threshold = 2 | ||
| timeout = 15 | ||
| target = "HTTP:8080/healthz" | ||
| interval = 30 | ||
| } | ||
|
|
||
| tags { | ||
| Name = "kubernetes" | ||
| Owner = "${var.owner}" | ||
| } | ||
| } | ||
|
|
||
| ############ | ||
| ## Security | ||
| ############ | ||
|
|
||
| resource "aws_security_group" "kubernetes_api" { | ||
| vpc_id = "${aws_vpc.kubernetes.id}" | ||
| name = "kubernetes-api" | ||
|
|
||
| # Allow inbound traffic to the port used by Kubernetes API HTTPS | ||
| ingress { | ||
| from_port = 6443 | ||
| to_port = 6443 | ||
| protocol = "TCP" | ||
| cidr_blocks = ["${var.control_cidr}"] | ||
| } | ||
|
|
||
| # Allow all outbound traffic | ||
| egress { | ||
| from_port = 0 | ||
| to_port = 0 | ||
| protocol = "-1" | ||
| cidr_blocks = ["0.0.0.0/0"] | ||
| } | ||
|
|
||
| tags { | ||
| Owner = "${var.owner}" | ||
| Name = "kubernetes-api" | ||
| } | ||
| } | ||
|
|
||
| ############ | ||
| ## Outputs | ||
| ############ | ||
|
|
||
| output "kubernetes_api_dns_name" { | ||
| value = "${aws_elb.kubernetes_api.dns_name}" | ||
| } |
Oops, something went wrong.