mirror of
https://github.com/2martens/terraform.git
synced 2026-10-17 20:26:51 +02:00
Moved all setup to launch configuration and removed provisioners
This commit is contained in:
+26
-8
@@ -179,15 +179,33 @@ resource "hcloud_server" "server_k8s_test" {
|
||||
firewall_ids = [hcloud_firewall.basic-firewall.id, hcloud_firewall.k8s-firewall.id]
|
||||
ssh_keys = [data.hcloud_ssh_key.macos.id]
|
||||
user_data = templatefile("${path.module}/modules/k8s-cluster/templates/cloud-init-k8s.tftpl", {
|
||||
node_ip : "10.0.0.2",
|
||||
admin_public_ssh_key : format("%s %s", data.hcloud_ssh_key.macos.public_key, data.hcloud_ssh_key.macos.name),
|
||||
terraform_public_ssh_key : var.terraform_public_ssh_key,
|
||||
microk8s_channel : "1.28-strict/stable",
|
||||
admin_user : "2martensAdmin",
|
||||
"microk8s_config" : templatefile("${path.module}/modules/k8s-cluster/templates/microk8s-config.tftpl", {
|
||||
node_ip : "10.0.0.2",
|
||||
admin_public_ssh_key : format("%s %s", data.hcloud_ssh_key.macos.public_key, data.hcloud_ssh_key.macos.name)
|
||||
admin_user : "2martensAdmin"
|
||||
terraform_public_ssh_key : var.terraform_public_ssh_key
|
||||
main_node : true
|
||||
microk8s_config : base64encode(templatefile("${path.module}/templates/microk8s-config.tftpl", {
|
||||
node_ip : "10.0.0.2"
|
||||
api_server_domain : ""
|
||||
})
|
||||
}))
|
||||
packages_setup : base64encode(file("${path.module}/templates/install-packages.sh"))
|
||||
firewall_setup : base64encode(templatefile("${path.module}/templates/firewall-setup.sh", {
|
||||
node_ip : "10.0.0.2"
|
||||
}))
|
||||
ssh_setup : base64encode(templatefile("${path.module}/templates/ssh-setup.sh", {
|
||||
admin_user : "2martensAdmin"
|
||||
}))
|
||||
microk8s_setup : base64encode(templatefile("${path.module}/templates/microk8s-setup.sh", {
|
||||
microk8s_channel : "1.28-strict/stable"
|
||||
}))
|
||||
cluster_setup_values : base64encode(templatefile("${path.module}/templates/cluster-setup-values.yaml", {
|
||||
client_id : var.vault_client_id
|
||||
client_secret : var.vault_client_secret
|
||||
}))
|
||||
cluster_setup_values : base64encode(file("${path.module}/templates/argocd-values-ha.yaml"))
|
||||
cluster_setup : base64encode(templatefile("${path.module}/templates/cluster-setup.sh", {
|
||||
argocd_environment : "test"
|
||||
high_availability : false
|
||||
}))
|
||||
})
|
||||
shutdown_before_deletion = true
|
||||
|
||||
|
||||
@@ -1,36 +1,3 @@
|
||||
resource "null_resource" "install_setup" {
|
||||
connection {
|
||||
host = hcloud_server.manager[0].ipv6_address
|
||||
user = "terraform"
|
||||
type = "ssh"
|
||||
private_key = var.terraform_private_ssh_key
|
||||
timeout = "10m"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"while (test -z `command -v helm`); do echo \"Waiting for cloud init to finish...\";sleep 5;done"
|
||||
]
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
content = templatefile("${path.module}/templates/cluster-setup-values.yaml", {
|
||||
client_id : var.vault_service_principal.client_id,
|
||||
client_secret : var.vault_service_principal.client_secret
|
||||
})
|
||||
destination = "/home/terraform/cluster-setup-values.yaml"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"helm repo add 2martens https://repo.2martens.de/charts/",
|
||||
"helm install setup 2martens/cluster_setup --values /home/terraform/cluster-setup-values.yaml",
|
||||
]
|
||||
}
|
||||
|
||||
depends_on = [null_resource.join_nodes, hcloud_server.manager]
|
||||
}
|
||||
|
||||
resource "inwx_nameserver_record" "argocd_a" {
|
||||
domain = var.domain
|
||||
name = format("%s.%s", "argocd", local.kube_api_server_domain)
|
||||
@@ -45,64 +12,3 @@ resource "inwx_nameserver_record" "argocd_aaaa" {
|
||||
type = "AAAA"
|
||||
ttl = 3600
|
||||
}
|
||||
|
||||
resource "null_resource" "install_argocd_single" {
|
||||
count = var.number_nodes < 3 ? 1 : 0
|
||||
|
||||
connection {
|
||||
host = hcloud_server.manager[0].ipv6_address
|
||||
user = "terraform"
|
||||
type = "ssh"
|
||||
private_key = var.terraform_private_ssh_key
|
||||
timeout = "10m"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"while (test -z `command -v helm`); do echo \"Waiting for cloud init to finish...\";sleep 5;done"
|
||||
]
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"helm repo add 2martens https://repo.2martens.de/charts/",
|
||||
"helm install setup 2martens/cluster_setup",
|
||||
"helm install argocd 2martens/argocd --set environment=${var.argocd_environment}",
|
||||
]
|
||||
}
|
||||
|
||||
depends_on = [null_resource.join_nodes, hcloud_server.manager]
|
||||
}
|
||||
|
||||
resource "null_resource" "install_argocd_ha" {
|
||||
count = var.number_nodes >= 3 ? 1 : 0
|
||||
|
||||
connection {
|
||||
host = hcloud_server.manager[0].ipv6_address
|
||||
user = "terraform"
|
||||
type = "ssh"
|
||||
private_key = var.terraform_private_ssh_key
|
||||
timeout = "10m"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"while (test -z `command -v helm`); do echo \"Waiting for cloud init to finish...\";sleep 5;done"
|
||||
]
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
content = file("${path.module}/templates/argocd-values-ha.yaml")
|
||||
destination = "/home/terraform/argocd-values-ha.yaml"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"helm repo add 2martens https://repo.2martens.de/charts/",
|
||||
"helm install setup 2martens/cluster_setup",
|
||||
"helm install argocd 2martens/argocd --set environment=${var.argocd_environment} --values /home/terraform/argocd-values-ha.yaml",
|
||||
]
|
||||
}
|
||||
|
||||
depends_on = [null_resource.join_nodes, hcloud_server.manager]
|
||||
}
|
||||
@@ -80,15 +80,38 @@ resource "hcloud_server" "manager" {
|
||||
"manager" : "yes"
|
||||
}
|
||||
|
||||
user_data = templatefile("${path.module}/templates/cloud-init-k8s.tftpl", {
|
||||
node_ip : var.private_node_ips[count.index],
|
||||
admin_public_ssh_key : format("%s %s", var.admin_ssh_key.public_key, var.admin_ssh_key.name),
|
||||
terraform_public_ssh_key : var.terraform_public_ssh_key,
|
||||
microk8s_channel : var.microk8s_channel,
|
||||
admin_user : var.admin_user,
|
||||
microk8s_config : base64encode(templatefile("${path.module}/templates/microk8s-config.tftpl", {
|
||||
node_ip : var.private_node_ips[count.index],
|
||||
user_data = templatefile("${path.module}/templates/cloud-init-k8s-manager.tftpl", {
|
||||
admin_public_ssh_key : format("%s %s", var.admin_ssh_key.public_key, var.admin_ssh_key.name)
|
||||
admin_user : var.admin_user
|
||||
terraform_public_ssh_key : var.terraform_public_ssh_key
|
||||
main_node : count.index == 0
|
||||
microk8s_config : base64encode(templatefile("${path.module}/templates/microk8s-config-manager.tftpl", {
|
||||
node_ip : var.private_node_ips[count.index]
|
||||
api_server_domain : local.kube_api_server_domain
|
||||
main_node : count.index == 0
|
||||
main_node_ip : var.private_node_ips[0]
|
||||
api_server_ip : var.create_loadbalancer ? hcloud_load_balancer.kubernetes[0].ipv4 : hcloud_primary_ip.ipv4_manager_address[0].ip_address
|
||||
cluster_token : random_id.cluster_token.hex
|
||||
}))
|
||||
packages_setup : base64encode(file("${path.module}/templates/install-packages.sh"))
|
||||
firewall_setup : base64encode(templatefile("${path.module}/templates/firewall-setup.sh", {
|
||||
node_ip : var.private_node_ips[count.index]
|
||||
}))
|
||||
ssh_setup : base64encode(templatefile("${path.module}/templates/ssh-setup.sh", {
|
||||
admin_user : var.admin_user
|
||||
}))
|
||||
microk8s_setup : base64encode(templatefile("${path.module}/templates/microk8s-setup.sh", {
|
||||
microk8s_channel : var.microk8s_channel
|
||||
main_node = count.index == 0
|
||||
}))
|
||||
cluster_setup_values : base64encode(templatefile("${path.module}/templates/cluster-setup-values.yaml", {
|
||||
client_id : var.vault_service_principal.client_id
|
||||
client_secret : var.vault_service_principal.client_secret
|
||||
}))
|
||||
cluster_setup_values : base64encode(file("${path.module}/templates/argocd-values-ha.yaml"))
|
||||
cluster_setup : base64encode(templatefile("${path.module}/templates/cluster-setup.sh", {
|
||||
argocd_environment : var.argocd_environment
|
||||
high_availability : var.number_nodes > 2
|
||||
}))
|
||||
})
|
||||
|
||||
@@ -107,96 +130,84 @@ resource "random_id" "cluster_token" {
|
||||
byte_length = 16
|
||||
}
|
||||
|
||||
resource "null_resource" "setup_tokens" {
|
||||
count = var.number_nodes > 1 ? 1 : 0
|
||||
|
||||
triggers = {
|
||||
rerun = random_id.cluster_token.hex
|
||||
}
|
||||
|
||||
connection {
|
||||
host = hcloud_server.manager[0].ipv6_address
|
||||
user = "terraform"
|
||||
type = "ssh"
|
||||
private_key = var.terraform_private_ssh_key
|
||||
timeout = "10m"
|
||||
}
|
||||
|
||||
provisioner "local-exec" {
|
||||
interpreter = ["bash", "-c"]
|
||||
command = <<EOT
|
||||
echo "1" > /tmp/current_joining_node.txt
|
||||
echo "0" > /tmp/current_joining_worker_node.txt
|
||||
EOT
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"while (test -z `command -v microk8s`); do echo \"Waiting for cloud init to finish...\";sleep 5;done"
|
||||
]
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
content = templatefile("${path.module}/templates/add-node.sh",
|
||||
{
|
||||
cluster_token = random_id.cluster_token.hex
|
||||
cluster_token_ttl_seconds = var.cluster_token_ttl_seconds
|
||||
})
|
||||
destination = "/usr/local/bin/add-node.sh"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"sh /usr/local/bin/add-node.sh",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "null_resource" "join_nodes" {
|
||||
count = var.number_nodes - 1 < 1 ? 0 : var.number_nodes - 1
|
||||
|
||||
triggers = {
|
||||
rerun = random_id.cluster_token.hex
|
||||
}
|
||||
connection {
|
||||
host = element(hcloud_server.manager.*.ipv6_address, count.index + 1)
|
||||
user = "terraform"
|
||||
type = "ssh"
|
||||
private_key = var.terraform_private_ssh_key
|
||||
timeout = "20m"
|
||||
}
|
||||
|
||||
provisioner "local-exec" {
|
||||
interpreter = ["bash", "-c"]
|
||||
command = "while [[ $(cat /tmp/current_joining_node.txt) != \"${count.index + 1}\" ]]; do echo \"${count.index + 1} is waiting...\";sleep 5;done"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"while (test -z `command -v microk8s`); do echo \"Waiting for cloud init to finish...\";sleep 5;done"
|
||||
]
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
content = templatefile("${path.module}/templates/join.sh",
|
||||
{
|
||||
cluster_token = random_id.cluster_token.hex
|
||||
main_node_ip = hcloud_server_network.manager_private[0].ip
|
||||
})
|
||||
destination = "/usr/local/bin/join.sh"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"sh /usr/local/bin/join.sh"
|
||||
]
|
||||
}
|
||||
|
||||
provisioner "local-exec" {
|
||||
interpreter = ["bash", "-c"]
|
||||
command = "echo \"${count.index + 2}\" > /tmp/current_joining_node.txt"
|
||||
}
|
||||
|
||||
depends_on = [null_resource.setup_tokens]
|
||||
}
|
||||
#resource "null_resource" "setup_tokens" {
|
||||
# count = var.number_nodes > 1 ? 1 : 0
|
||||
#
|
||||
# triggers = {
|
||||
# rerun = random_id.cluster_token.hex
|
||||
# }
|
||||
#
|
||||
# connection {
|
||||
# host = hcloud_server.manager[0].ipv6_address
|
||||
# user = "terraform"
|
||||
# type = "ssh"
|
||||
# private_key = var.terraform_private_ssh_key
|
||||
# timeout = "10m"
|
||||
# }
|
||||
#
|
||||
# provisioner "local-exec" {
|
||||
# interpreter = ["bash", "-c"]
|
||||
# command = <<EOT
|
||||
# echo "1" > /tmp/current_joining_node.txt
|
||||
# echo "0" > /tmp/current_joining_worker_node.txt
|
||||
# EOT
|
||||
# }
|
||||
#
|
||||
# provisioner "file" {
|
||||
# content = templatefile("${path.module}/templates/add-node.sh",
|
||||
# {
|
||||
# cluster_token = random_id.cluster_token.hex
|
||||
# cluster_token_ttl_seconds = var.cluster_token_ttl_seconds
|
||||
# })
|
||||
# destination = "/usr/local/bin/add-node.sh"
|
||||
# }
|
||||
#
|
||||
# provisioner "remote-exec" {
|
||||
# inline = [
|
||||
# "sh /usr/local/bin/add-node.sh",
|
||||
# ]
|
||||
# }
|
||||
#}
|
||||
#
|
||||
#
|
||||
#resource "null_resource" "join_nodes" {
|
||||
# count = var.number_nodes - 1 < 1 ? 0 : var.number_nodes - 1
|
||||
#
|
||||
# triggers = {
|
||||
# rerun = random_id.cluster_token.hex
|
||||
# }
|
||||
# connection {
|
||||
# host = element(hcloud_server.manager.*.ipv6_address, count.index + 1)
|
||||
# user = "terraform"
|
||||
# type = "ssh"
|
||||
# private_key = var.terraform_private_ssh_key
|
||||
# timeout = "20m"
|
||||
# }
|
||||
#
|
||||
# provisioner "local-exec" {
|
||||
# interpreter = ["bash", "-c"]
|
||||
# command = "while [[ $(cat /tmp/current_joining_node.txt) != \"${count.index + 1}\" ]]; do echo \"${count.index + 1} is waiting...\";sleep 5;done"
|
||||
# }
|
||||
#
|
||||
# provisioner "file" {
|
||||
# content = templatefile("${path.module}/templates/join.sh",
|
||||
# {
|
||||
# cluster_token = random_id.cluster_token.hex
|
||||
# main_node_ip = hcloud_server_network.manager_private[0].ip
|
||||
# })
|
||||
# destination = "/usr/local/bin/join.sh"
|
||||
# }
|
||||
#
|
||||
# provisioner "remote-exec" {
|
||||
# inline = [
|
||||
# "sh /usr/local/bin/join.sh"
|
||||
# ]
|
||||
# }
|
||||
#
|
||||
# provisioner "local-exec" {
|
||||
# interpreter = ["bash", "-c"]
|
||||
# command = "echo \"${count.index + 2}\" > /tmp/current_joining_node.txt"
|
||||
# }
|
||||
#
|
||||
# depends_on = [null_resource.setup_tokens]
|
||||
#}
|
||||
@@ -1,5 +1,9 @@
|
||||
#!/bin/sh
|
||||
|
||||
while test -z "\${command -v microk8s}";
|
||||
sleep 5; do echo \"Waiting for cloud init to finish...\";
|
||||
done
|
||||
|
||||
until microk8s.status --wait-ready;
|
||||
do sleep 5; echo "waiting for worker status..";
|
||||
done
|
||||
|
||||
@@ -0,0 +1,66 @@
|
||||
#cloud-config
|
||||
users:
|
||||
- name: ${admin_user}
|
||||
groups: users, admin
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
shell: /bin/bash
|
||||
ssh_authorized_keys:
|
||||
- ${admin_public_ssh_key}
|
||||
- name: terraform
|
||||
groups: users, admin
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
ssh_authorized_keys:
|
||||
- ${terraform_public_ssh_key}
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
package_reboot_if_required: true
|
||||
write_files:
|
||||
- owner: 2martensAdmin:2martensAdmin
|
||||
content: "${microk8s_config}"
|
||||
path: /home/2martensAdmin/.microk8s.yaml
|
||||
encoding: base64
|
||||
- owner: root:root
|
||||
content: "${packages_setup}"
|
||||
path: /usr/local/bin/install-packages.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
- owner: root:root
|
||||
content: "${firewall_setup}"
|
||||
path: /usr/local/bin/firewall-setup.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
- owner: root:root
|
||||
content: "${ssh_setup}"
|
||||
path: /usr/local/bin/ssh-setup.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
- owner: root:root
|
||||
content: "${microk8s_setup}"
|
||||
path: /usr/local/bin/microk8s-setup.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
%{ if main_node ~}
|
||||
- owner: root:root
|
||||
content: "${cluster_setup}"
|
||||
path: /usr/local/bin/cluster-setup.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
- owner: root:root
|
||||
content: "${cluster_setup_values}"
|
||||
path: /home/terraform/cluster-setup-values.yaml
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
- owner: root:root
|
||||
content: "${argocd_ha_values}"
|
||||
path: /home/terraform/argocd-values-ha.yaml
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
%{ endif ~}
|
||||
runcmd:
|
||||
- /usr/local/bin/install-packages.sh
|
||||
- /usr/local/bin/firewall-setup.sh
|
||||
- /usr/local/bin/ssh-setup.sh
|
||||
- /usr/local/bin/microk8s-setup.sh
|
||||
%{ if main_node ~}
|
||||
- /usr/local/bin/cluster-setup.sh
|
||||
%{ endif ~}
|
||||
@@ -0,0 +1,52 @@
|
||||
#cloud-config
|
||||
users:
|
||||
- name: ${admin_user}
|
||||
groups: users, admin
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
shell: /bin/bash
|
||||
ssh_authorized_keys:
|
||||
- ${admin_public_ssh_key}
|
||||
- name: terraform
|
||||
groups: users, admin
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
ssh_authorized_keys:
|
||||
- ${terraform_public_ssh_key}
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
package_reboot_if_required: true
|
||||
write_files:
|
||||
- owner: 2martensAdmin:2martensAdmin
|
||||
content: "${microk8s_config}"
|
||||
path: /home/2martensAdmin/.microk8s.yaml
|
||||
encoding: base64
|
||||
- owner: root:root
|
||||
content: "${packages_setup}"
|
||||
path: /usr/local/bin/install-packages.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
- owner: root:root
|
||||
content: "${firewall_setup}"
|
||||
path: /usr/local/bin/firewall-setup.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
- owner: root:root
|
||||
content: "${ssh_setup}"
|
||||
path: /usr/local/bin/ssh-setup.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
- owner: root:root
|
||||
content: "${microk8s_setup}"
|
||||
path: /usr/local/bin/microk8s-setup.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
- owner: root:root
|
||||
content: "${join_worker}"
|
||||
path: /usr/local/bin/join-worker.sh
|
||||
encoding: base64
|
||||
permissions: "0755"
|
||||
runcmd:
|
||||
- /usr/local/bin/install-packages.sh
|
||||
- /usr/local/bin/firewall-setup.sh
|
||||
- /usr/local/bin/ssh-setup.sh
|
||||
- /usr/local/bin/microk8s-setup.sh
|
||||
|
||||
@@ -1,56 +0,0 @@
|
||||
#cloud-config
|
||||
users:
|
||||
- name: ${admin_user}
|
||||
groups: users, admin
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
shell: /bin/bash
|
||||
ssh_authorized_keys:
|
||||
- ${admin_public_ssh_key}
|
||||
- name: terraform
|
||||
groups: users, admin
|
||||
sudo: ALL=(ALL) NOPASSWD:ALL
|
||||
ssh_authorized_keys:
|
||||
- ${terraform_public_ssh_key}
|
||||
packages:
|
||||
- fail2ban
|
||||
- ufw
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
package_reboot_if_required: true
|
||||
write_files:
|
||||
- owner: root:root
|
||||
content: "${microk8s_config}"
|
||||
path: /tmp/.microk8s.yaml
|
||||
encoding: base64
|
||||
runcmd:
|
||||
- printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
|
||||
- systemctl enable fail2ban
|
||||
- ufw allow OpenSSH
|
||||
- ufw allow 16443 comment "Kubernetes API endpoint"
|
||||
- ufw allow 80 comment HTTP
|
||||
- ufw allow 443 comment HTTPS
|
||||
- ufw allow to ${node_ip} port 9100 comment "Metrics endpoint"
|
||||
- ufw allow to ${node_ip} port 10250 comment "cadvisor port"
|
||||
- ufw allow to ${node_ip} port 10259 comment "kube-scheduler port"
|
||||
- ufw allow to ${node_ip} port 10257 comment "kube-controller-manager port"
|
||||
- ufw enable
|
||||
- sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 2/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
|
||||
- sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
|
||||
- sed -i '$a AllowUsers ${admin_user} terraform' /etc/ssh/sshd_config
|
||||
- curl https://packages.hetzner.com/hcloud/deb/hc-utils_0.0.4-1_all.deb -o /tmp/hc-utils_0.0.4-1_all.deb -s
|
||||
- apt install /tmp/hc-utils_0.0.4-1_all.deb
|
||||
- apt-get -y install snapd
|
||||
- snap install kubectl --classic
|
||||
- mkdir -p /var/snap/microk8s/common/etc/launcher
|
||||
- cp /tmp/.microk8s.yaml /var/snap/microk8s/common/etc/launcher/.microk8s.yaml
|
||||
- snap install microk8s --channel "${microk8s_channel}"
|
||||
- mkdir -p /home/terraform/.kube
|
||||
- microk8s kubectl config view --raw > /home/terraform/.kube/config
|
||||
- chown -R terraform:terraform /home/terraform/.kube
|
||||
- chmod go-r /home/terraform/.kube/config
|
||||
- microk8s.status --wait-ready
|
||||
@@ -0,0 +1,9 @@
|
||||
#!/bin/sh
|
||||
|
||||
helm repo add 2martens https://repo.2martens.de/charts/
|
||||
helm install setup 2martens/cluster_setup --values /home/terraform/cluster-setup-values.yaml
|
||||
%{ if high_availability ~}
|
||||
helm install argocd 2martens/argocd --set environment=${argocd_environment} --values /home/terraform/argocd-values-ha.yaml
|
||||
%{ else ~}
|
||||
helm install argocd 2martens/argocd --set environment=${argocd_environment}
|
||||
%{ endif ~}
|
||||
@@ -0,0 +1,15 @@
|
||||
#!/bin/sh
|
||||
|
||||
printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local
|
||||
systemctl enable fail2ban
|
||||
|
||||
ufw allow OpenSSH
|
||||
ufw allow 16443 comment "Kubernetes API endpoint"
|
||||
ufw allow 80 comment HTTP
|
||||
ufw allow 443 comment HTTPS
|
||||
ufw allow to ${node_ip} port 9100 comment "Metrics endpoint"
|
||||
ufw allow to ${node_ip} port 10250 comment "cadvisor port"
|
||||
ufw allow to ${node_ip} port 10259 comment "kube-scheduler port"
|
||||
ufw allow to ${node_ip} port 10257 comment "kube-controller-manager port"
|
||||
ufw allow to ${node_ip} port 25000 comment "port for joining nodes"
|
||||
ufw enable
|
||||
@@ -0,0 +1,9 @@
|
||||
#!/bin/sh
|
||||
|
||||
apt-get -y install fail2ban
|
||||
apt-get -y install ufw
|
||||
apt-get -y install snapd
|
||||
|
||||
curl https://packages.hetzner.com/hcloud/deb/hc-utils_0.0.4-1_all.deb -o /tmp/hc-utils_0.0.4-1_all.deb -s
|
||||
apt install /tmp/hc-utils_0.0.4-1_all.deb
|
||||
snap install kubectl --classic
|
||||
@@ -1,5 +1,9 @@
|
||||
#!/bin/sh
|
||||
|
||||
while test -z "\${command -v microk8s}";
|
||||
sleep 5; do echo \"Waiting for cloud init to finish...\";
|
||||
done
|
||||
|
||||
until microk8s.status --wait-ready;
|
||||
do sleep 3; echo "waiting for worker status..";
|
||||
done
|
||||
|
||||
@@ -1,5 +1,9 @@
|
||||
#!/bin/sh
|
||||
|
||||
while test -z "\${command -v microk8s}";
|
||||
sleep 5; do echo \"Waiting for cloud init to finish...\";
|
||||
done
|
||||
|
||||
until microk8s.status --wait-ready;
|
||||
do sleep 3; echo "waiting for worker status..";
|
||||
done
|
||||
|
||||
+8
-1
@@ -1,7 +1,14 @@
|
||||
---
|
||||
version: 0.2.0
|
||||
%{ if main_node ~}
|
||||
persistentClusterToken: ${cluster_token}
|
||||
%{ else ~}
|
||||
join:
|
||||
url: "${main_node_ip}:25000/${cluster_token}"
|
||||
worker: false
|
||||
%{ endif ~}
|
||||
extraKubeAPIServerArgs:
|
||||
--advertise-address=${node_ip}
|
||||
--advertise-address=${api_server_ip}
|
||||
--authorization-mode=RBAC,Node
|
||||
extraKubeletArgs:
|
||||
--node-ip=${node_ip}
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
version: 0.2.0
|
||||
join:
|
||||
url: "${main_node_ip}:25000/${cluster_token}"
|
||||
worker: true
|
||||
extraKubeletArgs:
|
||||
--node-ip=${node_ip}
|
||||
--cluster-dns=10.152.183.10
|
||||
--cluster-domain=cluster.local
|
||||
@@ -0,0 +1,9 @@
|
||||
#!/bin/sh
|
||||
|
||||
mkdir -p /var/snap/microk8s/common/etc/launcher
|
||||
cp /home/terraform/.microk8s.yaml /var/snap/microk8s/common/etc/launcher/.microk8s.yaml
|
||||
chown root:root /var/snap/microk8s/common/etc/launcher/.microk8s.yaml
|
||||
%{ if !main_node ~}
|
||||
sleep 120
|
||||
%{ endif ~}
|
||||
snap install microk8s --channel "${microk8s_channel}"
|
||||
@@ -0,0 +1,10 @@
|
||||
#!/bin/sh
|
||||
|
||||
sed -i -e '/^\(#\|\)PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config
|
||||
sed -i -e '/^\(#\|\)PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config
|
||||
sed -i -e '/^\(#\|\)X11Forwarding/s/^.*$/X11Forwarding no/' /etc/ssh/sshd_config
|
||||
sed -i -e '/^\(#\|\)MaxAuthTries/s/^.*$/MaxAuthTries 2/' /etc/ssh/sshd_config
|
||||
sed -i -e '/^\(#\|\)AllowTcpForwarding/s/^.*$/AllowTcpForwarding no/' /etc/ssh/sshd_config
|
||||
sed -i -e '/^\(#\|\)AllowAgentForwarding/s/^.*$/AllowAgentForwarding no/' /etc/ssh/sshd_config
|
||||
sed -i -e '/^\(#\|\)AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh\/authorized_keys/' /etc/ssh/sshd_config
|
||||
sed -i '$a AllowUsers ${admin_user} terraform' /etc/ssh/sshd_config
|
||||
@@ -59,15 +59,38 @@ resource "hcloud_server" "worker" {
|
||||
"worker" : "yes"
|
||||
}
|
||||
|
||||
user_data = templatefile("${path.module}/templates/cloud-init-k8s.tftpl", {
|
||||
node_ip : var.private_worker_node_ips[count.index],
|
||||
admin_public_ssh_key : format("%s %s", var.admin_ssh_key.public_key, var.admin_ssh_key.name),
|
||||
terraform_public_ssh_key : var.terraform_public_ssh_key,
|
||||
microk8s_channel : var.microk8s_channel,
|
||||
admin_user : var.admin_user,
|
||||
microk8s_config : base64encode(templatefile("${path.module}/templates/microk8s-config.tftpl", {
|
||||
node_ip : var.private_worker_node_ips[count.index],
|
||||
user_data = templatefile("${path.module}/templates/cloud-init-k8s-worker.tftpl", {
|
||||
admin_public_ssh_key : format("%s %s", var.admin_ssh_key.public_key, var.admin_ssh_key.name)
|
||||
admin_user : var.admin_user
|
||||
terraform_public_ssh_key : var.terraform_public_ssh_key
|
||||
main_node : count.index == 0
|
||||
microk8s_config : base64encode(templatefile("${path.module}/templates/microk8s-config-worker.tftpl", {
|
||||
node_ip : var.private_node_ips[count.index]
|
||||
api_server_domain : local.kube_api_server_domain
|
||||
main_node : count.index == 0
|
||||
main_node_ip : hcloud_server_network.manager_private[0].ip
|
||||
api_server_ip : var.create_loadbalancer ? hcloud_load_balancer.kubernetes[0].ipv4 : hcloud_server.manager[0].ipv4_address
|
||||
cluster_token : random_id.cluster_token.hex
|
||||
}))
|
||||
packages_setup : base64encode(file("${path.module}/templates/install-packages.sh"))
|
||||
firewall_setup : base64encode(templatefile("${path.module}/templates/firewall-setup.sh", {
|
||||
node_ip : var.private_node_ips[count.index]
|
||||
}))
|
||||
ssh_setup : base64encode(templatefile("${path.module}/templates/ssh-setup.sh", {
|
||||
admin_user : var.admin_user
|
||||
}))
|
||||
microk8s_setup : base64encode(templatefile("${path.module}/templates/microk8s-setup.sh", {
|
||||
microk8s_channel : var.microk8s_channel
|
||||
main_node : false
|
||||
}))
|
||||
cluster_setup_values : base64encode(templatefile("${path.module}/templates/cluster-setup-values.yaml", {
|
||||
client_id : var.vault_service_principal.client_id
|
||||
client_secret : var.vault_service_principal.client_secret
|
||||
}))
|
||||
cluster_setup_values : base64encode(file("${path.module}/templates/argocd-values-ha.yaml"))
|
||||
cluster_setup : base64encode(templatefile("${path.module}/templates/cluster-setup.sh", {
|
||||
argocd_environment : var.argocd_environment
|
||||
high_availability : var.number_nodes > 2
|
||||
}))
|
||||
})
|
||||
|
||||
@@ -82,50 +105,44 @@ resource "hcloud_server" "worker" {
|
||||
}
|
||||
}
|
||||
|
||||
resource "null_resource" "join_workers" {
|
||||
count = var.number_worker_nodes
|
||||
|
||||
triggers = {
|
||||
rerun = random_id.cluster_token.hex
|
||||
}
|
||||
connection {
|
||||
host = element(hcloud_server.worker.*.ipv6_address, count.index)
|
||||
user = "terraform"
|
||||
type = "ssh"
|
||||
private_key = var.terraform_private_ssh_key
|
||||
timeout = "20m"
|
||||
}
|
||||
|
||||
provisioner "local-exec" {
|
||||
interpreter = ["bash", "-c"]
|
||||
command = "while [[ $(cat /tmp/current_joining_worker_node.txt) != \"${count.index}\" ]]; do echo \"${count.index} is waiting...\";sleep 5;done"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"while (test -z `command -v microk8s`); do echo \"Waiting for cloud init to finish...\";sleep 5;done"
|
||||
]
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
content = templatefile("${path.module}/templates/join-worker.sh",
|
||||
{
|
||||
cluster_token = random_id.cluster_token.hex
|
||||
main_node_ip = hcloud_server_network.manager_private[0].ip
|
||||
})
|
||||
destination = "/usr/local/bin/join-worker.sh"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"sh /usr/local/bin/join-worker.sh"
|
||||
]
|
||||
}
|
||||
|
||||
provisioner "local-exec" {
|
||||
interpreter = ["bash", "-c"]
|
||||
command = "echo \"${count.index + 1}\" > /tmp/current_joining_worker_node.txt"
|
||||
}
|
||||
|
||||
depends_on = [null_resource.setup_tokens, null_resource.join_nodes]
|
||||
}
|
||||
#resource "null_resource" "join_workers" {
|
||||
# count = var.number_worker_nodes
|
||||
#
|
||||
# triggers = {
|
||||
# rerun = random_id.cluster_token.hex
|
||||
# }
|
||||
# connection {
|
||||
# host = element(hcloud_server.worker.*.ipv6_address, count.index)
|
||||
# user = "terraform"
|
||||
# type = "ssh"
|
||||
# private_key = var.terraform_private_ssh_key
|
||||
# timeout = "20m"
|
||||
# }
|
||||
#
|
||||
# provisioner "local-exec" {
|
||||
# interpreter = ["bash", "-c"]
|
||||
# command = "while [[ $(cat /tmp/current_joining_worker_node.txt) != \"${count.index}\" ]]; do echo \"${count.index} is waiting...\";sleep 5;done"
|
||||
# }
|
||||
#
|
||||
# provisioner "file" {
|
||||
# content = templatefile("${path.module}/templates/join-worker.sh",
|
||||
# {
|
||||
# cluster_token = random_id.cluster_token.hex
|
||||
# main_node_ip = hcloud_server_network.manager_private[0].ip
|
||||
# })
|
||||
# destination = "/usr/local/bin/join-worker.sh"
|
||||
# }
|
||||
#
|
||||
# provisioner "remote-exec" {
|
||||
# inline = [
|
||||
# "sh /usr/local/bin/join-worker.sh"
|
||||
# ]
|
||||
# }
|
||||
#
|
||||
# provisioner "local-exec" {
|
||||
# interpreter = ["bash", "-c"]
|
||||
# command = "echo \"${count.index + 1}\" > /tmp/current_joining_worker_node.txt"
|
||||
# }
|
||||
#
|
||||
# depends_on = [null_resource.setup_tokens, null_resource.join_nodes]
|
||||
#}
|
||||
Reference in New Issue
Block a user