2martens/terraform
1
0
Fork 0
mirror of https://github.com/2martens/terraform.git synced 2026-10-17 19:26:51 +02:00
Code Issues Activity

Added sysctl config to support cis-hardening

Browse Source
This commit is contained in:
2martens
2023-11-08 22:32:19 +01:00
parent a4772ee450
commit f5fdfb1326
5 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/modules/k8s-cluster/manager-node.tf
+1
View File
@@ -104,6 +104,7 @@ resource "hcloud_server" "manager" {
ssh_setup : base64encode(templatefile("${path.module}/templates/scripts/ssh-setup.sh", { ssh_setup : base64encode(templatefile("${path.module}/templates/scripts/ssh-setup.sh", {
admin_user : var.admin_user admin_user : var.admin_user
})) }))
sysctl_setup : base64encode(file("${path.module}/templates/scripts/sysctl-setup.sh"))
microk8s_setup : base64encode(templatefile("${path.module}/templates/scripts/microk8s-setup.sh", { microk8s_setup : base64encode(templatefile("${path.module}/templates/scripts/microk8s-setup.sh", {
microk8s_channel : var.microk8s_channel microk8s_channel : var.microk8s_channel
main_node = count.index == 0 main_node = count.index == 0
terraform/modules/k8s-cluster/templates/cloud-init-k8s-manager.tftpl
+1
View File
@@ -72,6 +72,7 @@ runcmd:
- /usr/local/bin/install-packages.sh - /usr/local/bin/install-packages.sh
- /usr/local/bin/firewall-setup.sh - /usr/local/bin/firewall-setup.sh
- /usr/local/bin/ssh-setup.sh - /usr/local/bin/ssh-setup.sh
- /usr/local/bin/sysctl-setup.sh
- /usr/local/bin/microk8s-setup.sh - /usr/local/bin/microk8s-setup.sh
%{ if main_node ~} %{ if main_node ~}
- sudo /usr/local/bin/cluster-setup.sh - sudo /usr/local/bin/cluster-setup.sh
terraform/modules/k8s-cluster/templates/cloud-init-k8s-worker.tftpl
+6
View File
@@ -40,6 +40,11 @@ write_files:
path: /run/tmpfiles.d/ssh-setup.sh path: /run/tmpfiles.d/ssh-setup.sh
encoding: base64 encoding: base64
defer: true defer: true
- owner: root:root
content: "${sysctl_setup}"
path: /run/tmpfiles.d/sysctl-setup.sh
encoding: base64
defer: true
- owner: root:root - owner: root:root
content: "${microk8s_setup}" content: "${microk8s_setup}"
path: /run/tmpfiles.d/microk8s-setup.sh path: /run/tmpfiles.d/microk8s-setup.sh
@@ -50,5 +55,6 @@ runcmd:
- /usr/local/bin/install-packages.sh - /usr/local/bin/install-packages.sh
- /usr/local/bin/firewall-setup.sh - /usr/local/bin/firewall-setup.sh
- /usr/local/bin/ssh-setup.sh - /usr/local/bin/ssh-setup.sh
- /usr/local/bin/sysctl-setup.sh
- /usr/local/bin/microk8s-setup.sh - /usr/local/bin/microk8s-setup.sh
terraform/modules/k8s-cluster/templates/scripts/sysctl-setup.sh
+3
View File
@@ -0,0 +1,3 @@
#!/bin/sh
printf "vm.overcommit_memory = 1\nkernel.panic = 10\nkernel.panic_on_oops = 1" > /etc/sysctl.d/90-kubelet.conf
terraform/modules/k8s-cluster/worker-node.tf
+1
View File
@@ -83,6 +83,7 @@ resource "hcloud_server" "worker" {
ssh_setup : base64encode(templatefile("${path.module}/templates/scripts/ssh-setup.sh", { ssh_setup : base64encode(templatefile("${path.module}/templates/scripts/ssh-setup.sh", {
admin_user : var.admin_user admin_user : var.admin_user
})) }))
sysctl_setup : base64encode(file("${path.module}/templates/scripts/sysctl-setup.sh"))
microk8s_setup : base64encode(templatefile("${path.module}/templates/scripts/microk8s-setup.sh", { microk8s_setup : base64encode(templatefile("${path.module}/templates/scripts/microk8s-setup.sh", {
microk8s_channel : var.microk8s_channel microk8s_channel : var.microk8s_channel
main_node : false main_node : false