2017-06-27 06:55:39 +02:00
|
|
|
resource "google_compute_network" "network" {
|
|
|
|
name = "${var.cluster_name}"
|
|
|
|
description = "Network for the ${var.cluster_name} cluster"
|
|
|
|
auto_create_subnetworks = true
|
|
|
|
}
|
|
|
|
|
2017-11-08 08:21:12 +01:00
|
|
|
resource "google_compute_firewall" "allow-ssh" {
|
|
|
|
name = "${var.cluster_name}-allow-ssh"
|
2017-06-27 06:55:39 +02:00
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "tcp"
|
2017-11-08 08:21:12 +01:00
|
|
|
ports = [22]
|
2017-06-27 06:55:39 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
source_ranges = ["0.0.0.0/0"]
|
2018-02-11 00:18:27 +01:00
|
|
|
target_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
2017-06-27 06:55:39 +02:00
|
|
|
}
|
|
|
|
|
2017-11-08 08:21:12 +01:00
|
|
|
resource "google_compute_firewall" "internal-etcd" {
|
|
|
|
name = "${var.cluster_name}-internal-etcd"
|
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
2017-06-27 06:55:39 +02:00
|
|
|
allow {
|
2017-11-08 08:21:12 +01:00
|
|
|
protocol = "tcp"
|
|
|
|
ports = [2380]
|
2017-06-27 06:55:39 +02:00
|
|
|
}
|
|
|
|
|
2017-11-08 08:21:12 +01:00
|
|
|
source_tags = ["${var.cluster_name}-controller"]
|
|
|
|
target_tags = ["${var.cluster_name}-controller"]
|
2017-06-27 06:55:39 +02:00
|
|
|
}
|
2017-09-05 06:14:05 +02:00
|
|
|
|
2018-04-08 08:16:27 +02:00
|
|
|
# Allow Prometheus to scrape etcd metrics
|
|
|
|
resource "google_compute_firewall" "internal-etcd-metrics" {
|
|
|
|
name = "${var.cluster_name}-internal-etcd-metrics"
|
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "tcp"
|
|
|
|
ports = [2381]
|
|
|
|
}
|
|
|
|
|
|
|
|
source_tags = ["${var.cluster_name}-worker"]
|
|
|
|
target_tags = ["${var.cluster_name}-controller"]
|
|
|
|
}
|
|
|
|
|
2018-08-22 05:52:43 +02:00
|
|
|
resource "google_compute_firewall" "allow-apiserver" {
|
|
|
|
name = "${var.cluster_name}-allow-apiserver"
|
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "tcp"
|
|
|
|
ports = [443]
|
|
|
|
}
|
|
|
|
|
|
|
|
source_ranges = ["0.0.0.0/0"]
|
|
|
|
target_tags = ["${var.cluster_name}-controller"]
|
|
|
|
}
|
|
|
|
|
2017-09-05 06:14:05 +02:00
|
|
|
# Calico BGP and IPIP
|
|
|
|
# https://docs.projectcalico.org/v2.5/reference/public-cloud/gce
|
2017-11-08 08:21:12 +01:00
|
|
|
resource "google_compute_firewall" "internal-calico" {
|
2017-09-05 06:14:05 +02:00
|
|
|
count = "${var.networking == "calico" ? 1 : 0}"
|
|
|
|
|
2017-11-08 08:21:12 +01:00
|
|
|
name = "${var.cluster_name}-internal-calico"
|
2017-09-05 06:14:05 +02:00
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "tcp"
|
|
|
|
ports = ["179"]
|
|
|
|
}
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "ipip"
|
|
|
|
}
|
|
|
|
|
2017-11-08 08:21:12 +01:00
|
|
|
source_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
|
|
|
target_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
|
|
|
}
|
|
|
|
|
|
|
|
# flannel
|
|
|
|
resource "google_compute_firewall" "internal-flannel" {
|
|
|
|
count = "${var.networking == "flannel" ? 1 : 0}"
|
|
|
|
|
|
|
|
name = "${var.cluster_name}-internal-flannel"
|
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "udp"
|
|
|
|
ports = [8472]
|
|
|
|
}
|
|
|
|
|
|
|
|
source_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
|
|
|
target_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
|
|
|
}
|
|
|
|
|
2018-03-29 06:45:24 +02:00
|
|
|
# Allow Prometheus to scrape node-exporter daemonset
|
2017-11-08 08:21:12 +01:00
|
|
|
resource "google_compute_firewall" "internal-node-exporter" {
|
|
|
|
name = "${var.cluster_name}-internal-node-exporter"
|
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "tcp"
|
|
|
|
ports = [9100]
|
|
|
|
}
|
|
|
|
|
2018-04-08 08:16:27 +02:00
|
|
|
source_tags = ["${var.cluster_name}-worker"]
|
2017-11-08 08:21:12 +01:00
|
|
|
target_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
|
|
|
}
|
|
|
|
|
2018-08-22 05:52:43 +02:00
|
|
|
# Allow apiserver to access kubelets for exec, log, port-forward
|
2017-11-08 08:21:12 +01:00
|
|
|
resource "google_compute_firewall" "internal-kubelet" {
|
|
|
|
name = "${var.cluster_name}-internal-kubelet"
|
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "tcp"
|
|
|
|
ports = [10250]
|
|
|
|
}
|
|
|
|
|
2018-08-22 05:52:43 +02:00
|
|
|
# allow Prometheus to scrape kubelet metrics too
|
2018-05-14 08:49:45 +02:00
|
|
|
source_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
2017-11-08 08:21:12 +01:00
|
|
|
target_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
|
|
|
}
|
|
|
|
|
2018-08-22 05:52:43 +02:00
|
|
|
# Allow heapster / metrics-server to scrape kubelet read-only
|
2017-11-08 08:21:12 +01:00
|
|
|
resource "google_compute_firewall" "internal-kubelet-readonly" {
|
|
|
|
name = "${var.cluster_name}-internal-kubelet-readonly"
|
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "tcp"
|
|
|
|
ports = [10255]
|
|
|
|
}
|
|
|
|
|
|
|
|
source_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
|
|
|
target_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
|
2017-09-05 06:14:05 +02:00
|
|
|
}
|
2018-05-07 08:21:53 +02:00
|
|
|
|
2018-08-22 05:52:43 +02:00
|
|
|
# Workers
|
|
|
|
|
|
|
|
resource "google_compute_firewall" "allow-ingress" {
|
|
|
|
name = "${var.cluster_name}-allow-ingress"
|
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "tcp"
|
|
|
|
ports = [80, 443]
|
|
|
|
}
|
|
|
|
|
|
|
|
source_ranges = ["0.0.0.0/0"]
|
|
|
|
target_tags = ["${var.cluster_name}-worker"]
|
|
|
|
}
|
|
|
|
|
2018-05-07 08:21:53 +02:00
|
|
|
resource "google_compute_firewall" "google-health-checks" {
|
2018-08-22 06:59:55 +02:00
|
|
|
name = "${var.cluster_name}-google-health-checks"
|
2018-05-07 08:21:53 +02:00
|
|
|
network = "${google_compute_network.network.name}"
|
|
|
|
|
|
|
|
allow {
|
|
|
|
protocol = "tcp"
|
|
|
|
ports = [10254]
|
|
|
|
}
|
|
|
|
|
|
|
|
# https://cloud.google.com/compute/docs/load-balancing/tcp-ssl/tcp-proxy#health-checking
|
|
|
|
source_ranges = ["130.211.0.0/22", "35.191.0.0/16"]
|
2018-08-22 06:59:55 +02:00
|
|
|
target_tags = ["${var.cluster_name}-worker"]
|
2018-05-07 08:21:53 +02:00
|
|
|
}
|