CadolesKube
/
typhoon
mirror of https://github.com/puppetmaster/typhoon.git
7
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Allow upgrading Azure Terraform Provider to v3.x 

* Change subnet references to source and destinations prefixes
(plural)
* Remove references to a resource group in some load balancing
components, which no longer require it (inferred)
* Rename `worker_address_prefix` output to `worker_address_prefixes`
This commit is contained in:
Dalton Hubble 2022-04-01 16:17:54 -07:00
parent 5365ce8204
commit 93ebfc7dd0
14 changed files with 433 additions and 454 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
CHANGES.md
View File

@ -4,6 +4,11 @@ Notable changes between versions.
## Latest ## Latest
### Azure
* Allow upgrading Azure Terraform provider to v3.x ([#1144](https://github.com/poseidon/typhoon/pull/1144))
* Rename `worker_address_prefix` output to `worker_address_prefixes`
## v1.23.5 ## v1.23.5
* Kubernetes [v1.23.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.23.md#v1235) * Kubernetes [v1.23.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.23.md#v1235)

12
azure/fedora-coreos/kubernetes/lb.tf
View File

@ -53,8 +53,6 @@ resource "azurerm_lb" "cluster" {
} }
resource "azurerm_lb_rule" "apiserver" { resource "azurerm_lb_rule" "apiserver" {
resource_group_name = azurerm_resource_group.cluster.name
name = "apiserver" name = "apiserver"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
frontend_ip_configuration_name = "apiserver" frontend_ip_configuration_name = "apiserver"
@ -67,8 +65,6 @@ resource "azurerm_lb_rule" "apiserver" {
} }
resource "azurerm_lb_rule" "ingress-http" { resource "azurerm_lb_rule" "ingress-http" {
resource_group_name = azurerm_resource_group.cluster.name
name = "ingress-http" name = "ingress-http"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
frontend_ip_configuration_name = "ingress" frontend_ip_configuration_name = "ingress"
@ -82,8 +78,6 @@ resource "azurerm_lb_rule" "ingress-http" {
} }
resource "azurerm_lb_rule" "ingress-https" { resource "azurerm_lb_rule" "ingress-https" {
resource_group_name = azurerm_resource_group.cluster.name
name = "ingress-https" name = "ingress-https"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
frontend_ip_configuration_name = "ingress" frontend_ip_configuration_name = "ingress"
@ -98,8 +92,6 @@ resource "azurerm_lb_rule" "ingress-https" {
# Worker outbound TCP/UDP SNAT # Worker outbound TCP/UDP SNAT
resource "azurerm_lb_outbound_rule" "worker-outbound" { resource "azurerm_lb_outbound_rule" "worker-outbound" {
resource_group_name = azurerm_resource_group.cluster.name
name = "worker" name = "worker"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
frontend_ip_configuration { frontend_ip_configuration {
@ -126,8 +118,6 @@ resource "azurerm_lb_backend_address_pool" "worker" {
# TCP health check for apiserver # TCP health check for apiserver
resource "azurerm_lb_probe" "apiserver" { resource "azurerm_lb_probe" "apiserver" {
resource_group_name = azurerm_resource_group.cluster.name
name = "apiserver" name = "apiserver"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
protocol = "Tcp" protocol = "Tcp"
@ -141,8 +131,6 @@ resource "azurerm_lb_probe" "apiserver" {
# HTTP health check for ingress # HTTP health check for ingress
resource "azurerm_lb_probe" "ingress" { resource "azurerm_lb_probe" "ingress" {
resource_group_name = azurerm_resource_group.cluster.name
name = "ingress" name = "ingress"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
protocol = "Http" protocol = "Http"

1
azure/fedora-coreos/kubernetes/network.tf
View File

@ -41,4 +41,3 @@ resource "azurerm_subnet_network_security_group_association" "worker" {
subnet_id = azurerm_subnet.worker.id subnet_id = azurerm_subnet.worker.id
network_security_group_id = azurerm_network_security_group.worker.id network_security_group_id = azurerm_network_security_group.worker.id
} }

6
azure/fedora-coreos/kubernetes/outputs.tf
View File

@ -43,9 +43,9 @@ output "worker_security_group_name" {
value = azurerm_network_security_group.worker.name value = azurerm_network_security_group.worker.name
} }
output "worker_address_prefix" { output "worker_address_prefixes" {
description = "Worker network subnet CIDR address (for source/destination)" description = "Worker network subnet CIDR addresses (for source/destination)"
value = azurerm_subnet.worker.address_prefix value = azurerm_subnet.worker.address_prefixes
} }
# Outputs for custom load balancing # Outputs for custom load balancing

80
azure/fedora-coreos/kubernetes/security.tf
View File

@ -18,8 +18,8 @@ resource "azurerm_network_security_rule" "controller-icmp" {
protocol = "Icmp" protocol = "Icmp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "*" destination_port_range = "*"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-ssh" { resource "azurerm_network_security_rule" "controller-ssh" {
@ -34,7 +34,7 @@ resource "azurerm_network_security_rule" "controller-ssh" {
source_port_range = "*" source_port_range = "*"
destination_port_range = "22" destination_port_range = "22"
source_address_prefix = "*" source_address_prefix = "*"
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-etcd" { resource "azurerm_network_security_rule" "controller-etcd" {
@ -48,8 +48,8 @@ resource "azurerm_network_security_rule" "controller-etcd" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "2379-2380" destination_port_range = "2379-2380"
source_address_prefix = azurerm_subnet.controller.address_prefix source_address_prefixes = azurerm_subnet.controller.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow Prometheus to scrape etcd metrics # Allow Prometheus to scrape etcd metrics
@ -64,8 +64,8 @@ resource "azurerm_network_security_rule" "controller-etcd-metrics" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "2381" destination_port_range = "2381"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow Prometheus to scrape kube-proxy metrics # Allow Prometheus to scrape kube-proxy metrics
@ -80,8 +80,8 @@ resource "azurerm_network_security_rule" "controller-kube-proxy" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "10249" destination_port_range = "10249"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow Prometheus to scrape kube-scheduler and kube-controller-manager metrics # Allow Prometheus to scrape kube-scheduler and kube-controller-manager metrics
@ -96,8 +96,8 @@ resource "azurerm_network_security_rule" "controller-kube-metrics" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "10257-10259" destination_port_range = "10257-10259"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-apiserver" { resource "azurerm_network_security_rule" "controller-apiserver" {
@ -112,7 +112,7 @@ resource "azurerm_network_security_rule" "controller-apiserver" {
source_port_range = "*" source_port_range = "*"
destination_port_range = "6443" destination_port_range = "6443"
source_address_prefix = "*" source_address_prefix = "*"
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-cilium-health" { resource "azurerm_network_security_rule" "controller-cilium-health" {
@ -127,8 +127,8 @@ resource "azurerm_network_security_rule" "controller-cilium-health" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "4240" destination_port_range = "4240"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-vxlan" { resource "azurerm_network_security_rule" "controller-vxlan" {
@ -142,8 +142,8 @@ resource "azurerm_network_security_rule" "controller-vxlan" {
protocol = "Udp" protocol = "Udp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "4789" destination_port_range = "4789"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-linux-vxlan" { resource "azurerm_network_security_rule" "controller-linux-vxlan" {
@ -157,8 +157,8 @@ resource "azurerm_network_security_rule" "controller-linux-vxlan" {
protocol = "Udp" protocol = "Udp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "8472" destination_port_range = "8472"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow Prometheus to scrape node-exporter daemonset # Allow Prometheus to scrape node-exporter daemonset
@ -173,8 +173,8 @@ resource "azurerm_network_security_rule" "controller-node-exporter" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "9100" destination_port_range = "9100"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow apiserver to access kubelet's for exec, log, port-forward # Allow apiserver to access kubelet's for exec, log, port-forward
@ -191,8 +191,8 @@ resource "azurerm_network_security_rule" "controller-kubelet" {
destination_port_range = "10250" destination_port_range = "10250"
# allow Prometheus to scrape kubelet metrics too # allow Prometheus to scrape kubelet metrics too
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Override Azure AllowVNetInBound and AllowAzureLoadBalancerInBound # Override Azure AllowVNetInBound and AllowAzureLoadBalancerInBound
@ -248,8 +248,8 @@ resource "azurerm_network_security_rule" "worker-icmp" {
protocol = "Icmp" protocol = "Icmp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "*" destination_port_range = "*"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-ssh" { resource "azurerm_network_security_rule" "worker-ssh" {
@ -263,8 +263,8 @@ resource "azurerm_network_security_rule" "worker-ssh" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "22" destination_port_range = "22"
source_address_prefix = azurerm_subnet.controller.address_prefix source_address_prefixes = azurerm_subnet.controller.address_prefixes
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-http" { resource "azurerm_network_security_rule" "worker-http" {
@ -279,7 +279,7 @@ resource "azurerm_network_security_rule" "worker-http" {
source_port_range = "*" source_port_range = "*"
destination_port_range = "80" destination_port_range = "80"
source_address_prefix = "*" source_address_prefix = "*"
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-https" { resource "azurerm_network_security_rule" "worker-https" {
@ -294,7 +294,7 @@ resource "azurerm_network_security_rule" "worker-https" {
source_port_range = "*" source_port_range = "*"
destination_port_range = "443" destination_port_range = "443"
source_address_prefix = "*" source_address_prefix = "*"
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-cilium-health" { resource "azurerm_network_security_rule" "worker-cilium-health" {
@ -309,8 +309,8 @@ resource "azurerm_network_security_rule" "worker-cilium-health" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "4240" destination_port_range = "4240"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-vxlan" { resource "azurerm_network_security_rule" "worker-vxlan" {
@ -324,8 +324,8 @@ resource "azurerm_network_security_rule" "worker-vxlan" {
protocol = "Udp" protocol = "Udp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "4789" destination_port_range = "4789"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-linux-vxlan" { resource "azurerm_network_security_rule" "worker-linux-vxlan" {
@ -339,8 +339,8 @@ resource "azurerm_network_security_rule" "worker-linux-vxlan" {
protocol = "Udp" protocol = "Udp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "8472" destination_port_range = "8472"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
# Allow Prometheus to scrape node-exporter daemonset # Allow Prometheus to scrape node-exporter daemonset
@ -355,8 +355,8 @@ resource "azurerm_network_security_rule" "worker-node-exporter" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "9100" destination_port_range = "9100"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
# Allow Prometheus to scrape kube-proxy # Allow Prometheus to scrape kube-proxy
@ -371,8 +371,8 @@ resource "azurerm_network_security_rule" "worker-kube-proxy" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "10249" destination_port_range = "10249"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
# Allow apiserver to access kubelet's for exec, log, port-forward # Allow apiserver to access kubelet's for exec, log, port-forward
@ -389,8 +389,8 @@ resource "azurerm_network_security_rule" "worker-kubelet" {
destination_port_range = "10250" destination_port_range = "10250"
# allow Prometheus to scrape kubelet metrics too # allow Prometheus to scrape kubelet metrics too
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
# Override Azure AllowVNetInBound and AllowAzureLoadBalancerInBound # Override Azure AllowVNetInBound and AllowAzureLoadBalancerInBound

2
azure/fedora-coreos/kubernetes/versions.tf
View File

@ -3,7 +3,7 @@
terraform { terraform {
required_version = ">= 0.13.0, < 2.0.0" required_version = ">= 0.13.0, < 2.0.0"
required_providers { required_providers {
azurerm = "~> 2.8" azurerm = ">= 2.8, < 4.0"
template = "~> 2.2" template = "~> 2.2"
null = ">= 2.1" null = ">= 2.1"

2
azure/fedora-coreos/kubernetes/workers/versions.tf
View File

@ -3,7 +3,7 @@
terraform { terraform {
required_version = ">= 0.13.0, < 2.0.0" required_version = ">= 0.13.0, < 2.0.0"
required_providers { required_providers {
azurerm = "~> 2.8" azurerm = ">= 2.8, < 4.0"
template = "~> 2.2" template = "~> 2.2"
ct = { ct = {

12
azure/flatcar-linux/kubernetes/lb.tf
View File

@ -53,8 +53,6 @@ resource "azurerm_lb" "cluster" {
} }
resource "azurerm_lb_rule" "apiserver" { resource "azurerm_lb_rule" "apiserver" {
resource_group_name = azurerm_resource_group.cluster.name
name = "apiserver" name = "apiserver"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
frontend_ip_configuration_name = "apiserver" frontend_ip_configuration_name = "apiserver"
@ -67,8 +65,6 @@ resource "azurerm_lb_rule" "apiserver" {
} }
resource "azurerm_lb_rule" "ingress-http" { resource "azurerm_lb_rule" "ingress-http" {
resource_group_name = azurerm_resource_group.cluster.name
name = "ingress-http" name = "ingress-http"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
frontend_ip_configuration_name = "ingress" frontend_ip_configuration_name = "ingress"
@ -82,8 +78,6 @@ resource "azurerm_lb_rule" "ingress-http" {
} }
resource "azurerm_lb_rule" "ingress-https" { resource "azurerm_lb_rule" "ingress-https" {
resource_group_name = azurerm_resource_group.cluster.name
name = "ingress-https" name = "ingress-https"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
frontend_ip_configuration_name = "ingress" frontend_ip_configuration_name = "ingress"
@ -98,8 +92,6 @@ resource "azurerm_lb_rule" "ingress-https" {
# Worker outbound TCP/UDP SNAT # Worker outbound TCP/UDP SNAT
resource "azurerm_lb_outbound_rule" "worker-outbound" { resource "azurerm_lb_outbound_rule" "worker-outbound" {
resource_group_name = azurerm_resource_group.cluster.name
name = "worker" name = "worker"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
frontend_ip_configuration { frontend_ip_configuration {
@ -126,8 +118,6 @@ resource "azurerm_lb_backend_address_pool" "worker" {
# TCP health check for apiserver # TCP health check for apiserver
resource "azurerm_lb_probe" "apiserver" { resource "azurerm_lb_probe" "apiserver" {
resource_group_name = azurerm_resource_group.cluster.name
name = "apiserver" name = "apiserver"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
protocol = "Tcp" protocol = "Tcp"
@ -141,8 +131,6 @@ resource "azurerm_lb_probe" "apiserver" {
# HTTP health check for ingress # HTTP health check for ingress
resource "azurerm_lb_probe" "ingress" { resource "azurerm_lb_probe" "ingress" {
resource_group_name = azurerm_resource_group.cluster.name
name = "ingress" name = "ingress"
loadbalancer_id = azurerm_lb.cluster.id loadbalancer_id = azurerm_lb.cluster.id
protocol = "Http" protocol = "Http"

1
azure/flatcar-linux/kubernetes/network.tf
View File

@ -41,4 +41,3 @@ resource "azurerm_subnet_network_security_group_association" "worker" {
subnet_id = azurerm_subnet.worker.id subnet_id = azurerm_subnet.worker.id
network_security_group_id = azurerm_network_security_group.worker.id network_security_group_id = azurerm_network_security_group.worker.id
} }

6
azure/flatcar-linux/kubernetes/outputs.tf
View File

@ -43,9 +43,9 @@ output "worker_security_group_name" {
value = azurerm_network_security_group.worker.name value = azurerm_network_security_group.worker.name
} }
output "worker_address_prefix" { output "worker_address_prefixes" {
description = "Worker network subnet CIDR address (for source/destination)" description = "Worker network subnet CIDR addresses (for source/destination)"
value = azurerm_subnet.worker.address_prefix value = azurerm_subnet.worker.address_prefixes
} }
# Outputs for custom load balancing # Outputs for custom load balancing

80
azure/flatcar-linux/kubernetes/security.tf
View File

@ -18,8 +18,8 @@ resource "azurerm_network_security_rule" "controller-icmp" {
protocol = "Icmp" protocol = "Icmp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "*" destination_port_range = "*"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-ssh" { resource "azurerm_network_security_rule" "controller-ssh" {
@ -34,7 +34,7 @@ resource "azurerm_network_security_rule" "controller-ssh" {
source_port_range = "*" source_port_range = "*"
destination_port_range = "22" destination_port_range = "22"
source_address_prefix = "*" source_address_prefix = "*"
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-etcd" { resource "azurerm_network_security_rule" "controller-etcd" {
@ -48,8 +48,8 @@ resource "azurerm_network_security_rule" "controller-etcd" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "2379-2380" destination_port_range = "2379-2380"
source_address_prefix = azurerm_subnet.controller.address_prefix source_address_prefixes = azurerm_subnet.controller.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow Prometheus to scrape etcd metrics # Allow Prometheus to scrape etcd metrics
@ -64,8 +64,8 @@ resource "azurerm_network_security_rule" "controller-etcd-metrics" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "2381" destination_port_range = "2381"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow Prometheus to scrape kube-proxy metrics # Allow Prometheus to scrape kube-proxy metrics
@ -80,8 +80,8 @@ resource "azurerm_network_security_rule" "controller-kube-proxy" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "10249" destination_port_range = "10249"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow Prometheus to scrape kube-scheduler and kube-controller-manager metrics # Allow Prometheus to scrape kube-scheduler and kube-controller-manager metrics
@ -96,8 +96,8 @@ resource "azurerm_network_security_rule" "controller-kube-metrics" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "10257-10259" destination_port_range = "10257-10259"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-apiserver" { resource "azurerm_network_security_rule" "controller-apiserver" {
@ -112,7 +112,7 @@ resource "azurerm_network_security_rule" "controller-apiserver" {
source_port_range = "*" source_port_range = "*"
destination_port_range = "6443" destination_port_range = "6443"
source_address_prefix = "*" source_address_prefix = "*"
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-cilium-health" { resource "azurerm_network_security_rule" "controller-cilium-health" {
@ -127,8 +127,8 @@ resource "azurerm_network_security_rule" "controller-cilium-health" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "4240" destination_port_range = "4240"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-vxlan" { resource "azurerm_network_security_rule" "controller-vxlan" {
@ -142,8 +142,8 @@ resource "azurerm_network_security_rule" "controller-vxlan" {
protocol = "Udp" protocol = "Udp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "4789" destination_port_range = "4789"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
resource "azurerm_network_security_rule" "controller-linux-vxlan" { resource "azurerm_network_security_rule" "controller-linux-vxlan" {
@ -157,8 +157,8 @@ resource "azurerm_network_security_rule" "controller-linux-vxlan" {
protocol = "Udp" protocol = "Udp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "8472" destination_port_range = "8472"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow Prometheus to scrape node-exporter daemonset # Allow Prometheus to scrape node-exporter daemonset
@ -173,8 +173,8 @@ resource "azurerm_network_security_rule" "controller-node-exporter" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "9100" destination_port_range = "9100"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Allow apiserver to access kubelet's for exec, log, port-forward # Allow apiserver to access kubelet's for exec, log, port-forward
@ -191,8 +191,8 @@ resource "azurerm_network_security_rule" "controller-kubelet" {
destination_port_range = "10250" destination_port_range = "10250"
# allow Prometheus to scrape kubelet metrics too # allow Prometheus to scrape kubelet metrics too
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.controller.address_prefix destination_address_prefixes = azurerm_subnet.controller.address_prefixes
} }
# Override Azure AllowVNetInBound and AllowAzureLoadBalancerInBound # Override Azure AllowVNetInBound and AllowAzureLoadBalancerInBound
@ -248,8 +248,8 @@ resource "azurerm_network_security_rule" "worker-icmp" {
protocol = "Icmp" protocol = "Icmp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "*" destination_port_range = "*"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-ssh" { resource "azurerm_network_security_rule" "worker-ssh" {
@ -263,8 +263,8 @@ resource "azurerm_network_security_rule" "worker-ssh" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "22" destination_port_range = "22"
source_address_prefix = azurerm_subnet.controller.address_prefix source_address_prefixes = azurerm_subnet.controller.address_prefixes
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-http" { resource "azurerm_network_security_rule" "worker-http" {
@ -279,7 +279,7 @@ resource "azurerm_network_security_rule" "worker-http" {
source_port_range = "*" source_port_range = "*"
destination_port_range = "80" destination_port_range = "80"
source_address_prefix = "*" source_address_prefix = "*"
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-https" { resource "azurerm_network_security_rule" "worker-https" {
@ -294,7 +294,7 @@ resource "azurerm_network_security_rule" "worker-https" {
source_port_range = "*" source_port_range = "*"
destination_port_range = "443" destination_port_range = "443"
source_address_prefix = "*" source_address_prefix = "*"
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-cilium-health" { resource "azurerm_network_security_rule" "worker-cilium-health" {
@ -309,8 +309,8 @@ resource "azurerm_network_security_rule" "worker-cilium-health" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "4240" destination_port_range = "4240"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-vxlan" { resource "azurerm_network_security_rule" "worker-vxlan" {
@ -324,8 +324,8 @@ resource "azurerm_network_security_rule" "worker-vxlan" {
protocol = "Udp" protocol = "Udp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "4789" destination_port_range = "4789"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
resource "azurerm_network_security_rule" "worker-linux-vxlan" { resource "azurerm_network_security_rule" "worker-linux-vxlan" {
@ -339,8 +339,8 @@ resource "azurerm_network_security_rule" "worker-linux-vxlan" {
protocol = "Udp" protocol = "Udp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "8472" destination_port_range = "8472"
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
# Allow Prometheus to scrape node-exporter daemonset # Allow Prometheus to scrape node-exporter daemonset
@ -355,8 +355,8 @@ resource "azurerm_network_security_rule" "worker-node-exporter" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "9100" destination_port_range = "9100"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
# Allow Prometheus to scrape kube-proxy # Allow Prometheus to scrape kube-proxy
@ -371,8 +371,8 @@ resource "azurerm_network_security_rule" "worker-kube-proxy" {
protocol = "Tcp" protocol = "Tcp"
source_port_range = "*" source_port_range = "*"
destination_port_range = "10249" destination_port_range = "10249"
source_address_prefix = azurerm_subnet.worker.address_prefix source_address_prefixes = azurerm_subnet.worker.address_prefixes
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
# Allow apiserver to access kubelet's for exec, log, port-forward # Allow apiserver to access kubelet's for exec, log, port-forward
@ -389,8 +389,8 @@ resource "azurerm_network_security_rule" "worker-kubelet" {
destination_port_range = "10250" destination_port_range = "10250"
# allow Prometheus to scrape kubelet metrics too # allow Prometheus to scrape kubelet metrics too
source_address_prefixes = [azurerm_subnet.controller.address_prefix, azurerm_subnet.worker.address_prefix] source_address_prefixes = concat(azurerm_subnet.controller.address_prefixes, azurerm_subnet.worker.address_prefixes)
destination_address_prefix = azurerm_subnet.worker.address_prefix destination_address_prefixes = azurerm_subnet.worker.address_prefixes
} }
# Override Azure AllowVNetInBound and AllowAzureLoadBalancerInBound # Override Azure AllowVNetInBound and AllowAzureLoadBalancerInBound

2
azure/flatcar-linux/kubernetes/versions.tf
View File

@ -3,7 +3,7 @@
terraform { terraform {
required_version = ">= 0.13.0, < 2.0.0" required_version = ">= 0.13.0, < 2.0.0"
required_providers { required_providers {
azurerm = "~> 2.8" azurerm = ">= 2.8, < 4.0"
template = "~> 2.2" template = "~> 2.2"
null = ">= 2.1" null = ">= 2.1"

2
azure/flatcar-linux/kubernetes/workers/versions.tf
View File

@ -3,7 +3,7 @@
terraform { terraform {
required_version = ">= 0.13.0, < 2.0.0" required_version = ">= 0.13.0, < 2.0.0"
required_providers { required_providers {
azurerm = "~> 2.8" azurerm = ">= 2.8, < 4.0"
template = "~> 2.2" template = "~> 2.2"
ct = { ct = {

2
docs/architecture/azure.md
View File

@ -62,7 +62,7 @@ resource "azurerm_network_security_rule" "some-app" {
source_port_range = "*" source_port_range = "*"
destination_port_range = "30333" destination_port_range = "30333"
source_address_prefix = "*" source_address_prefix = "*"
destination_address_prefix = module.ramius.worker_address_prefix destination_address_prefixes = module.ramius.worker_address_prefixes
} }
``` ```