CadolesKube
/
typhoon
mirror of https://github.com/puppetmaster/typhoon.git
7
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Migrate Google Cloud module Terraform v0.11 to v0.12 

* Replace v0.11 bracket type hints with Terraform v0.12 list expressions
* Use expression syntax instead of interpolated strings, where suggested
* Update Google Cloud tutorial and worker pools documentation
* Define Terraform and plugin version requirements in versions.tf
  * Require google ~> 2.5 to support Terraform v0.12
  * Require ct ~> 0.3.2 to support Terraform v0.12
This commit is contained in:
Dalton Hubble 2019-05-27 21:14:25 -07:00
parent 2ba0181dbe
commit d6d9e6c4b9
21 changed files with 249 additions and 291 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
CHANGES.md
View File

@ -39,8 +39,11 @@ Notable changes between versions.
#### Google Cloud #### Google Cloud
* Migrate from Terraform v0.11 to v0.12.x (**action required!**)
* Require `terraform-provider-google` v2.5+ to support Terraform v0.12
* Require `terraform-provider-ct` v0.3.2+ to support Terraform v0.12
* Rename `worker` pool module `count` variable to `worker_count` ([#485](https://github.com/poseidon/typhoon/pull/485)) (action required) * Rename `worker` pool module `count` variable to `worker_count` ([#485](https://github.com/poseidon/typhoon/pull/485)) (action required)
* `count` will become a reserved variable name in Terraform v0.12 * `count` is a reserved variable in Terraform v0.12
#### Addons #### Addons

10
README.md
View File

@ -50,15 +50,7 @@ Define a Kubernetes cluster by using the Terraform module for your chosen platfo
```tf ```tf
module "google-cloud-yavin" { module "google-cloud-yavin" {
source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.14.3" source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.14.4"
providers = {
google = "google.default"
local = "local.default"
null = "null.default"
template = "template.default"
tls = "tls.default"
}
# Google Cloud # Google Cloud
cluster_name = "yavin" cluster_name = "yavin"

14
docs/advanced/worker-pools.md
View File

@ -150,19 +150,15 @@ Create a cluster following the Google Cloud [tutorial](../cl/google-cloud.md#clu
module "yavin-worker-pool" { module "yavin-worker-pool" {
source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes/workers?ref=v1.14.3" source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes/workers?ref=v1.14.3"
providers = {
google = "google.default"
}
# Google Cloud # Google Cloud
region = "europe-west2" region = "europe-west2"
network = "${module.google-cloud-yavin.network_name}" network = module.google-cloud-yavin.network_name
cluster_name = "yavin" cluster_name = "yavin"
# configuration # configuration
name = "yavin-16x" name = "yavin-16x"
kubeconfig = "${module.google-cloud-yavin.kubeconfig}" kubeconfig = module.google-cloud-yavin.kubeconfig
ssh_authorized_key = "${var.ssh_authorized_key}" ssh_authorized_key = var.ssh_authorized_key
# optional # optional
worker_count = 2 worker_count = 2
@ -200,9 +196,9 @@ The Google Cloud internal `workers` module supports a number of [variables](http
|:-----|:------------|:--------| |:-----|:------------|:--------|
| name | Unique name (distinct from cluster name) | "yavin-16x" | | name | Unique name (distinct from cluster name) | "yavin-16x" |
| region | Region for the worker pool instances. May differ from the cluster's region | "europe-west2" | | region | Region for the worker pool instances. May differ from the cluster's region | "europe-west2" |
| network | Must be set to `network_name` output by cluster | "${module.cluster.network_name}" | | network | Must be set to `network_name` output by cluster | module.cluster.network_name |
| cluster_name | Must be set to `cluster_name` of cluster | "yavin" | | cluster_name | Must be set to `cluster_name` of cluster | "yavin" |
| kubeconfig | Must be set to `kubeconfig` output by cluster | "${module.cluster.kubeconfig}" | | kubeconfig | Must be set to `kubeconfig` output by cluster | module.cluster.kubeconfig |
| ssh_authorized_key | SSH public key for user 'core' | "ssh-rsa AAAAB3NZ..." | | ssh_authorized_key | SSH public key for user 'core' | "ssh-rsa AAAAB3NZ..." |
Check the list of regions [docs](https://cloud.google.com/compute/docs/regions-zones/regions-zones) or with `gcloud compute regions list`. Check the list of regions [docs](https://cloud.google.com/compute/docs/regions-zones/regions-zones) or with `gcloud compute regions list`.

42
docs/cl/google-cloud.md
View File

@ -10,15 +10,15 @@ Controllers are provisioned to run an `etcd-member` peer and a `kubelet` service
* Google Cloud Account and Service Account * Google Cloud Account and Service Account
* Google Cloud DNS Zone (registered Domain Name or delegated subdomain) * Google Cloud DNS Zone (registered Domain Name or delegated subdomain)
* Terraform v0.11.x and [terraform-provider-ct](https://github.com/poseidon/terraform-provider-ct) installed locally * Terraform v0.12.x and [terraform-provider-ct](https://github.com/poseidon/terraform-provider-ct) installed locally
## Terraform Setup ## Terraform Setup
Install [Terraform](https://www.terraform.io/downloads.html) v0.11.x on your system. Install [Terraform](https://www.terraform.io/downloads.html) v0.12.x on your system.
```sh ```sh
$ terraform version $ terraform version
Terraform v0.11.14 Terraform v0.12.0
``` ```
Add the [terraform-provider-ct](https://github.com/poseidon/terraform-provider-ct) plugin binary for your system to `~/.terraform.d/plugins/`, noting the final name. Add the [terraform-provider-ct](https://github.com/poseidon/terraform-provider-ct) plugin binary for your system to `~/.terraform.d/plugins/`, noting the final name.
@ -49,37 +49,15 @@ Configure the Google Cloud provider to use your service account key, project-id,
```tf ```tf
provider "google" { provider "google" {
version = "~> 2.7.0" version = "2.7.0"
alias = "default"
credentials = "${file("~/.config/google-cloud/terraform.json")}"
project = "project-id" project = "project-id"
region = "us-central1" region = "us-central1"
credentials = "${file("~/.config/google-cloud/terraform.json")}"
} }
provider "ct" { provider "ct" {
version = "0.3.2" version = "0.3.2"
} }
provider "local" {
version = "~> 1.0"
alias = "default"
}
provider "null" {
version = "~> 1.0"
alias = "default"
}
provider "template" {
version = "~> 1.0"
alias = "default"
}
provider "tls" {
version = "~> 1.0"
alias = "default"
}
``` ```
Additional configuration options are described in the `google` provider [docs](https://www.terraform.io/docs/providers/google/index.html). Additional configuration options are described in the `google` provider [docs](https://www.terraform.io/docs/providers/google/index.html).
@ -93,15 +71,7 @@ Define a Kubernetes cluster using the module `google-cloud/container-linux/kuber
```tf ```tf
module "google-cloud-yavin" { module "google-cloud-yavin" {
source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.14.3" source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.14.4"
providers = {
google = "google.default"
local = "local.default"
null = "null.default"
template = "template.default"
tls = "tls.default"
}
# Google Cloud # Google Cloud
cluster_name = "yavin" cluster_name = "yavin"

10
docs/index.md
View File

@ -49,15 +49,7 @@ Define a Kubernetes cluster by using the Terraform module for your chosen platfo
```tf ```tf
module "google-cloud-yavin" { module "google-cloud-yavin" {
source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.14.3" source = "git::https://github.com/poseidon/typhoon//google-cloud/container-linux/kubernetes?ref=v1.14.4"
providers = {
google = "google.default"
local = "local.default"
null = "null.default"
template = "template.default"
tls = "tls.default"
}
# Google Cloud # Google Cloud
cluster_name = "yavin" cluster_name = "yavin"

41
google-cloud/container-linux/kubernetes/apiserver.tf
View File

@ -1,15 +1,15 @@
# TCP Proxy load balancer DNS record # TCP Proxy load balancer DNS record
resource "google_dns_record_set" "apiserver" { resource "google_dns_record_set" "apiserver" {
# DNS Zone name where record should be created # DNS Zone name where record should be created
managed_zone = "${var.dns_zone_name}" managed_zone = var.dns_zone_name
# DNS record # DNS record
name = "${format("%s.%s.", var.cluster_name, var.dns_zone)}" name = format("%s.%s.", var.cluster_name, var.dns_zone)
type = "A" type = "A"
ttl = 300 ttl = 300
# IPv4 address of apiserver TCP Proxy load balancer # IPv4 address of apiserver TCP Proxy load balancer
rrdatas = ["${google_compute_global_address.apiserver-ipv4.address}"] rrdatas = [google_compute_global_address.apiserver-ipv4.address]
} }
# Static IPv4 address for the TCP Proxy Load Balancer # Static IPv4 address for the TCP Proxy Load Balancer
@ -21,17 +21,17 @@ resource "google_compute_global_address" "apiserver-ipv4" {
# Forward IPv4 TCP traffic to the TCP proxy load balancer # Forward IPv4 TCP traffic to the TCP proxy load balancer
resource "google_compute_global_forwarding_rule" "apiserver" { resource "google_compute_global_forwarding_rule" "apiserver" {
name = "${var.cluster_name}-apiserver" name = "${var.cluster_name}-apiserver"
ip_address = "${google_compute_global_address.apiserver-ipv4.address}" ip_address = google_compute_global_address.apiserver-ipv4.address
ip_protocol = "TCP" ip_protocol = "TCP"
port_range = "443" port_range = "443"
target = "${google_compute_target_tcp_proxy.apiserver.self_link}" target = google_compute_target_tcp_proxy.apiserver.self_link
} }
# Global TCP Proxy Load Balancer for apiservers # Global TCP Proxy Load Balancer for apiservers
resource "google_compute_target_tcp_proxy" "apiserver" { resource "google_compute_target_tcp_proxy" "apiserver" {
name = "${var.cluster_name}-apiserver" name = "${var.cluster_name}-apiserver"
description = "Distribute TCP load across ${var.cluster_name} controllers" description = "Distribute TCP load across ${var.cluster_name} controllers"
backend_service = "${google_compute_backend_service.apiserver.self_link}" backend_service = google_compute_backend_service.apiserver.self_link
} }
# Global backend service backed by unmanaged instance groups # Global backend service backed by unmanaged instance groups
@ -46,26 +46,30 @@ resource "google_compute_backend_service" "apiserver" {
# controller(s) spread across zonal instance groups # controller(s) spread across zonal instance groups
backend { backend {
group = "${google_compute_instance_group.controllers.0.self_link}" group = google_compute_instance_group.controllers[0].self_link
} }
backend { backend {
group = "${google_compute_instance_group.controllers.1.self_link}" group = google_compute_instance_group.controllers[1].self_link
} }
backend { backend {
group = "${google_compute_instance_group.controllers.2.self_link}" group = google_compute_instance_group.controllers[2].self_link
} }
health_checks = ["${google_compute_health_check.apiserver.self_link}"] health_checks = [google_compute_health_check.apiserver.self_link]
} }
# Instance group of heterogeneous (unmanged) controller instances # Instance group of heterogeneous (unmanged) controller instances
resource "google_compute_instance_group" "controllers" { resource "google_compute_instance_group" "controllers" {
count = "${length(local.zones)}" count = length(local.zones)
name = "${format("%s-controllers-%s", var.cluster_name, element(local.zones, count.index))}" name = format(
zone = "${element(local.zones, count.index)}" "%s-controllers-%s",
var.cluster_name,
element(local.zones, count.index),
)
zone = element(local.zones, count.index)
named_port { named_port {
name = "apiserver" name = "apiserver"
@ -73,11 +77,11 @@ resource "google_compute_instance_group" "controllers" {
} }
# add instances in the zone into the instance group # add instances in the zone into the instance group
instances = [ instances = matchkeys(
"${matchkeys(google_compute_instance.controllers.*.self_link, google_compute_instance.controllers.*.self_link,
google_compute_instance.controllers.*.zone, google_compute_instance.controllers.*.zone,
list(element(local.zones, count.index)))}", [element(local.zones, count.index)],
] )
} }
# TCP health check for apiserver # TCP health check for apiserver
@ -95,3 +99,4 @@ resource "google_compute_health_check" "apiserver" {
port = "443" port = "443"
} }
} }

23
google-cloud/container-linux/kubernetes/bootkube.tf
View File

@ -1,19 +1,20 @@
# Self-hosted Kubernetes assets (kubeconfig, manifests) # Self-hosted Kubernetes assets (kubeconfig, manifests)
module "bootkube" { module "bootkube" {
source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=082921d67905417755609eebda7d39a7e26f7fdb" source = "git::https://github.com/poseidon/terraform-render-bootkube.git?ref=0103bc06bb3f597455a765bf5d916f9b241cbea0"
cluster_name = "${var.cluster_name}" cluster_name = var.cluster_name
api_servers = ["${format("%s.%s", var.cluster_name, var.dns_zone)}"] api_servers = [format("%s.%s", var.cluster_name, var.dns_zone)]
etcd_servers = ["${google_dns_record_set.etcds.*.name}"] etcd_servers = google_dns_record_set.etcds.*.name
asset_dir = "${var.asset_dir}" asset_dir = var.asset_dir
networking = "${var.networking}" networking = var.networking
network_mtu = 1440 network_mtu = 1440
pod_cidr = "${var.pod_cidr}" pod_cidr = var.pod_cidr
service_cidr = "${var.service_cidr}" service_cidr = var.service_cidr
cluster_domain_suffix = "${var.cluster_domain_suffix}" cluster_domain_suffix = var.cluster_domain_suffix
enable_reporting = "${var.enable_reporting}" enable_reporting = var.enable_reporting
enable_aggregation = "${var.enable_aggregation}" enable_aggregation = var.enable_aggregation
// temporary // temporary
apiserver_port = 443 apiserver_port = 443
} }

69
google-cloud/container-linux/kubernetes/controllers.tf
View File

@ -1,106 +1,107 @@
# Discrete DNS records for each controller's private IPv4 for etcd usage # Discrete DNS records for each controller's private IPv4 for etcd usage
resource "google_dns_record_set" "etcds" { resource "google_dns_record_set" "etcds" {
count = "${var.controller_count}" count = var.controller_count
# DNS Zone name where record should be created # DNS Zone name where record should be created
managed_zone = "${var.dns_zone_name}" managed_zone = var.dns_zone_name
# DNS record # DNS record
name = "${format("%s-etcd%d.%s.", var.cluster_name, count.index, var.dns_zone)}" name = format("%s-etcd%d.%s.", var.cluster_name, count.index, var.dns_zone)
type = "A" type = "A"
ttl = 300 ttl = 300
# private IPv4 address for etcd # private IPv4 address for etcd
rrdatas = ["${element(google_compute_instance.controllers.*.network_interface.0.network_ip, count.index)}"] rrdatas = [element(google_compute_instance.controllers.*.network_interface.0.network_ip, count.index)]
} }
# Zones in the region # Zones in the region
data "google_compute_zones" "all" { data "google_compute_zones" "all" {
region = "${var.region}" region = var.region
} }
locals { locals {
# TCP proxy load balancers require a fixed number of zonal backends. Spread # TCP proxy load balancers require a fixed number of zonal backends. Spread
# controllers over up to 3 zones, since all GCP regions have at least 3. # controllers over up to 3 zones, since all GCP regions have at least 3.
zones = "${slice(data.google_compute_zones.all.names, 0, 3)}" zones = slice(data.google_compute_zones.all.names, 0, 3)
controllers_ipv4_public = ["${google_compute_instance.controllers.*.network_interface.0.access_config.0.nat_ip}"] controllers_ipv4_public = google_compute_instance.controllers.*.network_interface.0.access_config.0.nat_ip
} }
# Controller instances # Controller instances
resource "google_compute_instance" "controllers" { resource "google_compute_instance" "controllers" {
count = "${var.controller_count}" count = var.controller_count
name = "${var.cluster_name}-controller-${count.index}" name = "${var.cluster_name}-controller-${count.index}"
zone = "${element(local.zones, count.index)}" zone = element(local.zones, count.index)
machine_type = "${var.controller_type}" machine_type = var.controller_type
metadata = { metadata = {
user-data = "${element(data.ct_config.controller-ignitions.*.rendered, count.index)}" user-data = element(data.ct_config.controller-ignitions.*.rendered, count.index)
} }
boot_disk { boot_disk {
auto_delete = true auto_delete = true
initialize_params { initialize_params {
image = "${var.os_image}" image = var.os_image
size = "${var.disk_size}" size = var.disk_size
} }
} }
network_interface { network_interface {
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
# Ephemeral external IP # Ephemeral external IP
access_config = {} access_config {
}
} }
can_ip_forward = true can_ip_forward = true
tags = ["${var.cluster_name}-controller"] tags = ["${var.cluster_name}-controller"]
lifecycle { lifecycle {
ignore_changes = [ ignore_changes = [metadata]
"metadata",
]
} }
} }
# Controller Ignition configs # Controller Ignition configs
data "ct_config" "controller-ignitions" { data "ct_config" "controller-ignitions" {
count = "${var.controller_count}" count = var.controller_count
content = "${element(data.template_file.controller-configs.*.rendered, count.index)}" content = element(
data.template_file.controller-configs.*.rendered,
count.index,
)
pretty_print = false pretty_print = false
snippets = ["${var.controller_clc_snippets}"] snippets = var.controller_clc_snippets
} }
# Controller Container Linux configs # Controller Container Linux configs
data "template_file" "controller-configs" { data "template_file" "controller-configs" {
count = "${var.controller_count}" count = var.controller_count
template = "${file("${path.module}/cl/controller.yaml.tmpl")}" template = file("${path.module}/cl/controller.yaml.tmpl")
vars = { vars = {
# Cannot use cyclic dependencies on controllers or their DNS records # Cannot use cyclic dependencies on controllers or their DNS records
etcd_name = "etcd${count.index}" etcd_name = "etcd${count.index}"
etcd_domain = "${var.cluster_name}-etcd${count.index}.${var.dns_zone}" etcd_domain = "${var.cluster_name}-etcd${count.index}.${var.dns_zone}"
# etcd0=https://cluster-etcd0.example.com,etcd1=https://cluster-etcd1.example.com,... # etcd0=https://cluster-etcd0.example.com,etcd1=https://cluster-etcd1.example.com,...
etcd_initial_cluster = "${join(",", data.template_file.etcds.*.rendered)}" etcd_initial_cluster = join(",", data.template_file.etcds.*.rendered)
kubeconfig = indent(10, module.bootkube.kubeconfig-kubelet)
kubeconfig = "${indent(10, module.bootkube.kubeconfig-kubelet)}" ssh_authorized_key = var.ssh_authorized_key
ssh_authorized_key = "${var.ssh_authorized_key}" cluster_dns_service_ip = cidrhost(var.service_cidr, 10)
cluster_dns_service_ip = "${cidrhost(var.service_cidr, 10)}" cluster_domain_suffix = var.cluster_domain_suffix
cluster_domain_suffix = "${var.cluster_domain_suffix}"
} }
} }
data "template_file" "etcds" { data "template_file" "etcds" {
count = "${var.controller_count}" count = var.controller_count
template = "etcd$${index}=https://$${cluster_name}-etcd$${index}.$${dns_zone}:2380" template = "etcd$${index}=https://$${cluster_name}-etcd$${index}.$${dns_zone}:2380"
vars = { vars = {
index = "${count.index}" index = count.index
cluster_name = "${var.cluster_name}" cluster_name = var.cluster_name
dns_zone = "${var.dns_zone}" dns_zone = var.dns_zone
} }
} }

31
google-cloud/container-linux/kubernetes/ingress.tf
View File

@ -14,52 +14,52 @@ resource "google_compute_global_address" "ingress-ipv6" {
# Google Cloud does not allow TCP proxies for port 80. Must use HTTP proxy. # Google Cloud does not allow TCP proxies for port 80. Must use HTTP proxy.
resource "google_compute_global_forwarding_rule" "ingress-http-ipv4" { resource "google_compute_global_forwarding_rule" "ingress-http-ipv4" {
name = "${var.cluster_name}-ingress-http-ipv4" name = "${var.cluster_name}-ingress-http-ipv4"
ip_address = "${google_compute_global_address.ingress-ipv4.address}" ip_address = google_compute_global_address.ingress-ipv4.address
ip_protocol = "TCP" ip_protocol = "TCP"
port_range = "80" port_range = "80"
target = "${google_compute_target_http_proxy.ingress-http.self_link}" target = google_compute_target_http_proxy.ingress-http.self_link
} }
# Forward IPv4 TCP traffic to the TCP proxy load balancer # Forward IPv4 TCP traffic to the TCP proxy load balancer
resource "google_compute_global_forwarding_rule" "ingress-https-ipv4" { resource "google_compute_global_forwarding_rule" "ingress-https-ipv4" {
name = "${var.cluster_name}-ingress-https-ipv4" name = "${var.cluster_name}-ingress-https-ipv4"
ip_address = "${google_compute_global_address.ingress-ipv4.address}" ip_address = google_compute_global_address.ingress-ipv4.address
ip_protocol = "TCP" ip_protocol = "TCP"
port_range = "443" port_range = "443"
target = "${google_compute_target_tcp_proxy.ingress-https.self_link}" target = google_compute_target_tcp_proxy.ingress-https.self_link
} }
# Forward IPv6 TCP traffic to the HTTP proxy load balancer # Forward IPv6 TCP traffic to the HTTP proxy load balancer
# Google Cloud does not allow TCP proxies for port 80. Must use HTTP proxy. # Google Cloud does not allow TCP proxies for port 80. Must use HTTP proxy.
resource "google_compute_global_forwarding_rule" "ingress-http-ipv6" { resource "google_compute_global_forwarding_rule" "ingress-http-ipv6" {
name = "${var.cluster_name}-ingress-http-ipv6" name = "${var.cluster_name}-ingress-http-ipv6"
ip_address = "${google_compute_global_address.ingress-ipv6.address}" ip_address = google_compute_global_address.ingress-ipv6.address
ip_protocol = "TCP" ip_protocol = "TCP"
port_range = "80" port_range = "80"
target = "${google_compute_target_http_proxy.ingress-http.self_link}" target = google_compute_target_http_proxy.ingress-http.self_link
} }
# Forward IPv6 TCP traffic to the TCP proxy load balancer # Forward IPv6 TCP traffic to the TCP proxy load balancer
resource "google_compute_global_forwarding_rule" "ingress-https-ipv6" { resource "google_compute_global_forwarding_rule" "ingress-https-ipv6" {
name = "${var.cluster_name}-ingress-https-ipv6" name = "${var.cluster_name}-ingress-https-ipv6"
ip_address = "${google_compute_global_address.ingress-ipv6.address}" ip_address = google_compute_global_address.ingress-ipv6.address
ip_protocol = "TCP" ip_protocol = "TCP"
port_range = "443" port_range = "443"
target = "${google_compute_target_tcp_proxy.ingress-https.self_link}" target = google_compute_target_tcp_proxy.ingress-https.self_link
} }
# HTTP proxy load balancer for ingress controllers # HTTP proxy load balancer for ingress controllers
resource "google_compute_target_http_proxy" "ingress-http" { resource "google_compute_target_http_proxy" "ingress-http" {
name = "${var.cluster_name}-ingress-http" name = "${var.cluster_name}-ingress-http"
description = "Distribute HTTP load across ${var.cluster_name} workers" description = "Distribute HTTP load across ${var.cluster_name} workers"
url_map = "${google_compute_url_map.ingress-http.self_link}" url_map = google_compute_url_map.ingress-http.self_link
} }
# TCP proxy load balancer for ingress controllers # TCP proxy load balancer for ingress controllers
resource "google_compute_target_tcp_proxy" "ingress-https" { resource "google_compute_target_tcp_proxy" "ingress-https" {
name = "${var.cluster_name}-ingress-https" name = "${var.cluster_name}-ingress-https"
description = "Distribute HTTPS load across ${var.cluster_name} workers" description = "Distribute HTTPS load across ${var.cluster_name} workers"
backend_service = "${google_compute_backend_service.ingress-https.self_link}" backend_service = google_compute_backend_service.ingress-https.self_link
} }
# HTTP URL Map (required) # HTTP URL Map (required)
@ -67,7 +67,7 @@ resource "google_compute_url_map" "ingress-http" {
name = "${var.cluster_name}-ingress-http" name = "${var.cluster_name}-ingress-http"
# Do not add host/path rules for applications here. Use Ingress resources. # Do not add host/path rules for applications here. Use Ingress resources.
default_service = "${google_compute_backend_service.ingress-http.self_link}" default_service = google_compute_backend_service.ingress-http.self_link
} }
# Backend service backed by managed instance group of workers # Backend service backed by managed instance group of workers
@ -81,10 +81,10 @@ resource "google_compute_backend_service" "ingress-http" {
timeout_sec = "60" timeout_sec = "60"
backend { backend {
group = "${module.workers.instance_group}" group = module.workers.instance_group
} }
health_checks = ["${google_compute_health_check.ingress.self_link}"] health_checks = [google_compute_health_check.ingress.self_link]
} }
# Backend service backed by managed instance group of workers # Backend service backed by managed instance group of workers
@ -98,10 +98,10 @@ resource "google_compute_backend_service" "ingress-https" {
timeout_sec = "60" timeout_sec = "60"
backend { backend {
group = "${module.workers.instance_group}" group = module.workers.instance_group
} }
health_checks = ["${google_compute_health_check.ingress.self_link}"] health_checks = [google_compute_health_check.ingress.self_link]
} }
# Ingress HTTP Health Check # Ingress HTTP Health Check
@ -120,3 +120,4 @@ resource "google_compute_health_check" "ingress" {
request_path = "/healthz" request_path = "/healthz"
} }
} }

32
google-cloud/container-linux/kubernetes/network.tf
View File

@ -1,12 +1,12 @@
resource "google_compute_network" "network" { resource "google_compute_network" "network" {
name = "${var.cluster_name}" name = var.cluster_name
description = "Network for the ${var.cluster_name} cluster" description = "Network for the ${var.cluster_name} cluster"
auto_create_subnetworks = true auto_create_subnetworks = true
} }
resource "google_compute_firewall" "allow-ssh" { resource "google_compute_firewall" "allow-ssh" {
name = "${var.cluster_name}-allow-ssh" name = "${var.cluster_name}-allow-ssh"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@ -19,7 +19,7 @@ resource "google_compute_firewall" "allow-ssh" {
resource "google_compute_firewall" "internal-etcd" { resource "google_compute_firewall" "internal-etcd" {
name = "${var.cluster_name}-internal-etcd" name = "${var.cluster_name}-internal-etcd"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@ -33,7 +33,7 @@ resource "google_compute_firewall" "internal-etcd" {
# Allow Prometheus to scrape etcd metrics # Allow Prometheus to scrape etcd metrics
resource "google_compute_firewall" "internal-etcd-metrics" { resource "google_compute_firewall" "internal-etcd-metrics" {
name = "${var.cluster_name}-internal-etcd-metrics" name = "${var.cluster_name}-internal-etcd-metrics"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@ -46,7 +46,7 @@ resource "google_compute_firewall" "internal-etcd-metrics" {
resource "google_compute_firewall" "allow-apiserver" { resource "google_compute_firewall" "allow-apiserver" {
name = "${var.cluster_name}-allow-apiserver" name = "${var.cluster_name}-allow-apiserver"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@ -60,10 +60,10 @@ resource "google_compute_firewall" "allow-apiserver" {
# BGP and IPIP # BGP and IPIP
# https://docs.projectcalico.org/latest/reference/public-cloud/gce # https://docs.projectcalico.org/latest/reference/public-cloud/gce
resource "google_compute_firewall" "internal-bgp" { resource "google_compute_firewall" "internal-bgp" {
count = "${var.networking != "flannel" ? 1 : 0}" count = var.networking != "flannel" ? 1 : 0
name = "${var.cluster_name}-internal-bgp" name = "${var.cluster_name}-internal-bgp"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@ -80,10 +80,10 @@ resource "google_compute_firewall" "internal-bgp" {
# flannel VXLAN # flannel VXLAN
resource "google_compute_firewall" "internal-vxlan" { resource "google_compute_firewall" "internal-vxlan" {
count = "${var.networking == "flannel" ? 1 : 0}" count = var.networking == "flannel" ? 1 : 0
name = "${var.cluster_name}-internal-vxlan" name = "${var.cluster_name}-internal-vxlan"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "udp" protocol = "udp"
@ -97,7 +97,7 @@ resource "google_compute_firewall" "internal-vxlan" {
# Allow Prometheus to scrape node-exporter daemonset # Allow Prometheus to scrape node-exporter daemonset
resource "google_compute_firewall" "internal-node-exporter" { resource "google_compute_firewall" "internal-node-exporter" {
name = "${var.cluster_name}-internal-node-exporter" name = "${var.cluster_name}-internal-node-exporter"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@ -111,7 +111,7 @@ resource "google_compute_firewall" "internal-node-exporter" {
# Allow apiserver to access kubelets for exec, log, port-forward # Allow apiserver to access kubelets for exec, log, port-forward
resource "google_compute_firewall" "internal-kubelet" { resource "google_compute_firewall" "internal-kubelet" {
name = "${var.cluster_name}-internal-kubelet" name = "${var.cluster_name}-internal-kubelet"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@ -127,7 +127,7 @@ resource "google_compute_firewall" "internal-kubelet" {
resource "google_compute_firewall" "allow-ingress" { resource "google_compute_firewall" "allow-ingress" {
name = "${var.cluster_name}-allow-ingress" name = "${var.cluster_name}-allow-ingress"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@ -140,7 +140,7 @@ resource "google_compute_firewall" "allow-ingress" {
resource "google_compute_firewall" "google-ingress-health-checks" { resource "google_compute_firewall" "google-ingress-health-checks" {
name = "${var.cluster_name}-ingress-health" name = "${var.cluster_name}-ingress-health"
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
allow { allow {
protocol = "tcp" protocol = "tcp"
@ -149,17 +149,13 @@ resource "google_compute_firewall" "google-ingress-health-checks" {
# https://cloud.google.com/load-balancing/docs/health-check-concepts#method # https://cloud.google.com/load-balancing/docs/health-check-concepts#method
source_ranges = [ source_ranges = [
# Global LB health checks
"35.191.0.0/16", "35.191.0.0/16",
"130.211.0.0/22", "130.211.0.0/22",
# Region LB health checks
"35.191.0.0/16", "35.191.0.0/16",
"209.85.152.0/22", "209.85.152.0/22",
"209.85.204.0/22", "209.85.204.0/22",
] ]
target_tags = ["${var.cluster_name}-worker"] target_tags = ["${var.cluster_name}-worker"]
} }

17
google-cloud/container-linux/kubernetes/outputs.tf
View File

@ -1,43 +1,44 @@
output "kubeconfig-admin" { output "kubeconfig-admin" {
value = "${module.bootkube.kubeconfig-admin}" value = module.bootkube.kubeconfig-admin
} }
# Outputs for Kubernetes Ingress # Outputs for Kubernetes Ingress
output "ingress_static_ipv4" { output "ingress_static_ipv4" {
description = "Global IPv4 address for proxy load balancing to the nearest Ingress controller" description = "Global IPv4 address for proxy load balancing to the nearest Ingress controller"
value = "${google_compute_global_address.ingress-ipv4.address}" value = google_compute_global_address.ingress-ipv4.address
} }
output "ingress_static_ipv6" { output "ingress_static_ipv6" {
description = "Global IPv6 address for proxy load balancing to the nearest Ingress controller" description = "Global IPv6 address for proxy load balancing to the nearest Ingress controller"
value = "${google_compute_global_address.ingress-ipv6.address}" value = google_compute_global_address.ingress-ipv6.address
} }
# Outputs for worker pools # Outputs for worker pools
output "network_name" { output "network_name" {
value = "${google_compute_network.network.name}" value = google_compute_network.network.name
} }
output "kubeconfig" { output "kubeconfig" {
value = "${module.bootkube.kubeconfig-kubelet}" value = module.bootkube.kubeconfig-kubelet
} }
# Outputs for custom firewalling # Outputs for custom firewalling
output "network_self_link" { output "network_self_link" {
value = "${google_compute_network.network.self_link}" value = google_compute_network.network.self_link
} }
# Outputs for custom load balancing # Outputs for custom load balancing
output "worker_instance_group" { output "worker_instance_group" {
description = "Worker managed instance group full URL" description = "Worker managed instance group full URL"
value = "${module.workers.instance_group}" value = module.workers.instance_group
} }
output "worker_target_pool" { output "worker_target_pool" {
description = "Worker target pool self link" description = "Worker target pool self link"
value = "${module.workers.target_pool}" value = module.workers.target_pool
} }

25
google-cloud/container-linux/kubernetes/require.tf
View File

@ -1,25 +0,0 @@
# Terraform version and plugin versions
terraform {
required_version = ">= 0.11.0"
}
provider "google" {
version = ">= 1.19, < 3.0"
}
provider "local" {
version = "~> 1.0"
}
provider "null" {
version = "~> 1.0"
}
provider "template" {
version = "~> 1.0"
}
provider "tls" {
version = "~> 1.0"
}

31
google-cloud/container-linux/kubernetes/ssh.tf
View File

@ -1,46 +1,46 @@
# Secure copy etcd TLS assets to controllers. # Secure copy etcd TLS assets to controllers.
resource "null_resource" "copy-controller-secrets" { resource "null_resource" "copy-controller-secrets" {
count = "${var.controller_count}" count = var.controller_count
connection { connection {
type = "ssh" type = "ssh"
host = "${element(local.controllers_ipv4_public, count.index)}" host = element(local.controllers_ipv4_public, count.index)
user = "core" user = "core"
timeout = "15m" timeout = "15m"
} }
provisioner "file" { provisioner "file" {
content = "${module.bootkube.etcd_ca_cert}" content = module.bootkube.etcd_ca_cert
destination = "$HOME/etcd-client-ca.crt" destination = "$HOME/etcd-client-ca.crt"
} }
provisioner "file" { provisioner "file" {
content = "${module.bootkube.etcd_client_cert}" content = module.bootkube.etcd_client_cert
destination = "$HOME/etcd-client.crt" destination = "$HOME/etcd-client.crt"
} }
provisioner "file" { provisioner "file" {
content = "${module.bootkube.etcd_client_key}" content = module.bootkube.etcd_client_key
destination = "$HOME/etcd-client.key" destination = "$HOME/etcd-client.key"
} }
provisioner "file" { provisioner "file" {
content = "${module.bootkube.etcd_server_cert}" content = module.bootkube.etcd_server_cert
destination = "$HOME/etcd-server.crt" destination = "$HOME/etcd-server.crt"
} }
provisioner "file" { provisioner "file" {
content = "${module.bootkube.etcd_server_key}" content = module.bootkube.etcd_server_key
destination = "$HOME/etcd-server.key" destination = "$HOME/etcd-server.key"
} }
provisioner "file" { provisioner "file" {
content = "${module.bootkube.etcd_peer_cert}" content = module.bootkube.etcd_peer_cert
destination = "$HOME/etcd-peer.crt" destination = "$HOME/etcd-peer.crt"
} }
provisioner "file" { provisioner "file" {
content = "${module.bootkube.etcd_peer_key}" content = module.bootkube.etcd_peer_key
destination = "$HOME/etcd-peer.key" destination = "$HOME/etcd-peer.key"
} }
@ -64,21 +64,21 @@ resource "null_resource" "copy-controller-secrets" {
# one-time self-hosted cluster bootstrapping. # one-time self-hosted cluster bootstrapping.
resource "null_resource" "bootkube-start" { resource "null_resource" "bootkube-start" {
depends_on = [ depends_on = [
"module.bootkube", module.bootkube,
"module.workers", module.workers,
"google_dns_record_set.apiserver", google_dns_record_set.apiserver,
"null_resource.copy-controller-secrets", null_resource.copy-controller-secrets,
] ]
connection { connection {
type = "ssh" type = "ssh"
host = "${element(local.controllers_ipv4_public, 0)}" host = element(local.controllers_ipv4_public, 0)
user = "core" user = "core"
timeout = "15m" timeout = "15m"
} }
provisioner "file" { provisioner "file" {
source = "${var.asset_dir}" source = var.asset_dir
destination = "$HOME/assets" destination = "$HOME/assets"
} }
@ -89,3 +89,4 @@ resource "null_resource" "bootkube-start" {
] ]
} }
} }

50
google-cloud/container-linux/kubernetes/variables.tf
View File

@ -1,77 +1,77 @@
variable "cluster_name" { variable "cluster_name" {
type = "string" type = string
description = "Unique cluster name (prepended to dns_zone)" description = "Unique cluster name (prepended to dns_zone)"
} }
# Google Cloud # Google Cloud
variable "region" { variable "region" {
type = "string" type = string
description = "Google Cloud Region (e.g. us-central1, see `gcloud compute regions list`)" description = "Google Cloud Region (e.g. us-central1, see `gcloud compute regions list`)"
} }
variable "dns_zone" { variable "dns_zone" {
type = "string" type = string
description = "Google Cloud DNS Zone (e.g. google-cloud.example.com)" description = "Google Cloud DNS Zone (e.g. google-cloud.example.com)"
} }
variable "dns_zone_name" { variable "dns_zone_name" {
type = "string" type = string
description = "Google Cloud DNS Zone name (e.g. example-zone)" description = "Google Cloud DNS Zone name (e.g. example-zone)"
} }
# instances # instances
variable "controller_count" { variable "controller_count" {
type = "string" type = string
default = "1" default = "1"
description = "Number of controllers (i.e. masters)" description = "Number of controllers (i.e. masters)"
} }
variable "worker_count" { variable "worker_count" {
type = "string" type = string
default = "1" default = "1"
description = "Number of workers" description = "Number of workers"
} }
variable "controller_type" { variable "controller_type" {
type = "string" type = string
default = "n1-standard-1" default = "n1-standard-1"
description = "Machine type for controllers (see `gcloud compute machine-types list`)" description = "Machine type for controllers (see `gcloud compute machine-types list`)"
} }
variable "worker_type" { variable "worker_type" {
type = "string" type = string
default = "n1-standard-1" default = "n1-standard-1"
description = "Machine type for controllers (see `gcloud compute machine-types list`)" description = "Machine type for controllers (see `gcloud compute machine-types list`)"
} }
variable "os_image" { variable "os_image" {
type = "string" type = string
default = "coreos-stable" default = "coreos-stable"
description = "Container Linux image for compute instances (e.g. coreos-stable)" description = "Container Linux image for compute instances (e.g. coreos-stable)"
} }
variable "disk_size" { variable "disk_size" {
type = "string" type = string
default = "40" default = "40"
description = "Size of the disk in GB" description = "Size of the disk in GB"
} }
variable "worker_preemptible" { variable "worker_preemptible" {
type = "string" type = string
default = "false" default = "false"
description = "If enabled, Compute Engine will terminate workers randomly within 24 hours" description = "If enabled, Compute Engine will terminate workers randomly within 24 hours"
} }
variable "controller_clc_snippets" { variable "controller_clc_snippets" {
type = "list" type = list(string)
description = "Controller Container Linux Config snippets" description = "Controller Container Linux Config snippets"
default = [] default = []
} }
variable "worker_clc_snippets" { variable "worker_clc_snippets" {
type = "list" type = list(string)
description = "Worker Container Linux Config snippets" description = "Worker Container Linux Config snippets"
default = [] default = []
} }
@ -79,24 +79,24 @@ variable "worker_clc_snippets" {
# configuration # configuration
variable "ssh_authorized_key" { variable "ssh_authorized_key" {
type = "string" type = string
description = "SSH public key for user 'core'" description = "SSH public key for user 'core'"
} }
variable "asset_dir" { variable "asset_dir" {
description = "Path to a directory where generated assets should be placed (contains secrets)" description = "Path to a directory where generated assets should be placed (contains secrets)"
type = "string" type = string
} }
variable "networking" { variable "networking" {
description = "Choice of networking provider (flannel or calico)" description = "Choice of networking provider (flannel or calico)"
type = "string" type = string
default = "calico" default = "calico"
} }
variable "pod_cidr" { variable "pod_cidr" {
description = "CIDR IPv4 range to assign Kubernetes pods" description = "CIDR IPv4 range to assign Kubernetes pods"
type = "string" type = string
default = "10.2.0.0/16" default = "10.2.0.0/16"
} }
@ -106,24 +106,26 @@ CIDR IPv4 range to assign Kubernetes services.
The 1st IP will be reserved for kube_apiserver, the 10th IP will be reserved for coredns. The 1st IP will be reserved for kube_apiserver, the 10th IP will be reserved for coredns.
EOD EOD
type = "string"
type = string
default = "10.3.0.0/16" default = "10.3.0.0/16"
} }
variable "cluster_domain_suffix" { variable "cluster_domain_suffix" {
description = "Queries for domains with the suffix will be answered by coredns. Default is cluster.local (e.g. foo.default.svc.cluster.local) " description = "Queries for domains with the suffix will be answered by coredns. Default is cluster.local (e.g. foo.default.svc.cluster.local) "
type = "string" type = string
default = "cluster.local" default = "cluster.local"
} }
variable "enable_reporting" { variable "enable_reporting" {
type = "string" type = string
description = "Enable usage or analytics reporting to upstreams (Calico)" description = "Enable usage or analytics reporting to upstreams (Calico)"
default = "false" default = "false"
} }
variable "enable_aggregation" { variable "enable_aggregation" {
description = "Enable the Kubernetes Aggregation Layer (defaults to false)" description = "Enable the Kubernetes Aggregation Layer (defaults to false)"
type = "string" type = string
default = "false" default = "false"
} }

11
google-cloud/container-linux/kubernetes/versions.tf Normal file
View File

@ -0,0 +1,11 @@
# Terraform version and plugin versions
terraform {
required_version = "~> 0.12.0"
required_providers {
google = "~> 2.5"
ct = "~> 0.3.2"
template = "~> 2.1"
null = "~> 2.1"
}
}

29
google-cloud/container-linux/kubernetes/workers.tf
View File

@ -1,21 +1,22 @@
module "workers" { module "workers" {
source = "./workers" source = "./workers"
name = "${var.cluster_name}" name = var.cluster_name
cluster_name = "${var.cluster_name}" cluster_name = var.cluster_name
# GCE # GCE
region = "${var.region}" region = var.region
network = "${google_compute_network.network.name}" network = google_compute_network.network.name
worker_count = "${var.worker_count}" worker_count = var.worker_count
machine_type = "${var.worker_type}" machine_type = var.worker_type
os_image = "${var.os_image}" os_image = var.os_image
disk_size = "${var.disk_size}" disk_size = var.disk_size
preemptible = "${var.worker_preemptible}" preemptible = var.worker_preemptible
# configuration # configuration
kubeconfig = "${module.bootkube.kubeconfig-kubelet}" kubeconfig = module.bootkube.kubeconfig-kubelet
ssh_authorized_key = "${var.ssh_authorized_key}" ssh_authorized_key = var.ssh_authorized_key
service_cidr = "${var.service_cidr}" service_cidr = var.service_cidr
cluster_domain_suffix = "${var.cluster_domain_suffix}" cluster_domain_suffix = var.cluster_domain_suffix
clc_snippets = "${var.worker_clc_snippets}" clc_snippets = var.worker_clc_snippets
} }

5
google-cloud/container-linux/kubernetes/workers/outputs.tf
View File

@ -2,12 +2,13 @@
output "instance_group" { output "instance_group" {
description = "Worker managed instance group full URL" description = "Worker managed instance group full URL"
value = "${google_compute_region_instance_group_manager.workers.instance_group}" value = google_compute_region_instance_group_manager.workers.instance_group
} }
# Outputs for regional load balancing # Outputs for regional load balancing
output "target_pool" { output "target_pool" {
description = "Worker target pool self link" description = "Worker target pool self link"
value = "${google_compute_target_pool.workers.self_link}" value = google_compute_target_pool.workers.self_link
} }

5
google-cloud/container-linux/kubernetes/workers/target_pool.tf
View File

@ -1,11 +1,11 @@
# Target pool for TCP/UDP load balancing # Target pool for TCP/UDP load balancing
resource "google_compute_target_pool" "workers" { resource "google_compute_target_pool" "workers" {
name = "${var.name}-worker-pool" name = "${var.name}-worker-pool"
region = "${var.region}" region = var.region
session_affinity = "NONE" session_affinity = "NONE"
health_checks = [ health_checks = [
"${google_compute_http_health_check.workers.name}", google_compute_http_health_check.workers.name,
] ]
} }
@ -20,3 +20,4 @@ resource "google_compute_http_health_check" "workers" {
port = 10254 port = 10254
request_path = "/healthz" request_path = "/healthz"
} }

42
google-cloud/container-linux/kubernetes/workers/variables.tf
View File

@ -1,53 +1,53 @@
variable "name" { variable "name" {
type = "string" type = string
description = "Unique name for the worker pool" description = "Unique name for the worker pool"
} }
variable "cluster_name" { variable "cluster_name" {
type = "string" type = string
description = "Must be set to `cluster_name of cluster`" description = "Must be set to `cluster_name of cluster`"
} }
# Google Cloud # Google Cloud
variable "region" { variable "region" {
type = "string" type = string
description = "Must be set to `region` of cluster" description = "Must be set to `region` of cluster"
} }
variable "network" { variable "network" {
type = "string" type = string
description = "Must be set to `network_name` output by cluster" description = "Must be set to `network_name` output by cluster"
} }
# instances # instances
variable "worker_count" { variable "worker_count" {
type = "string" type = string
default = "1" default = "1"
description = "Number of worker compute instances the instance group should manage" description = "Number of worker compute instances the instance group should manage"
} }
variable "machine_type" { variable "machine_type" {
type = "string" type = string
default = "n1-standard-1" default = "n1-standard-1"
description = "Machine type for compute instances (e.g. gcloud compute machine-types list)" description = "Machine type for compute instances (e.g. gcloud compute machine-types list)"
} }
variable "os_image" { variable "os_image" {
type = "string" type = string
default = "coreos-stable" default = "coreos-stable"
description = "Container Linux image for compute instanges (e.g. gcloud compute images list)" description = "Container Linux image for compute instanges (e.g. gcloud compute images list)"
} }
variable "disk_size" { variable "disk_size" {
type = "string" type = string
default = "40" default = "40"
description = "Size of the disk in GB" description = "Size of the disk in GB"
} }
variable "preemptible" { variable "preemptible" {
type = "string" type = string
default = "false" default = "false"
description = "If enabled, Compute Engine will terminate instances randomly within 24 hours" description = "If enabled, Compute Engine will terminate instances randomly within 24 hours"
} }
@ -55,12 +55,12 @@ variable "preemptible" {
# configuration # configuration
variable "kubeconfig" { variable "kubeconfig" {
type = "string" type = string
description = "Must be set to `kubeconfig` output by cluster" description = "Must be set to `kubeconfig` output by cluster"
} }
variable "ssh_authorized_key" { variable "ssh_authorized_key" {
type = "string" type = string
description = "SSH public key for user 'core'" description = "SSH public key for user 'core'"
} }
@ -70,32 +70,34 @@ CIDR IPv4 range to assign Kubernetes services.
The 1st IP will be reserved for kube_apiserver, the 10th IP will be reserved for coredns. The 1st IP will be reserved for kube_apiserver, the 10th IP will be reserved for coredns.
EOD EOD
type = "string"
type = string
default = "10.3.0.0/16" default = "10.3.0.0/16"
} }
variable "cluster_domain_suffix" { variable "cluster_domain_suffix" {
description = "Queries for domains with the suffix will be answered by coredns. Default is cluster.local (e.g. foo.default.svc.cluster.local) " description = "Queries for domains with the suffix will be answered by coredns. Default is cluster.local (e.g. foo.default.svc.cluster.local) "
type = "string" type = string
default = "cluster.local" default = "cluster.local"
} }
variable "clc_snippets" { variable "clc_snippets" {
type = "list" type = list(string)
description = "Container Linux Config snippets" description = "Container Linux Config snippets"
default = [] default = []
} }
# unofficial, undocumented, unsupported, temporary # unofficial, undocumented, unsupported, temporary
variable "accelerator_type" { variable "accelerator_type" {
type = "string" type = string
default = "" default = ""
description = "Google Compute Engine accelerator type (e.g. nvidia-tesla-k80, see gcloud compute accelerator-types list)" description = "Google Compute Engine accelerator type (e.g. nvidia-tesla-k80, see gcloud compute accelerator-types list)"
} }
variable "accelerator_count" { variable "accelerator_count" {
type = "string" type = string
default = "0" default = "0"
description = "Number of compute engine accelerators" description = "Number of compute engine accelerators"
} }

4
google-cloud/container-linux/kubernetes/workers/versions.tf Normal file
View File

@ -0,0 +1,4 @@
terraform {
required_version = ">= 0.12"
}

44
google-cloud/container-linux/kubernetes/workers/workers.tf
View File

@ -5,11 +5,11 @@ resource "google_compute_region_instance_group_manager" "workers" {
# instance name prefix for instances in the group # instance name prefix for instances in the group
base_instance_name = "${var.name}-worker" base_instance_name = "${var.name}-worker"
instance_template = "${google_compute_instance_template.worker.self_link}" instance_template = google_compute_instance_template.worker.self_link
region = "${var.region}" region = var.region
target_size = "${var.worker_count}" target_size = var.worker_count
target_pools = ["${google_compute_target_pool.workers.self_link}"] target_pools = [google_compute_target_pool.workers.self_link]
named_port { named_port {
name = "http" name = "http"
@ -26,37 +26,38 @@ resource "google_compute_region_instance_group_manager" "workers" {
resource "google_compute_instance_template" "worker" { resource "google_compute_instance_template" "worker" {
name_prefix = "${var.name}-worker-" name_prefix = "${var.name}-worker-"
description = "Worker Instance template" description = "Worker Instance template"
machine_type = "${var.machine_type}" machine_type = var.machine_type
metadata = { metadata = {
user-data = "${data.ct_config.worker-ignition.rendered}" user-data = data.ct_config.worker-ignition.rendered
} }
scheduling { scheduling {
automatic_restart = "${var.preemptible ? false : true}" automatic_restart = var.preemptible ? false : true
preemptible = "${var.preemptible}" preemptible = var.preemptible
} }
disk { disk {
auto_delete = true auto_delete = true
boot = true boot = true
source_image = "${var.os_image}" source_image = var.os_image
disk_size_gb = "${var.disk_size}" disk_size_gb = var.disk_size
} }
network_interface { network_interface {
network = "${var.network}" network = var.network
# Ephemeral external IP # Ephemeral external IP
access_config = {} access_config {
}
} }
can_ip_forward = true can_ip_forward = true
tags = ["worker", "${var.cluster_name}-worker", "${var.name}-worker"] tags = ["worker", "${var.cluster_name}-worker", "${var.name}-worker"]
guest_accelerator { guest_accelerator {
count = "${var.accelerator_count}" count = var.accelerator_count
type = "${var.accelerator_type}" type = var.accelerator_type
} }
lifecycle { lifecycle {
@ -67,19 +68,20 @@ resource "google_compute_instance_template" "worker" {
# Worker Ignition config # Worker Ignition config
data "ct_config" "worker-ignition" { data "ct_config" "worker-ignition" {
content = "${data.template_file.worker-config.rendered}" content = data.template_file.worker-config.rendered
pretty_print = false pretty_print = false
snippets = ["${var.clc_snippets}"] snippets = var.clc_snippets
} }
# Worker Container Linux config # Worker Container Linux config
data "template_file" "worker-config" { data "template_file" "worker-config" {
template = "${file("${path.module}/cl/worker.yaml.tmpl")}" template = file("${path.module}/cl/worker.yaml.tmpl")
vars = { vars = {
kubeconfig = "${indent(10, var.kubeconfig)}" kubeconfig = indent(10, var.kubeconfig)
ssh_authorized_key = "${var.ssh_authorized_key}" ssh_authorized_key = var.ssh_authorized_key
cluster_dns_service_ip = "${cidrhost(var.service_cidr, 10)}" cluster_dns_service_ip = cidrhost(var.service_cidr, 10)
cluster_domain_suffix = "${var.cluster_domain_suffix}" cluster_domain_suffix = var.cluster_domain_suffix
} }
} }