CadolesKube/typhoon
7
0
Fork 0
mirror of https://github.com/puppetmaster/typhoon.git synced 2024-12-24 04:19:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

digital-ocean: Add cluster firewall rules

Browse Source 
* Requires Terraform v0.10.0+
This commit is contained in:
Dalton Hubble 2017-08-12 17:03:01 -07:00
parent cafc58c610
commit f04411377f
3 changed files with 55 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
digital-ocean/container-linux/kubernetes/controllers.tf
View File

@ -33,7 +33,7 @@ resource "digitalocean_droplet" "controllers" {
]
}
// Tag to label controllers
# Tag to label controllers
resource "digitalocean_tag" "controllers" {
name = "${var.cluster_name}-controller"
}

53
digital-ocean/container-linux/kubernetes/network.tf Normal file
View File

@ -0,0 +1,53 @@
resource "digitalocean_firewall" "rules" {
name = "${var.cluster_name}"
tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
# allow ssh, http/https ingress, and peer-to-peer traffic
inbound_rule = [
{
protocol = "tcp"
port_range = "22"
source_addresses = ["0.0.0.0/0", "::/0"]
},
{
protocol = "tcp"
port_range = "80"
source_addresses = ["0.0.0.0/0", "::/0"]
},
{
protocol = "tcp"
port_range = "443"
source_addresses = ["0.0.0.0/0", "::/0"]
},
{
protocol = "udp"
port_range = "all"
source_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
},
{
protocol = "tcp"
port_range = "all"
source_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
},
]
# allow all outbound traffic
outbound_rule = [
{
protocol = "icmp"
destination_addresses = ["0.0.0.0/0", "::/0"]
},
{
protocol = "udp"
port_range = "all"
destination_addresses = ["0.0.0.0/0", "::/0"]
},
{
protocol = "tcp"
port_range = "all"
destination_addresses = ["0.0.0.0/0", "::/0"]
},
]
}

2
digital-ocean/container-linux/kubernetes/workers.tf
View File

@ -33,7 +33,7 @@ resource "digitalocean_droplet" "workers" {
]
}
// Tag to label workers
# Tag to label workers
resource "digitalocean_tag" "workers" {
name = "${var.cluster_name}-worker"
}