digital-ocean: Add cluster firewall rules

* Requires Terraform v0.10.0+

digital-ocean/container-linux/kubernetes/controllers.tf

@@ -33,7 +33,7 @@ resource "digitalocean_droplet" "controllers" {
   ]
 }
 
-// Tag to label controllers
+# Tag to label controllers
 resource "digitalocean_tag" "controllers" {
   name = "${var.cluster_name}-controller"
 }

digital-ocean/container-linux/kubernetes/network.tf

@@ -0,0 +1,53 @@
+resource "digitalocean_firewall" "rules" {
+  name = "${var.cluster_name}"
+
+  tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
+
+  # allow ssh, http/https ingress, and peer-to-peer traffic
+  inbound_rule = [
+    {
+      protocol = "tcp"
+      port_range = "22"
+      source_addresses = ["0.0.0.0/0", "::/0"]
+    },
+    {
+      protocol = "tcp"
+      port_range = "80"
+      source_addresses = ["0.0.0.0/0", "::/0"]
+    },
+    {
+      protocol = "tcp"
+      port_range = "443"
+      source_addresses = ["0.0.0.0/0", "::/0"]
+    },
+    {
+      protocol = "udp"
+      port_range = "all"
+      source_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
+    },
+    {
+      protocol = "tcp"
+      port_range = "all"
+      source_tags = ["${var.cluster_name}-controller", "${var.cluster_name}-worker"]
+    },
+  ]
+
+  # allow all outbound traffic
+  outbound_rule = [
+    {
+      protocol = "icmp"
+      destination_addresses = ["0.0.0.0/0", "::/0"]
+    },
+    {
+      protocol = "udp"
+      port_range = "all"
+      destination_addresses = ["0.0.0.0/0", "::/0"]
+    },
+    {
+      protocol = "tcp"
+      port_range = "all"
+      destination_addresses = ["0.0.0.0/0", "::/0"]
+    },
+  ]
+}
+

digital-ocean/container-linux/kubernetes/workers.tf

@@ -33,7 +33,7 @@ resource "digitalocean_droplet" "workers" {
   ]
 }
 
-// Tag to label workers
+# Tag to label workers
 resource "digitalocean_tag" "workers" {
   name = "${var.cluster_name}-worker"
 }