typhoon/aws/fedora-coreos/kubernetes
Dalton Hubble 2837275265 Introduce cluster creation without local writes to asset_dir
* Allow generated assets (TLS materials, manifests) to be
securely distributed to controller node(s) via file provisioner
(i.e. ssh-agent) as an assets bundle file, rather than relying
on assets being locally rendered to disk in an asset_dir and
then securely distributed
* Change `asset_dir` from required to optional. Left unset,
asset_dir defaults to "" and no assets will be written to
files on the machine that runs terraform apply
* Enhancement: Managed cluster assets are kept only in Terraform
state, which supports different backends (GCS, S3, etcd, etc) and
optional encryption. terraform apply accesses state, runs in-memory,
and distributes sensitive materials to controllers without making
use of local disk (simplifies use in CI systems)
* Enhancement: Improve asset unpack and layout process to position
etcd certificates and control plane certificates more cleanly,
without unneeded secret materials

Details:

* Terraform file provisioner support for distributing directories of
contents (with unknown structure) has been limited to reading from a
local directory, meaning local writes to asset_dir were required.
https://github.com/poseidon/typhoon/issues/585 discusses the problem
and newer or upcoming Terraform features that might help.
* Observation: Terraform provisioner support for single files works
well, but iteration isn't viable. We're also constrained to Terraform
language features on the apply side (no extra plugins, no shelling out)
and CoreOS / Fedora tools on the receive side.
* Take a map representation of the contents that would have been splayed
out in asset_dir and pack/encode them into a single file format devised
for easy unpacking. Use an awk one-liner on the receive side to unpack.
In pratice, this has worked well and its rather nice that a single
assets file is transferred by file provisioner (all or none)

Rel: https://github.com/poseidon/terraform-render-bootstrap/pull/162
2019-12-05 01:24:50 -08:00
..
fcc Introduce cluster creation without local writes to asset_dir 2019-12-05 01:24:50 -08:00
workers Fix terraform fmt formatting 2019-11-13 23:44:02 -08:00
ami.tf Detect most recent Fedora CoreOS AMI in region 2019-10-06 18:13:55 -07:00
bootstrap.tf Introduce cluster creation without local writes to asset_dir 2019-12-05 01:24:50 -08:00
controllers.tf Rename bootkube modules to bootstrap 2019-09-14 16:24:32 -07:00
LICENSE Port Typhoon Fedora CoreOS support to AWS 2019-07-18 00:55:22 -07:00
network.tf Port Typhoon Fedora CoreOS support to AWS 2019-07-18 00:55:22 -07:00
nlb.tf Port Typhoon Fedora CoreOS support to AWS 2019-07-18 00:55:22 -07:00
outputs.tf Rename bootkube modules to bootstrap 2019-09-14 16:24:32 -07:00
README.md Update Kubernetes from v1.16.2 to v1.16.3 2019-11-13 13:05:15 -08:00
security.tf Migrate Fedora CoreOS AWS to a static pod control plane 2019-09-09 22:37:31 -07:00
ssh.tf Introduce cluster creation without local writes to asset_dir 2019-12-05 01:24:50 -08:00
variables.tf Fix terraform fmt formatting 2019-11-13 23:44:02 -08:00
versions.tf Adopt Terraform v0.12 templatefile function 2019-11-13 16:33:36 -08:00
workers.tf Add node_labels variable in workers modules to set initial node labels (#550) 2019-09-28 14:59:24 -07:00

Typhoon

Typhoon is a minimal and free Kubernetes distribution.

  • Minimal, stable base Kubernetes distribution
  • Declarative infrastructure and configuration
  • Free (freedom and cost) and privacy-respecting
  • Practical for labs, datacenters, and clouds

Typhoon distributes upstream Kubernetes, architectural conventions, and cluster addons, much like a GNU/Linux distribution provides the Linux kernel and userspace components.

Features

Docs

Please see the official docs and the AWS tutorial.