mirror of
https://github.com/puppetmaster/typhoon.git
synced 2024-12-26 19:59:34 +01:00
48d4973957
* Define a dual-stack virtual network with both IPv4 and IPv6 private address space. Change `host_cidr` variable (string) to a `network_cidr` variable (object) with "ipv4" and "ipv6" fields that list CIDR strings. * Define dual-stack controller and worker subnets. Disable Azure default outbound access (a deprecated fallback mechanism) * Enable dual-stack load balancing to Kubernetes Ingress by adding a public IPv6 frontend IP and LB rule to the load balancer. * Enable worker outbound IPv6 connectivity through load balancer SNAT by adding an IPv6 frontend IP and outbound rule * Configure controller nodes with a public IPv6 address to provide direct outbound IPv6 connectivity * Add an IPv6 worker backend pool. Azure requires separate IPv4 and IPv6 backend pools, though the health probe can be shared * Extend network security group rules for IPv6 source/destinations Checklist: Access to controller and worker nodes via IPv6 addresses: * SSH access to controller nodes via public IPv6 address * SSH access to worker nodes via (private) IPv6 address (via controller) Outbound IPv6 connectivity from controller and worker nodes: ``` nc -6 -zv ipv6.google.com 80 Ncat: Version 7.94 ( https://nmap.org/ncat ) Ncat: Connected to [2607:f8b0:4001:c16::66]:80. Ncat: 0 bytes sent, 0 bytes received in 0.02 seconds. ``` Serve Ingress traffic via IPv4 or IPv6 just requires setting up A and AAAA records and running the ingress controller with `hostNetwork: true` since, hostPort only forwards IPv4 traffic
187 lines
4.8 KiB
HCL
187 lines
4.8 KiB
HCL
variable "cluster_name" {
|
|
type = string
|
|
description = "Unique cluster name (prepended to dns_zone)"
|
|
}
|
|
|
|
# Azure
|
|
|
|
variable "region" {
|
|
type = string
|
|
description = "Azure Region (e.g. centralus , see `az account list-locations --output table`)"
|
|
}
|
|
|
|
variable "dns_zone" {
|
|
type = string
|
|
description = "Azure DNS Zone (e.g. azure.example.com)"
|
|
}
|
|
|
|
variable "dns_zone_group" {
|
|
type = string
|
|
description = "Resource group where the Azure DNS Zone resides (e.g. global)"
|
|
}
|
|
|
|
# instances
|
|
|
|
variable "controller_count" {
|
|
type = number
|
|
description = "Number of controllers (i.e. masters)"
|
|
default = 1
|
|
}
|
|
|
|
variable "worker_count" {
|
|
type = number
|
|
description = "Number of workers"
|
|
default = 1
|
|
}
|
|
|
|
variable "controller_type" {
|
|
type = string
|
|
description = "Machine type for controllers (see `az vm list-skus --location centralus`)"
|
|
default = "Standard_B2s"
|
|
}
|
|
|
|
variable "worker_type" {
|
|
type = string
|
|
description = "Machine type for workers (see `az vm list-skus --location centralus`)"
|
|
default = "Standard_D2as_v5"
|
|
}
|
|
|
|
variable "os_image" {
|
|
type = string
|
|
description = "Channel for a Container Linux derivative (flatcar-stable, flatcar-beta, flatcar-alpha)"
|
|
default = "flatcar-stable"
|
|
|
|
validation {
|
|
condition = contains(["flatcar-stable", "flatcar-beta", "flatcar-alpha"], var.os_image)
|
|
error_message = "The os_image must be flatcar-stable, flatcar-beta, or flatcar-alpha."
|
|
}
|
|
}
|
|
|
|
variable "disk_size" {
|
|
type = number
|
|
description = "Size of the disk in GB"
|
|
default = 30
|
|
}
|
|
|
|
variable "worker_priority" {
|
|
type = string
|
|
description = "Set worker priority to Spot to use reduced cost surplus capacity, with the tradeoff that instances can be deallocated at any time."
|
|
default = "Regular"
|
|
}
|
|
|
|
variable "controller_snippets" {
|
|
type = list(string)
|
|
description = "Controller Container Linux Config snippets"
|
|
default = []
|
|
}
|
|
|
|
variable "worker_snippets" {
|
|
type = list(string)
|
|
description = "Worker Container Linux Config snippets"
|
|
default = []
|
|
}
|
|
|
|
# configuration
|
|
|
|
variable "ssh_authorized_key" {
|
|
type = string
|
|
description = "SSH public key for user 'core'"
|
|
}
|
|
|
|
variable "azure_authorized_key" {
|
|
type = string
|
|
description = "Optionally, pass a dummy RSA key to satisfy Azure validations (then use an ed25519 key set above)"
|
|
default = ""
|
|
}
|
|
|
|
variable "networking" {
|
|
type = string
|
|
description = "Choice of networking provider (flannel, calico, or cilium)"
|
|
default = "cilium"
|
|
}
|
|
|
|
variable "network_cidr" {
|
|
type = object({
|
|
ipv4 = list(string)
|
|
ipv6 = optional(list(string), ["fd9a:0d2f:b7dc::/48"])
|
|
})
|
|
description = "Virtual network CIDR ranges"
|
|
default = {
|
|
ipv4 = ["10.0.0.0/16"]
|
|
}
|
|
}
|
|
|
|
variable "pod_cidr" {
|
|
type = string
|
|
description = "CIDR IPv4 range to assign Kubernetes pods"
|
|
default = "10.2.0.0/16"
|
|
}
|
|
|
|
variable "service_cidr" {
|
|
type = string
|
|
description = <<EOD
|
|
CIDR IPv4 range to assign Kubernetes services.
|
|
The 1st IP will be reserved for kube_apiserver, the 10th IP will be reserved for coredns.
|
|
EOD
|
|
default = "10.3.0.0/16"
|
|
}
|
|
|
|
variable "enable_reporting" {
|
|
type = bool
|
|
description = "Enable usage or analytics reporting to upstreams (Calico)"
|
|
default = false
|
|
}
|
|
|
|
variable "enable_aggregation" {
|
|
type = bool
|
|
description = "Enable the Kubernetes Aggregation Layer"
|
|
default = true
|
|
}
|
|
|
|
variable "worker_node_labels" {
|
|
type = list(string)
|
|
description = "List of initial worker node labels"
|
|
default = []
|
|
}
|
|
|
|
variable "arch" {
|
|
type = string
|
|
description = "Container architecture (amd64 or arm64)"
|
|
default = "amd64"
|
|
|
|
validation {
|
|
condition = var.arch == "amd64" || var.arch == "arm64"
|
|
error_message = "The arch must be amd64 or arm64."
|
|
}
|
|
}
|
|
|
|
variable "daemonset_tolerations" {
|
|
type = list(string)
|
|
description = "List of additional taint keys kube-system DaemonSets should tolerate (e.g. ['custom-role', 'gpu-role'])"
|
|
default = []
|
|
}
|
|
|
|
# unofficial, undocumented, unsupported
|
|
|
|
variable "cluster_domain_suffix" {
|
|
type = string
|
|
description = "Queries for domains with the suffix will be answered by coredns. Default is cluster.local (e.g. foo.default.svc.cluster.local) "
|
|
default = "cluster.local"
|
|
}
|
|
|
|
variable "components" {
|
|
description = "Configure pre-installed cluster components"
|
|
# Component configs are passed through to terraform-render-bootstrap,
|
|
# which handles type enforcement and defines defaults
|
|
# https://github.com/poseidon/terraform-render-bootstrap/blob/main/variables.tf#L95
|
|
type = object({
|
|
enable = optional(bool)
|
|
coredns = optional(map(any))
|
|
kube_proxy = optional(map(any))
|
|
flannel = optional(map(any))
|
|
calico = optional(map(any))
|
|
cilium = optional(map(any))
|
|
})
|
|
default = null
|
|
}
|