mirror of
https://github.com/puppetmaster/typhoon.git
synced 2024-12-28 12:29:33 +01:00
6db11d5908
* terraform-provider-aws v2.23.0 allows AWS root block devices to enable encryption by default. * Require updating terraform-provider-aws to v2.23.0 or higher * Enable root EBS device encryption by default for controller instances and worker instances in auto-scaling groups For comparison: * Google Cloud persistent disks have been encrypted by default for years * Azure managed disk encryption is not ready yet (#486)
92 lines
2.5 KiB
HCL
92 lines
2.5 KiB
HCL
# Workers AutoScaling Group
|
|
resource "aws_autoscaling_group" "workers" {
|
|
name = "${var.name}-worker ${aws_launch_configuration.worker.name}"
|
|
|
|
# count
|
|
desired_capacity = var.worker_count
|
|
min_size = var.worker_count
|
|
max_size = var.worker_count + 2
|
|
default_cooldown = 30
|
|
health_check_grace_period = 30
|
|
|
|
# network
|
|
vpc_zone_identifier = var.subnet_ids
|
|
|
|
# template
|
|
launch_configuration = aws_launch_configuration.worker.name
|
|
|
|
# target groups to which instances should be added
|
|
target_group_arns = flatten([
|
|
aws_lb_target_group.workers-http.id,
|
|
aws_lb_target_group.workers-https.id,
|
|
var.target_groups,
|
|
])
|
|
|
|
lifecycle {
|
|
# override the default destroy and replace update behavior
|
|
create_before_destroy = true
|
|
}
|
|
|
|
# Waiting for instance creation delays adding the ASG to state. If instances
|
|
# can't be created (e.g. spot price too low), the ASG will be orphaned.
|
|
# Orphaned ASGs escape cleanup, can't be updated, and keep bidding if spot is
|
|
# used. Disable wait to avoid issues and align with other clouds.
|
|
wait_for_capacity_timeout = "0"
|
|
|
|
tags = [
|
|
{
|
|
key = "Name"
|
|
value = "${var.name}-worker"
|
|
propagate_at_launch = true
|
|
},
|
|
]
|
|
}
|
|
|
|
# Worker template
|
|
resource "aws_launch_configuration" "worker" {
|
|
image_id = local.ami_id
|
|
instance_type = var.instance_type
|
|
spot_price = var.spot_price
|
|
enable_monitoring = false
|
|
|
|
user_data = data.ct_config.worker-ignition.rendered
|
|
|
|
# storage
|
|
root_block_device {
|
|
volume_type = var.disk_type
|
|
volume_size = var.disk_size
|
|
iops = var.disk_iops
|
|
encrypted = true
|
|
}
|
|
|
|
# network
|
|
security_groups = var.security_groups
|
|
|
|
lifecycle {
|
|
// Override the default destroy and replace update behavior
|
|
create_before_destroy = true
|
|
ignore_changes = [image_id]
|
|
}
|
|
}
|
|
|
|
# Worker Ignition config
|
|
data "ct_config" "worker-ignition" {
|
|
content = data.template_file.worker-config.rendered
|
|
pretty_print = false
|
|
snippets = var.clc_snippets
|
|
}
|
|
|
|
# Worker Container Linux config
|
|
data "template_file" "worker-config" {
|
|
template = file("${path.module}/cl/worker.yaml.tmpl")
|
|
|
|
vars = {
|
|
kubeconfig = indent(10, var.kubeconfig)
|
|
ssh_authorized_key = var.ssh_authorized_key
|
|
cluster_dns_service_ip = cidrhost(var.service_cidr, 10)
|
|
cluster_domain_suffix = var.cluster_domain_suffix
|
|
cgroup_driver = local.flavor == "flatcar" && local.channel == "edge" ? "systemd" : "cgroupfs"
|
|
}
|
|
}
|
|
|