mirror of
https://github.com/puppetmaster/typhoon.git
synced 2024-12-26 07:29:32 +01:00
147c21a4bd
* Introduce "calico" as a `networking` option on Azure and DigitalOcean using Calico's new VXLAN support (similar to flannel). Flannel remains the default on these platforms for now. * Historically, DigitalOcean and Azure only allowed Flannel as the CNI provider, since those platforms don't support IPIP traffic that was previously required for Calico. * Looking forward, its desireable for Calico to become the default across Typhoon clusters, since it provides NetworkPolicy and a consistent experience * No changes to AWS, GCP, or bare-metal where Calico remains the default CNI provider. On these platforms, IPIP mode will always be used, since its available and more performant than vxlan
122 lines
3.3 KiB
HCL
122 lines
3.3 KiB
HCL
# Secure copy etcd TLS assets and kubeconfig to controllers. Activates kubelet.service
|
|
resource "null_resource" "copy-controller-secrets" {
|
|
count = "${var.controller_count}"
|
|
|
|
depends_on = [
|
|
"digitalocean_firewall.rules",
|
|
]
|
|
|
|
connection {
|
|
type = "ssh"
|
|
host = "${element(concat(digitalocean_droplet.controllers.*.ipv4_address), count.index)}"
|
|
user = "fedora"
|
|
timeout = "15m"
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = "${module.bootkube.kubeconfig-kubelet}"
|
|
destination = "$HOME/kubeconfig"
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = "${module.bootkube.etcd_ca_cert}"
|
|
destination = "$HOME/etcd-client-ca.crt"
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = "${module.bootkube.etcd_client_cert}"
|
|
destination = "$HOME/etcd-client.crt"
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = "${module.bootkube.etcd_client_key}"
|
|
destination = "$HOME/etcd-client.key"
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = "${module.bootkube.etcd_server_cert}"
|
|
destination = "$HOME/etcd-server.crt"
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = "${module.bootkube.etcd_server_key}"
|
|
destination = "$HOME/etcd-server.key"
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = "${module.bootkube.etcd_peer_cert}"
|
|
destination = "$HOME/etcd-peer.crt"
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = "${module.bootkube.etcd_peer_key}"
|
|
destination = "$HOME/etcd-peer.key"
|
|
}
|
|
|
|
provisioner "remote-exec" {
|
|
inline = [
|
|
"sudo mkdir -p /etc/ssl/etcd/etcd",
|
|
"sudo mv etcd-client* /etc/ssl/etcd/",
|
|
"sudo cp /etc/ssl/etcd/etcd-client-ca.crt /etc/ssl/etcd/etcd/server-ca.crt",
|
|
"sudo mv etcd-server.crt /etc/ssl/etcd/etcd/server.crt",
|
|
"sudo mv etcd-server.key /etc/ssl/etcd/etcd/server.key",
|
|
"sudo cp /etc/ssl/etcd/etcd-client-ca.crt /etc/ssl/etcd/etcd/peer-ca.crt",
|
|
"sudo mv etcd-peer.crt /etc/ssl/etcd/etcd/peer.crt",
|
|
"sudo mv etcd-peer.key /etc/ssl/etcd/etcd/peer.key",
|
|
"sudo mv $HOME/kubeconfig /etc/kubernetes/kubeconfig",
|
|
]
|
|
}
|
|
}
|
|
|
|
# Secure copy kubeconfig to all workers. Activates kubelet.service.
|
|
resource "null_resource" "copy-worker-secrets" {
|
|
count = "${var.worker_count}"
|
|
|
|
connection {
|
|
type = "ssh"
|
|
host = "${element(concat(digitalocean_droplet.workers.*.ipv4_address), count.index)}"
|
|
user = "fedora"
|
|
timeout = "15m"
|
|
}
|
|
|
|
provisioner "file" {
|
|
content = "${module.bootkube.kubeconfig-kubelet}"
|
|
destination = "$HOME/kubeconfig"
|
|
}
|
|
|
|
provisioner "remote-exec" {
|
|
inline = [
|
|
"sudo mv $HOME/kubeconfig /etc/kubernetes/kubeconfig",
|
|
]
|
|
}
|
|
}
|
|
|
|
# Secure copy bootkube assets to ONE controller and start bootkube to perform
|
|
# one-time self-hosted cluster bootstrapping.
|
|
resource "null_resource" "bootkube-start" {
|
|
depends_on = [
|
|
"null_resource.copy-controller-secrets",
|
|
"null_resource.copy-worker-secrets",
|
|
]
|
|
|
|
connection {
|
|
type = "ssh"
|
|
host = "${digitalocean_droplet.controllers.0.ipv4_address}"
|
|
user = "fedora"
|
|
timeout = "15m"
|
|
}
|
|
|
|
provisioner "file" {
|
|
source = "${var.asset_dir}"
|
|
destination = "$HOME/assets"
|
|
}
|
|
|
|
provisioner "remote-exec" {
|
|
inline = [
|
|
"while [ ! -f /var/lib/cloud/instance/boot-finished ]; do sleep 4; done",
|
|
"sudo mv $HOME/assets /var/lib/bootkube",
|
|
"sudo systemctl start bootkube",
|
|
]
|
|
}
|
|
}
|