C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

add master_allowed_remote_ips (with terraform fmt) (#4022)

Browse source
This commit is contained in:
rptaylor 2019-04-21 01:57:44 -07:00 committed by Kubernetes Prow Robot
parent 12086744e0
commit 873b5608cf
5 changed files with 14 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
contrib/terraform/openstack/README.md
View file

@ -243,6 +243,7 @@ For your cluster, edit `inventory/$CLUSTER/cluster.tf`.
|`supplementary_master_groups` | To add ansible groups to the masters, such as `kube-node` for tainting them as nodes, empty by default. | |`supplementary_master_groups` | To add ansible groups to the masters, such as `kube-node` for tainting them as nodes, empty by default. |
|`supplementary_node_groups` | To add ansible groups to the nodes, such as `kube-ingress` for running ingress controller pods, empty by default. | |`supplementary_node_groups` | To add ansible groups to the nodes, such as `kube-ingress` for running ingress controller pods, empty by default. |
|`bastion_allowed_remote_ips` | List of CIDR allowed to initiate a SSH connection, `["0.0.0.0/0"]` by default | |`bastion_allowed_remote_ips` | List of CIDR allowed to initiate a SSH connection, `["0.0.0.0/0"]` by default |
|`master_allowed_remote_ips` | List of CIDR blocks allowed to initiate an API connection, `["0.0.0.0/0"]` by default |
|`k8s_allowed_remote_ips` | List of CIDR allowed to initiate a SSH connection, empty by default | |`k8s_allowed_remote_ips` | List of CIDR allowed to initiate a SSH connection, empty by default |
|`worker_allowed_ports` | List of ports to open on worker nodes, `[{ "protocol" = "tcp", "port_range_min" = 30000, "port_range_max" = 32767, "remote_ip_prefix" = "0.0.0.0/0"}]` by default | |`worker_allowed_ports` | List of ports to open on worker nodes, `[{ "protocol" = "tcp", "port_range_min" = 30000, "port_range_max" = 32767, "remote_ip_prefix" = "0.0.0.0/0"}]` by default |

1
contrib/terraform/openstack/kubespray.tf
View file

@ -52,6 +52,7 @@ module "compute" {
k8s_node_fips = "${module.ips.k8s_node_fips}" k8s_node_fips = "${module.ips.k8s_node_fips}"
bastion_fips = "${module.ips.bastion_fips}" bastion_fips = "${module.ips.bastion_fips}"
bastion_allowed_remote_ips = "${var.bastion_allowed_remote_ips}" bastion_allowed_remote_ips = "${var.bastion_allowed_remote_ips}"
master_allowed_remote_ips = "${var.master_allowed_remote_ips}"
k8s_allowed_remote_ips = "${var.k8s_allowed_remote_ips}" k8s_allowed_remote_ips = "${var.k8s_allowed_remote_ips}"
k8s_allowed_egress_ips = "${var.k8s_allowed_egress_ips}" k8s_allowed_egress_ips = "${var.k8s_allowed_egress_ips}"
supplementary_master_groups = "${var.supplementary_master_groups}" supplementary_master_groups = "${var.supplementary_master_groups}"

3
contrib/terraform/openstack/modules/compute/main.tf
View file

@ -10,12 +10,13 @@ resource "openstack_networking_secgroup_v2" "k8s_master" {
} }
resource "openstack_networking_secgroup_rule_v2" "k8s_master" { resource "openstack_networking_secgroup_rule_v2" "k8s_master" {
count = "${length(var.master_allowed_remote_ips)}"
direction = "ingress" direction = "ingress"
ethertype = "IPv4" ethertype = "IPv4"
protocol = "tcp" protocol = "tcp"
port_range_min = "6443" port_range_min = "6443"
port_range_max = "6443" port_range_max = "6443"
remote_ip_prefix = "0.0.0.0/0" remote_ip_prefix = "${var.master_allowed_remote_ips[count.index]}"
security_group_id = "${openstack_networking_secgroup_v2.k8s_master.id}" security_group_id = "${openstack_networking_secgroup_v2.k8s_master.id}"
} }

4
contrib/terraform/openstack/modules/compute/variables.tf
View file

@ -66,6 +66,10 @@ variable "bastion_allowed_remote_ips" {
type = "list" type = "list"
} }
variable "master_allowed_remote_ips" {
type = "list"
}
variable "k8s_allowed_remote_ips" { variable "k8s_allowed_remote_ips" {
type = "list" type = "list"
} }

6
contrib/terraform/openstack/variables.tf
View file

@ -145,6 +145,12 @@ variable "bastion_allowed_remote_ips" {
default = ["0.0.0.0/0"] default = ["0.0.0.0/0"]
} }
variable "master_allowed_remote_ips" {
description = "An array of CIDRs allowed to access API of masters"
type = "list"
default = ["0.0.0.0/0"]
}
variable "k8s_allowed_remote_ips" { variable "k8s_allowed_remote_ips" {
description = "An array of CIDRs allowed to SSH to hosts" description = "An array of CIDRs allowed to SSH to hosts"
type = "list" type = "list"