Commit graph

49 commits

Author SHA1 Message Date
Hugo Blom
49196c2ec4
[Openstack] Add bastion_allowed_ports to allow custom security group rules on bastion node (#9336)
* make it possible to configure bastion remote ips

* Update README.md
2022-09-27 22:03:35 -07:00
rptaylor
5bce39abf8
add optional parameter extra_groups for k8s_nodes (#9211) 2022-09-13 00:13:08 -07:00
Cyclinder
dc8ad78206
fix: incorrect condition type (#8822)
Signed-off-by: cyclinder qifeng.guo@daocloud.io
2022-05-13 14:09:56 -07:00
Robin Wallace
fe66121287
[Openstack] master foreach and fixes (#8709)
* [openstack] fix for new network modules

* [openstack] for-each master nodes
2022-05-03 08:51:56 -07:00
Christian Rohmann
90883e76af
terrform/openstack: Fix templating of ansible_ssh_common_args in no_floating.yml if used as TF module (#8646)
* terraform/openstack: Use path.module for ansible_bastion_template.txt

This extends on #7643 by not using path.root, but switching to path.module
to allow use of the terraform code as a module itself. This change then keeps
all calls to the template file stable even for that use-case.

* terraform/openstack: Make sed calls fail on errors

By using a single call with two replacements to use of sed will create proper exit codes
and allowing for errors to be recognized by terraform.
2022-03-29 00:07:11 -07:00
Cristian Calin
7759494c85
[terraform][openstack] allow disabling port_security at port level (#8455)
Use openstack_networking_port_v2 and openstack_networking_floatingip_associate_v2
to attach floating ips. This gives us more flexibility on disabling port security
when binding instances directly on provider networks in private cloud scenario.
2022-02-02 08:50:22 -08:00
Cristian Calin
ea44d64511
[contrib] terraform openstack: allow disabling port security (#8410) 2022-01-14 12:58:32 -08:00
moss2k13
135c9b29a7
contrib: add cloud-init support for terraform vms (#8394)
* contrib: add cloud-init support for terraform vms

This change enables instance customization via cloud-init,
for example: additional CA certs, custom SSH access etc.

* contrib: update docs for terraform cloud-init

* contrib: disable yamllint in cloud-init

require-starting-space rule breaks cloud-init header

* contrib: documenation formatting

* yamllint: disable comments related checks

* docs: markdown formatting
2022-01-11 05:23:16 -08:00
Robin Wallace
38c12288f1
Add option for boot volume type for k8s node (#8256) 2021-11-30 12:59:01 -08:00
Olle Larsson
fe0810aff9
Add option to set different server group policy for etcd, node, and master server (#8046) 2021-11-22 02:53:09 -08:00
Simon Kollberg
d7039ef707
Openstack cwd (#7643)
* terraform/openstack: Use path.root for ansible_bastion_template.txt

The path.root variable points to the root module path. Using this
instead of a relative path makes less assumptions about the current
working directory.

* terraform/openstack: Add group_vars_path variable

Previously, the group_vars path was assumed to be in CWD. The
default value for the group_vars_path variable is still relative
to CWD and thus should be backwards compatible if unset.
2021-06-25 00:26:45 -07:00
Cristian Calin
360aff4a57
Rename ansible groups to use _ instead of - (#7552)
* rename ansible groups to use _ instead of -

k8s-cluster -> k8s_cluster
k8s-node -> k8s_node
calico-rr -> calico_rr
no-floating -> no_floating

Note: kube-node,k8s-cluster groups in upgrade CI
      need clean-up after v2.16 is tagged

* ensure old groups are mapped to the new ones
2021-04-29 05:20:50 -07:00
Etienne Champetier
f0cdf71ccb
Remove vault (#7400)
* Remove contrib/vault

This is marked as broken since 2018 / 3dcb914607
This still reference apiserver.pem, not used since ddffdb63bf

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>

* Finish nuking vault from the codebase

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-24 09:26:08 -07:00
Kenichi Omichi
486b223e01
Replace kube-master with kube_control_plane (#7256)
This replaces kube-master with kube_control_plane because of [1]:

  The Kubernetes project is moving away from wording that is
  considered offensive. A new working group WG Naming was created
  to track this work, and the word "master" was declared as offensive.
  A proposal was formalized for replacing the word "master" with
  "control plane". This means it should be removed from source code,
  documentation, and user-facing configuration from Kubernetes and
  its sub-projects.

NOTE: The reason why this changes it to kube_control_plane not
      kube-control-plane is for valid group names on ansible.

[1]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cluster-lifecycle/kubeadm/2067-rename-master-label-taint/README.md#motivation
2021-03-23 17:26:05 -07:00
Florian Ruynat
18c0e54e4f
Add most_recent = true while retrieving the latest image (#7376) 2021-03-15 07:05:06 -07:00
Hugo Blom
f2d10e9465
allow users to set image_uuid instead of name, this allows the use of openstack community images (#7283) 2021-02-16 07:05:06 -08:00
Hugo Blom
1c8bba36db
make sure worker rules is applied on workers (#7279) 2021-02-12 12:43:05 -08:00
Hugo Blom
df7ed24389
[Openstack] Add security groups not managed by terraform (#6865)
* add custom sec groups

* make sure groups are applied only when created

* fix spacing
2020-11-05 05:30:54 -08:00
Hugo Blom
2f8fc92182
make it possible to open additional ports on master nodes (#6547) 2020-08-27 02:07:13 -07:00
rptaylor
f2d2d080f6
add master_volume_type variable (#6524) 2020-08-18 00:49:29 -07:00
Florian Ruynat
764a851189
Terraform quoted references are now deprecated (#6203) 2020-06-05 00:05:43 -07:00
qvicksilver
065292f8a4
Terraform/OpenStack: Allow free form worker node definition (#5952)
* Terraform/OpenStack: Allow free form worker node definition

* fixup! Terraform/OpenStack: Allow free form worker node definition
2020-04-16 07:52:45 -07:00
Pierre Gaxatte
a8822e24b0
Fix terraform formatting (#5823) 2020-03-27 05:46:24 -07:00
Hugo Blom
a901b1f0d7
convert volumes to dynamic blocks, openstack (#5673) 2020-02-24 01:20:49 -08:00
rptaylor
277b347604
add az_list_node variable to specify different AZs for kubelets (#5413)
* rebase and add az_list_node variable to specify different AZs for kubelets

* fix missing variable name change
2020-02-18 04:29:27 -08:00
Kessler
3c3ebc05cc Fix invalid count index (#5469) 2020-01-02 01:57:39 -08:00
Hugo Blom
40e35b3fa6 Support Openstack servergroups (#5412)
* add support for nova servergroups

* Add documentation for openstack nova servergroups

* uppdate to TF 0.12.12 format and fix etcd

* revert for_each change

* fix variables and formatting in main.tf

* try to avoid errors

* update variable

* Update main.tf

* Update main.tf

* update all other instance resources
2019-12-09 01:15:10 -08:00
Hugo Blom
a8c5a0afdc Make it possible to disable access_ip (openstack provider) (#5239)
* Add a variable do disable access_ip

* Document the use of use_access_ip
2019-10-07 04:09:09 -07:00
Robert Neumann
a5d165dc85 Customize host root volume size by Terrafrom provisioning (#4239)
* print hostnames (#5110)

Terrafrom - customize hosts root volume size

disable block_device by default value

Terraform formatting fix

Fixed typos

* fix resources after rebase

* Fix glusterfs image issue
2019-09-25 05:17:59 -07:00
Hugo Blom
da015e0249 Updated Openstack to terraform 0.12 (#5062)
* update openstack to terraform 0.12(.5)

* replace cluter.tf with cluster.tfvars

* update README.md to terraform 0.12

* update Openstack CI tests to use terraform 0.12

* specify terraform version in openstack README

* gitlab CI to copy cluster.tfvars in case of openstack provider

* The terraform/openstack dynamic inventory can read
tfstate v4 (generated by terraform 0.12) and convert them internally
ro v3 (as generated by terraform 0.11.x).

Additionally the script has been updated to Python 3.
2019-08-18 01:30:05 -07:00
Vladimir Kiselev
045acc724b fix relative paths for bastion host template (#4126)
This is a fix for #4124
2019-06-05 01:51:55 -07:00
Robert Neumann
787a9c74fa Terraform wait for floating IP instance has been associated (#4321)
* Add wait for floating ip associate with instance

* Terraform formatting fix

* Sort Open Telekom Cloud in compatible list
2019-05-09 02:16:50 -07:00
Jiang Yi Tao
f518b90c6b associate fips for masters with no etcd (#4657) 2019-04-28 22:58:20 -07:00
rptaylor
873b5608cf add master_allowed_remote_ips (with terraform fmt) (#4022) 2019-04-21 01:57:44 -07:00
Maxime Guyot
1cf76a10db Disable usage of default security group (#4533) 2019-04-17 02:10:03 -07:00
Andreas Holmsten
7f1d9ff543 [contrib/terraform/openstack] Add k8s_allowed_remote_ips variable (#4506)
* Add k8s_allowed_remote_ips variable

Useful for defining CIDRs allowed to initiate a SSH connection when
you don't want to use a bastion.

* Add TF_VAR_k8s_allowed_remote_ips variable to tf-apply-ovh
2019-04-15 07:22:08 -07:00
Karen Almog
20ebb49568 Don't create security groups for a bastion host on openstack, if doesn't exist (#4291) 2019-04-09 04:01:09 -07:00
Ted Wexler
b5a895d1ec Run 'terraform fmt' in contrib/terraform/openstack (#4242) 2019-02-17 21:04:41 -08:00
Andreas Holmsten
6c34745958
Add worker_allowed_ports
* [contrib/terraform/openstack] Add worker_allowed_ports

  Allow user to define in terraform template which ports and remote
  IPs that are allowed to access worker nodes. This is useful when you
  don't want to open up whole NodePort range to the outside world, or
  ports outside NodePort range.
2018-11-01 17:48:37 +01:00
Andreas Holmsten
0a9a42b544 Change from Nova security groups to Neutron (#2910)
* Replace `openstack_compute_secgroup_v2` with `openstack_networking_secgroup_v2`

The `openstack_networking_secgroup_v2` resource allow specifications of
both ingress and egress. Nova security groups define ingress rules only.

This change will also allow for more user-friendly specified security
rules, as the different security group resources have different HCL
syntax.
2018-09-28 11:35:02 +02:00
Antoine Legrand
a642931422
Merge pull request #3019 from holmsten/terraform-ops-worker-groups
[contrib/terraform/openstack] Add supplementary node groups
2018-08-16 16:06:53 +02:00
rguichard
c19643cee2 availability zones support for OpenStack
allow masters, nodes and gluster nodes (within each group) to be scheduled
on differents AZ.
2018-08-01 16:42:58 +02:00
rguichard
1a38a9df88 add security groups for traffic to 30000-32767/tcp
This will make NodePort services work out of the box
2018-07-27 14:57:29 +02:00
Andreas Holmsten
b900bd6e94
[contrib/terraform/openstack] Add supplementary node groups
* Add supplementary node groups

  To add additional ansible groups to the k8s nodes, such as
  `kube-ingress` for running ingress controller pods. Empty by default.
2018-06-28 16:46:20 +02:00
Pablo Moreno
df6c5b28a1 [contrib/terraform/openstack] Backward compatibility changes (#2539)
* [terraform/openstack] Restores ability to use existing public nodes and masters as bastion.

* [terraform/openstack] Uses network_id as output

* [terraform/openstack] Fixes link to inventory/local/group_vars

* [terraform/openstack] Adds supplementary master groups

* [terraform/openstack] Updates documentation avoiding manual setups for bastion (as they are not needed now).

* [terraform/openstack] Supplementary master groups in docs.

* [terraform/openstack] Fixes repeated usage of master fips instead of bastion fips

* [terraform/openstack] Missing change for network_id to subnet_id

* [terraform/openstack] Changes conditional to element( concat ) form to avoid type issues with empty lists.
2018-04-30 18:11:07 +03:00
ArchiFleKs
20779df686 remove kube-node from master node by default 2018-01-17 19:02:02 +01:00
ArchiFleKs
ba7b1d74d0 remove user_data which may mess up /etc/hosts 2018-01-17 14:29:23 +01:00
ArchiFleKs
74fd975b57 run terraform FMT for readability 2018-01-05 12:09:04 +01:00
BenGalewsky
591ae700ce Update OpenStack Terraform: Modules, Bastions, and New Floating IP config (#1958)
* Adding bastion and private network provisioning for openstack terraform

* Remove usage of floating-ip property

* Combine openstack instances + floating ips

* Fix relating floating IPs to hosts for openstack builds

* Tighten up security groups

Allow ssh into all instances with floating IP

* Add the gluster hosts to the no-floating group

* Break terraform into modules

* Update README and var descriptions to match current config

* Remove volume property in gluster compute def

* Include cluster name in internal network and router names

* Make dns_nameservers a variable
2017-12-05 12:48:47 +00:00