|
| 1 | +# 开通ack pro |
| 2 | +data "alicloud_ack_service" "open_ack" { |
| 3 | + enable = "On" |
| 4 | + type = "propayasgo" |
| 5 | +} |
| 6 | + |
| 7 | +# 查询实例实例规格 |
| 8 | +data "alicloud_instance_types" "default" { |
| 9 | + instance_type_family = "ecs.g7" |
| 10 | + sorted_by = "CPU" |
| 11 | + memory_size = "16" |
| 12 | +} |
| 13 | + |
| 14 | +# 查询实例规格支持的可用区 |
| 15 | +data "alicloud_zones" "default" { |
| 16 | + available_instance_type = data.alicloud_instance_types.default.ids.0 |
| 17 | + available_slb_address_type = "classic_internet" |
| 18 | +} |
| 19 | + |
| 20 | +locals { |
| 21 | + zone1 = data.alicloud_zones.default.ids[length(data.alicloud_zones.default.ids) - 1] |
| 22 | + zone2 = data.alicloud_zones.default.ids[length(data.alicloud_zones.default.ids) - 2] |
| 23 | +} |
| 24 | + |
| 25 | +# 创建VPC |
| 26 | +resource "alicloud_vpc" "vpc" { |
| 27 | + cidr_block = "10.0.0.0/8" |
| 28 | + vpc_name = "${var.common_name}-vpc" |
| 29 | +} |
| 30 | + |
| 31 | +# 创建VSwitch |
| 32 | +resource "alicloud_vswitch" "vswitch1" { |
| 33 | + vpc_id = alicloud_vpc.vpc.id |
| 34 | + cidr_block = "10.0.0.0/24" |
| 35 | + zone_id = local.zone1 |
| 36 | + vswitch_name = "${var.common_name}-vsw" |
| 37 | +} |
| 38 | + |
| 39 | +resource "alicloud_vswitch" "vswitch2" { |
| 40 | + vpc_id = alicloud_vpc.vpc.id |
| 41 | + cidr_block = "10.0.1.0/24" |
| 42 | + zone_id = local.zone2 |
| 43 | + vswitch_name = "${var.common_name}-vsw" |
| 44 | +} |
| 45 | + |
| 46 | +# 创建安全组 |
| 47 | +resource "alicloud_security_group" "sg" { |
| 48 | + vpc_id = alicloud_vpc.vpc.id |
| 49 | + security_group_name = "${var.common_name}-sg" |
| 50 | +} |
| 51 | + |
| 52 | +resource "alicloud_security_group_rule" "ingress_http" { |
| 53 | + security_group_id = alicloud_security_group.sg.id |
| 54 | + type = "ingress" |
| 55 | + ip_protocol = "tcp" |
| 56 | + port_range = "80/80" |
| 57 | + cidr_ip = "0.0.0.0/0" |
| 58 | +} |
| 59 | + |
| 60 | +resource "alicloud_security_group_rule" "ingress_https" { |
| 61 | + security_group_id = alicloud_security_group.sg.id |
| 62 | + type = "ingress" |
| 63 | + ip_protocol = "tcp" |
| 64 | + port_range = "443/443" |
| 65 | + cidr_ip = "0.0.0.0/0" |
| 66 | +} |
| 67 | + |
| 68 | +# 创建ACK集群 |
| 69 | +resource "alicloud_cs_managed_kubernetes" "ack" { |
| 70 | + depends_on = [data.alicloud_ack_service.open_ack, alicloud_ram_role.role, alicloud_ram_role_policy_attachment.attach] |
| 71 | + name = var.managed_kubernetes_cluster_name |
| 72 | + cluster_spec = "ack.pro.small" |
| 73 | + vswitch_ids = [alicloud_vswitch.vswitch1.id, alicloud_vswitch.vswitch2.id] |
| 74 | + pod_vswitch_ids = [alicloud_vswitch.vswitch1.id, alicloud_vswitch.vswitch2.id] |
| 75 | + service_cidr = "192.168.0.0/16" |
| 76 | + new_nat_gateway = true |
| 77 | + slb_internet_enabled = true |
| 78 | + security_group_id = alicloud_security_group.sg.id |
| 79 | + |
| 80 | + addons { |
| 81 | + name = "ack-node-local-dns" |
| 82 | + } |
| 83 | + addons { |
| 84 | + name = "terway-eniip" |
| 85 | + config = jsonencode({ |
| 86 | + IPVlan = "false" |
| 87 | + NetworkPolicy = "false" |
| 88 | + ENITrunking = "false" |
| 89 | + }) |
| 90 | + } |
| 91 | + addons { |
| 92 | + name = "csi-plugin" |
| 93 | + } |
| 94 | + addons { |
| 95 | + name = "csi-provisioner" |
| 96 | + } |
| 97 | + addons { |
| 98 | + name = "storage-operator" |
| 99 | + config = jsonencode({ |
| 100 | + CnfsOssEnable = "false" |
| 101 | + CnfsNasEnable = "false" |
| 102 | + }) |
| 103 | + } |
| 104 | + addons { |
| 105 | + name = "nginx-ingress-controller" |
| 106 | + disabled = true |
| 107 | + } |
| 108 | + addons { |
| 109 | + name = "logtail-ds" |
| 110 | + config = jsonencode({ |
| 111 | + IngressDashboardEnabled = "true" |
| 112 | + }) |
| 113 | + } |
| 114 | + addons { |
| 115 | + name = "alb-ingress-controller" |
| 116 | + version = "" |
| 117 | + config = jsonencode({ |
| 118 | + albIngress = { |
| 119 | + AddressType = "Internet" |
| 120 | + ZoneMappings = { |
| 121 | + "${local.zone1}" = ["${alicloud_vswitch.vswitch1.id}"] |
| 122 | + "${local.zone2}" = ["${alicloud_vswitch.vswitch2.id}"] |
| 123 | + } |
| 124 | + CreateDefaultALBConfig = true |
| 125 | + } |
| 126 | + }) |
| 127 | + } |
| 128 | + |
| 129 | + delete_options { |
| 130 | + delete_mode = "delete" |
| 131 | + resource_type = "ALB" |
| 132 | + } |
| 133 | + delete_options { |
| 134 | + delete_mode = "delete" |
| 135 | + resource_type = "SLB" |
| 136 | + } |
| 137 | + delete_options { |
| 138 | + delete_mode = "delete" |
| 139 | + resource_type = "SLS_Data" |
| 140 | + } |
| 141 | + delete_options { |
| 142 | + delete_mode = "delete" |
| 143 | + resource_type = "SLS_ControlPlane" |
| 144 | + } |
| 145 | + delete_options { |
| 146 | + delete_mode = "delete" |
| 147 | + resource_type = "PrivateZone" |
| 148 | + } |
| 149 | +} |
| 150 | + |
| 151 | +# 创建节点池 |
| 152 | +resource "alicloud_cs_kubernetes_node_pool" "node_pool" { |
| 153 | + node_pool_name = "${var.common_name}-nodepool" |
| 154 | + cluster_id = alicloud_cs_managed_kubernetes.ack.id |
| 155 | + vswitch_ids = [alicloud_vswitch.vswitch1.id, alicloud_vswitch.vswitch2.id] |
| 156 | + instance_types = [data.alicloud_instance_types.default.ids.0] |
| 157 | + system_disk_category = "cloud_essd" |
| 158 | + system_disk_size = 120 |
| 159 | + desired_size = 3 |
| 160 | + runtime_name = "containerd" |
| 161 | + runtime_version = "1.6.28" |
| 162 | +} |
| 163 | + |
| 164 | +# 通过ROS在集群内部署资源 |
| 165 | +resource "random_integer" "default" { |
| 166 | + min = 100000 |
| 167 | + max = 999999 |
| 168 | +} |
| 169 | + |
| 170 | +resource "alicloud_ros_stack" "deploy_k8s_resource" { |
| 171 | + stack_name = "${var.common_name}-k8s-resource-${random_integer.default.result}" |
| 172 | + template_url = "https://ros-public-templates.oss-cn-hangzhou.aliyuncs.com/ros-templates/documents/solution/micro/build-microservices-on-ack-k8s-resource.tf.yaml" |
| 173 | + parameters { |
| 174 | + parameter_key = "cluster_id" |
| 175 | + parameter_value = alicloud_cs_managed_kubernetes.ack.id |
| 176 | + } |
| 177 | + disable_rollback = true |
| 178 | + depends_on = [alicloud_cs_kubernetes_node_pool.node_pool] |
| 179 | +} |
| 180 | + |
| 181 | +# 定义本地变量，包含所有要创建的 RAM Role 及其策略 |
| 182 | +locals { |
| 183 | + cs_roles = [ |
| 184 | + { |
| 185 | + name = "AliyunCSManagedLogRole" |
| 186 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 187 | + description = "集群的日志组件使用此角色来访问您在其他云产品中的资源。" |
| 188 | + policy_name = "AliyunCSManagedLogRolePolicy" |
| 189 | + }, |
| 190 | + { |
| 191 | + name = "AliyunCSManagedCmsRole" |
| 192 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 193 | + description = "集群的CMS组件使用此角色来访问您在其他云产品中的资源。" |
| 194 | + policy_name = "AliyunCSManagedCmsRolePolicy" |
| 195 | + }, |
| 196 | + { |
| 197 | + name = "AliyunCSManagedCsiRole" |
| 198 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 199 | + description = "集群的存储组件使用此角色来访问您在其他云产品中的资源。" |
| 200 | + policy_name = "AliyunCSManagedCsiRolePolicy" |
| 201 | + }, |
| 202 | + { |
| 203 | + name = "AliyunCSManagedCsiPluginRole" |
| 204 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 205 | + description = "集群的存储组件使用此角色来访问您在其他云产品中的资源。" |
| 206 | + policy_name = "AliyunCSManagedCsiPluginRolePolicy" |
| 207 | + }, |
| 208 | + { |
| 209 | + name = "AliyunCSManagedCsiProvisionerRole" |
| 210 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 211 | + description = "集群的存储组件使用此角色来访问您在其他云产品中的资源。" |
| 212 | + policy_name = "AliyunCSManagedCsiProvisionerRolePolicy" |
| 213 | + }, |
| 214 | + { |
| 215 | + name = "AliyunCSManagedVKRole" |
| 216 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 217 | + description = "ACK Serverless集群的VK组件使用此角色来访问您在其他云产品中的资源。" |
| 218 | + policy_name = "AliyunCSManagedVKRolePolicy" |
| 219 | + }, |
| 220 | + { |
| 221 | + name = "AliyunCSServerlessKubernetesRole" |
| 222 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 223 | + description = "集群默认使用此角色来访问您在其他云产品中的资源。" |
| 224 | + policy_name = "AliyunCSServerlessKubernetesRolePolicy" |
| 225 | + }, |
| 226 | + { |
| 227 | + name = "AliyunCSKubernetesAuditRole" |
| 228 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 229 | + description = "集群审计功能使用此角色来访问您在其他云产品中的资源。" |
| 230 | + policy_name = "AliyunCSKubernetesAuditRolePolicy" |
| 231 | + }, |
| 232 | + { |
| 233 | + name = "AliyunCSManagedNetworkRole" |
| 234 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 235 | + description = "集群网络组件使用此角色来访问您在其他云产品中的资源。" |
| 236 | + policy_name = "AliyunCSManagedNetworkRolePolicy" |
| 237 | + }, |
| 238 | + { |
| 239 | + name = "AliyunCSDefaultRole" |
| 240 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 241 | + description = "集群操作时默认使用此角色来访问您在其他云产品中的资源。" |
| 242 | + policy_name = "AliyunCSDefaultRolePolicy" |
| 243 | + }, |
| 244 | + { |
| 245 | + name = "AliyunCSManagedKubernetesRole" |
| 246 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 247 | + description = "集群默认使用此角色来访问您在其他云产品中的资源。" |
| 248 | + policy_name = "AliyunCSManagedKubernetesRolePolicy" |
| 249 | + }, |
| 250 | + { |
| 251 | + name = "AliyunCSManagedArmsRole" |
| 252 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 253 | + description = "集群Arms插件使用此角色来访问您在其他云产品中的资源。" |
| 254 | + policy_name = "AliyunCSManagedArmsRolePolicy" |
| 255 | + }, |
| 256 | + { |
| 257 | + name = "AliyunCISDefaultRole" |
| 258 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 259 | + description = "容器服务（CS）智能运维使用此角色来访问您在其他云产品中的资源。" |
| 260 | + policy_name = "AliyunCISDefaultRolePolicy" |
| 261 | + }, |
| 262 | + { |
| 263 | + name = "AliyunOOSLifecycleHook4CSRole" |
| 264 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"oos.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 265 | + description = "集群扩缩容节点池依赖OOS服务，OOS使用此角色来访问您在其他云产品中的资源。" |
| 266 | + policy_name = "AliyunOOSLifecycleHook4CSRolePolicy" |
| 267 | + }, |
| 268 | + { |
| 269 | + name = "AliyunCSManagedAutoScalerRole" |
| 270 | + policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}" |
| 271 | + description = "集群的弹性伸缩组件使用此角色来访问您在其他云产品中的资源。" |
| 272 | + policy_name = "AliyunCSManagedAutoScalerRolePolicy" |
| 273 | + } |
| 274 | + ] |
| 275 | +} |
| 276 | + |
| 277 | +// 查询RAM角色列表 |
| 278 | +data "alicloud_ram_roles" "roles" { |
| 279 | + policy_type = "Custom" |
| 280 | + name_regex = "^Aliyun.*Role$" |
| 281 | +} |
| 282 | + |
| 283 | +locals { |
| 284 | + # 提取所有所需RAM角色name |
| 285 | + all_role_names = [for role in local.cs_roles : role.name] |
| 286 | + # 提取已存在的RAM角色name |
| 287 | + created_role_names = [for role in data.alicloud_ram_roles.roles.roles : role.name] |
| 288 | + # 计算补集：即找出还未创建的所需RAM角色 |
| 289 | + complement_names = setsubtract(local.all_role_names, local.created_role_names) |
| 290 | + # 待创建的RAM角色 |
| 291 | + complement_roles = [for role in local.cs_roles : role if contains(local.complement_names, role.name)] |
| 292 | +} |
| 293 | + |
| 294 | +// 创建角色。 |
| 295 | +resource "alicloud_ram_role" "role" { |
| 296 | + for_each = { for r in local.complement_roles : r.name => r } |
| 297 | + role_name = each.value.name |
| 298 | + assume_role_policy_document = each.value.policy_document |
| 299 | + description = each.value.description |
| 300 | + force = true |
| 301 | +} |
| 302 | + |
| 303 | +// 角色关联系统权限。 |
| 304 | +resource "alicloud_ram_role_policy_attachment" "attach" { |
| 305 | + for_each = { for r in local.complement_roles : r.name => r } |
| 306 | + policy_name = each.value.policy_name |
| 307 | + policy_type = "System" |
| 308 | + role_name = each.value.name |
| 309 | + depends_on = [alicloud_ram_role.role] |
| 310 | +} |
0 commit comments