Skip to content
This repository was archived by the owner on May 17, 2024. It is now read-only.

Commit 5db8554

Browse files
JoshVanLJoshVanL
committed
Enable manifests apply to multiple arbitrary clusters
Signed-off-by: JoshVanL <[email protected]>
1 parent c5ca429 commit 5db8554

File tree

10 files changed

+7903
-186
lines changed

10 files changed

+7903
-186
lines changed

‎demo/Makefile

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ terraform_apply: ## Applies terraform infrastructure
3737
echo 'google_project = "$(GOOGLE_PROJECT)"' > infrastructure/$(CLOUD)/terraform.tfvars
3838
echo 'ca_crt_file = "$(CA_CRT_FILE)"' >> infrastructure/$(CLOUD)/terraform.tfvars
3939
echo 'ca_key_file = "$(CA_KEY_FILE)"' >> infrastructure/$(CLOUD)/terraform.tfvars
40+
echo 'cloud = "$(CLOUD)"' >> infrastructure/$(CLOUD)/terraform.tfvars
4041
cd infrastructure/$(CLOUD) && terraform init && terraform apply
4142
cd infrastructure/$(CLOUD) && terraform output config > ../../manifests/$(CLOUD)-config.json
4243
$(shell cd infrastructure/$(CLOUD) && terraform output kubeconfig_command)
@@ -53,7 +54,7 @@ manifests_apply: depend manifests/$(CLOUD)-config.json ## Use kubecfg to apply m
5354
# apply all CRDs
5455
$(BINDIR)/kubecfg $(EXT_VARS) show config.jsonnet --format json | sed 's#^---$$##' | jq 'select(.kind == "CustomResourceDefinition")' | kubectl apply -f -
5556
# apply everything
56-
$(BINDIR)/kubecfg $(EXT_VARS) show config.jsonnet | kubectl apply -f -
57+
$(BINDIR)/kubecfg $(EXT_VARS) show config.jsonnet | kubectl apply -f - --validate=false
5758

5859
.PHONY: manifests_validate
5960
manifests_validate: depend manifests/$(CLOUD)-config.json ## Use kubecfg to validate manifests

‎demo/config.dist.jsonnet

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,30 @@ function(cloud='google') main {
55
// this will only run the google cluster
66
clouds: {
77
google: main.clouds.google,
8+
amazon: null,
9+
digitalocean: null,
810
},
911
base_domain: '.kubernetes.example.net',
1012
cert_manager+: {
1113
letsencrypt_contact_email:: '[email protected]',
14+
solvers+: [
15+
//{
16+
// http01: {
17+
// ingress: {},
18+
// },
19+
//},
20+
{
21+
dns01: {
22+
clouddns: {
23+
project: $.config.cert_manager.project,
24+
serviceAccountSecretRef: {
25+
name: $.cert_manager.google_secret.metadata.name,
26+
key: 'credentials.json',
27+
},
28+
},
29+
},
30+
},
31+
],
1232
},
1333
dex+: if $.master then {
1434
users: [

‎demo/infrastructure/amazon/outputs.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ output "config" {
1111
}
1212

1313
output "kubeconfig_command" {
14-
value = "cp infrastructure/amazon/kubeconfig_cluster-${random_id.suffix.hex} $$KUBECONFIG"
14+
value = "cp infrastructure/${var.cloud}/kubeconfig_cluster-${random_id.suffix.hex} $KUBECONFIG"
1515
}
1616

1717
output "kubeconfig" {

‎demo/infrastructure/amazon/providers.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,12 @@ variable "aws_region" {
22
default = "eu-west-1"
33
}
44

5+
variable "cloud" {
6+
default = "amazon"
7+
}
8+
59
variable "cluster_version" {
6-
default = "1.12"
10+
default = "1.14"
711
}
812

913
provider "aws" {

‎demo/infrastructure/modules/amazon-cluster/cluster.tf

Lines changed: 58 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -5,36 +5,11 @@ data "aws_availability_zones" "available" {}
55

66
locals {
77
cluster_name = "cluster-${var.suffix}"
8-
9-
worker_groups = [
10-
{
11-
instance_type = "t2.large"
12-
subnets = "${join(",", module.vpc.private_subnets)}"
13-
asg_desired_capacity = "2"
14-
},
15-
]
16-
tags = {
17-
Workspace = "${terraform.workspace}"
18-
}
19-
worker_groups_launch_template = [
20-
{
21-
# This will launch an autoscaling group with only Spot Fleet instances
22-
instance_type = "t2.small"
23-
additional_userdata = "echo foo bar"
24-
subnets = "${join(",", module.vpc.private_subnets)}"
25-
additional_security_group_ids = "${aws_security_group.worker_group_mgmt_one.id},${aws_security_group.worker_group_mgmt_two.id}"
26-
override_instance_type = "t3.small"
27-
asg_desired_capacity = "2"
28-
spot_instance_pools = 10
29-
on_demand_percentage_above_base_capacity = "0"
30-
},
31-
]
328
}
339

3410
resource "aws_security_group" "worker_group_mgmt_one" {
3511
name_prefix = "worker_group_mgmt_one"
36-
description = "SG to be applied to all *nix machines"
37-
vpc_id = "${module.vpc.vpc_id}"
12+
vpc_id = module.vpc.vpc_id
3813

3914
ingress {
4015
from_port = 22
@@ -49,7 +24,7 @@ resource "aws_security_group" "worker_group_mgmt_one" {
4924

5025
resource "aws_security_group" "worker_group_mgmt_two" {
5126
name_prefix = "worker_group_mgmt_two"
52-
vpc_id = "${module.vpc.vpc_id}"
27+
vpc_id = module.vpc.vpc_id
5328

5429
ingress {
5530
from_port = 22
@@ -64,7 +39,7 @@ resource "aws_security_group" "worker_group_mgmt_two" {
6439

6540
resource "aws_security_group" "all_worker_mgmt" {
6641
name_prefix = "all_worker_management"
67-
vpc_id = "${module.vpc.vpc_id}"
42+
vpc_id = module.vpc.vpc_id
6843

6944
ingress {
7045
from_port = 22
@@ -80,28 +55,63 @@ resource "aws_security_group" "all_worker_mgmt" {
8055
}
8156

8257
module "vpc" {
83-
source = "terraform-aws-modules/vpc/aws"
84-
version = "1.60.0"
85-
name = "test-vpc"
86-
cidr = "10.0.0.0/16"
87-
azs = ["${data.aws_availability_zones.available.names[0]}", "${data.aws_availability_zones.available.names[1]}", "${data.aws_availability_zones.available.names[2]}"]
88-
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
89-
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
90-
enable_nat_gateway = true
91-
single_nat_gateway = true
92-
tags = "${merge(local.tags, map("kubernetes.io/cluster/${local.cluster_name}", "shared"))}"
58+
source = "terraform-aws-modules/vpc/aws"
59+
version = "2.6.0"
60+
61+
name = "test-vpc"
62+
cidr = "10.0.0.0/16"
63+
azs = "${data.aws_availability_zones.available.names}"
64+
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
65+
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
66+
enable_nat_gateway = true
67+
single_nat_gateway = true
68+
enable_dns_hostnames = true
69+
70+
tags = {
71+
"kubernetes.io/cluster/${local.cluster_name}" = "shared"
72+
}
73+
74+
public_subnet_tags = {
75+
"kubernetes.io/cluster/${local.cluster_name}" = "shared"
76+
"kubernetes.io/role/elb" = "1"
77+
}
78+
79+
private_subnet_tags = {
80+
"kubernetes.io/cluster/${local.cluster_name}" = "shared"
81+
"kubernetes.io/role/internal-elb" = "1"
82+
}
9383
}
9484

9585
module "eks" {
96-
source = "terraform-aws-modules/eks/aws"
97-
cluster_name = "${local.cluster_name}"
98-
cluster_version = "${var.cluster_version}"
99-
subnets = ["${module.vpc.private_subnets}"]
100-
tags = "${local.tags}"
101-
vpc_id = "${module.vpc.vpc_id}"
102-
worker_groups = "${local.worker_groups}"
103-
worker_groups_launch_template = "${local.worker_groups_launch_template}"
104-
worker_group_count = "1"
105-
worker_group_launch_template_count = "1"
86+
#source = "terraform-aws-modules/eks/aws"
87+
source = "[email protected]:terraform-aws-modules/terraform-aws-eks.git?ref=6c3e4ec510f658f53508623a6192df064e7a4786"
88+
cluster_name = "${local.cluster_name}"
89+
subnets = "${module.vpc.private_subnets}"
90+
91+
tags = {
92+
Environment = "test"
93+
GithubRepo = "terraform-aws-eks"
94+
GithubOrg = "terraform-aws-modules"
95+
}
96+
97+
vpc_id = "${module.vpc.vpc_id}"
98+
99+
worker_groups = [
100+
{
101+
name = "worker-group-1"
102+
instance_type = "t2.small"
103+
additional_userdata = "echo foo bar"
104+
asg_desired_capacity = 2
105+
additional_security_group_ids = ["${aws_security_group.worker_group_mgmt_one.id}"]
106+
},
107+
{
108+
name = "worker-group-2"
109+
instance_type = "t2.medium"
110+
additional_userdata = "echo foo bar"
111+
additional_security_group_ids = ["${aws_security_group.worker_group_mgmt_two.id}"]
112+
asg_desired_capacity = 1
113+
},
114+
]
115+
106116
worker_additional_security_group_ids = ["${aws_security_group.all_worker_mgmt.id}"]
107117
}

‎demo/manifests/components/cert-manager.jsonnet

Lines changed: 2 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,11 @@ local kube = import '../vendor/kube-prod-runtime/lib/kube.libsonnet';
33

44
local CERT_MANAGER_IMAGE = '';
55

6-
local add_acme_spec(issuer, obj) =
7-
if std.objectHas(issuer.spec, 'acme') then
8-
obj {
9-
spec+: {
10-
acme: {
11-
config: [{
12-
dns01: {
13-
provider: issuer.spec.acme.dns01.providers[0].name,
14-
},
15-
domains: obj.spec.dnsNames,
16-
}],
17-
},
18-
},
19-
}
20-
else
21-
obj;
22-
236
upstream_cert_manager {
247
ca_secret_name:: 'ca-key-pair',
258

269
// create simple to use certificate resource
27-
Certificate(namespace, name, issuer, domains):: add_acme_spec(issuer, kube._Object($.certCRD.spec.group + '/' + $.certCRD.spec.version, $.certCRD.spec.names.kind, name) + {
10+
Certificate(namespace, name, issuer, solver, domains):: kube._Object($.certCRD.spec.group + '/' + $.certCRD.spec.version, $.certCRD.spec.names.kind, name) + {
2811
metadata+: {
2912
namespace: namespace,
3013
name: name,
@@ -37,7 +20,5 @@ upstream_cert_manager {
3720
kind: issuer.kind,
3821
},
3922
},
40-
}),
41-
42-
// TODO: use upstream images for cert-manager
23+
},
4324
}

‎demo/manifests/components/landingpage.jsonnet

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ local HTTP_PORT = 80;
114114
width: 56,
115115
height: 56,
116116
alt: cloud,
117-
src: cloud + '.svg',
117+
src: std.split(cloud, '_')[0] + '.svg',
118118
},
119119
],
120120
],

‎demo/manifests/main.jsonnet

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -136,19 +136,7 @@ local apply_ca_issuer(ca_crt, ca_key, obj) =
136136
letsencryptStaging+: {
137137
spec+: {
138138
acme+: {
139-
http01: null,
140-
dns01: {
141-
providers: [{
142-
name: 'clouddns',
143-
clouddns: {
144-
project: $.config.cert_manager.project,
145-
serviceAccountSecretRef: {
146-
name: $.cert_manager.google_secret.metadata.name,
147-
key: 'credentials.json',
148-
},
149-
},
150-
}],
151-
},
139+
solvers: $.cert_manager.solvers,
152140
},
153141
},
154142
},
@@ -251,6 +239,7 @@ local apply_ca_issuer(ca_crt, ca_key, obj) =
251239
$.namespace,
252240
this.name,
253241
$.cert_manager.letsencryptProd,
242+
$.cert_manager.solver,
254243
[this.domain]
255244
),
256245
ingressRoute: IngressRouteTLSPassthrough($.namespace, this.name, this.domain, this.name, 5556),
@@ -267,7 +256,7 @@ local apply_ca_issuer(ca_crt, ca_key, obj) =
267256
'https://gangway' + v.domain_part + $.base_domain + '/callback',
268257
],
269258
}),
270-
$.clouds
259+
std.prune($.clouds)
271260
),
272261
}
273262
else
@@ -328,6 +317,7 @@ local apply_ca_issuer(ca_crt, ca_key, obj) =
328317
$.namespace,
329318
this.name,
330319
$.cert_manager.letsencryptProd,
320+
$.cert_manager.solver,
331321
[this.domain]
332322
),
333323
ingressRoute: IngressRouteTLSPassthrough($.namespace, this.name, this.domain, this.name, 8080),
@@ -371,6 +361,7 @@ local apply_ca_issuer(ca_crt, ca_key, obj) =
371361
$.namespace,
372362
this.name,
373363
if $.ca_crt != '' && $.ca_key != '' then $.cert_manager.ca_issuer.issuer else $.cert_manager.letsencryptProd,
364+
$.cert_manager.solver,
374365
[this.domain]
375366
),
376367
ingressRoute: IngressRouteTLSPassthrough($.namespace, this.name, this.domain, this.name, 443),
@@ -399,6 +390,7 @@ local apply_ca_issuer(ca_crt, ca_key, obj) =
399390
$.namespace,
400391
this.name,
401392
$.cert_manager.letsencryptProd,
393+
$.cert_manager.solver,
402394
[this.domain]
403395
),
404396

@@ -408,7 +400,7 @@ local apply_ca_issuer(ca_crt, ca_key, obj) =
408400
'https://gangway' + $.clouds[c].domain_part + $.base_domain,
409401
'Gangway ' + c,
410402
)),
411-
std.objectFields($.clouds)
403+
std.objectFields(std.prune($.clouds))
412404
)),
413405
},
414406
}

0 commit comments

Comments
 (0)